Linux Kernel vulnerabilities

CVE-2022-50300 [HIGH] CWE-416 CVE-2022-50300: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map use-after In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map use-after-free when handling missing device in read_one_chunk Store the error code before freeing the extent_map. Though it's reference counted structure, in that function it's the first and last allocation so this would lead to a potential use-after-free. The

CVE-2025-38172 [HIGH] CWE-416 CVE-2025-38172: In the Linux kernel, the following vulnerability has been resolved: erofs: avoid using multiple dev In the Linux kernel, the following vulnerability has been resolved: erofs: avoid using multiple devices with different type For multiple devices, both primary and extra devices should be the same type. `erofs_init_device` has already guaranteed that if the primary is a file-backed device, extra devices should also be regular files. However, if the p

CVE-2022-50305 [HIGH] CWE-416 CVE-2022-50305: In the Linux kernel, the following vulnerability has been resolved: ASoC: sof_es8336: fix possible In the Linux kernel, the following vulnerability has been resolved: ASoC: sof_es8336: fix possible use-after-free in sof_es8336_remove() sof_es8336_remove() calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function ha

CVE-2026-23411 [HIGH] CWE-362 CVE-2026-23411: In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race between free In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race between freeing data and fs accessing it AppArmor was putting the reference to i_private data on its end after removing the original entry from the file system. However the inode can aand does live beyond that point and it is possible that some of the fs call back

CVE-2025-39790 [HIGH] CWE-415 CVE-2025-39790: In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Detect events p In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Detect events pointing to unexpected TREs When a remote device sends a completion event to the host, it contains a pointer to the consumed TRE. The host uses this pointer to process all of the TREs between it and the host's local copy of the ring's read pointer. This

CVE-2025-39809 [HIGH] CWE-787 CVE-2025-39809: In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quick In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length The QuickI2C ACPI _DSD methods return ICRS and ISUB data with a trailing byte, making the actual length is one more byte than the structs defined. It caused stack-out-of-bounds and kernel crash: kernel: BUG: KASAN: s

CVE-2025-38394 [HIGH] CWE-787 CVE-2025-38394: In the Linux kernel, the following vulnerability has been resolved: HID: appletb-kbd: fix memory co In the Linux kernel, the following vulnerability has been resolved: HID: appletb-kbd: fix memory corruption of input_handler_list In appletb_kbd_probe an input handler is initialised and then registered with input core through input_register_handler(). When this happens input core will add the input handler (specifically its node) to the global input

CVE-2025-71123 [HIGH] CVE-2025-71123: In the Linux kernel, the following vulnerability has been resolved: ext4: fix string copying in par In the Linux kernel, the following vulnerability has been resolved: ext4: fix string copying in parse_apply_sb_mount_options() strscpy_pad() can't be used to copy a non-NUL-term string into a NUL-term string of possibly bigger size. Commit 0efc5990bca5 ("string.h: Introduce memtostr() and memtostr_pad()") provides additional information in that regard. So if

CVE-2025-38667 [HIGH] CWE-787 CVE-2025-38667: In the Linux kernel, the following vulnerability has been resolved: iio: fix potential out-of-bound In the Linux kernel, the following vulnerability has been resolved: iio: fix potential out-of-bound write The buffer is set to 20 characters. If a caller write more characters, count is truncated to the max available space in "simple_write_to_buffer". To protect from OoB access, check that the input size fit into buffer and add a zero terminator afte

CVE-2026-63794 [HIGH] CWE-787 CVE-2026-63794: In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path In sev_dbg_crypt(), the per-iteration transfer length is bounded by the source page offset (PAGE_SIZE - s_off) but not by the destination page offset (PAGE_SIZE - d_off). When d_off > s_off, the encrypt path (__sev_dbg_en

CVE-2025-39861 [HIGH] CWE-416 CVE-2025-39861: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: vhci: Prevent use-af In the Linux kernel, the following vulnerability has been resolved: Bluetooth: vhci: Prevent use-after-free by removing debugfs files early Move the creation of debugfs files into a dedicated function, and ensure they are explicitly removed during vhci_release(), before associated data structures are freed. Previously, debugfs files such as "force_s

CVE-2023-53286 [HIGH] CVE-2023-53286: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Return the firmware In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Return the firmware result upon destroying QP/RQ Previously when destroying a QP/RQ, the result of the firmware destruction function was ignored and upper layers weren't informed about the failure. Which in turn could lead to various problems since when upper layer isn't aware of t

CVE-2026-53193 [HIGH] CWE-416 CVE-2026-53193: In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Forcibly close tim In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Forcibly close timer instances at closing When snd_timer object is freed via snd_timer_free() and still pending snd_timer_instance objects are assigned to the timer object, it tries to unlink all instances and just set NULL to each ti->timer, then releases the resources

CVE-2026-43329 [HIGH] CWE-770 CVE-2026-43329: In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: strictly In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: strictly check for maximum number of actions The maximum number of flowtable hardware offload actions in IPv6 is: * ethernet mangling (4 payload actions, 2 for each ethernet address) * SNAT (4 payload actions) * DNAT (4 payload actions) * Double VLAN (4 vlan act

CVE-2025-39793 [HIGH] CVE-2025-39793: In the Linux kernel, the following vulnerability has been resolved: io_uring/memmap: cast nr_pages In the Linux kernel, the following vulnerability has been resolved: io_uring/memmap: cast nr_pages to size_t before shifting If the allocated size exceeds UINT_MAX, then it's necessary to cast the mr->nr_pages value to size_t to prevent it from overflowing. In practice this isn't much of a concern as the required memory size will have been validated upfront,

CVE-2025-39717 [HIGH] CWE-416 CVE-2025-39717: In the Linux kernel, the following vulnerability has been resolved: open_tree_attr: do not allow id In the Linux kernel, the following vulnerability has been resolved: open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE As described in commit 7a54947e727b ('Merge patch series "fs: allow changing idmappings"'), open_tree_attr(2) was necessary in order to allow for a detached mount to be created and have its idmappings changed wit

CVE-2026-53059 [HIGH] CWE-787 CVE-2026-53059: In the Linux kernel, the following vulnerability has been resolved: dm log: fix out-of-bounds write In the Linux kernel, the following vulnerability has been resolved: dm log: fix out-of-bounds write due to region_count overflow The local variable region_count in create_log_context() is declared as unsigned int (32-bit), but dm_sector_div_up() returns sector_t (64-bit). When a device-mapper target has a sufficiently large ti->len with a small regio

CVE-2025-39944 [HIGH] CWE-416 CVE-2025-39944: In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix use-after-fre In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() The original code relies on cancel_delayed_work() in otx2_ptp_destroy(), which does not ensure that the delayed work item synctstamp_work has fully completed if it was already running. This leads to use-after-free scenarios

CVE-2025-39871 [HIGH] CWE-416 CVE-2025-39871: In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Remove imprope In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Remove improper idxd_free The call to idxd_free() introduces a duplicate put_device() leading to a reference count underflow: refcount_t: underflow; use-after-free. WARNING: CPU: 15 PID: 4428 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110 ... Call Trace: idx

CVE-2025-39881 [HIGH] CWE-416 CVE-2025-39881: In the Linux kernel, the following vulnerability has been resolved: kernfs: Fix UAF in polling when In the Linux kernel, the following vulnerability has been resolved: kernfs: Fix UAF in polling when open file is released A use-after-free (UAF) vulnerability was identified in the PSI (Pressure Stall Information) monitoring mechanism: BUG: KASAN: slab-use-after-free in psi_trigger_poll+0x3c/0x140 Read of size 8 at addr ffff3de3d50bd308 by task syst