Linux Kernel vulnerabilities

CVE-2011-3188 [CRITICAL] CVE-2011-3188: The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorith The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes it easier for remote attackers to cause a denial of service (disrupted networking) or hijack network sessions by predicting these values and sending crafted packets.

CVE-2019-10220 [HIGH] CWE-22 CVE-2019-10220: Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in direc Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists.

CVE-2017-7472 [MEDIUM] CWE-404 CVE-2017-7472: The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of servic The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls.

CVE-2026-31476 [HIGH] CVE-2026-31476: In the Linux kernel, the following vulnerability has been resolved: ksmbd: do not expire session on In the Linux kernel, the following vulnerability has been resolved: ksmbd: do not expire session on binding failure When a multichannel session binding request fails (e.g. wrong password), the error path unconditionally sets sess->state = SMB2_SESSION_EXPIRED. However, during binding, sess points to the target session looked up via ksmbd_session_lookup_slowp

CVE-2026-53390 [HIGH] CWE-125 CVE-2026-53390: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds read i In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds read in smb_check_perm_dacl() The permission-check ACE walk in smb_check_perm_dacl() validates the ACE header size and caps sid.num_subauth at SID_MAX_SUB_AUTHORITIES, but it never checks that ace->size is actually large enough to contain num_subauth sub-auth

CVE-2016-8440 [CRITICAL] CWE-119 CVE-2016-8440: Possible buffer overflow in SMMU system call. Improper input validation in ADSP SID2CB system call m Possible buffer overflow in SMMU system call. Improper input validation in ADSP SID2CB system call may result in hypervisor memory overwrite. Product: Android. Versions: Kernel 3.18. Android ID: A-31625306. References: QC-CR#1036747.

CVE-2016-6828 [MEDIUM] CWE-416 CVE-2016-6828: The tcp_check_send_head function in include/net/tcp.h in the Linux kernel before 4.7.5 does not prop The tcp_check_send_head function in include/net/tcp.h in the Linux kernel before 4.7.5 does not properly maintain certain SACK state after a failed data copy, which allows local users to cause a denial of service (tcp_xmit_retransmit_queue use-after-free and system crash) via a crafted SACK option.

CVE-2026-53003 [HIGH] CWE-20 CVE-2026-53003: In the Linux kernel, the following vulnerability has been resolved: pppoe: drop PFC frames RFC 251 In the Linux kernel, the following vulnerability has been resolved: pppoe: drop PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the current PPPoE driver assumes an uncompressed (2-byte) protocol field. However, the generic

CVE-2022-4379 [HIGH] CWE-416 CVE-2022-4379: A use-after-free vulnerability was found in __nfs42_ssc_open() in fs/nfs/nfs4file.c in the Linux ker A use-after-free vulnerability was found in __nfs42_ssc_open() in fs/nfs/nfs4file.c in the Linux kernel. This flaw allows an attacker to conduct a remote denial

CVE-2026-43493 [CRITICAL] CWE-390 CVE-2026-43493: In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling o In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications.

CVE-2026-53399 [CRITICAL] CWE-476 CVE-2026-53399: In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on se In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via idr_alloc_cyclic() under cl_lock before returning to nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then fails, the error path frees the layout stateid dire

CVE-2026-64066 [CRITICAL] CWE-125 CVE-2026-64066: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_read_to_pageca In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_read_to_pagecache() to pause on subreq failure Fix netfs_read_to_pagecache() so that it pauses the generation of new subrequests if an already-issued subrequest fails.

CVE-2026-64122 [CRITICAL] CWE-416 CVE-2026-64122: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free i In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover mlx5e_tx_reporter_timeout_recover() accesses sq->netdev after mlx5e_safe_reopen_channels() has torn down and freed the channel (and its embedded SQs). Replace the three sq->netdev references with priv->netdev whic

CVE-2026-43011 [CRITICAL] CWE-415 CVE-2026-43011: In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix potential double f In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix potential double free of skb When alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at line 48 and returns 1 (error). This error propagates back through the call chain: x25_queue_rx_frame returns 1 | v x25_state3_machine receives the return value 1 and t

CVE-2026-43414 [CRITICAL] CWE-415 CVE-2026-43414: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix f In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free(). When an error happens, this function is called by qla2x00_sp_release(), when kref_put() releases the first and the last reference. qla2x00_els_dcmd_sp_free(

CVE-2024-53177 [CRITICAL] CWE-416 CVE-2024-53177: In the Linux kernel, the following vulnerability has been resolved: smb: prevent use-after-free due In the Linux kernel, the following vulnerability has been resolved: smb: prevent use-after-free due to open_cached_dir error paths If open_cached_dir() encounters an error parsing the lease from the server, the error handling may race with receiving a lease break, resulting in open_cached_dir() freeing the cfid while the queued work is pending.

CVE-2026-64089 [CRITICAL] CVE-2026-64089: In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative la In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative last_changeset_len batadv_piv_tt::last_changeset_len len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_my_tt_response(), last_

CVE-2026-53398 [CRITICAL] CWE-665 CVE-2026-53398: In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFO_NO_NAME decod In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFO_NO_NAME decode error cleanup nfsd4_decode_secinfo_no_name() currently initializes sin_exp after decoding sin_style. If the XDR stream is truncated, the decoder returns nfserr_bad_xdr before sin_exp is initialized. Since commit 3fdc54646234 ("NFSD: Reduce amount

CVE-2022-27666 [HIGH] CWE-787 CVE-2022-27666: A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ip A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.

CVE-2026-31478 [CRITICAL] CWE-131 CVE-2026-31478: In the Linux kernel, the following vulnerability has been resolved: ksmbd: replace hardcoded hdr2_l In the Linux kernel, the following vulnerability has been resolved: ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() After this commit (e2b76ab8b5c9 "ksmbd: add support for read compound"), response buffer management was changed to use dynamic iov array. In the new design, smb2_calc_max_out_buf_len() expects the se