Linux Kernel vulnerabilities

CVE-2023-53487 [HIGH] CVE-2023-53487: In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas_flash: allow user In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas_flash: allow user copy to flash block cache objects With hardened usercopy enabled (CONFIG_HARDENED_USERCOPY=y), using the /proc/powerpc/rtas/firmware_update interface to prepare a system firmware update yields a BUG(): kernel BUG at mm/usercopy.c:102! Oops: Exception in kernel

CVE-2022-50401 [HIGH] CWE-415 CVE-2022-50401: In the Linux kernel, the following vulnerability has been resolved: nfsd: under NFSv4.1, fix double In the Linux kernel, the following vulnerability has been resolved: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure On error situation `clp->cl_cb_conn.cb_xprt` should not be given a reference to the xprt otherwise both client cleanup and the error handling path of the caller call to put it. Better to delay handing over the referen

CVE-2023-53216 [HIGH] CVE-2023-53216: In the Linux kernel, the following vulnerability has been resolved: arm64: efi: Make efi_rt_lock a In the Linux kernel, the following vulnerability has been resolved: arm64: efi: Make efi_rt_lock a raw_spinlock Running a rt-kernel base on 6.2.0-rc3-rt1 on an Ampere Altra outputs the following: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 9, name: kworker/u320:0

CVE-2025-38688 [HIGH] CVE-2025-38688: In the Linux kernel, the following vulnerability has been resolved: iommufd: Prevent ALIGN() overfl In the Linux kernel, the following vulnerability has been resolved: iommufd: Prevent ALIGN() overflow When allocating IOVA the candidate range gets aligned to the target alignment. If the range is close to ULONG_MAX then the ALIGN() can wrap resulting in a corrupted iova. Open code the ALIGN() using get_add_overflow() to prevent this. This simplifies the ch

CVE-2025-38349 [HIGH] CWE-416 CVE-2025-38349: In the Linux kernel, the following vulnerability has been resolved: eventpoll: don't decrement ep r In the Linux kernel, the following vulnerability has been resolved: eventpoll: don't decrement ep refcount while still holding the ep mutex Jann Horn points out that epoll is decrementing the ep refcount and then doing a mutex_unlock(&ep->mtx); afterwards. That's very wrong, because it can lead to a use-after-free. That pattern is actually fine fo

CVE-2025-39810 [HIGH] CWE-787 CVE-2025-39810: In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix memory corruption In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix memory corruption when FW resources change during ifdown bnxt_set_dflt_rings() assumes that it is always called before any TC has been created. So it doesn't take bp->num_tc into account and assumes that it is always 0 or 1. In the FW resource or capability change scenar

CVE-2025-39855 [HIGH] CWE-416 CVE-2025-39855: In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL access of tx->in_ In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL access of tx->in_use in ice_ptp_ts_irq The E810 device has support for a "low latency" firmware interface to access and read the Tx timestamps. This interface does not use the standard Tx timestamp logic, due to the latency overhead of proxying sideband command requests

CVE-2025-38443 [HIGH] CWE-416 CVE-2025-38443: In the Linux kernel, the following vulnerability has been resolved: nbd: fix uaf in nbd_genl_connec In the Linux kernel, the following vulnerability has been resolved: nbd: fix uaf in nbd_genl_connect() error path There is a use-after-free issue in nbd: block nbd6: Receive control failed (result -104) block nbd6: shutting down sockets BUG: KASAN: slab-use-after-free in recv_work+0x694/0xa80 drivers/block/nbd.c:1022 Write of size 4 at addr ffff8880

CVE-2022-50432 [HIGH] CWE-416 CVE-2022-50432: In the Linux kernel, the following vulnerability has been resolved: kernfs: fix use-after-free in _ In the Linux kernel, the following vulnerability has been resolved: kernfs: fix use-after-free in __kernfs_remove Syzkaller managed to trigger concurrent calls to kernfs_remove_by_name_ns() for the same file resulting in a KASAN detected use-after-free. The race occurs when the root node is freed during kernfs_drain(). To prevent this acquire an add

