Linux Kernel vulnerabilities

CVE-2011-2918 [MEDIUM] CWE-400 CVE-2011-2918: The Performance Events subsystem in the Linux kernel before 3.1 does not properly handle event overf The Performance Events subsystem in the Linux kernel before 3.1 does not properly handle event overflows associated with PERF_COUNT_SW_CPU_CLOCK events, which allows local users to cause a denial of service (system hang) via a crafted application.

CVE-2026-46081 [HIGH] CWE-787 CVE-2026-46081: In the Linux kernel, the following vulnerability has been resolved: crypto: acomp - fix wrong point In the Linux kernel, the following vulnerability has been resolved: crypto: acomp - fix wrong pointer stored by acomp_save_req() acomp_save_req() stores &req->chain in req->base.data. When acomp_reqchain_done() is invoked on asynchronous completion, it receives &req->chain as the data argument but casts it directly to struct acomp_req. Since data poi

CVE-2023-53676 [HIGH] CWE-787 CVE-2023-53676: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix buffer In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() The function lio_target_nacl_info_show() uses sprintf() in a loop to print details for every iSCSI connection in a session without checking for the buffer length. With enough iSCSI connections it's possible to ov

CVE-2025-39828 [HIGH] CVE-2025-39828: In the Linux kernel, the following vulnerability has been resolved: atm: atmtcp: Prevent arbitrary In the Linux kernel, the following vulnerability has been resolved: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). syzbot reported the splat below. [0] When atmtcp_v_open() or atmtcp_v_close() is called via connect() or close(), atmtcp_send_control() is called to send an in-kernel special message. The message has ATMTCP_HDR_MAGIC in atmtcp_c

CVE-2023-53541 [HIGH] CWE-787 CVE-2023-53541: In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: brcmnand: Fix pot In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write When the oob buffer length is not in multiple of words, the oob write function does out-of-bounds read on the oob source buffer at the last iteration. Fix that by always checking length limit on the oob buffer re

CVE-2025-39824 [HIGH] CWE-416 CVE-2025-39824: In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix UAF via HID_CLAI In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix UAF via HID_CLAIMED_INPUT validation After hid_hw_start() is called hidinput_connect() will eventually be called to set up the device with the input layer since the HID_CONNECT_DEFAULT connect mask is used. During hidinput_connect() all input and output reports are pro

CVE-2026-53194 [HIGH] CWE-787 CVE-2026-53194: In the Linux kernel, the following vulnerability has been resolved: USB: serial: kl5kusb105: fix bu In the Linux kernel, the following vulnerability has been resolved: USB: serial: kl5kusb105: fix bulk-out buffer overflow klsi_105_prepare_write_buffer() is called by the generic write path with the bulk-out buffer and its size (bulk_out_size, 64 bytes). It stores a two-byte length header at the start of the buffer and copies the payload from the wri

CVE-2025-39797 [HIGH] CVE-2025-39797: In the Linux kernel, the following vulnerability has been resolved: xfrm: Duplicate SPI Handling T In the Linux kernel, the following vulnerability has been resolved: xfrm: Duplicate SPI Handling The issue originates when Strongswan initiates an XFRM_MSG_ALLOCSPI Netlink message, which triggers the kernel function xfrm_alloc_spi(). This function is expected to ensure uniqueness of the Security Parameter Index (SPI) for inbound Security Associations (SAs).

CVE-2026-53143 [HIGH] CWE-787 CVE-2026-53143: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix buffer overflow In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 The v11 MQD manager incorrectly assigned the CP-compute variants of checkpoint_mqd/restore_mqd for KFD_MQD_TYPE_SDMA queues. These functions use sizeof(struct v11_compute_mqd) (2048 bytes) instead of sizeof(str

CVE-2026-53137 [HIGH] CWE-787 CVE-2026-53137: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp HDMI HDC In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size [Why & How] During HDCP 2.x repeater authentication over HDMI, the driver reads the sink's RxStatus register and extracts a 10-bit message size field (max value 1023). This value is used as the read length for the Recei

