Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 3.9. It arises because when a datagram socket is closed, the vmcitransportrecvdgramcb function adds packets to the socket’s backlog. After the receive queue becomes empty, the releasesock function moves those packets back into the receive...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.9. It arises when IPv4 FIB dumps are concurrently executed alongside nexthop replacement; no check is performed to verify whether an index path exists. As a result, fibinfonhc may return NULL and be dereferenced via nhcflags, leading to a...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 2.6.13. It stems from emtextchange failing to verify whether the algo array ends with NUL before passing it to textsearchprepare, potentially leading to out-of-bounds reads and kernel memory leaks...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions from 5.10.42 up to 5.11, from 5.12.9 up to 5.13, and specifically in version 5.13. This vulnerability stems from improper handling in chcrktlsdevdel and chcrktlsdevadd; when using xaerase to remove entries in tidlist, soft interrupts are no...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.10. It arises when, during cleanup by ebrelocateparseslow, a post-increment buffercount is used to release relocation pointers within the exec array; this may lead to out-of-bounds access and the deallocation of entries outside the origina...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.17. It stems from xei2cremove failing to cancel the i2c-work work item; after adapter deregistration, it still accesses the freed adapter and invokes callbacks, potentially leading to use-after-free conditions...

Red Hat: CVE-2026-98871: kernel: crypto: ccp - Fix possible deadlock in SEV init failure path

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix possible deadlock in SEV init failure path sevplatforminithandleinitexpath calls rmpmarkpagesfirmware with locked=false while the parent function of initexpath already acquired the sevcmdmutex. In the case of an...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions from 4.1.40 up to 4.2, from 4.4.54 up to 4.5, from 4.9.15 up to 4.10, from 4.10.3 up to 4.11, and in version 4.11. This vulnerability arises because the Linux kernel’s namespace fails to check reference counts prior to unmounting child moun...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.10. It stems from the recursive cleanup of the STAREXCL port group within the brmulticastsgdelexcludeports function in network bridging. This results in a large number of STAREXCL ports, each consuming one kernel stack frame; this may lead...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.15. It stems from the adjustidledly function within the drm/xe drivers, which fails to handle division by zero when timestampbase is set to 0. Additionally, there are a u32 overflow and a loop that decrements maxcnt during the...

PT-2026-121862

In the Linux kernel, the following vulnerability has been resolved: firmware: arm scmi: Validate BASE ERROR EVENT payload size BASE ERROR EVENT carries a variable number of message reports, with the count encoded in error status. The notification parser used that count without checking whether th...

PT-2026-121870

In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntalloc ioctl alloc allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 5.15.222, 6.1.189, 6.6.158, 6.12.111, and 6.18.53. This vulnerability arises when the maxsegs value provided by the host driver is excessively large and then truncated to zero; as a result, mmcallocsg attempts to allocate memory of...

PT-2026-121847

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed When accidentally setting “kvm-arm.vgic v4 enable=1” on a system that has no MSI controller device tree node and GICv4, it results a panic as “gic domain” is NULL and the...

Red Hat: CVE-2026-98872: kernel: freevxfs: don't BUG() on unknown typed-extent type

In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG on unknown typed-extent type vxfsbmaptyped handles four typed-extent types and calls BUG in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from...

PT-2026-121859

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwl mvm scan fits, so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwl mvm build scan probe aft...

PT-2026-121893

In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl do mkdir debug print ovl do mkdir prints the input dentry with %pd after vfs mkdir. Since commit fe497f0759e0 "VFS: change vfs mkdir to unlock on failure.", vfs mkdir calls end creating on the input dentry on...

PT-2026-121851

In the Linux kernel, the following vulnerability has been resolved: net: bridge: remove stale rcu barrier in br multicast dev del This rcu barrier came from a time call rcu calls were used in net/bridge/br multicast.c. Now kfree rcu is there, we can remove this problematic rcu barrier which cause...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.11. It stems from improper lifecycle management of the nestedmmus array in KVM arm64 nv; after relocation during VCPUINIT, pointers to the now-freed structure are still used, potentially leading to use-after-free conditions...

PT-2026-121843

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack expect: zero at allocation time There are occasional LLM hints wrt. leaking uninitialized data to userspace via ctnetlink. Just zero at allocation time, expectations are not frequently used these days...