Linux Kernel vulnerabilities

CVE-2026-53077 [HIGH] CVE-2026-53077: In the Linux kernel, the following vulnerability has been resolved: net/rds: Restrict use of RDS/IB In the Linux kernel, the following vulnerability has been resolved: net/rds: Restrict use of RDS/IB to the initial network namespace Prevent using RDS/IB in network namespaces other than the initial one. The existing RDS/IB code will not work properly in non-initial network namespaces.

CVE-2026-46183 [HIGH] CWE-415 CVE-2026-46183: In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: protect In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock damon_sysfs_quot_goal->path can be read and written by users, via DAMON sysfs 'path' file. It can also be indirectly read, for the parameters {on,off}line committing to DAMON. The reads for parameters committing are p

CVE-2026-31764 [HIGH] CWE-129 CVE-2026-31764: In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: Set buffe In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only The st_lsm6dsx_hwfifo_odr_store() function, which is called when userspace writes the buffer sampling frequency sysfs attribute, calls st_lsm6dsx_check_odr(), which accesses the odr_table array at index `senso

CVE-2026-23262 [HIGH] CWE-787 CVE-2026-23262: In the Linux kernel, the following vulnerability has been resolved: gve: Fix stats report corruptio In the Linux kernel, the following vulnerability has been resolved: gve: Fix stats report corruption on queue count change The driver and the NIC share a region in memory for stats reporting. The NIC calculates its offset into this region based on the total size of the stats region and the size of the NIC's stats. When the number of queues is change

CVE-2026-53273 [HIGH] CWE-416 CVE-2026-53273: In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-f In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-free when the client exits before the supplicant Commit 70b0d6b0a199 ("tee: optee: Fix supplicant wait loop") made the client wait as killable so it can be interrupted during shutdown or after a supplicant crash. This changes the original lifetime expect

CVE-2026-53129 [HIGH] CWE-416 CVE-2026-53129: In the Linux kernel, the following vulnerability has been resolved: fs/mbcache: cancel shrink work In the Linux kernel, the following vulnerability has been resolved: fs/mbcache: cancel shrink work before destroying the cache mb_cache_destroy() calls shrinker_free() and then frees all cache entries and the cache itself, but it does not cancel the pending c_shrink_work work item first. If mb_cache_entry_create() schedules c_shrink_work via schedule

CVE-2026-53250 [HIGH] CWE-367 CVE-2026-53250: In the Linux kernel, the following vulnerability has been resolved: xsk: cache csum_start/csum_offs In the Linux kernel, the following vulnerability has been resolved: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() The TX metadata area resides in the UMEM buffer which is memory-mapped and concurrently writable by userspace. In xsk_skb_metadata(), csum_start and csum_offset are read from shared memory for bounds validation, th

CVE-2026-31700 [HIGH] CWE-362 CVE-2026-31700: In the Linux kernel, the following vulnerability has been resolved: net/packet: fix TOCTOU race on In the Linux kernel, the following vulnerability has been resolved: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() In tpacket_snd(), when PACKET_VNET_HDR is enabled, vnet_hdr points directly into the mmap'd TX ring buffer shared with userspace. The kernel validates the header via __packet_snd_vnet_parse() but then re-reads all fields

CVE-2026-45860 [HIGH] CVE-2026-45860: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: increa In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: increase the connection clean up limit to 64 After the optimization to only perform one GC per jiffy, a new problem was introduced. If more than 8 new connections are tracked per jiffy the list won't be cleaned up fast enough possibly reaching the limit wrongly. In

CVE-2026-45859 [HIGH] CVE-2026-45859: In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: do In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation Ulrich reports a regression with nfqueue: If an application did not set the 'F_GSO' capability flag and a gso packet with an unconfirmed nf_conn entry is received all packets are now dropped instead of queued, becaus

