Linux Kernel vulnerabilities

CVE-2026-23178 [HIGH] CVE-2026-23178: In the Linux kernel, the following vulnerability has been resolved: HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() `i2c_hid_xfer` In the Linux kernel, the following vulnerability has been resolved: HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() `i2c_hid_xfer` is used to read `recv_len + sizeof(__le16)` bytes of data into `ihid->rawbuf`. The former can come from the userspace in the hidraw driver and is only bounded b

CVE-2026-31690 [HIGH] CWE-787 CVE-2026-31690: In the Linux kernel, the following vulnerability has been resolved: firmware: thead: Fix buffer ove In the Linux kernel, the following vulnerability has been resolved: firmware: thead: Fix buffer overflow and use standard endian macros Addresses two issues in the TH1520 AON firmware protocol driver: 1. Fix a potential buffer overflow where the code used unsafe pointer arithmetic to access the 'mode' field through the 'resource' pointer with an off

CVE-2026-31720 [HIGH] CWE-787 CVE-2026-31720: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_uac1_legacy: val In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_uac1_legacy: validate control request size f_audio_complete() copies req->length bytes into a 4-byte stack variable: u32 data = 0; memcpy(&data, req->buf, req->length); req->length is derived from the host-controlled USB request path, which can lead to a stack out-of

CVE-2026-43020 [HIGH] CWE-787 CVE-2026-43020: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate LTK e In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate LTK enc_size on load Load Long Term Keys stores the user-provided enc_size and later uses it to size fixed-size stack operations when replying to LE LTK requests. An enc_size larger than the 16-byte key buffer can therefore overflow the reply stack buffer.

CVE-2026-53300 [HIGH] CWE-416 CVE-2026-53300: In the Linux kernel, the following vulnerability has been resolved: net: enetc: fix NTMP DMA use-af In the Linux kernel, the following vulnerability has been resolved: net: enetc: fix NTMP DMA use-after-free issue The AI-generated review reported a potential DMA use-after-free issue [1]. If netc_xmit_ntmp_cmd() times out and returns an error, the pending command is not explicitly aborted, while ntmp_free_data_mem() unconditionally frees the DMA buf

CVE-2026-46124 [HIGH] CVE-2026-46124: In the Linux kernel, the following vulnerability has been resolved: isofs: validate block number fr In the Linux kernel, the following vulnerability has been resolved: isofs: validate block number from NFS file handle in isofs_export_iget isofs_fh_to_dentry() and isofs_fh_to_parent() pass an attacker- controlled block number (ifid->block or ifid->parent_block) from the NFS file handle to isofs_export_iget(), which only rejects block == 0 before calling iso

CVE-2026-46306 [HIGH] CVE-2026-46306: In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect PPPoE PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the flow dissector driver has assumed an uncompressed frame until the blamed

CVE-2026-31533 [CRITICAL] CWE-416 CVE-2026-31533: In the Linux kernel, the following vulnerability has been resolved: net/tls: fix use-after-free in In the Linux kernel, the following vulnerability has been resolved: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption The -EBUSY handling in tls_do_encryption(), introduced by commit 859054147318 ("net: tls: handle backlogging of crypto requests"), has a use-after-free due to double cleanup of encrypt_pending and the scatterlis

CVE-2008-4210 [MEDIUM] CWE-264 CVE-2008-4210: fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when ther fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by creating an executable file in a setgid directory through the (1) truncate or (2

CVE-2025-68359 CVE-2025-68359: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free of qgroup record after failure to add delayed ref head In t In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free of qgroup record after failure to add delayed ref head In the previous code it was possible to incur into a double kfree() scenario when calling add_delayed_ref_head(). This could happen if the record was reported to already ex

CVE-2025-40258 mptcp: fix race condition in mptcp_schedule_work() mptcp: fix race condition in mptcp_schedule_work() In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount on sk->sk_refcnt if the work was scheduled. This refcount will be released by mptcp_worker(). [A] if (schedule_work(...

CVE-2025-68741 scsi: qla2xxx: Fix improper freeing of purex item scsi: qla2xxx: Fix improper freeing of purex item In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix improper freeing of purex item In qla2xxx_process_purls_iocb(), an item is allocated via qla27xx_copy_multiple_pkt(), which internally calls qla24xx_alloc_purex_item(). The qla24xx_alloc_purex_item() function may return a pre-allocated item from a per-adapter pool for small allocations, instea

CVE-1999-0414 [MEDIUM] CVE-1999-0414: In Linux before version 2.0.36, remote attackers can spoof a TCP connection and pass data to the app In Linux before version 2.0.36, remote attackers can spoof a TCP connection and pass data to the application layer before fully establishing the connection.

CVE-2017-15126 [HIGH] CWE-119 CVE-2017-15126: A use-after-free flaw was found in fs/userfaultfd.c in the Linux kernel before 4.13.6. The issue is A use-after-free flaw was found in fs/userfaultfd.c in the Linux kernel before 4.13.6. The issue is related to the handling of fork failure when dealing with event messages. Failure to fork correctly can lead to a situation where a fork event will be removed from an already freed list of events with userfaultfd_ctx_put().

CVE-2025-40253 CVE-2025-40253: In the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Fix double-kfree The function 'mpc_rcvd_sweep_req(mpcginfo)' is called In the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Fix double-kfree The function 'mpc_rcvd_sweep_req(mpcginfo)' is called conditionally from function 'ctcmpc_unpack_skb'. It frees passed mpcginfo. After that a call to function 'kfree' in function 'ctcmpc_unpack_skb' frees it again. Remove '

CVE-2025-40362 ceph: fix multifs mds auth caps issue ceph: fix multifs mds auth caps issue In the Linux kernel, the following vulnerability has been resolved: ceph: fix multifs mds auth caps issue The mds auth caps check should also validate the fsname along with the associated caps. Not doing so would result in applying the mds auth caps of one fs on to the other fs in a multifs ceph cluster. The bug causes multiple issues w.r.t user authentication, following is one such example. Steps to R

CVE-2023-52832 [CRITICAL] CWE-920 CVE-2023-52832: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't return un In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't return unset power in ieee80211_get_tx_power() We can get a UBSAN warning if ieee80211_get_tx_power() returns the INT_MIN value mac80211 internally uses for "unset power level". UBSAN: signed-integer-overflow in net/wireless/nl80211.c:3816:5 -2147483648 * 1

CVE-2024-35845 [CRITICAL] CWE-134 CVE-2024-35845: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dbg-tlv: ensure In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dbg-tlv: ensure NUL termination The iwl_fw_ini_debug_info_tlv is used as a string, so we must ensure the string is terminated correctly before using it.

CVE-2023-1390 [HIGH] CWE-1050 CVE-2023-1390: A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The whi A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue. Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system to instantly spike to 100%, causing a

CVE-2021-47348 [CRITICAL] CWE-119 CVE-2021-47348: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid HDCP ove In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid HDCP over-read and corruption Instead of reading the desired 5 bytes of the actual target field, the code was reading 8. This could result in a corrupted value if the trailing 3 bytes were non-zero, so instead use an appropriately sized and zero-initialized