CVE-2022-50248 [HIGH] CWE-415 CVE-2022-50248: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix double In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix double free on tx path. We see kernel crashes and lockups and KASAN errors related to ax210 firmware crashes. One of the KASAN dumps pointed at the tx path, and it appears there is indeed a way to double-free an skb. If iwl_mvm_tx_skb_sta returns non-zero, the

CVE-2022-50241 [HIGH] CWE-416 CVE-2022-50241: In the Linux kernel, the following vulnerability has been resolved: NFSD: fix use-after-free on sou In the Linux kernel, the following vulnerability has been resolved: NFSD: fix use-after-free on source server when doing inter-server copy Use-after-free occurred when the laundromat tried to free expired cpntf_state entry on the s2s_cp_stateids list after inter-server copy completed. The sc_cp_list that the expired copy state was inserted on was alr

CVE-2025-38730 [HIGH] CWE-787 CVE-2025-38730: In the Linux kernel, the following vulnerability has been resolved: io_uring/net: commit partial bu In the Linux kernel, the following vulnerability has been resolved: io_uring/net: commit partial buffers on retry Ring provided buffers are potentially only valid within the single execution context in which they were acquired. io_uring deals with this and invalidates them on retry. But on the networking side, if MSG_WAITALL is set, or if the socket

CVE-2025-38500 [HIGH] CWE-416 CVE-2025-38500: In the Linux kernel, the following vulnerability has been resolved: xfrm: interface: fix use-after- In the Linux kernel, the following vulnerability has been resolved: xfrm: interface: fix use-after-free after changing collect_md xfrm interface collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail when called on such interfaces. The check to enforce this was done only in the case where the x

CVE-2026-45935 [HIGH] CWE-125 CVE-2026-45935: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix slab-out-of-bound In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot In the 'DeleteIndexEntryRoot' case of the 'do_action' function, the entry size ('esize') is retrieved from the log record without adequate bounds checking. Specifically, the code calculates the end of the entry ('e2') usi

CVE-2023-53537 [HIGH] CWE-416 CVE-2023-53537: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid use-after-fr In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid use-after-free for cached IPU bio xfstest generic/019 reports a bug: kernel BUG at mm/filemap.c:1619! RIP: 0010:folio_end_writeback+0x8a/0x90 Call Trace: end_page_writeback+0x1c/0x60 f2fs_write_end_io+0x199/0x420 bio_endio+0x104/0x180 submit_bio_noacct+0xa5/0x510

CVE-2023-53311 [HIGH] CWE-416 CVE-2023-53311: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free of n In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput During unmount process of nilfs2, nothing holds nilfs_root structure after nilfs2 detaches its writer in nilfs_detach_log_writer(). Previously, nilfs_evict_inode() could cause use-after-free read for nilfs_root if i

CVE-2023-53194 [HIGH] CWE-416 CVE-2023-53194: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add length check in i In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add length check in indx_get_root This adds a length check to guarantee the retrieved index root is legit. [ 162.459513] BUG: KASAN: use-after-free in hdr_find_e.isra.0+0x10c/0x320 [ 162.460176] Read of size 2 at addr ffff8880037bca99 by task mount/243 [ 162.460851] [ 162.

CVE-2023-53153 [HIGH] CWE-416 CVE-2023-53153: In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix use after f In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix use after free for wext Key information in wext.connect is not reset on (re)connect and can hold data from a previous connection. Reset key data to avoid that drivers or mac80211 incorrectly detect a WEP connection request and access the freed or already reused m

CVE-2025-39945 [HIGH] CWE-416 CVE-2025-39945: In the Linux kernel, the following vulnerability has been resolved: cnic: Fix use-after-free bugs i In the Linux kernel, the following vulnerability has been resolved: cnic: Fix use-after-free bugs in cnic_delete_task The original code uses cancel_delayed_work() in cnic_cm_stop_bnx2x_hw(), which does not guarantee that the delayed work item 'delete_task' has fully completed if it was already running. Additionally, the delayed work item is cyclic, t

CVE-2025-39863 [HIGH] CWE-416 CVE-2025-39863: In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-f In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work The brcmf_btcoex_detach() only shuts down the btcoex timer, if the flag timer_on is false. However, the brcmf_btcoex_timerfunc(), which runs as timer handler, sets timer_on to false. This creates critical rac