CVE-2025-38566 [HIGH] CWE-754 CVE-2025-38566: In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix handling of server In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix handling of server side tls alerts Scott Mayhew discovered a security exploit in NFS over TLS in tls_alert_recv() due to its assumption it can read data from the msg iterator's kvec.. kTLS implementation splits TLS non-data record payload between the control message buffe

CVE-2026-52957 [HIGH] CWE-476 CVE-2026-52957: In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential null-ptr In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential null-ptr-deref in decode_choose_args() A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself contains a CRUSH map. When decoding this CRUSH map in crush_decode(), an array of max_buckets CRUSH buckets is decoded, where some indices may not refer to

CVE-2026-52998 [HIGH] CWE-476 CVE-2026-52998: In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix p In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check The nf_osf_ttl() function accessed skb->dev to perform a local interface address lookup without verifying that the device pointer was valid. Additionally, the implementation utilized an in_dev_for_each_ifa_rcu loo

CVE-2026-46052 [HIGH] CVE-2026-46052: In the Linux kernel, the following vulnerability has been resolved: ceph: only d_add() negative den In the Linux kernel, the following vulnerability has been resolved: ceph: only d_add() negative dentries when they are unhashed Ceph can call d_add(dentry, NULL) on a negative dentry that is already present in the primary dcache hash. In the current VFS that is not safe. d_add() goes through __d_add() to __d_rehash(), which unconditionally reinserts dentry-

CVE-2026-31552 [HIGH] CWE-835 CVE-2026-31552: In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: Return -ENOMEM in In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom Since upstream commit e75665dd0968 ("wifi: wlcore: ensure skb headroom before skb_push"), wl1271_tx_allocate() and with it wl1271_prepare_tx_frame() returns -EAGAIN if pskb_expand_head() fails. However, i

CVE-2024-36031 [CRITICAL] CWE-324 CVE-2024-36031: In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expi In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation The expiry time of a key is unconditionally overwritten during instantiation, defaulting to turn it permanent. This causes a problem for DNS resolution as the expiration set by user-space is overwritten to TIME64_MAX, disabli

CVE-2026-43405 [HIGH] CWE-908 CVE-2026-43405: In the Linux kernel, the following vulnerability has been resolved: libceph: Use u32 for non-negati In the Linux kernel, the following vulnerability has been resolved: libceph: Use u32 for non-negative values in ceph_monmap_decode() This patch fixes unnecessary implicit conversions that change signedness of blob_len and num_mon in ceph_monmap_decode(). Currently blob_len and num_mon are (signed) int variables. They are used to hold values that are

CVE-2026-53183 [HIGH] CVE-2026-53183: In the Linux kernel, the following vulnerability has been resolved: mptcp: allow subflow rcv wnd to In the Linux kernel, the following vulnerability has been resolved: mptcp: allow subflow rcv wnd to shrink In MPTCP connection, the `window` field in the TCP header refers to the MPTCP-level rcv_nxt and it's right edge should not move backward. Such constraint is enforced at DSS option generation time. At the same time, the TCP stack ensures independently t

CVE-2026-43164 [HIGH] CWE-476 CVE-2026-43164: In the Linux kernel, the following vulnerability has been resolved: udplite: Fix null-ptr-deref in In the Linux kernel, the following vulnerability has been resolved: udplite: Fix null-ptr-deref in __udp_enqueue_schedule_skb(). syzbot reported null-ptr-deref of udp_sk(sk)->udp_prod_queue. [0] Since the cited commit, udp_lib_init_sock() can fail, as can udp_init_sock() and udpv6_init_sock(). Let's handle the error in udplite_sk_init() and udplitev

CVE-2026-53284 [HIGH] CWE-476 CVE-2026-53284: In the Linux kernel, the following vulnerability has been resolved: btrfs: only release the dirty p In the Linux kernel, the following vulnerability has been resolved: btrfs: only release the dirty pages io tree after successful writes [WARNING] With extra warning on dirty extent buffers at umount (aka, the next patch in the series), test case generic/388 can trigger the following warning about dirty extent buffers at unmount time: BTRFS critical