Sat, Jan 11 · 01:15 PM CSTCVE-2024-47408
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: net/smc: check smcd_v2_ext_offset when receiving proposal msg When receiving proposal msg in server, the field smcd_v2_ext_offset in proposal msg is from the remote client and can not be fully trusted. Once the value of smcd_v2_ext_offset exceed the ma
CVECVE-2024-47408
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jan 11 · 01:15 PM CST
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2024-49568
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg When receiving proposal msg in server, the fields v2_ext_offset/ eid_cnt/ism_gid_cnt in proposal msg are from the remote client and can not be fully trusted. Especially the fi
CVECVE-2024-49568
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jan 11 · 01:15 PM CST
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2025-40074
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv4: start using dst_dev_rcu() Change icmpv4_xrlim_allow(), ip_defrag() to prevent possible UAF. Change ipmr_prepare_xmit(), ipmr_queue_fwd_xmit(), ip_mr_output(), ipv4_neigh_lookup() to use lockdep enabled dst_dev_rcu().
CVECVE-2025-40074
SeverityCRITICAL
TypeUPDATED
PublishedTue, Oct 28 · 12:15 PM CDT
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2026-68161
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown proc_sctp_do_udp_port() starts per-net SCTP UDP tunneling sockets when net.sctp.udp_port is set, and stops/restarts them when the sysctl value changes. The netns exit path does not stop these sockets
CVECVE-2026-68161
SeverityCRITICAL
TypeUPDATED
PublishedMon, Aug 10 · 01:20 PM CDT
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2026-72463
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb->dev refcnt until after transport_finish. However, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking device reference, such as vti_rcv_cb. The subsequent as
CVECVE-2026-72463
SeverityCRITICAL
TypeUPDATED
PublishedSat, Aug 15 · 06:22 AM CDT
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2026-74743
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit needed_headroom and needed_tailroom from lowerdev macvlan devices inherit hard_header_len from lowerdev during macvlan_init(), but leave needed_headroom and needed_tailroom set to 0. When the underlying lowerdev requires extra headroom
CVECVE-2026-74743
SeverityCRITICAL
TypeUPDATED
PublishedWed, Aug 26 · 03:16 PM CDT
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2026-80926
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in oplock break notification smb2_oplock_break_noti() reads opinfo->conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning the oplock is disconnected, session_fd_check()
CVECVE-2026-80926
SeverityCRITICAL
TypeUPDATED
PublishedFri, Sep 11 · 08:18 PM CDT
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2026-80980
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and out_of_sync sharing a byte The three connection state flags are single-bit bitfields, so they occupy one byte of struct smc_connection and every store to one is a read-modify-write of the other two: u8 killed : 1; u8 fre
CVECVE-2026-80980
SeverityCRITICAL
TypeUPDATED
PublishedFri, Sep 11 · 08:19 PM CDT
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2026-89972
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: nvme: add missing SRCU grace period in error path nvme_alloc_ns() error path at out_unlink_ns removes ns from the namespace head siblings list with list_del_rcu(&ns->siblings) but does not wait for SRCU readers before freeing the namespace struct. Mult
CVECVE-2026-89972
SeverityCRITICAL
TypeUPDATED
PublishedWed, Sep 16 · 11:17 AM CDT
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2026-80726
9.3/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page Explicitly clear role.invalid when deriving a child shadow page's role from its parent to harden against bugs elsewhere in KVM, as violating KVM's invariant that invalid pages
CVECVE-2026-80726
SeverityCRITICAL
TypeUPDATED
PublishedThu, Sep 03 · 01:06 PM CDT
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2026-72496
9.2/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Proper rollback if the ioremap fails bnxt_qplib_alloc_dpi returns success even if ioremap fails. Add the proper rollback when the ioremap fails and return -ENOMEM status.
