Linux Kernel vulnerabilities

CVE-2020-29569 [HIGH] CWE-416 CVE-2020-29569: An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Lin An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handler to reset ring->xenblkd to NULL when stopped. However, the handler may not have time to run if the frontend quickly toggles between the states connect and disconnect. As a consequence, the bloc

CVE-2003-0619 [MEDIUM] CVE-2003-0619: Integer signedness error in the decode_fh function of nfs3xdr.c in Linux kernel before 2.4.21 allows Integer signedness error in the decode_fh function of nfs3xdr.c in Linux kernel before 2.4.21 allows remote attackers to cause a denial of service (kernel panic) via a negative size value within XDR data of an NFSv3 procedure call.

CVE-2018-16882 [HIGH] CWE-416 CVE-2018-16882: A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted inter A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor address, which is later used in pi_test_and

CVE-2026-43239 [HIGH] CVE-2026-43239: In the Linux kernel, the following vulnerability has been resolved: smb: client: prevent races in - In the Linux kernel, the following vulnerability has been resolved: smb: client: prevent races in ->query_interfaces() It was possible for two query interface works to be concurrently trying to update the interfaces. Prevent this by checking and updating iface_last_update under iface_lock.

CVE-2026-43215 [HIGH] CWE-667 CVE-2026-43215: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix locking usage for tco In the Linux kernel, the following vulnerability has been resolved: cifs: Fix locking usage for tcon fields We used to use the cifs_tcp_ses_lock to protect a lot of objects that are not just the server, ses or tcon lists. We later introduced srv_lock, ses_lock and tc_lock to protect fields within the corresponding structs. This was done to provide a

CVE-2026-52918 [HIGH] CVE-2026-52918: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: serialize accept_q a In the Linux kernel, the following vulnerability has been resolved: Bluetooth: serialize accept_q access bt_sock_poll() walks the accept queue without synchronization, while child teardown can unlink the same socket and drop its last reference. The unsynchronized accept queue walk has existed since the initial Bluetooth import. Protect accept_q with a dedic

CVE-2026-46056 [HIGH] CWE-416 CVE-2026-46056: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix poten In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci_conn lookup and field access must be covered by hdev lock in hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise the connection can be freed concurrently. Extend the hci_dev_lock critical section

CVE-2026-43018 [HIGH] CWE-416 CVE-2026-43018: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix poten In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt hci_conn lookup and field access must be covered by hdev lock in hci_le_remote_conn_param_req_evt, otherwise it's possible it is freed concurrently. Extend the hci_dev_lock critical section to cover all conn

CVE-2026-43334 [HIGH] CVE-2026-43334: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: force responder In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: force responder MITM requirements before building the pairing response smp_cmd_pairing_req() currently builds the pairing response from the initiator auth_req before enforcing the local BT_SECURITY_HIGH requirement. If the initiator omits SMP_AUTH_MITM, the response can also

CVE-2021-4440 [HIGH] CWE-400 CVE-2021-4440: In the Linux kernel, the following vulnerability has been resolved: x86/xen: Drop USERGS_SYSRET64 p In the Linux kernel, the following vulnerability has been resolved: x86/xen: Drop USERGS_SYSRET64 paravirt call commit afd30525a659ac0ae0904f0cb4a2ca75522c3123 upstream. USERGS_SYSRET64 is used to return from a syscall via SYSRET, but a Xen PV guest will nevertheless use the IRET hypercall, as there is no sysret PV hypercall defined. So instead of te

CVE-2026-46166 [HIGH] CWE-416 CVE-2026-46166: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use safe list i In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use safe list iteration in radar detect work The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to be freed and removed from the list. Guard against this to avoid a slab-use-after-free error.

CVE-2026-53358 [HIGH] CWE-667 CVE-2026-53358: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use chan time In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() l2cap_chan_close() removes the channel from conn->chan_l, which must be done under conn->lock. cleanup_listen() runs under the parent sk_lock, so acquiring conn->lock would invert the established conn->lock -> cha

CVE-2026-53072 [HIGH] CWE-667 CVE-2026-53072: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix locking in hci_c In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER When protocol sets HCI_PROTO_DEFER, hci_conn_request_evt() calls hci_connect_cfm(conn) without hdev->lock. Generally hci_connect_cfm() assumes it is held, and if conn is deleted concurrently -> UAF. Only SCO and I

CVE-2026-46152 [HIGH] CWE-1058 CVE-2026-46152: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop stray 'sta In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop stray 'static' from fast-RX rx_result ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but its per-invocation rx_result is declared static. Concurrent callers then share one instance and can overwrite each other's result between ieee80211_rx_mes

CVE-2026-45945 [HIGH] CWE-362 CVE-2026-45945: In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix race condition In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix race condition during PASID entry replacement The Intel VT-d PASID table entry is 512 bits (64 bytes). When replacing an active PASID entry (e.g., during domain replacement), the current implementation calculates a new entry on the stack and copies it to the table usin

CVE-2026-53281 [HIGH] CWE-476 CVE-2026-53281: In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid NULL pointer In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption Commit 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE") fixed a NULL pointer dereference in an unlikely situation partly. If dev_pasid is not found in the dev_pasids list, it remains NULL. However, the

CVE-2026-43403 [HIGH] CVE-2026-43403: In the Linux kernel, the following vulnerability has been resolved: nsfs: tighten permission checks In the Linux kernel, the following vulnerability has been resolved: nsfs: tighten permission checks for ns iteration ioctls Even privileged services should not necessarily be able to see other privileged service's namespaces so they can't leak information to each other. Use may_see_all_namespaces() helper that centralizes this policy until the nstree adapts.

CVE-2026-43391 [HIGH] CVE-2026-43391: In the Linux kernel, the following vulnerability has been resolved: nsfs: tighten permission checks In the Linux kernel, the following vulnerability has been resolved: nsfs: tighten permission checks for handle opening Even privileged services should not necessarily be able to see other privileged service's namespaces so they can't leak information to each other. Use may_see_all_namespaces() helper that centralizes this policy until the nstree adapts.

CVE-2026-53374 [HIGH] CVE-2026-53374: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: zero-initialize GAR In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: zero-initialize GART table on allocation GART TLB is flushed after unmapping but not after mapping. Since amdgpu_bo_create_kernel() does not zero-initialize the buffer, when a single PTE is written the TLB may speculatively load other uninitialized entries from the same cacheline

CVE-2026-43139 [HIGH] CWE-908 CVE-2026-43139: In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix uninitialized saddr In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() xfrm6_get_saddr() does not check the return value of ipv6_dev_get_saddr(). When ipv6_dev_get_saddr() fails to find a suitable source address (returns -EADDRNOTAVAIL), saddr->in6 is left uninitialized, but xfrm6_get_saddr() still retu