Linux Kernel vulnerabilities

CVE-2023-1281 [HIGH] CWE-416 CVE-2023-1281: Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this vulnerability to elevate its privileges to

CVE-2021-4028 [HIGH] CWE-416 CVE-2021-4028: A flaw in the Linux kernel's implementation of RDMA communications manager listener code allowed an A flaw in the Linux kernel's implementation of RDMA communications manager listener code allowed an attacker with local access to setup a socket to listen on a high port allowing for a list element to be used after free. Given the ability to execute code, a local attacker could leverage this use-after-free to crash the system or possibly escalate privile

CVE-2020-14351 [HIGH] CWE-416 CVE-2020-14351: A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem a A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVE-2024-47742 [HIGH] CWE-22 CVE-2024-47742: In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Block path tra In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Block path traversal Most firmware names are hardcoded strings, or are constructed from fairly constrained format strings where the dynamic parts are just some hex numbers or such. However, there are a couple codepaths in the kernel where firmware file names contain

CVE-2024-36978 [HIGH] CWE-787 CVE-2024-36978: In the Linux kernel, the following vulnerability has been resolved: net: sched: sch_multiq: fix pos In the Linux kernel, the following vulnerability has been resolved: net: sched: sch_multiq: fix possible OOB write in multiq_tune() q->bands will be assigned to qopt->bands to execute subsequent code logic after kmalloc. So the old q->bands should not be used in kmalloc. Otherwise, an out-of-bounds write will occur.

CVE-2024-1085 [HIGH] CWE-416 CVE-2024-1085: A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_setelem_catchall_deactivate() function checks whether the catch-all set element is active in the current generation instead of the next generation before freeing it, but only flags it inactive in the next g

CVE-2023-1670 [HIGH] CWE-416 CVE-2023-1670: A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Ethernet driver was found.A A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Ethernet driver was found.A local user could use this flaw to crash the system or potentially escalate their privileges on the system.

CVE-2022-48948 [HIGH] CWE-120 CVE-2022-48948: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Prevent buffe In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Prevent buffer overflow in setup handler Setup function uvc_function_setup permits control transfer requests with up to 64 bytes of payload (UVC_MAX_REQUEST_SIZE), data stage handler for OUT transfer uses memcpy to copy req->actual bytes to uvc_event->data.data arra

CVE-2024-26753 [HIGH] CWE-787 CVE-2024-26753: In the Linux kernel, the following vulnerability has been resolved: crypto: virtio/akcipher - Fix s In the Linux kernel, the following vulnerability has been resolved: crypto: virtio/akcipher - Fix stack overflow on memcpy sizeof(struct virtio_crypto_akcipher_session_para) is less than sizeof(struct virtio_crypto_op_ctrl_req::u), copying more bytes from stack variable leads stack overflow. Clang reports this issue by commands: make -j CC=clang-14 m

CVE-2021-47404 [HIGH] CWE-787 CVE-2021-47404: In the Linux kernel, the following vulnerability has been resolved: HID: betop: fix slab-out-of-bou In the Linux kernel, the following vulnerability has been resolved: HID: betop: fix slab-out-of-bounds Write in betop_probe Syzbot reported slab-out-of-bounds Write bug in hid-betopff driver. The problem is the driver assumes the device must have an input report but some malicious devices violate this assumption. So this patch checks hid_device's in

CVE-2024-42148 [HIGH] CWE-129 CVE-2024-42148: In the Linux kernel, the following vulnerability has been resolved: bnx2x: Fix multiple UBSAN array In the Linux kernel, the following vulnerability has been resolved: bnx2x: Fix multiple UBSAN array-index-out-of-bounds Fix UBSAN warnings that occur when using a system with 32 physical cpu cores or more, or when the user defines a number of Ethernet queues greater than or equal to FP_SB_MAX_E1x using the num_queues module parameter. Currently ther

