Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 3.18. It arises from the failure to hash dentrys prior to their detachment, resulting in a race condition between detachmounts and ddelete. This may expose the contents of hidden files mounted on the system...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 3.12. It stems from improper handling of expired locks in namespaces, potentially exposing files and directories whose underlying structure has been overwritten...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.15. It arises because mntnstreeremove releases references to the mount namespace via callrcu, causing fsnotify tags to be removed within the context of a RCU soft interrupt. This, in turn, may trigger calls to functions that sleep under...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.12. It arises because, after checking the number of paths in fibnlmsgsize, fibinfonhc fails to handle the case where RTMNEWNEXTHOP reduces the path count; this results in a NULL return value, potentially leading to null pointer dereferenci...

PT-2026-122059

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use active memslots for the per-vCPU MMIO cache KVM tags the per-vCPU MMIO cache with a memslot generation so that a memslot update invalidates cached MMIO information. Both the fill and validation paths use kvm memslot...

Linux kernel security vulnerabilities

A security vulnerability exists in the Linux kernel; it arises when reading the write-only HRST and CLIRQ registers triggers a command, causing a dump of regular registers to result in a reset of the development board...

PT-2026-121922

In the Linux kernel, the following vulnerability has been resolved: flow dissector: avoid u16 truncation of hlen in bpf flow dissect bpf flow dissect sanitizes the offsets returned by the BPF program with clamp tu16, ..., hlen. If hlen is bigger than 65535, the upper bound is truncated before the...

PT-2026-122050

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de "inet: switch inet dump fib to RCU protection" allowed IPv4 FIB dumps to run concurrently with nexthop replacement. fib dump info fnhe uses fib info num pat...

PT-2026-122057

In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clear inode For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c. Recently people and syzbot have found ways to force it to happen with...

PT-2026-121917

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the HID steam component during the teardown sequence. A narrow timing window allows callbacks to be scheduled during cleanup, resulting in a dangling pointer to the free...

PT-2026-122048

In the Linux kernel, the following vulnerability has been resolved: ipv4: do not warn on route notification size race Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added asynchronous route notifications for hardware flag changes. fib alias hw flags set siz...

PT-2026-121906

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skb get hash net in seg6 make flowlabel Since commit d58e468b1112 "flow dissector: implements flow dissector BPF hook" skb flow dissect needs a net pointer, either from skb-dev, skb-sk, or since commit 3cbf4ffba5ee...

PT-2026-122026

In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: fix runtime PM leak on request error path pm runtime get sync leaves the usage counter incremented even when it fails, and xgpio request returns the error without dropping it. gpiolib does not call -free when -reque...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions from 4.1.40 up to 4.2, from 4.4.54 up to 4.5, from 4.9.15 up to 4.10, from 4.10.3 up to 4.11, and in version 4.11. This vulnerability arises because the Linux kernel’s namespace fails to check reference counts prior to unmounting child moun...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.16. It stems from the ice driver’s use of metadatadstfree to release metadatadst when removing a representer; no checks are performed on the dstentry reference count. This may lead to use-after-free conditions if packets remain queued on...

PT-2026-121945

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the AMT Automatic Multicast Tunneling module. An socket buffer skb queued in a queuing discipline qdisc can outlive the tunnel it references via a raw...

PT-2026-121947

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4 bo cache destroy purges the cached BOs but never frees the size list, leaking it on every unbind...

PT-2026-121980

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthor drv.c:panthor ioctl group create, the queue count is validated against the hardcoded maximum: if !args-queues.count || args-queues.cou...

PT-2026-121989

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Serialize concurrent connect calls iso sock connect checks the socket state before taking the socket lock and drops the lock again before setting up a connection. Two callers can both pass the admission check whil...

PT-2026-122008

In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup br multicast sg del exclude ports removes automatically added STAR EXCL port groups by calling br multicast del pg. For S,G entries, that deletion calls back into br multicast s...