CVE-2026-53202 [HIGH] CWE-674 CVE-2026-53202: In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix signed integer In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix signed integer truncation in IPC receive Fix potential buffer overflow where firmware-supplied data_size is cast to signed int before being used in min_t(). Large unsigned values (>= 0x80000000) become negative, causing unsigned wraparound and oversized memcpy operatio

CVE-2026-31780 [HIGH] CWE-787 CVE-2026-31780: In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix u8 overflow In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation The variable valuesize is declared as u8 but accumulates the total length of all SSIDs to scan. Each SSID contributes up to 33 bytes (IEEE80211_MAX_SSID_LEN + 1), and with WILC_MAX_NUM_PROBED_SSID (10) SSIDs the tot

CVE-2026-31772 [HIGH] CWE-787 CVE-2026-31772: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix stack In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync hci_le_big_create_sync() uses DEFINE_FLEX to allocate a struct hci_cp_le_big_create_sync on the stack with room for 0x11 (17) BIS entries. However, conn->num_bis can hold up to HCI_MAX_ISO_BIS (31) entries — vali

CVE-2026-43258 [HIGH] CWE-787 CVE-2026-43258: In the Linux kernel, the following vulnerability has been resolved: alpha: fix user-space corruptio In the Linux kernel, the following vulnerability has been resolved: alpha: fix user-space corruption during memory compaction Alpha systems can suffer sporadic user-space crashes and heap corruption when memory compaction is enabled. Symptoms include SIGSEGV, glibc allocator failures (e.g. "unaligned tcache chunk"), and compiler internal errors. The

CVE-2026-31469 [HIGH] CWE-416 CVE-2026-31469: In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix UAF on dst_ops In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false A UAF issue occurs when the virtio_net driver is configured with napi_tx=N and the device's IFF_XMIT_DST_RELEASE flag is cleared (e.g., during the configuration of tc route filter rules). When IF

CVE-2026-31508 [HIGH] CVE-2026-31508: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Avoid releasi In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Avoid releasing netdev before teardown completes The patch cited in the Fixes tag below changed the teardown code for OVS ports to no longer unconditionally take the RTNL. After this change, the netdev_destroy() callback can proceed immediately to the call_rcu() invocation

CVE-2026-46116 [HIGH] CWE-416 CVE-2026-46116: In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_s In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls under syzkaller load on linux-6.12.y stable (reproduced on 6.12.47, also reachable via the same code path on torvalds/master and on t

CVE-2026-53401 [HIGH] CWE-416 CVE-2026-53401: In the Linux kernel, the following vulnerability has been resolved: fbdev: omap2: fix use-after-fre In the Linux kernel, the following vulnerability has been resolved: fbdev: omap2: fix use-after-free in omapfb_mmap omapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that can lead to use-after-free: The fb_mmap() entry point holds mm_lock but not lock (fb_info->lock), while ioctl handlers like OMAPFB_SETUP_PLANE hold lock but not mm_l

CVE-2026-53004 [HIGH] CWE-787 CVE-2026-53004: In the Linux kernel, the following vulnerability has been resolved: sctp: fix OOB write to userspac In the Linux kernel, the following vulnerability has been resolved: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks sctp_getsockopt_peer_auth_chunks() checks that the caller's optval buffer is large enough for the peer AUTH chunk list with if (len gauth_chunks, which lives at offset offsetof(struct sctp_authchunks, gauth_chunks)

CVE-2026-46001 [HIGH] CWE-787 CVE-2026-46001: In the Linux kernel, the following vulnerability has been resolved: hwmon: (pt5161l) Fix bugs in pt In the Linux kernel, the following vulnerability has been resolved: hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() Fix two bugs in pt5161l_read_block_data(): 1. Buffer overrun: The local buffer rbuf is declared as u8 rbuf[24], but i2c_smbus_read_block_data() can return up to I2C_SMBUS_BLOCK_MAX (32) bytes. The i2c-core copies the data into t