Linux Kernel vulnerabilities

CVE-2016-10142 [HIGH] CVE-2016-10142: An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too Big (PTB) messages An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too Big (PTB) messages. (The scope of this CVE is all affected IPv6 implementations from all vendors.) The security implications of IP fragmentation have been discussed at length in [RFC6274] and [RFC7739]. An attacker can leverage the generation of IPv6 atomic fragments t

CVE-2026-43383 [CRITICAL] CWE-208 CVE-2026-43383: In the Linux kernel, the following vulnerability has been resolved: net/tcp-md5: Fix MAC comparison In the Linux kernel, the following vulnerability has been resolved: net/tcp-md5: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.

CVE-2024-36896 [CRITICAL] CWE-476 CVE-2024-36896: In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix access violation In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix access violation during port device removal Testing with KASAN and syzkaller revealed a bug in port.c:disable_store(): usb_hub_to_struct_hub() can return NULL if the hub that the port belongs to is concurrently removed, but the function does not check for this poss

CVE-2026-63938 [CRITICAL] CWE-125 CVE-2026-63938: In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request ind In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request indices against the actual size of the buffer When processing Page State Change (PSC) requests, validate the PSC buffer against the effective size of the scratch area, which could be less than the maximum size if the guest provided a pointer that isn't

CVE-2026-64034 [CRITICAL] CWE-367 CVE-2026-64034: In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fe In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-reads the same field from the same DMA buffer for test_bit() and pointer

CVE-2018-1000026 [HIGH] CWE-20 CVE-2018-1000026: Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input validation vulnerability in bnx2x network card driver that can result in DoS: Network card firmware assertion takes card off-line. This attack appear to be exploitable via An attacker on a must pass a very large, specially crafted packet to the bnx2

CVE-2022-3640 [HIGH] CWE-119 CVE-2022-3640: A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the functi A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211944.

CVE-2015-1421 [CRITICAL] CVE-2015-1421: Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data.

CVE-2024-43847 [HIGH] CVE-2024-43847: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix invalid memor In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix invalid memory access while processing fragmented packets The monitor ring and the reo reinject ring share the same ring mask index. When the driver receives an interrupt for the reo reinject ring, the monitor ring is also processed, leading to invalid memory access. Since

CVE-2026-31409 [HIGH] CVE-2026-31409: In the Linux kernel, the following vulnerability has been resolved: ksmbd: unset conn->binding on f In the Linux kernel, the following vulnerability has been resolved: ksmbd: unset conn->binding on failed binding request When a multichannel SMB2_SESSION_SETUP request with SMB2_SESSION_REQ_FLAG_BINDING fails ksmbd sets conn->binding = true but never clears it on the error path. This leaves the connection in a binding state where all subsequent ksmbd_session

CVE-2026-64093 [HIGH] CVE-2026-64093: In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: directly In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: directly shut down timer on cleanup batadv_tp_sender_cleanup() was calling timer_delete_sync() followed by timer_delete() to guard against the timer handler re-arming itself between the two calls. This double-deletion hack relied on the sending status being set to 0 to s

CVE-2026-31408 [HIGH] CWE-416 CVE-2026-31408: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-f In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a reference to the socket. A concurrent close() can free the socket between the lock release and the

CVE-2026-46125 [HIGH] CWE-416 CVE-2026-46125: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep the station since it's related to the link of the vif being removed. Delete an existing statio

CVE-2022-49238 [HIGH] CWE-416 CVE-2022-49238: In the Linux kernel, the following vulnerability has been resolved: ath11k: free peer for station w In the Linux kernel, the following vulnerability has been resolved: ath11k: free peer for station when disconnect from AP for QCA6390/WCN6855 Commit b4a0f54156ac ("ath11k: move peer delete after vdev stop of station for QCA6390 and WCN6855") is to fix firmware crash by changing the WMI command sequence, but actually skip all the peer delete operation

CVE-2026-43110 [HIGH] CWE-129 CVE-2026-43110: In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: validate bsscfg In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: validate bsscfg indices in IF events brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw bsscfgidx field as an array index without a matching range check. Reject IF events whose bssc

CVE-2026-64441 [HIGH] CWE-125 CVE-2026-64441: In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB rea In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() Three IE/attribute parsing functions have missing bounds checks. rtw_get_sec_ie() and rtw_get_wapi_ie() iterate over a raw IE buffer without verifying that the header bytes (tag + length

CVE-2026-64434 [HIGH] CWE-416 CVE-2026-64434: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in ch In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2cap_chan_timeout() runs asynchronously and accesses chan->conn. If the connection is torn down while the timer is running or pending, chan->conn can be freed, leading to a use-after-free when the timer worker attempts

CVE-2026-64096 [HIGH] CWE-416 CVE-2026-64096: In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: fix use-afte In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: fix use-after-free in orig_node RCU release batadv_mcast_purge_orig() removes entries from RCU-protected hlists but does not wait for an RCU grace period before returning. Concurrent RCU readers may still accesses references to those entries at the point of removal

CVE-2026-31588 [HIGH] CWE-416 CVE-2026-31588: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use scratch field in In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use scratch field in MMIO fragment to hold small write values When exiting to userspace to service an emulated MMIO write, copy the to-be-written value to a scratch field in the MMIO fragment if the size of the data payload is 8 bytes or less, i.e. can fit in a single chunk,

CVE-2026-53171 [HIGH] CVE-2026-53171: In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix arithmetic is In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix arithmetic issues in dma_length() dma_length() derives DMA region usage from command stream values and updates region_size[]: len = ((len + stride[0]) * size0 + stride[1]) * size1 region_size[region] = max(..., len + dma->offset) Several arithmetic issues can corrupt the