Linux Kernel vulnerabilities

CVE-2023-38427 [CRITICAL] CWE-125 CVE-2023-38427: An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/smb2pdu.c in ksmbd has an in An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/smb2pdu.c in ksmbd has an integer underflow and out-of-bounds read in deassemble_neg_contexts.

CVE-2022-48716 [CRITICAL] CWE-400 CVE-2022-48716: In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd938x: fix inco In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd938x: fix incorrect used of portid Mixer controls have the channel id in mixer->reg, which is not same as port id. port id should be derived from chan_info array. So fix this. Without this, its possible that we could corrupt struct wcd938x_sdw_priv by accessing p

CVE-2026-43493 [CRITICAL] CVE-2026-43493: In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling o In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications.

CVE-2026-43208 [CRITICAL] CWE-787 CVE-2026-43208: In the Linux kernel, the following vulnerability has been resolved: net: do not pass flow_id to set In the Linux kernel, the following vulnerability has been resolved: net: do not pass flow_id to set_rps_cpu() Blamed commit made the assumption that the RPS table for each receive queue would have the same size, and that it would not change. Compute flow_id in set_rps_cpu(), do not assume we can use the value computed by get_rps_cpu(). Otherwise

CVE-2026-31589 [CRITICAL] CWE-416 CVE-2026-31589: In the Linux kernel, the following vulnerability has been resolved: mm: call ->free_folio() directl In the Linux kernel, the following vulnerability has been resolved: mm: call ->free_folio() directly in folio_unmap_invalidate() We can only call filemap_free_folio() if we have a reference to (or hold a lock on) the mapping. Otherwise, we've already removed the folio from the mapping so it no longer pins the mapping and the mapping can be remove

CVE-2026-23112 [CRITICAL] CWE-787 CVE-2026-23112: In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: add bounds checks in In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec nvmet_tcp_build_pdu_iovec() could walk past cmd->req.sg when a PDU length or offset exceeds sg_cnt and then use bogus sg->length/offset values, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining entries, and sg-

CVE-2026-43414 [CRITICAL] CWE-415 CVE-2026-43414: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix f In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free(). When an error happens, this function is called by qla2x00_sp_release(), when kref_put() releases the first and the last reference. qla2x00_els_dcmd_sp_free(

CVE-2026-53363 [CRITICAL] CVE-2026-53363: In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: preserve shared-fr In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags() iptfs_consume_frags() transfers paged fragments from one socket buffer to another but fails to propagate the SKBFL_SHARED_FRAG flag. This is the same class of bug that was fixed in skb_try_coalesce() for CVE-2026-46300: wh

CVE-2025-68794 CVE-2025-68794: In the Linux kernel, the following vulnerability has been resolved: iomap: adjust read range correctly for non-block-aligned positions iomap_adjust_re In the Linux kernel, the following vulnerability has been resolved: iomap: adjust read range correctly for non-block-aligned positions iomap_adjust_read_range() assumes that the position and length passed in are block-aligned. This is not always the case however, as shown in the syzbot generated case for erofs. This

CVE-2025-68809 ksmbd: vfs: fix race on m_flags in vfs_cache ksmbd: vfs: fix race on m_flags in vfs_cache In the Linux kernel, the following vulnerability has been resolved: ksmbd: vfs: fix race on m_flags in vfs_cache ksmbd maintains delete-on-close and pending-delete state in ksmbd_inode->m_flags. In vfs_cache.c this field is accessed under inconsistent locking: some paths read and modify m_flags under ci->m_lock while others do so without taking the lock at all. Examples: - ksmbd_query_in

CVE-2025-68726 CVE-2025-68726: In the Linux kernel, the following vulnerability has been resolved: crypto: aead - Fix reqsize handling Commit afddce13ce81d ("crypto: api - Add reqsi In the Linux kernel, the following vulnerability has been resolved: crypto: aead - Fix reqsize handling Commit afddce13ce81d ("crypto: api - Add reqsize to crypto_alg") introduced cra_reqsize field in crypto_alg struct to replace type specific reqsize fields. It looks like this was introduced specifically for ahash a

CVE-2010-0415 [MEDIUM] CVE-2010-0415: The do_pages_move function in mm/migrate.c in the Linux kernel before 2.6.33-rc7 does not validate n The do_pages_move function in mm/migrate.c in the Linux kernel before 2.6.33-rc7 does not validate node values, which allows local users to read arbitrary kernel memory locations, cause a denial of service (OOPS), and possibly have unspecified other impact by specifying a node that is not part of the kernel's node set.

CVE-2016-10142 [HIGH] CVE-2016-10142: An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too Big (PTB) messages An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too Big (PTB) messages. (The scope of this CVE is all affected IPv6 implementations from all vendors.) The security implications of IP fragmentation have been discussed at length in [RFC6274] and [RFC7739]. An attacker can leverage the generation of IPv6 atomic fragments t

CVE-2004-0424 [HIGH] CVE-2004-0424: Integer overflow in the ip_setsockopt function in Linux kernel 2.4.22 through 2.4.25 and 2.6.1 throu Integer overflow in the ip_setsockopt function in Linux kernel 2.4.22 through 2.4.25 and 2.6.1 through 2.6.3 allows local users to cause a denial of service (crash) or execute arbitrary code via the MCAST_MSFILTER socket option.

CVE-2003-0985 [HIGH] CVE-2003-0985: The mremap system call (do_mremap) in Linux kernel 2.4.x before 2.4.21, and possibly other versions The mremap system call (do_mremap) in Linux kernel 2.4.x before 2.4.21, and possibly other versions before 2.4.24, does not properly perform bounds checks, which allows local users to cause a denial of service and possibly gain privileges by causing a remapping of a virtual memory area (VMA) to create a zero length VMA, a different vulnerability than CAN-2004-00

CVE-2022-41674 [HIGH] CWE-787 CVE-2022-41674: An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames cou An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c.

CVE-2023-52735 [CRITICAL] CWE-120 CVE-2023-52735: In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Don't let sock_ma In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself sock_map proto callbacks should never call themselves by design. Protect against bugs like [1] and break out of the recursive loop to avoid a stack overflow in favor of a resource leak. [1] https://lore.kernel.o

CVE-2026-43383 [CRITICAL] CVE-2026-43383: In the Linux kernel, the following vulnerability has been resolved: net/tcp-md5: Fix MAC comparison In the Linux kernel, the following vulnerability has been resolved: net/tcp-md5: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.

CVE-2019-10125 [CRITICAL] CWE-416 CVE-2019-10125: An issue was discovered in aio_poll() in fs/aio.c in the Linux kernel through 5.0.4. A file may be r An issue was discovered in aio_poll() in fs/aio.c in the Linux kernel through 5.0.4. A file may be released by aio_poll_wake() if an expected event is triggered immediately (e.g., by the close of a pair of pipes) after the return of vfs_poll(), and this will cause a use-after-free.

CVE-2022-47943 [HIGH] CWE-125 CVE-2022-47943: An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is an ou An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is an out-of-bounds read and OOPS for SMB2_WRITE, when there is a large length in the zero DataOffset case.