Linux Kernel vulnerabilities

CVE-2023-2598 [HIGH] CWE-416 CVE-2023-2598: A flaw was found in the fixed buffer registration code for io_uring (io_sqe_buffer_register in io_ur A flaw was found in the fixed buffer registration code for io_uring (io_sqe_buffer_register in io_uring/rsrc.c) in the Linux kernel that allows out-of-bounds access to physical memory beyond the end of the buffer. This flaw enables full local privilege escalation.

CVE-2026-53268 [HIGH] CWE-125 CVE-2026-53268: In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack_irc: fix p In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack_irc: fix possible out-of-bounds read When parsing fails after we've matched the command string we should bail out instead of trying to match a different command. This helper should be deprecated, given prevalence of TLS I doubt it has any relevance in 2026.

CVE-2026-46303 [HIGH] CWE-401 CVE-2026-46303: In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE c In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume size rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block number is within the mounted ISO 9660 volume. commit e595447e177b ("[PATCH] r

CVE-2026-53254 [HIGH] CWE-125 CVE-2026-53254: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in MCC handlers The RFCOMM MCC handlers cast skb->data to protocol-specific structs without validating skb->len first. A malicious remote device can send truncated MCC frames and trigger out-of-bounds reads in these handlers. Fix this by using

CVE-2026-31513 [HIGH] CWE-125 CVE-2026-31513: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix stack-out In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req Syzbot reported a KASAN stack-out-of-bounds read in l2cap_build_cmd() that is triggered by a malformed Enhanced Credit Based Connection Request. The vulnerability stems from l2cap_ecred_conn_req(). The function a

CVE-2023-3390 [HIGH] CWE-416 CVE-2023-3390: A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/ A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation

CVE-2023-3389 [HIGH] CWE-416 CVE-2023-3389: A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve lo A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a hrtimer. We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59 (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and

CVE-2023-39180 [HIGH] CVE-2023-39180: A flaw was found within the handling of SMB2_READ commands in the kernel ksmbd module A flaw was found within the handling of SMB2_READ commands in the kernel ksmbd module. The issue results from not releasing memory after its effective lifetime. An attacker can leverage this to create a denial-of-service condition on affected installations of Linux. Authentication is not required to exploit this vulnerability, but only systems with ksmbd enabled are vulnera

CVE-2023-3090 [HIGH] CWE-787 CVE-2023-3090: A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled. We recommend upgrading past commit 90cbed5247439a966b645

CVE-2017-14489 [MEDIUM] CWE-20 CVE-2017-14489: The iscsi_if_rx function in drivers/scsi/scsi_transport_iscsi.c in the Linux kernel through 4.13.2 a The iscsi_if_rx function in drivers/scsi/scsi_transport_iscsi.c in the Linux kernel through 4.13.2 allows local users to cause a denial of service (panic) by leveraging incorrect length validation.

CVE-2023-39179 [HIGH] CVE-2023-39179: A flaw was found within the handling of SMB2 read requests in the kernel ksmbd module A flaw was found within the handling of SMB2 read requests in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnerable to

CVE-2023-2007 [HIGH] CWE-367 CVE-2023-2007: The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of pr The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel.

CVE-2026-46294 [HIGH] CWE-787 CVE-2026-46294: In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in io In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in ioctl processing Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status: 1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the cod

CVE-2026-43206 [HIGH] CWE-787 CVE-2026-43206: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix out-of-bounds w In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. This allows unprivileged userspace to trigger an out-of bounds kernel memory write by passing a

CVE-2026-46253 [HIGH] CWE-787 CVE-2026-46253: In the Linux kernel, the following vulnerability has been resolved: pstore/ram: fix buffer overflow In the Linux kernel, the following vulnerability has been resolved: pstore/ram: fix buffer overflow in persistent_ram_save_old() persistent_ram_save_old() can be called multiple times for the same persistent_ram_zone (e.g., via ramoops_pstore_read -> ramoops_get_next_prz for PSTORE_TYPE_DMESG records). Currently, the function only allocates prz->old

CVE-2026-23268 [HIGH] CVE-2026-23268: In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unprivileged loca In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unprivileged local user can do privileged policy management An unprivileged local user can load, replace, and remove profiles by opening the apparmorfs interfaces, via a confused deputy attack, by passing the opened fd to a privileged process, and getting the privileged process

CVE-2026-23359 [HIGH] CWE-787 CVE-2026-23359: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack-out-of-bounds wr In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack-out-of-bounds write in devmap get_upper_ifindexes() iterates over all upper devices and writes their indices into an array without checking bounds. Also the callers assume that the max number of upper devices is MAX_NEST_DEV and allocate excluded_devices[1+MAX_NEST_DE

CVE-2024-38612 [CRITICAL] CWE-416 CVE-2024-38612: In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix invalid unregiste In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix invalid unregister error path The error path of seg6_init() is wrong in case CONFIG_IPV6_SEG6_LWTUNNEL is not defined. In that case if seg6_hmac_init() fails, the genl_unregister_family() isn't called. This issue exist since commit 46738b1317e1 ("ipv6: sr: add opti

CVE-2023-4458 [HIGH] CWE-125 CVE-2023-4458: A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue res A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enab

CVE-2026-22998 [HIGH] CWE-476 CVE-2026-22998: In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix NULL pointer dere In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") added ttag bounds checking and data_offset validation in nvmet_tcp_handle_h2c_data_pdu(), but it did not validate wheth