Linux Kernel vulnerabilities

CVE-2023-53214 [HIGH] CWE-787 CVE-2023-53214: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential me In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential memory corruption in __update_iostat_latency() Add iotype sanity check to avoid potential memory corruption. This is to fix the compile error below: fs/f2fs/iostat.c:231 __update_iostat_latency() error: buffer overflow 'io_lat->peak_lat[type]' 3 type; 21

CVE-2025-39766 [HIGH] CVE-2025-39766: In the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue re In the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit The following setup can trigger a WARNING in htb_activate due to the condition: !cl->leaf.q->q.qlen tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 \ ht

CVE-2026-43303 [HIGH] CWE-416 CVE-2026-43303: In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: clear page->priv In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: clear page->private in free_pages_prepare() Several subsystems (slub, shmem, ttm, etc.) use page->private but don't clear it before freeing pages. When these pages are later allocated as high-order pages and split via split_page(), tail pages retain stale page->private

CVE-2025-39823 [HIGH] CWE-129 CVE-2025-39823: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: use array_index_nospe In the Linux kernel, the following vulnerability has been resolved: KVM: x86: use array_index_nospec with indices that come from guest min and dest_id are guest-controlled indices. Using array_index_nospec() after the bounds checks clamps these values to mitigate speculative execution side-channels.

CVE-2026-45989 [HIGH] CWE-416 CVE-2026-45989: In the Linux kernel, the following vulnerability has been resolved: of: unittest: fix use-after-fre In the Linux kernel, the following vulnerability has been resolved: of: unittest: fix use-after-free in testdrv_probe() The function testdrv_probe() retrieves the device_node from the PCI device, applies an overlay, and then immediately calls of_node_put(dn). This releases the reference held by the PCI core, potentially freeing the node if the refere

CVE-2022-50034 [HIGH] CWE-416 CVE-2022-50034: In the Linux kernel, the following vulnerability has been resolved: usb: cdns3 fix use-after-free a In the Linux kernel, the following vulnerability has been resolved: usb: cdns3 fix use-after-free at workaround 2 BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xac cdns3_wa2_remove_old_request() { ... kfree(priv_req->request.buf); cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request); list_del_init(&priv_req->list);

CVE-2025-38685 [HIGH] CWE-787 CVE-2025-38685: In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bound In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit This issue triggers when a userspace program does an ioctl FBIOPUT_CON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and updates the screen if console is visible. As part of

CVE-2025-38245 [HIGH] CVE-2025-38245: In the Linux kernel, the following vulnerability has been resolved: atm: Release atm_dev_mutex afte In the Linux kernel, the following vulnerability has been resolved: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). syzbot reported a warning below during atm_dev_register(). [0] Before creating a new device and procfs/sysfs for it, atm_dev_register() looks up a duplicated device by __atm_dev_lookup(). These operations are done und

CVE-2026-45866 [HIGH] CWE-416 CVE-2026-45866: In the Linux kernel, the following vulnerability has been resolved: serial: caif: fix use-after-fre In the Linux kernel, the following vulnerability has been resolved: serial: caif: fix use-after-free in caif_serial ldisc_close() There is a use-after-free bug in caif_serial where handle_tx() may access ser->tty after the tty has been freed. The race condition occurs between ldisc_close() and packet transmission: CPU 0 (close) CPU 1 (xmit) -------

CVE-2026-45946 [HIGH] CWE-416 CVE-2026-45946: In the Linux kernel, the following vulnerability has been resolved: power: supply: ab8500: Fix use- In the Linux kernel, the following vulnerability has been resolved: power: supply: ab8500: Fix use-after-free in power_supply_changed() Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `power_supply` handle, means that the `power_supply` handle will be deallocated/unregistered _before_ the inter

CVE-2026-43456 [HIGH] CWE-908 CVE-2026-43456: In the Linux kernel, the following vulnerability has been resolved: bonding: fix type confusion in In the Linux kernel, the following vulnerability has been resolved: bonding: fix type confusion in bond_setup_by_slave() kernel BUG at net/core/skbuff.c:2306! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306 RSP: 0018:ffffc90004aff760 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88807e3c8

CVE-2021-0929 [HIGH] CVE-2021-0929: In ion_dma_buf_end_cpu_access and related functions of ion In ion_dma_buf_end_cpu_access and related functions of ion.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-187527909References: Upstream kernel

CVE-2023-53179 [HIGH] CWE-787 CVE-2023-53179: In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: add the missi In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead to the use of wrong `CIDR_POS(c)` for calculating array offsets, which can lead to integer underflow. As a result, it

CVE-2025-38068 [HIGH] CWE-787 CVE-2025-38068: In the Linux kernel, the following vulnerability has been resolved: crypto: lzo - Fix compression b In the Linux kernel, the following vulnerability has been resolved: crypto: lzo - Fix compression buffer overrun Unlike the decompression code, the compression code in LZO never checked for output overruns. It instead assumes that the caller always provides enough buffer space, disregarding the buffer length provided by the caller. Add a safe compre

CVE-2022-50035 [HIGH] CWE-416 CVE-2022-50035: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix use-after-free In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix use-after-free on amdgpu_bo_list mutex If amdgpu_cs_vm_handling returns r != 0, then it will unlock the bo_list_mutex inside the function amdgpu_cs_vm_handling and again on amdgpu_cs_parser_fini. This problem results in the following use-after-free problem: [ 220.2809

CVE-2023-53570 [HIGH] CWE-190 CVE-2023-53570: In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: fix integer over In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems() nl80211_parse_mbssid_elems() uses a u8 variable num_elems to count the number of MBSSID elements in the nested netlink attribute attrs, which can lead to an integer overflow if a user of the nl80211 interface specifi

CVE-2025-39788 [HIGH] CWE-787 CVE-2025-39788: In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: exynos: Fix programm In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE On Google gs101, the number of UTP transfer request slots (nutrs) is 32, and in this case the driver ends up programming the UTRL_NEXUS_TYPE incorrectly as 0. This is because the left hand side of the shift is 1, which is of

CVE-2025-38704 [HIGH] CVE-2025-38704: In the Linux kernel, the following vulnerability has been resolved: rcu/nocb: Fix possible invalid In the Linux kernel, the following vulnerability has been resolved: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access In the preparation stage of CPU online, if the corresponding the rdp's->nocb_cb_kthread does not exist, will be created, there is a situation where the rdp's rcuop kthreads creation fails, and then de-offload this CPU's rdp,

CVE-2025-38369 [HIGH] CWE-416 CVE-2025-38369: In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Check availabi In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using Running IDXD workloads in a container with the /dev directory mounted can trigger a call trace or even a kernel panic when the parent process of the container is terminated. This issue occurs b

CVE-2023-53587 [HIGH] CWE-416 CVE-2023-53587: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Sync IRQ works bef In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Sync IRQ works before buffer destruction If something was written to the buffer just before destruction, it may be possible (maybe not in a real system, but it did happen in ARCH=um with time-travel) to destroy the ringbuffer before the IRQ work ran, leading this KASAN r