CVE-2024-53142 [HIGH] CWE-787 CVE-2024-53142: In the Linux kernel, the following vulnerability has been resolved: initramfs: avoid filename buffe In the Linux kernel, the following vulnerability has been resolved: initramfs: avoid filename buffer overrun The initramfs filename field is defined in Documentation/driver-api/early-userspace/buffer-format.rst as: 37 cpio_file := ALGN(4) + cpio_header + filename + "\0" + ALGN(4) + data ... 55 ============= ================== =======================

CVE-2026-52943 [HIGH] CWE-416 CVE-2026-52943: In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix missing zeroco In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix missing zerocopy reference in pskb_carve helpers pskb_carve_inside_header() and pskb_carve_inside_nonlinear() both copy the old skb_shared_info header into a new buffer via memcpy(), which includes the destructor_arg pointer (uarg) for MSG_ZEROCOPY skbs. Neither func

CVE-2024-53194 [HIGH] CWE-416 CVE-2024-53194: In the Linux kernel, the following vulnerability has been resolved: PCI: Fix use-after-free of slot In the Linux kernel, the following vulnerability has been resolved: PCI: Fix use-after-free of slot->bus on hot remove Dennis reports a boot crash on recent Lenovo laptops with a USB4 dock. Since commit 0fc70886569c ("thunderbolt: Reset USB4 v2 host router") and commit 59a54c5f3dbd ("thunderbolt: Reset topology created by the boot firmware"), USB4 v

CVE-2024-26936 [HIGH] CWE-120 CVE-2024-26936: In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate request buffer In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate request buffer size in smb2_allocate_rsp_buf() The response buffer should be allocated in smb2_allocate_rsp_buf before validating request. But the fields in payload as well as smb2 header is used in smb2_allocate_rsp_buf(). This patch add simple buffer size validation

CVE-2025-39952 [HIGH] CWE-787 CVE-2025-39952: In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: avoid buffer ov In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: avoid buffer overflow in WID string configuration Fix the following copy overflow warning identified by Smatch checker. drivers/net/wireless/microchip/wilc1000/wlan_cfg.c:184 wilc_wlan_parse_response_frame() error: '__memcpy()' 'cfg->s[i]->str' copy overflow (512 vs

CVE-2025-37891 [HIGH] CWE-120 CVE-2025-37891: In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: Fix buffer overflow In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: Fix buffer overflow at UMP SysEx message conversion The conversion function from MIDI 1.0 to UMP packet contains an internal buffer to keep the incoming MIDI bytes, and its size is 4, as it was supposed to be the max size for a MIDI1 UMP packet data. However, the implementa

CVE-2026-31786 [HIGH] CWE-787 CVE-2026-31786: In the Linux kernel, the following vulnerability has been resolved: Buffer overflow in drivers/xen/ In the Linux kernel, the following vulnerability has been resolved: Buffer overflow in drivers/xen/sys-hypervisor.c The build id returned by HYPERVISOR_xen_version(XENVER_build_id) is neither NUL terminated nor a string. The first causes a buffer overflow as sprintf in buildid_show will read and copy till it finds a NUL. 00000000 f4 91 51 f4 dd 38

CVE-2025-71162 [HIGH] CWE-416 CVE-2025-71162: In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra-adma: Fix use- In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra-adma: Fix use-after-free A use-after-free bug exists in the Tegra ADMA driver when audio streams are terminated, particularly during XRUN conditions. The issue occurs when the DMA buffer is freed by tegra_adma_terminate_all() before the vchan completion tasklet finis

CVE-2026-45984 [HIGH] CWE-416 CVE-2026-45984: In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix use-after-free in iom In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix use-after-free in iomap inline data write path The inline data buffer head (dibh) is being released prematurely in gfs2_iomap_begin() via release_metapath() while iomap->inline_data still points to dibh->b_data. This causes a use-after-free when iomap_write_end_inline() lat