Linux Kernel vulnerabilities

CVE-2025-38317 [HIGH] CWE-787 CVE-2025-38317: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix buffer overfl In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix buffer overflow in debugfs If the user tries to write more than 32 bytes then it results in memory corruption. Fortunately, this is debugfs so it's limited to root users.

CVE-2025-71234 [HIGH] CWE-787 CVE-2025-71234: In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: fix slab-out-of In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add The driver does not set hw->sta_data_size, which causes mac80211 to allocate insufficient space for driver private station data in __sta_info_alloc(). When rtl8xxxu_sta_add() accesses members of struct rtl8xxxu_sta_info throu

CVE-2023-53554 [HIGH] CWE-787 CVE-2023-53554: In the Linux kernel, the following vulnerability has been resolved: staging: ks7010: potential buff In the Linux kernel, the following vulnerability has been resolved: staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext() The "exc->key_len" is a u16 that comes from the user. If it's over IW_ENCODING_TOKEN_MAX (64) that could lead to memory corruption.

CVE-2026-52910 [HIGH] CWE-125 CVE-2026-52910: In the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog a In the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog after RCU grace period. Eulgyu Kim reported the splat below with a repro. [0] The repro sets up a UDP reuseport group with a cBPF prog and replaces it with a new one while another thread is sending a UDP packet to the group. The reuseport prog is freed

CVE-2025-38568 [HIGH] CWE-787 CVE-2025-38568: In the Linux kernel, the following vulnerability has been resolved: net/sched: mqprio: fix stack ou In the Linux kernel, the following vulnerability has been resolved: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing TCA_MQPRIO_TC_ENTRY_INDEX is validated using NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value TC_QOPT_MAX_QUEUE (16). This leads to a 4-byte out-of-bounds stack write in the fp[] array, which only

CVE-2022-20566 [HIGH] CVE-2022-20566: In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-165329981References: Upstream kernel

CVE-2026-45853 [HIGH] CWE-787 CVE-2026-45853: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Use kvfree instead In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() amdgpu_discovery_get_nps_info() internally allocates memory for ranges using kvcalloc(), which may use vmalloc() for large allocation. Using kfree() to release vmalloc memory will lead to a memory corruption. U

CVE-2025-39691 [HIGH] CWE-416 CVE-2025-39691: In the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free w In the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bh_read() helper There's issue as follows: BUG: KASAN: stack-out-of-bounds in end_buffer_read_sync+0xe3/0x110 Read of size 8 at addr ffffc9000168f7f8 by task swapper/3/0 CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.16.0-862.14.0.6.x86_64

CVE-2026-23233 [HIGH] CWE-787 CVE-2026-23233: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid mapping wron In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid mapping wrong physical block for swapfile Xiaolong Guo reported a f2fs bug in bugzilla [1] [1] https://bugzilla.kernel.org/show_bug.cgi?id=220951 Quoted: "When using stress-ng's swap stress test on F2FS filesystem with kernel 6.6+, the system experiences data co

CVE-2023-53524 [HIGH] CWE-190 CVE-2023-53524: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: Fix intege In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf An integer overflow occurs in the iwl_write_to_user_buf() function, which is called by the iwl_dbgfs_monitor_data_read() function. static bool iwl_write_to_user_buf(char __user *user_buf, ssize_t count, void *buf, ss

CVE-2023-53454 [HIGH] CWE-416 CVE-2023-53454: In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Correct devm d In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Correct devm device reference for hidinput input_dev name Reference the HID device rather than the input device for the devm allocation of the input_dev name. Referencing the input_dev would lead to a use-after-free when the input_dev was unregistered and subsequentl

CVE-2022-50258 [HIGH] CWE-787 CVE-2022-50258: In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential s In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() This patch fixes a stack-out-of-bounds read in brcmfmac that occurs when 'buf' that is not null-terminated is passed as an argument of strsep() in brcmf_c_preinit_dcmds(). This buffer is filled with a firmwa

CVE-2026-23012 [HIGH] CWE-416 CVE-2026-23012: In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: remove call_cont In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: remove call_control in inactive contexts If damon_call() is executed against a DAMON context that is not running, the function returns error while keeping the damon_call_control object linked to the context's call_controls list. Let's suppose the object is deallocated

CVE-2023-53282 [HIGH] CWE-416 CVE-2023-53282: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix use-after-free In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write During the sysfs firmware write process, a use-after-free read warning is logged from the lpfc_wr_object() routine: BUG: KFENCE: use-after-free read in lpfc_wr_object+0x235/0x310 [lpfc] Use-after-free read at

CVE-2022-50507 [HIGH] CWE-416 CVE-2022-50507: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Validate data run off In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Validate data run offset This adds sanity checks for data run offset. We should make sure data run offset is legit before trying to unpack them, otherwise we may encounter use-after-free or some unexpected memory access behaviors. [ 82.940342] BUG: KASAN: use-after-free in

CVE-2025-39955 [HIGH] CVE-2025-39955: In the Linux kernel, the following vulnerability has been resolved: tcp: Clear tcp_sk(sk)->fastopen In the Linux kernel, the following vulnerability has been resolved: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). syzbot reported the splat below where a socket had tcp_sk(sk)->fastopen_rsk in the TCP_ESTABLISHED state. [0] syzbot reused the server-side TCP Fast Open socket as a new client before the TFO socket completes 3WHS: 1. accept() 2. con

CVE-2026-53195 [HIGH] CWE-787 CVE-2026-53195: In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap ov In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() build_i2c_fw_hdr() allocates a fixed-size buffer of (16*1024 - 512) + sizeof(struct ti_i2c_firmware_rec) bytes, then copies le16_to_cpu(img_header->Length) bytes into it without validating that Length fits within the availab

CVE-2026-31641 [HIGH] CWE-125 CVE-2026-31641: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix RxGK token loading t In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix RxGK token loading to check bounds rxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length from the XDR token as u32 values and passes each through round_up(x, 4) before using the rounded value for validation and allocation. When the raw length is >= 0xfff

CVE-2026-23078 [HIGH] CWE-787 CVE-2026-23078: In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Fix buffer ove In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Fix buffer overflow in config retrieval The scarlett2_usb_get_config() function has a logic error in the endianness conversion code that can cause buffer overflows when count > 1. The code checks `if (size == 2)` where `size` is the total buffer size in bytes, then

CVE-2026-23410 [HIGH] CWE-362 CVE-2026-23410: In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race on rawdata d In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race on rawdata dereference There is a race condition that leads to a use-after-free situation: because the rawdata inodes are not refcounted, an attacker can start open()ing one of the rawdata files, and at the same time remove the last reference to this rawdata (by re