Linux Kernel vulnerabilities

CVE-2023-3812 [HIGH] CWE-787 CVE-2023-3812: An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functional An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system.

CVE-2024-0646 [HIGH] CWE-787 CVE-2024-0646: An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security function An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system.

CVE-2023-38429 [CRITICAL] CWE-193 CVE-2023-38429: An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c in ksmbd has an off- An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c in ksmbd has an off-by-one error in memory allocation (because of ksmbd_smb2_check_message) that may lead to out-of-bounds access.

CVE-2020-8835 [HIGH] CWE-125 CVE-2020-8835: In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restr In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vuln

CVE-2026-53003 [HIGH] CVE-2026-53003: In the Linux kernel, the following vulnerability has been resolved: pppoe: drop PFC frames RFC 251 In the Linux kernel, the following vulnerability has been resolved: pppoe: drop PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the current PPPoE driver assumes an uncompressed (2-byte) protocol field. However, the generic PPP la

CVE-2026-46114 [HIGH] CWE-476 CVE-2026-46114: In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject non-8-byte ATO In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads atomic_write_reply() at drivers/infiniband/sw/rxe/rxe_resp.c unconditionally dereferences 8 bytes at payload_addr(pkt): value = *(u64 *)payload_addr(pkt); check_rkey() previously accepted an ATOMIC_WRITE request with pktlen == resid

CVE-2026-43254 [HIGH] CWE-190 CVE-2026-43254: In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - fix packet extracti In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - fix packet extraction from stream When processing TCP stream data in ovpn_tcp_recv, we receive large cloned skbs from __strp_rcv that may contain multiple coalesced packets. The current implementation has two bugs: 1. Header offset overflow: Using pskb_pull with large of

CVE-2026-31612 [HIGH] CVE-2026-31612: In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate EaNameLength in In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate EaNameLength in smb2_get_ea() smb2_get_ea() reads ea_req->EaNameLength from the client request and passes it directly to strncmp() as the comparison length without verifying that the length of the name really is the size of the input buffer received. Fix this up by properly

CVE-2016-2117 [HIGH] CWE-200 CVE-2016-2117: The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5. The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from kernel memory by reading packet data.

CVE-2026-31444 [CRITICAL] CWE-416 CVE-2026-31444: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free and N In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() smb_grant_oplock() has two issues in the oplock publication sequence: 1) opinfo is linked into ci->m_op_list (via opinfo_add) before add_lease_global_list() is called. If add_lease_global_list() fails (kmalloc return

CVE-2026-46137 [CRITICAL] CWE-362 CVE-2026-46137: In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: fix po In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: fix potential data-race This mptcp_pm_add_timer() helper is executed as a timer callback in softirq context. To avoid any data races, the socket lock needs to be held with bh_lock_sock(). If the socket is in use, retry again soon after, similar to what i

CVE-2026-45972 [CRITICAL] CWE-416 CVE-2026-45972: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF and double free in smb2_open_file() Zero out @err_iov and @err_buftype before retrying SMB2_open() to prevent an UAF bug if @data != NULL, otherwise a double free.

CVE-2026-53086 [CRITICAL] CWE-362 CVE-2026-53086: In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeo In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeout handler The bcmgenet_timeout handler tries to take down all tx queues when a single queue times out. This is over zealous and causes many race conditions with queues that are still chugging along. Instead lets only restart the timed out queue.

CVE-2016-5244 [HIGH] CWE-200 CVE-2016-5244: The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initiali The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which allows remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message.

CVE-1999-1166 [HIGH] CVE-1999-1166: Linux 2.0.37 does not properly encode the Custom segment limit, which allows local users to gain roo Linux 2.0.37 does not properly encode the Custom segment limit, which allows local users to gain root privileges by accessing and modifying kernel memory.

CVE-2023-38431 [CRITICAL] CWE-125 CVE-2023-38431: An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/connection.c in ksmbd does n An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/connection.c in ksmbd does not validate the relationship between the NetBIOS header's length field and the SMB header sizes, via pdu_size in ksmbd_conn_handler_loop, leading to an out-of-bounds read.

CVE-1999-0381 [HIGH] CVE-1999-0381: super 3.11.6 and other versions have a buffer overflow in the syslog utility which allows a local us super 3.11.6 and other versions have a buffer overflow in the syslog utility which allows a local user to gain root access.

CVE-2019-3900 [HIGH] CWE-835 CVE-2019-3900: An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scena

CVE-2009-1337 [MEDIUM] CWE-264 CVE-2009-1337: The exit_notify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict ex The exit_notify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAP_KILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exit_signal field and then uses an exec system call to launch a setuid application.

CVE-2021-4154 [HIGH] CWE-416 CVE-2021-4154: A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux ker A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's cgroup v1 parser. A local attacker with a user privilege could cause a privilege escalation by exploiting the fsconfig syscall parameter leading to a container breakout and a denial of service on the system.