Linux Kernel vulnerabilities

CVE-2016-8479 [HIGH] CWE-264 CVE-2016-8479: An elevation of privilege vulnerability in the Qualcomm GPU driver could enable a local malicious ap An elevation of privilege vulnerability in the Qualcomm GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android.

CVE-2022-29901 [MEDIUM] CVE-2022-29901: Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarch

CVE-2016-8431 [HIGH] CWE-264 CVE-2016-8431: An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious appl An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Ve

CVE-2016-8432 [HIGH] CWE-264 CVE-2016-8432: An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious appl An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Ve

CVE-2026-43452 [HIGH] CVE-2026-43452: In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: guard opti In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: guard option walkers against 1-byte tail reads When the last byte of options is a non-single-byte option kind, walkers that advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end of the option area. Add an explicit i == optlen - 1 check before dereferencing o

CVE-2026-46037 [HIGH] CVE-2026-46037: In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: validate reply type In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: validate reply type before using icmp_pointers Extended echo replies use ICMP_EXT_ECHOREPLY as the outbound reply type. That value is outside the range covered by icmp_pointers[], which only describes the traditional ICMP types up to NR_ICMP_TYPES. Avoid consulting icmp_pointers

CVE-2026-31631 [HIGH] CWE-787 CVE-2026-31631: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix buffer overread in r In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() Fix rxgk_do_verify_authenticator() to check the buffer size before checking the nonce.

CVE-2026-23459 [HIGH] CVE-2026-23459: In the Linux kernel, the following vulnerability has been resolved: ip_tunnel: adapt iptunnel_xmit_ In the Linux kernel, the following vulnerability has been resolved: ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS Blamed commits forgot that vxlan/geneve use udp_tunnel[6]_xmit_skb() which call iptunnel_xmit_stats(). iptunnel_xmit_stats() was assuming tunnels were only using NETDEV_PCPU_STAT_TSTATS. @syncp offset in pcpu_sw_netstats and

CVE-2022-2585 [HIGH] CWE-416 CVE-2022-2585: It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-after-free.

CVE-2019-16921 [HIGH] CWE-665 CVE-2019-16921: In the Linux kernel before 4.17, hns_roce_alloc_ucontext in drivers/infiniband/hw/hns/hns_roce_main. In the Linux kernel before 4.17, hns_roce_alloc_ucontext in drivers/infiniband/hw/hns/hns_roce_main.c does not initialize the resp data structure, which might allow attackers to obtain sensitive information from kernel stack memory, aka CID-df7e40425813.

CVE-2022-25265 [HIGH] CWE-913 CVE-2022-25265: In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they we In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 (e.g., with GCC 3.2.2 and Linux kernel 2.4.20). This can cause execution of bytes located in supposedly non-executable regions of a file.

CVE-2026-31771 [HIGH] CVE-2026-31771: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: move wake In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: move wake reason storage into validated event handlers hci_store_wake_reason() is called from hci_event_packet() immediately after stripping the HCI event header but before hci_event_func() enforces the per-event minimum payload length from hci_ev_table. This means a sh

CVE-2022-32981 [HIGH] CWE-120 CVE-2022-32981: An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a b An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers.

CVE-2017-1000365 [HIGH] CVE-2017-1000365: The Linux Kernel imposes a size restriction on the arguments and environmental strings passed throug The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIM_INFINITY (1/4 of the size), but does not take the argument and environment pointers into account, which allows attackers to bypass this limitation. This affects Linux Kernel versions 4.11.5 and earlier. It appears that this feature was i

CVE-2022-36123 [HIGH] CVE-2022-36123: The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss) The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This allows Xen PV guest OS users to cause a denial of service or gain privileges.

CVE-2026-31392 [HIGH] CVE-2026-31392: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix krb5 mount wit In the Linux kernel, the following vulnerability has been resolved: smb: client: fix krb5 mount with username option Customer reported that some of their krb5 mounts were failing against a single server as the client was trying to mount the shares with wrong credentials. It turned out the client was reusing SMB session from first mount to try mounting the ot

CVE-2019-5108 [MEDIUM] CWE-440 CVE-2019-5108: An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks,

CVE-2024-26882 [HIGH] CVE-2024-26882: In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: make sure to pu In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() Apply the same fix than ones found in : 8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()") 1ca1ba465e55 ("geneve: make sure to pull inner header in geneve_rx()") We have to save skb->network_heade

CVE-2024-26592 [HIGH] CWE-416 CVE-2024-26592: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF issue in ksmbd_t In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF issue in ksmbd_tcp_new_connection() The race is between the handling of a new TCP connection and its disconnection. It leads to UAF on `struct tcp_transport` in ksmbd_tcp_new_connection() function.

CVE-2021-33034 [HIGH] CWE-416 CVE-2021-33034: In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.