USN-8924-1: Linux kernel vulnerabilities

It was discovered that the timer stats implementation in the Linux kernel allowed the discovery of a real PID value while inside a PID namespace. A local attacker could use this to expose sensitive information. CVE-2017-5967 Wen Xu discovered that the XFS file system implementation in the Linux...

USN-8924-1 linux vulnerabilities

It was discovered that the timer stats implementation in the Linux kernel allowed the discovery of a real PID value while inside a PID namespace. A local attacker could use this to expose sensitive information. CVE-2017-5967 Wen Xu discovered that the XFS file system implementation in the Linux...

CVE-2026-46300

CVE-KERNEL · Linux Kernel LPE Chain Multi-CVE Local Privilege Escalation chain for Linux kernel vulnerabilities uid=1000 → root via xfrm-ESP, RxRPC, or Fragnesia page-cache write Overview CVE-KERNEL is a Python-based Local Privilege Escalation LPE tool that chains multiple Linux kernel CVEs to...

CVE-2026-90261

A flaw was found in the btrfs zoned filesystem component of the Linux kernel. During metadata-heavy operations, a specific writeback scenario can prevent the system from properly managing active block groups. This issue can lead to a transaction abortion, forcing the filesystem into a read-only...

CVE-2026-90262

A flaw was found in the Linux kernel's btrfs filesystem. This flaw occurs when the btrfsreadmerkletreepage function encounters a Merkle folio that is not up-to-date. Instead of retrying the read, the system incorrectly treats this as a permanent error, causing transient read failures to become...

CVE-2026-90250

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter cgroup storage mechanism. When replacing an existing BPF program with a new one that uses BPFMAPTYPEPERCPUCGROUPSTORAGE, the system may fail to properly allocate and assign the necessary cgroup storage. This oversight can lead to a...

CVE-2026-90242

A flaw was found in the Linux kernel's iommu/vt-d subsystem. When an IOMMU Input/Output Memory Management Unit domain with an iopfhandler is replaced by another domain at the Requestor ID RID level, a reference count for the old domain is not properly released. This resource leak prevents the...

CVE-2026-90238

A flaw was found in the Linux kernel's AMD ISP4 media driver. During the initialization process, a self-deadlock can occur if the isp4sdpwronandinit function attempts to re-acquire a mutex it already holds. This issue can lead to a system deadlock, resulting in a Denial of Service DoS for the...

CVE-2026-90260

A flaw was found in the Linux kernel's Btrfs zoned filesystem. When a freed-but-still-dirty tree block is written out as zeros, the btreecsumonebio function improperly clears the extent buffer's in-memory content. This can lead to corruption of the extent tree, potentially causing system...

CVE-2026-90258

A flaw was found in the pinctrl: airoha component of the Linux kernel. Without properly handling IRQ Interrupt Request resource helpers, the gpiolib General Purpose Input/Output library fails to set a flag indicating an IRQ pin is in use. This oversight can allow an unprivileged user or another...

CVE-2026-90256

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. A use-after-free UAF vulnerability can occur when hciconn::l2capdata is accessed without proper locking during the disconnection indication process. This can lead to a system crash or...

CVE-2026-90251

A flaw was found in the Linux kernel's Bluetooth Microsoft MSFT driver. This vulnerability arises from insufficient validation of the evtprefixlen field against the actual response length during the readsupportedfeatures operation. A malicious Bluetooth controller could exploit this by sending a...

CVE-2026-90249

A flaw was found in the Linux kernel's Industrial I/O IIO core, specifically within the gp2ap002 light sensor driver. A local attacker with appropriate permissions could exploit this by repeatedly writing the same value to the event enable attribute. This can lead to an unbalanced runtime Power...

CVE-2026-90248

A flaw was found in the Linux kernel's network scheduler component net/sched: clsapi. A race condition exists in the tcnewtfilter function during the insertion of a new protocol. If a process loses a race to insert a protocol, its error handling path may incorrectly remove an active network...

CVE-2026-90247

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF component. This vulnerability allows for a memory map mmap lock to be leaked when handling interrupt work, specifically within the stackmapgetbuildidoffset and bpffindvma functions. This can lead to a situation where two read locks...

CVE-2026-90246

A flaw was found in AppArmor within the Linux kernel. An unprivileged user can exploit an integer overflow vulnerability in the verifytags function by crafting a malicious AppArmor policy. This flaw allows an attacker to trigger an out-of-bounds read during policy loading, which could lead to...

CVE-2026-90245

A flaw was found in the Linux kernel's fbdev kyro driver. This vulnerability arises from the calculation of overlay viewport end coordinates using 32-bit unsigned arithmetic. Large input values can cause these calculations to wrap around, resulting in incorrect coordinates being passed to the...

CVE-2026-90244

A flaw was found in the Linux kernel. Specifically, within the iommu/dma component, a lack of proper locking in the VFIO type1 legacy container could allow concurrent access to the msipagelist. This concurrent access can lead to data corruption of the msipagelist, potentially causing system...

CVE-2026-90243

A flaw was found in the Linux kernel's IOMMU/VT-d subsystem. During the tear-down of copied context entries, the kernel zeroes out parts of an entry before clearing its "Present" bit and invalidating related caches. This timing issue allows hardware to fetch a partially cleared entry that is stil...

CVE-2026-90237

A flaw was found in the Linux kernel's netfilter connection tracking nfct component. This vulnerability arises from the incorrect handling of connection tracking expectations, where early insertion of expectations into the list can lead to stale entries. These stale entries point to incorrect...