Linux Kernel vulnerabilities

CVE-2026-31629 [HIGH] CWE-667 CVE-2026-31629: In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: add missing return a In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: add missing return after LLCP_CLOSED checks In nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(), when the socket state is LLCP_CLOSED, the code correctly calls release_sock() and nfc_llcp_sock_put() but fails to return. Execution falls through to the remainder of the function

CVE-2026-43322 [HIGH] CWE-416 CVE-2026-43322: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix UAF in In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix UAF in le_read_features_complete This fixes the following backtrace caused by hci_conn being freed before le_read_features_complete but after hci_le_read_remote_features_sync so hci_conn_del -> hci_cmd_sync_dequeue is not able to prevent it: BUG: KASAN: slab

CVE-2026-63807 [HIGH] CWE-125 CVE-2026-63807: In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage i In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level When recovering hugepages in the shadow MMU, verify that the base gfn of the shadow page is actually contained within the target memslot, *before* querying the max mapping level given the shadow page's gfn.

CVE-2026-53322 [HIGH] CWE-415 CVE-2026-53322: In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Clean up DMABUFs befo In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Clean up DMABUFs before disabling function On device shutdown, make vfio_pci_core_close_device() call vfio_pci_dma_buf_cleanup() before the function is disabled via vfio_pci_core_disable(). This ensures that all access via DMABUFs is revoked before the function's BARs becom

CVE-2026-53170 [HIGH] CWE-908 CVE-2026-53170: In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: reject DMA comman In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: reject DMA commands with uninitialized length cmd_state_init() initializes the command state with memset(0xff), leaving dma->len at U64_MAX to signal missing setup. The only setter is NPU_SET_DMA0_LEN; if userspace omits this command and issues NPU_OP_DMA_START, dma->le

CVE-2026-53171 [HIGH] CVE-2026-53171: In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix arithmetic is In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix arithmetic issues in dma_length() dma_length() derives DMA region usage from command stream values and updates region_size[]: len = ((len + stride[0]) * size0 + stride[1]) * size1 region_size[region] = max(..., len + dma->offset) Several arithmetic issues can corrupt the

CVE-2019-10639 [HIGH] CWE-326 CVE-2019-10639: The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial k The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. Specifically, it is possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multi

CVE-2026-31611 [HIGH] CVE-2026-31611: In the Linux kernel, the following vulnerability has been resolved: ksmbd: require 3 sub-authoritie In the Linux kernel, the following vulnerability has been resolved: ksmbd: require 3 sub-authorities before reading sub_auth[2] parse_dacl() compares each ACE SID against sid_unix_NFS_mode and on match reads sid.sub_auth[2] as the file mode. If sid_unix_NFS_mode is the prefix S-1-5-88-3 with num_subauth = 2 then compare_sids() compares only min(num_subauth,

CVE-2021-4157 [HIGH] CWE-119 CVE-2021-4157: An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was fo An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could potentially use this flaw to crash the system or escalate privileges on the system.

CVE-2009-4538 [CRITICAL] CVE-2009-4538: drivers/net/e1000e/netdev.c in the e1000e driver in the Linux kernel 2.6.32.3 and earlier does not p drivers/net/e1000e/netdev.c in the e1000e driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to have an unspecified impact via crafted packets, a related issue to CVE-2009-4537.

CVE-2021-41073 [HIGH] CWE-763 CVE-2021-41073: loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain pri loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a free of a kernel buffer, as demonstrated by using /proc//maps for exploitation.

CVE-2020-27786 [HIGH] CWE-416 CVE-2020-27786: A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local accoun A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to this specific memory while freed and before use causes the flow of execution to change and possibly allow for memory corruption or privilege e

CVE-2016-8438 [CRITICAL] CWE-190 CVE-2016-8438: Integer overflow leading to a TOCTOU condition in hypervisor PIL. An integer overflow exposes a race Integer overflow leading to a TOCTOU condition in hypervisor PIL. An integer overflow exposes a race condition that may be used to bypass (Peripheral Image Loader) PIL authentication. Product: Android. Versions: Kernel 3.18. Android ID: A-31624565. References: QC-CR#1023638.

CVE-2023-2008 [HIGH] CWE-129 CVE-2023-2008: A flaw was found in the Linux kernel's udmabuf device driver. The specific flaw exists within a faul A flaw was found in the Linux kernel's udmabuf device driver. The specific flaw exists within a fault handler. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an array. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the conte

CVE-2026-43377 [HIGH] CVE-2026-43377: In the Linux kernel, the following vulnerability has been resolved: ksmbd: Don't log keys in SMB3 s In the Linux kernel, the following vulnerability has been resolved: ksmbd: Don't log keys in SMB3 signing and encryption key generation When KSMBD_DEBUG_AUTH logging is enabled, generate_smb3signingkey() and generate_smb3encryptionkey() log the session, signing, encryption, and decryption key bytes. Remove the logs to avoid exposing credentials.

CVE-2021-34866 [HIGH] CWE-843 CVE-2021-34866: This vulnerability allows local attackers to escalate privileges on affected installations of Linux This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of prope

CVE-2016-8459 [CRITICAL] CWE-119 CVE-2016-8459: Possible buffer overflow in storage subsystem. Bad parameters as part of listener responses to RPMB Possible buffer overflow in storage subsystem. Bad parameters as part of listener responses to RPMB commands could lead to buffer overflow. Product: Android. Versions: Kernel 3.18. Android ID: A-32577972. References: QC-CR#988462.

CVE-2016-2384 [MEDIUM] CVE-2016-2384: Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor.

CVE-2017-2671 [MEDIUM] CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtain The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a certain lock and consequently cannot ensure that disconnect function calls are safe, which allows local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call.

CVE-2016-8437 [CRITICAL] CWE-20 CVE-2016-8437: Improper input validation in Access Control APIs. Access control API may return memory range checkin Improper input validation in Access Control APIs. Access control API may return memory range checking incorrectly. Product: Android. Versions: Kernel 3.18. Android ID: A-31623057. References: QC-CR#1009695.