kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5

A flaw was found in the Linux kernel's handling of IPv4 raw sockets. An unprivileged attacker with CAPNETRAW capabilities can craft and inject a malformed IPv4 packet with an invalid Internet Header Length IHL. This can lead to an out-of-bounds memory access when the packet is processed by certai...

kernel: ALSA: seq: close a re-opened queue timer in the destructor

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture sequencer component. An unprivileged local user with access to the sound device can exploit a timing window during the cleanup of a queue timer. This allows the user to re-open a timer that has already been closed,...

kernel: drm/amd/display: set new_stream to NULL after release

A flaw was found in the Linux kernel's drm/amd/display component. Specifically, within the dmupdatecrtcstate function, a stream pointer is released but not subsequently set to NULL. This can lead to a double release of the same pointer if an error occurs later in the process, creating a...

kernel: ovl: check access to copy_file_range source with src mounter creds

A flaw was found in the Linux kernel's overlayfs component. When copying files across different overlay filesystems, the system incorrectly checked read permissions using the destination filesystem's credentials instead of the source's. This oversight could allow an unauthorized user to read file...

kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension

A flaw was found in the Linux kernel's drm/amdkfd component. This vulnerability arises from a race condition where the Micro Engine Scheduler MES fails to perform a necessary Translation Lookaside Buffer TLB invalidation after unmapping queues. This oversight allows in-flight Direct Memory Access...

kernel: perf: Fix addr_filter_ranges lifetime

A flaw was found in the Linux kernel's performance events perf subsystem. This vulnerability occurs because memory allocated for event address filters is released prematurely while still in active use by other kernel processes. A local user could exploit this use-after-free flaw during performanc...

kernel: calipso: Don't call calipso functions for AF_INET sk.

In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso functions for AFINET sk. syzkaller reported a null-ptr-deref in txoptget. 0 The offset 0x70 was of struct ipv6txoptions in struct ipv6pinfo, so struct ipv6pinfo was NULL there. However, this never...

kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()

A flaw was found in the drm/amdgpu component of the Linux kernel. A use-after-unlock vulnerability exists where a virtual machine VM pointer is dereferenced after its protective lock has been released. This allows the pointer to be modified, potentially leading to memory corruption. An attacker...

kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation

A flaw was found in the Linux kernel's DisplayPort DP Multi-Stream Transport MST subsystem. This vulnerability involves multiple buffer overflows within the drmdpsidebandappendpayload function when handling data from connected devices. A physically connected, malicious DP MST device can exploit...

kernel: inet: frags: strip GSO state from fragments before reassembly

A flaw was found in the Linux kernel's network fragment reassembly process. An unprivileged local user, or a guest in a virtualized environment, could craft specially formed IPv4 or IPv6 network fragments that incorrectly retain Generic Segmentation Offload GSO state after reassembly. This...

kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS

A flaw was found in the Linux kernel's AMD GPU amdgpu driver. The driver fails to validate the size of Video BIOS VBIOS tables, allowing the calculated entry count to exceed the bounds of an internal array. A local attacker or compromised firmware image could exploit this flaw to trigger an...

kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound

A flaw was found in the drm/vmwgfx component of the Linux kernel. An integer overflow vulnerability exists in the vmwshaderdefine function due to improper validation of user-supplied shader window size and offset. When the offset value is close to its maximum, an unsigned addition can wrap around...

kernel: perf: Fix use-after-free when perf mmap() revival races with the last munmap()

A flaw was found in the Linux kernel's perf subsystem. A race condition exists between the perf mmap revival and the last munmap operation. This allows a local unprivileged user to exploit a use-after-free vulnerability, leading to local privilege escalation to root...

kernel: ALSA: hda/cs35l41: Fix firmware load work teardown

A flaw was found in the Linux kernel's ALSA sound driver for the cs35l41 component. This vulnerability occurs because the driver fails to properly remove controls and cancel firmware load work during component unbinding or device removal, especially when firmware autostart is disabled. This can...

kernel: xfs: bounds-check buffer log item's dirty bitmap

A flaw was found in the Linux kernel's XFS filesystem. A local attacker, by mounting a specially crafted XFS image, could trigger an out-of-bounds write during log recovery. This vulnerability allows for kernel heap corruption, which could lead to a denial of service or potentially arbitrary code...

CVE-2020-1206-POC

CVE-2020-1206 Uninitialized Kernel Memory Read POC c 2020 ZecOps, Inc. - https://www.zecops.com - Find Attackers' Mistakes POC to check for CVE-2020-1206 / "SMBleed" Expected outcome: Local file containing target computer kernel memory. Intended only for educational and testing in corporate...

CVE-2026-98728

A flaw was found in the Linux kernel's Trusted Platform Module TPM driver. This flaw can lead to information disclosure when the kernel requests random data. Due to an incorrect bounds check when processing session-tagged responses, a truncated response can pass validation and cause the kernel to...

CVE-2026-98726

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express multipath subsystem. A malicious NVMe device can provide crafted Asymmetric Namespace Access ANA log data that triggers an integer underflow during buffer bounds validation. This failure leads to an out-of-bounds memory read,...

CVE-2026-98730

A flaw was found in the Linux kernel's Intel Bluetooth PCIe driver. A local user with access to the Bluetooth Host Controller Interface HCI user channel can inject an oversized transmission packet. Because the driver fails to validate packet length before copying data into a fixed-size memory...

CVE-2026-98727

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express multipath subsystem. The multipath driver inappropriately marks a storage device as supporting zoned storage before confirming its zone configuration. When a device reports a zone size of zero, subsequent read or write...