CVECVE-2026-72496
SeverityCRITICAL
TypeUPDATED
PublishedSat, Aug 15 · 06:22 AM CDT
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2026-74521
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp() to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp() stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equal. Use memcmp() in
CVECVE-2026-74521
SeverityCRITICAL
TypeUPDATED
PublishedSat, Aug 15 · 01:17 PM CDT
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2023-53762
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync Use-after-free can occur in hci_disconnect_all_sync if a connection is deleted by concurrent processing of a controller event. To prevent this the code now tries to iterate over the list backwards
CVECVE-2023-53762
SeverityHIGH
TypeUPDATED
PublishedMon, Dec 08 · 02:15 AM CST
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2024-41062
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: bluetooth/l2cap: sync sock recv cb and release The problem occurs between the system call to close the sock and hci_rx_work, where the former releases the sock and the latter accesses it without lock protection. CPU0 CPU1 ---- ---- sock_close hci_rx_wo
CVECVE-2024-41062
SeverityHIGH
TypeUPDATED
PublishedMon, Jul 29 · 03:15 PM CDT
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2025-68736
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: landlock: Fix handling of disconnected directories Disconnected files or directories can appear when they are visible and opened from a bind mount, but have been renamed or moved from the source of the bind mount in a way that makes them inaccessible f
CVECVE-2025-68736
SeverityHIGH
TypeUPDATED
PublishedWed, Dec 24 · 01:16 PM CST
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2026-46113
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN The shadow MMU computes GFNs for direct shadow pages using sp->gfn plus the SPTE index. This assumption breaks for shadow paging if the guest page tables are modified between VM entries (
CVECVE-2026-46113
SeverityHIGH
TypeUPDATED
PublishedThu, May 28 · 10:16 AM CDT
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2026-53359
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by c
CVECVE-2026-53359
SeverityHIGH
TypeUPDATED
PublishedSat, Jul 04 · 12:17 PM CDT
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2026-68097
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ACE size against SID sub-authorities set_ntacl_dacl() validates sid.num_subauth before copying an ACE, but does not verify that the declared ACE size contains all sub-authorities described by that field. An undersized ACE can therefore
CVECVE-2026-68097
SeverityHIGH
TypeUPDATED
PublishedMon, Aug 10 · 01:19 PM CDT
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2026-72334
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISO_END/CONT handling Core specification (Part C vol 4 sec 5.4.5) does not exclude empty ISO_CONT, ISO_END packets. We currently reject them if they are last. If controller sends malformed sequence ISO_START -> rx_len = 4,
CVECVE-2026-72334
SeverityHIGH
TypeUPDATED
PublishedSat, Aug 15 · 06:22 AM CDT
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2026-80935
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response (event->addr, a device-controlled __le32) and clamps onl
CVECVE-2026-80935
SeverityHIGH
TypeUPDATED
PublishedFri, Sep 11 · 08:18 PM CDT
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2026-80937
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915_mcu_get_eeprom() copies a fixed EFUSE block into the driver's dev->mt76.eeprom.data buffer at the offset reported by the MCU response (res->addr, a device-controlled __le3
CVECVE-2026-80937
SeverityHIGH
TypeUPDATED
PublishedFri, Sep 11 · 08:18 PM CDT
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2026-89445
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGER_IOPF borrows an attach handle from group->pasid_array without synchronizing against PASID detach, then a concurrent iommu_report_device_fault() can dereference that borrowed handle's
CVECVE-2026-89445
SeverityHIGH
TypeUPDATED
PublishedFri, Sep 11 · 08:19 PM CDT
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2023-52629
8.4/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: sh: push-switch: Reorder cleanup operations to avoid use-after-free bug The original code puts flush_work() before timer_shutdown_sync() in switch_drv_remove(). Although we use flush_work() to stop the worker, it could be rescheduled in switch_timer().
CVECVE-2023-52629
SeverityHIGH
TypeUPDATED
PublishedFri, Mar 29 · 10:15 AM CDT
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2023-53851
8.4/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: Drop aux devices together with DP controller Using devres to depopulate the aux bus made sure that upon a probe deferral the EDP panel device would be destroyed and recreated upon next attempt. But the struct device which the devres is tied
CVECVE-2023-53851
SeverityHIGH
TypeUPDATED
PublishedTue, Dec 09 · 04:17 PM CST
ModifiedSat, Oct 03 · 11:17 AM CDT
CVE-2026-89452
8.4/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/msm: Unwind probe state on registration failure msm_iommu_probe() adds its devm-managed IOMMU object to qcom_iommu_devices before adding the IOMMU sysfs device and registering it with the IOMMU core. If iommu_device_sysfs_add() fails, probe retur
CVECVE-2026-89452
SeverityHIGH
TypeUPDATED
PublishedFri, Sep 11 · 08:19 PM CDT
ModifiedSat, Oct 03 · 11:17 AM CDT
