Linux Kernel vulnerabilities

CVE-2022-3640 [HIGH] CWE-119 CVE-2022-3640: A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the functi A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211944.

CVE-2025-22041 [HIGH] CWE-416 CVE-2025-22041: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ks In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_sessions_deregister() In multichannel mode, UAF issue can occur in session_deregister when the second channel sets up a session through the connection of the first channel. session that is freed through the global session table can be accessed again

CVE-2026-31435 [HIGH] CWE-125 CVE-2026-31435: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix read abandonment dur In the Linux kernel, the following vulnerability has been resolved: netfs: Fix read abandonment during retry Under certain circumstances, all the remaining subrequests from a read request will get abandoned during retry. The abandonment process expects the 'subreq' variable to be set to the place to start abandonment from, but it doesn't always have

CVE-2026-46238 [HIGH] CVE-2026-46238: In the Linux kernel, the following vulnerability has been resolved: batman-adv: stop caching unowne In the Linux kernel, the following vulnerability has been resolved: batman-adv: stop caching unowned originator pointers in BAT IV BAT IV keeps the last-hop neighbor address in each neigh_node, but some paths also cache an originator pointer derived from a temporary lookup. That pointer is not owned by the neigh_node and may no longer refer to a live origina

CVE-2026-43176 [HIGH] CVE-2026-43176: In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: pci: validate rele In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: pci: validate release report content before using for RTL8922DE The commit 957eda596c76 ("wifi: rtw89: pci: validate sequence number of TX release report") does validation on existing chips, which somehow a release report of SKB becomes malformed. As no clear cause found, add ru

CVE-2026-43172 [HIGH] CVE-2026-43172: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix 22000 series In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix 22000 series SMEM parsing If the firmware were to report three LMACs (which doesn't exist in hardware) then using "fwrt->smem_cfg.lmac[2]" is an overrun of the array. Reject such and use IWL_FW_CHECK instead of WARN_ON in this function.

CVE-2026-53232 [HIGH] CVE-2026-53232: In the Linux kernel, the following vulnerability has been resolved: net: phy: clean the sfp upstrea In the Linux kernel, the following vulnerability has been resolved: net: phy: clean the sfp upstream if phy probing fails Sashiko reported that we don't call sfp_bus_del_upstream() in the probe failure path, so let's add it, otherwise the sfp-bus is left with a dangling 'upstream' field, that may be used later on during SFP events. This issue existed before

CVE-2026-43249 [HIGH] CWE-415 CVE-2026-43249: In the Linux kernel, the following vulnerability has been resolved: 9p/xen: protect xen_9pfs_front_ In the Linux kernel, the following vulnerability has been resolved: 9p/xen: protect xen_9pfs_front_free against concurrent calls The xenwatch thread can race with other back-end change notifications and call xen_9pfs_front_free() twice, hitting the observed general protection fault due to a double-free. Guard the teardown path so only one caller can

CVE-2026-46113 [HIGH] CWE-416 CVE-2026-46113: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN The shadow MMU computes GFNs for direct shadow pages using sp->gfn plus the SPTE index. This assumption breaks for shadow paging if the guest page tables are modified between VM entries (similar to commit aad885e77496,

CVE-2026-53053 [HIGH] CVE-2026-53053: In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix clone_alias() to In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix clone_alias() to use the original device's devid Currently clone_alias() assumes first argument (pdev) is always the original device pointer. This function is called by pci_for_each_dma_alias() which based on topology decides to send original or alias device details in first a

CVE-2026-31558 [HIGH] CWE-125 CVE-2026-31558: In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Make kvm_get_vc In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust kvm_get_vcpu_by_cpuid() takes a cpuid parameter whose type is int, so cpuid can be negative. Let kvm_get_vcpu_by_cpuid() return NULL for this case so as to make it more robust. This fix an out-of-bounds access to kvm_arch::phy

CVE-2026-53230 [HIGH] CWE-125 CVE-2026-53230: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bound In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list mlx5_query_nic_vport_mac_list() sizes its firmware command buffer using the PF's log_max_current_uc/mc_list capabilities. When querying a VF vport with a larger configured max (via devlink), the firmware response can o

CVE-2012-3400 [HIGH] CWE-787 CVE-2012-3400: Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel before 3.4.5 allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem.

CVE-2011-1180 [CRITICAL] CWE-787 CVE-2011-1180: Multiple stack-based buffer overflows in the iriap_getvaluebyclass_indication function in net/irda/i Multiple stack-based buffer overflows in the iriap_getvaluebyclass_indication function in net/irda/iriap.c in the Linux kernel before 2.6.39 allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging connectivity to an IrDA infrared network and sending a large integer value for a (

CVE-2023-0179 [HIGH] CWE-190 CVE-2023-0179: A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution.

CVE-2014-3687 [HIGH] CWE-400 CVE-2014-3687: The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter.

CVE-2020-25645 [HIGH] CWE-319 CVE-2020-25645: A flaw was found in the Linux kernel in versions before 5.9-rc7. Traffic between two Geneve endpoint A flaw was found in the Linux kernel in versions before 5.9-rc7. Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidenti

CVE-2021-42008 [HIGH] CWE-787 CVE-2021-42008: The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a sl The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab out-of-bounds write. Input from a process that has the CAP_NET_ADMIN capability can lead to root access.

CVE-2026-23456 [HIGH] CWE-125 CVE-2026-23456: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: f In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case In decode_int(), the CONS case calls get_bits(bs, 2) to read a length value, then calls get_uint(bs, len) without checking that len bytes remain in the buffer. The existing boundary check only validates the 2 bits f

CVE-2023-39191 [HIGH] CWE-20 CVE-2023-39191: An improper input validation flaw was found in the eBPF subsystem in the Linux kernel. The issue occ An improper input validation flaw was found in the eBPF subsystem in the Linux kernel. The issue occurs due to a lack of proper validation of dynamic pointers within user-supplied eBPF programs prior to executing them. This may allow an attacker with CAP_BPF privileges to escalate privileges and execute arbitrary code in the context of the kernel.