Linux-4.19.72_CVE-2020-24490

Linux kernel There are several guides for kernel developers and users. These guides can be rendered in a number of formats, like HTML and PDF. Please read Documentation/admin-guide/README.rst first. In order to build the documentation, use make htmldocs or make pdfdocs. The formatted documentatio...

kernel: smb: client: reject a tree connect response whose byte count is too small

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an integer underflow, causing the client to read beyond an allocated...

kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done

A flaw was found in the Linux kernel. A remote attacker could exploit a use-after-free vulnerability in the Transparent Inter-Process Communication TIPC cryptographic decryption process. This flaw occurs when a network namespace, a mechanism for isolating network resources, is deallocated before ...

kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()

A flaw was found in the Linux kernel's Server Message Block SMB client. The coalescet2 function processes server-supplied DataOffset fields without proper validation against buffer boundaries. A remote attacker could exploit this by crafting malicious SMB responses. This could lead to out-of-boun...

kernel: signal: Prevent exec() race

A flaw was found in the Linux kernel's signal handling subsystem. A race condition occurs during process execution when managing pending timer signals, allowing the system to reference memory after it has been released. A local attacker could exploit this use-after-free flaw to achieve privilege...

kernel: sctp: fix race between sctp_wait_for_connect and peeloff

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A race condition exists in the sctpwaitforconnect function, where a socket lock is temporarily released and re-acquired. During this brief period, another process can move the SCTP association to a...

kernel: openvswitch: defer tunnel netdev_put to RCU release

A flaw was found in the Linux kernel's Open vSwitch OVS component. A race condition can occur during the destruction of a network device netdev tunnel, where the ovsnetdevtunneldestroy function may attempt to release a device reference while other parts of the system are still actively using it...

kernel: sctp: validate stream count in sctp_process_strreset_inreq()

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. When processing a Stream Reset Incoming Request RESETINREQUEST from a peer, the kernel does not properly validate the stream count. This can lead to an integer overflow when calculating the size for t...

kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()

A flaw was found in the Linux kernel's USB Type-C Port Manager TCPM driver. A remote attacker, acting as a malicious USB-C port partner, could exploit an out-of-bounds write vulnerability in the svdmconsumemodes function. By sending an unsolicited 'Discover Modes ACK' with excessive data, the...

kernel: exec: Cleanup POSIX timers right after de_thread()

A flaw was found in the Linux kernel. When a multi-threaded program sets up a per-thread timer and executes a new program that subsequently fails during startup, the kernel can free timer memory while it remains referenced in an active queue. A local user could exploit this vulnerability to trigg...

CVE-2026-98535

A flaw was found in the Linux kernel's Freescale Frame Manager fman network driver. During device initialization, the driver retrieves a system clock resource to check its frequency but fails to release the reference count after reading the value. This omission results in a resource leak,...

CVE-2026-98537

A flaw was found in the Linux kernel's workqueue subsystem. A local attacker can cause a Denial of Service DoS by inducing memory pressure that triggers an out-of-memory notification. During subsequent dependency checks, a worker thread not actively running a task dereferences a null pointer,...

CVE-2026-98536

A flaw was found in the Linux kernel's writeback subsystem. This vulnerability can lead to a Denial of Service DoS when the routine responsible for cleaning up offline control group writeback structures fails to report a quiescent state during extended cleanup passes under certain preemption...

CVE-2026-98468

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem for ARM64. This flaw may allow a local user to cause a Denial of Service DoS or kernel instability. A race condition occurs when virtual machine stage 2 memory tables are freed concurrently with host memory migratio...

CVE-2026-98533

A flaw was found in the Linux kernel's Integrity Policy Enforcement IPE subsystem. When dm-verity updates a root hash, the old hash can be freed while concurrent policy evaluation operations are still accessing it. A local attacker could exploit this use-after-free condition to trigger a Denial o...

CVE-2026-98534

A flaw was found in the Linux kernel's Integrity Policy Enforcement IPE subsystem. A local attacker can cause a denial of service DoS or potentially execute arbitrary code by triggering a race condition during policy management. This issue occurs when a newly loaded policy is audited after intern...

security-research

Security Research Proof-of-concept code for disclosed Linux kernel vulnerabilities. CVE| Source| Writeup ---|---|--- CVE-2026-64564| pocubuntu.c| SCTPhantom CVE-2026-74580| poc.c| Vghost CVE-2026-80530| poc.c| TBD...

CVE-2026-98467

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem for ARM64 architecture. A race condition during the teardown of nested virtual machine memory mappings can cause the kernel to dereference a null pointer. A local user or nested guest can trigger concurrent memory...

CVE-2026-98532

A flaw was found in the Linux kernel. A remote attacker could cause a Denial of Service DoS or memory corruption by sending specially crafted IPv6 network packets. The IPv6 extension header parsing mechanism fails to verify that the declared length of a header fits within the received packet data...

CVE-2026-98531

A flaw was found in the Linux kernel's IPv6 Segment Routing SRv6 component. This flaw allows a local user to cause an information disclosure. By sending a crafted Generic Netlink message with an attribute shorter than expected, the system performs an out-of-bounds read into uninitialized kernel...