Linux Kernel vulnerabilities

CVE-2026-52959 [HIGH] CVE-2026-52959: In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Do not use hos In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Do not use host-controlled page order in cleanup path When issuing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST), get_ext_report() allocates a buffer to retrieve a certificate blob from the host, keeping track of its size in report_req->certs_len. However, the h

CVE-2026-31635 [HIGH] CWE-130 CVE-2026-31635: In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix oversized RESPONSE a In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix oversized RESPONSE authenticator length check rxgk_verify_response() decodes auth_len from the packet and is supposed to verify that it fits in the remaining bytes. The existing check is inverted, so oversized RESPONSE authenticators are accepted and passed to rxgk_decrypt

CVE-2008-4302 [MEDIUM] CWE-667 CVE-2008-4302: fs/splice.c in the splice subsystem in the Linux kernel before 2.6.22.2 does not properly handle a f fs/splice.c in the splice subsystem in the Linux kernel before 2.6.22.2 does not properly handle a failure of the add_to_page_cache_lru function, and subsequently attempts to unlock a page that was not locked, which allows local users to cause a denial of service (kernel BUG and system crash), as demonstrated by the fio I/O tool.

CVE-2024-38623 [CRITICAL] CWE-129 CVE-2024-38623: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Use variable length a In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Use variable length array instead of fixed size Should fix smatch warning: ntfs_set_label() error: __builtin_memcpy() 'uni->name' too small (20 vs 256)

CVE-2023-32256 [HIGH] CVE-2023-32256: A flaw was found in the Linux kernel's ksmbd component A flaw was found in the Linux kernel's ksmbd component. A race condition between smb2 close operation and logoff in multichannel connections could result in a use-after-free issue.

CVE-2026-43226 [HIGH] CVE-2026-43226: In the Linux kernel, the following vulnerability has been resolved: net/rds: No shortcut out of RDS In the Linux kernel, the following vulnerability has been resolved: net/rds: No shortcut out of RDS_CONN_ERROR RDS connections carry a state "rds_conn_path::cp_state" and transitions from one state to another and are conditional upon an expected state: "rds_conn_path_transition." There is one exception to this conditionality, which is "RDS_CONN_ERROR" that

CVE-2026-53391 [HIGH] CWE-476 CVE-2026-53391: In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr nfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of a netaddr4 from a GETDEVICEINFO multipath-DS body, then immediately calls strrchr(buf, '.') to locate the port separator. Both decodes use xdr_stream_deco

CVE-2021-31440 [HIGH] CWE-682 CVE-2021-31440: This vulnerability allows local attackers to escalate privileges on affected installations of Linux This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper

CVE-2026-53392 [HIGH] CWE-476 CVE-2026-53392: In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero fi In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count ff_layout_alloc_lseg() decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzalloc_objs(), and the current code only rejects NULL. A zero count yields ZERO_SIZE_PTR, which

CVE-2020-27068 [CRITICAL] CVE-2020-27068: Product: AndroidVersions: Android kernelAndroid ID: A-127973231References: Upstream kernel Product: AndroidVersions: Android kernelAndroid ID: A-127973231References: Upstream kernel

CVE-2026-43099 [HIGH] CWE-476 CVE-2026-43099: In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: fix null-ptr-deref In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: fix null-ptr-deref in icmp_build_probe() ipv6_stub->ipv6_dev_find() may return ERR_PTR(-EAFNOSUPPORT) when the IPv6 stack is not active (CONFIG_IPV6=m and not loaded), and passing this error pointer to dev_hold() will cause a kernel crash with null-ptr-deref. Instead, sil

CVE-2026-23451 [HIGH] CWE-835 CVE-2026-23451: In the Linux kernel, the following vulnerability has been resolved: bonding: prevent potential infi In the Linux kernel, the following vulnerability has been resolved: bonding: prevent potential infinite loop in bond_header_parse() bond_header_parse() can loop if a stack of two bonding devices is setup, because skb->dev always points to the hierarchy top. Add new "const struct net_device *dev" parameter to (struct header_ops)->parse() method to ma

CVE-2026-43336 [HIGH] CVE-2026-43336: In the Linux kernel, the following vulnerability has been resolved: lib/crypto: chacha: Zeroize per In the Linux kernel, the following vulnerability has been resolved: lib/crypto: chacha: Zeroize permuted_state before it leaves scope Since the ChaCha permutation is invertible, the local variable 'permuted_state' is sufficient to compute the original 'state', and thus the key, even after the permutation has been done. While the kernel is quite inconsistent

CVE-2023-32820 [HIGH] CWE-617 CVE-2023-32820: In wlan firmware, there is a possible firmware assertion due to improper input handling. This could In wlan firmware, there is a possible firmware assertion due to improper input handling. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07932637; Issue ID: ALPS07932637.

CVE-2026-46304 [HIGH] CVE-2026-46304: In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid recursive nvmet-wq In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free nvmet_tcp_release_queue_work() runs on nvmet-wq and can drop the final controller reference through nvmet_cq_put(). If that triggers nvmet_ctrl_free(), the teardown path flushes ctrl->async_event_work on the same nvmet-wq. Call chain:

CVE-2026-43345 [HIGH] CVE-2026-43345: In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix event ring index In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix event ring index not programmed for IPA v5.0+ For IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to CH_C_CNTXT_1. The v5.0 register definition intended to define this field in the CH_C_CNTXT_1 fmask array but used the old identifier of ERINDEX instead of CH_ERINDE

CVE-2026-53070 [HIGH] CVE-2026-53070: In the Linux kernel, the following vulnerability has been resolved: sctp: disable BH before calling In the Linux kernel, the following vulnerability has been resolved: sctp: disable BH before calling udp_tunnel_xmit_skb() udp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with BH disabled. After commit 6f1a9140ecda ("add xmit recursion limit to tunnel xmit functions"), on the path: udp(6)_tunnel_xmit_skb() -> ip(6)tunnel_xmit() dev_xmit_r

CVE-2026-31719 [HIGH] CVE-2026-31719: In the Linux kernel, the following vulnerability has been resolved: crypto: krb5enc - fix async dec In the Linux kernel, the following vulnerability has been resolved: crypto: krb5enc - fix async decrypt skipping hash verification krb5enc_dispatch_decrypt() sets req->base.complete as the skcipher callback, which is the caller's own completion handler. When the skcipher completes asynchronously, this signals "done" to the caller without executing krb5enc_di

CVE-2026-23364 [HIGH] CVE-2026-23364: In the Linux kernel, the following vulnerability has been resolved: ksmbd: Compare MACs in constant In the Linux kernel, the following vulnerability has been resolved: ksmbd: Compare MACs in constant time To prevent timing attacks, MAC comparisons need to be constant-time. Replace the memcmp() with the correct function, crypto_memneq().

CVE-2010-4165 [MEDIUM] CWE-369 CVE-2010-4165: The do_tcp_setsockopt function in net/ipv4/tcp.c in the Linux kernel before 2.6.37-rc2 does not prop The do_tcp_setsockopt function in net/ipv4/tcp.c in the Linux kernel before 2.6.37-rc2 does not properly restrict TCP_MAXSEG (aka MSS) values, which allows local users to cause a denial of service (OOPS) via a setsockopt call that specifies a small value, leading to a divide-by-zero error or incorrect use of a signed integer.