Linux Kernel vulnerabilities

CVE-2025-37927 [HIGH] CWE-787 CVE-2025-37927: In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix potential buffer In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid There is a string parsing logic error which can lead to an overflow of hid or uid buffers. Comparing ACPIID_LEN against a total string length doesn't take into account the lengths of individual hid and uid buffers so the

CVE-2025-37810 [HIGH] CWE-787 CVE-2025-37810: In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: check that e In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: check that event count does not exceed event buffer length The event count is read from register DWC3_GEVNTCOUNT. There is a check for the count being zero, but not for exceeding the event buffer length. Check that event count does not exceed event buffer length, a

CVE-2023-20928 [HIGH] CVE-2023-20928: In binder_vma_close of binder In binder_vma_close of binder.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-254837884References: Upstream kernel

CVE-2025-21879 [HIGH] CWE-416 CVE-2025-21879: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free on in In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free on inode when scanning root during em shrinking At btrfs_scan_root() we are accessing the inode's root (and fs_info) in a call to btrfs_fs_closing() after we have scheduled the inode for a delayed iput, and that can result in a use-after-free on the inode in

CVE-2022-50552 [HIGH] CWE-416 CVE-2022-50552: In the Linux kernel, the following vulnerability has been resolved: blk-mq: use quiesced elevator s In the Linux kernel, the following vulnerability has been resolved: blk-mq: use quiesced elevator switch when reinitializing queues The hctx's run_work may be racing with the elevator switch when reinitializing hardware queues. The queue is merely frozen in this context, but that only prevents requests from allocating and doesn't stop the hctx work f

CVE-2023-21255 [HIGH] CVE-2023-21255: In multiple functions of binder In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-36963 [HIGH] CWE-863 CVE-2024-36963: In the Linux kernel, the following vulnerability has been resolved: tracefs: Reset permissions on r In the Linux kernel, the following vulnerability has been resolved: tracefs: Reset permissions on remount if permissions are options There's an inconsistency with the way permissions are handled in tracefs. Because the permissions are generated when accessed, they default to the root inode's permission if they were never set by the user. If the user

CVE-2022-21546 [HIGH] CWE-476 CVE-2022-21546: In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix WRITE_SAME No In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix WRITE_SAME No Data Buffer crash In newer version of the SBC specs, we have a NDOB bit that indicates there is no data buffer that gets written out. If this bit is set using commands like "sg_write_same --ndob" we will crash in target_core_iblock/file's execute_write

CVE-2022-50131 [HIGH] CWE-787 CVE-2022-50131: In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: prevent a buffer In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: prevent a buffer overflow in mcp_smbus_write() Smatch Warning: drivers/hid/hid-mcp2221.c:388 mcp_smbus_write() error: __memcpy() '&mcp->txbuf[5]' too small (59 vs 255) drivers/hid/hid-mcp2221.c:388 mcp_smbus_write() error: __memcpy() 'buf' too small (34 vs 255) The 'len

CVE-2022-50156 [HIGH] CWE-787 CVE-2022-50156: In the Linux kernel, the following vulnerability has been resolved: HID: cp2112: prevent a buffer o In the Linux kernel, the following vulnerability has been resolved: HID: cp2112: prevent a buffer overflow in cp2112_xfer() Smatch warnings: drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy() 'data->block[1]' too small (33 vs 255) drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy() 'buf' too small (64 vs 255) The 'read_length' var

CVE-2026-46275 [HIGH] CWE-362 CVE-2026-46275: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs a In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the lifecycle management of hci_uart. The primary issue arises because the workqueues (init_ready

CVE-2022-50030 [HIGH] CWE-787 CVE-2022-50030: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Prevent buffer over In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input Malformed user input to debugfs results in buffer overflow crashes. Adapt input string lengths to fit within internal buffers, leaving space for NULL terminators.

CVE-2023-53037 [HIGH] CWE-416 CVE-2023-53037: In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Bad drive in topo In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Bad drive in topology results kernel crash When the SAS Transport Layer support is enabled and a device exposed to the OS by the driver fails INQUIRY commands, the driver frees up the memory allocated for an internal HBA port data structure. However, in some places, the

CVE-2026-23407 [HIGH] CWE-125 CVE-2026-23407: In the Linux kernel, the following vulnerability has been resolved: apparmor: fix missing bounds ch In the Linux kernel, the following vulnerability has been resolved: apparmor: fix missing bounds check on DEFAULT table in verify_dfa() The verify_dfa() function only checks DEFAULT_TABLE bounds when the state is not differentially encoded. When the verification loop traverses the differential encoding chain, it reads k = DEFAULT_TABLE[j] and uses k

CVE-2025-38267 [HIGH] CWE-787 CVE-2025-38267: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not trigger WAR In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun When reading a memory mapped buffer the reader page is just swapped out with the last page written in the write buffer. If the reader page is the same as the commit buffer (the buffer that is currently being written to) it

CVE-2025-38019 [HIGH] CWE-416 CVE-2025-38019: In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_router: Fix use In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices The driver only offloads neighbors that are constructed on top of net devices registered by it or their uppers (which are all Ethernet). The device supports GRE encapsulation and decapsulation of forwarded traff

CVE-2025-38702 [HIGH] CWE-787 CVE-2025-38702: In the Linux kernel, the following vulnerability has been resolved: fbdev: fix potential buffer ove In the Linux kernel, the following vulnerability has been resolved: fbdev: fix potential buffer overflow in do_register_framebuffer() The current implementation may lead to buffer overflow when: 1. Unregistration creates NULL gaps in registered_fb[] 2. All array slots become occupied despite num_registered_fb < FB_MAX 3. The registration loop exceeds

CVE-2022-50301 [HIGH] CWE-787 CVE-2022-50301: In the Linux kernel, the following vulnerability has been resolved: iommu/omap: Fix buffer overflow In the Linux kernel, the following vulnerability has been resolved: iommu/omap: Fix buffer overflow in debugfs There are two issues here: 1) The "len" variable needs to be checked before the very first write. Otherwise if omap2_iommu_dump_ctx() with "bytes" less than 32 it is a buffer overflow. 2) The snprintf() function returns the number of bytes

CVE-2022-50235 [HIGH] CWE-787 CVE-2022-50235: In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buff In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READDIR Restore the previous limit on the @count argument to prevent a buffer overflow attack.

CVE-2025-38348 [HIGH] CWE-787 CVE-2025-38348: In the Linux kernel, the following vulnerability has been resolved: wifi: p54: prevent buffer-overf In the Linux kernel, the following vulnerability has been resolved: wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() Robert Morris reported: |If a malicious USB device pretends to be an Intersil p54 wifi |interface and generates an eeprom_readback message with a large |eeprom->v1.len, p54_rx_eeprom_readback() will copy data from the |m