Linux Kernel vulnerabilities

CVE-2024-26898 [HIGH] CVE-2024-26898: In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-afte In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts This patch is against CVE-2023-6270. The description of cve is: A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, a

CVE-2023-4207 [HIGH] CWE-416 CVE-2023-4207: A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter()

CVE-2024-41000 [HIGH] CWE-190 CVE-2024-41000: In the Linux kernel, the following vulnerability has been resolved: block/ioctl: prefer different o In the Linux kernel, the following vulnerability has been resolved: block/ioctl: prefer different overflow check Running syzkaller with the newly reintroduced signed integer overflow sanitizer shows this report: [ 62.982337] ------------[ cut here ]------------ [ 62.985692] cgroup: Invalid name [ 62.986211] UBSAN: signed-integer-overflow in ../block

CVE-2022-49581 [HIGH] CWE-787 CVE-2022-49581: In the Linux kernel, the following vulnerability has been resolved: be2net: Fix buffer overflow in In the Linux kernel, the following vulnerability has been resolved: be2net: Fix buffer overflow in be_get_module_eeprom be_cmd_read_port_transceiver_data assumes that it is given a buffer that is at least PAGE_DATA_LEN long, or twice that if the module supports SFF 8472. However, this is not always the case. Fix this by passing the desired offset and

CVE-2023-4208 [HIGH] CWE-416 CVE-2023-4208: A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited t A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter

CVE-2023-4623 [HIGH] CWE-416 CVE-2023-4623: A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remov

CVE-2024-46740 [HIGH] CWE-416 CVE-2024-46740: In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF caused by offse In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF caused by offsets overwrite Binder objects are processed and copied individually into the target buffer during transactions. Any raw data in-between these objects is copied as well. However, this raw data copy lacks an out-of-bounds check. If the raw data exceeds the

CVE-2025-39866 [HIGH] CWE-416 CVE-2025-39866: In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-fr In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when __mark_inode_dirty() get the bdi_writeback that was in the progress of switching. CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1 ...... pstate: 60400005 (nZCv d

CVE-2024-41039 [HIGH] CWE-120 CVE-2024-41039: In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Fix overflow In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Fix overflow checking of wmfw header Fix the checking that firmware file buffer is large enough for the wmfw header, to prevent overrunning the buffer. The original code tested that the firmware data buffer contained enough bytes for the sums of the size of the stru

CVE-2023-4015 [HIGH] CWE-416 CVE-2023-4015: A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. On an error when building a nftables rule, deactivating immediate expressions in nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used. We recommend upgrading past commi

CVE-2010-2525 [HIGH] CWE-863 CVE-2010-2525: A flaw was discovered in gfs2 file system’s handling of acls (access control lists). An unprivileged A flaw was discovered in gfs2 file system’s handling of acls (access control lists). An unprivileged local attacker could exploit this flaw to gain access or execute any file stored in the gfs2 file system.

CVE-2021-0512 [HIGH] CVE-2021-0512: In __hidinput_change_resolution_multipliers of hid-input In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-173843328References: Upstream kernel

CVE-2026-31694 [HIGH] CVE-2026-31694: In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuse_add_dirent_to_cache() computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cache page. The existing logic only checks whether the dirent fits in the remaining space of the current

CVE-2021-47642 [HIGH] CWE-787 CVE-2021-47642: In the Linux kernel, the following vulnerability has been resolved: video: fbdev: nvidiafb: Use str In the Linux kernel, the following vulnerability has been resolved: video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow Coverity complains of a possible buffer overflow. However, given the 'static' scope of nvidia_setup_i2c_bus() it looks like that can't happen after examiniing the call sites. CID 19036 (#1 of 1): Copy into fixed size b

CVE-2024-50151 [HIGH] CWE-787 CVE-2024-50151: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOBs when buil In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOBs when building SMB2_IOCTL request When using encryption, either enforced by the server or when using 'seal' mount option, the client will squash all compound request buffers down for encryption into a single iov in smb2_set_next_command(). SMB2_ioctl_init() allo

CVE-2022-49292 [HIGH] CWE-787 CVE-2022-49292: In the Linux kernel, the following vulnerability has been resolved: ALSA: oss: Fix PCM OSS buffer a In the Linux kernel, the following vulnerability has been resolved: ALSA: oss: Fix PCM OSS buffer allocation overflow We've got syzbot reports hitting INT_MAX overflow at vmalloc() allocation that is called from snd_pcm_plug_alloc(). Although we apply the restrictions to input parameters, it's based only on the hw_params of the underlying PCM device.

CVE-2024-56626 [HIGH] CWE-787 CVE-2024-56626: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix Out-of-Bounds Write In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write An offset from client could be a negative value, It could allows to write data outside the bounds of the allocated buffer. Note that this issue is coming when setting 'vfs objects = streams_xattr parameter' in ksmbd.conf.

CVE-2023-28464 [HIGH] CWE-415 CVE-2023-28464: hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation.

CVE-2022-49196 [HIGH] CWE-416 CVE-2022-49196: In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Fix use after In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Fix use after free in remove_phb_dynamic() In remove_phb_dynamic() we use &phb->io_resource, after we've called device_unregister(&host_bridge->dev). But the unregister may have freed phb, because pcibios_free_controller_deferred() is the release function for the host

CVE-2023-0240 [HIGH] CWE-416 CVE-2023-0240: There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vu There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation. In the io_prep_async_work function the assumption that the last io_grab_identity call cannot return false is not true, and in this case the function will use the init_cred or the previous linked requests ident