Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 4.15. It arises when ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and referenced as UDP packets; only after matching an existing socket does an exception occur. This allows path traversal attackers to perform...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.14; it stems from the failure to release allocated arrays when clearing the DAO input mapper, resulting in a memory leak...

PT-2026-122055

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AF XDP on a striding RQ, mlx5e defers releasing XSK buffers until an MPWQE is refilled. If XSK allocation then returns -ENOMEM, actual wq head is not advanced...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.12.111 and prior to 6.18.53. This vulnerability arises because the net/mlx5 HWS fails to remove a table from the misstbl list when terminating a table with a miss table, potentially resulting in nodes within the misstbl list...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111, and 6.18.53. This vulnerability arises because gntallocioctlalloc fails to verify whether the number of grants requested by a user exceeds the global limit prior to allocation; this m...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.12.111 and prior to 6.18.53. This vulnerability stems from a race condition between channel closure and interrupt handling in the imx mailbox driver, resulting in RX events being enabled after channel closure. This may cause shar...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.12.111 and prior to 6.18.53. This vulnerability stems from a lack of range checks when invalid data is included in decoutputinfo; it may lead to buffer overflows and write operations to invalid memory...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 4.4. It stems from the bnxten driver failing to adjust the length of the DMA mapping after filling packets in bnxtstartxmit; this allows hardware DMA reads to exceed the mapped buffer boundaries, potentially leading to IOMMU failures and...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 4.16. It stems from outdated ERSPAN PMTU updates in ip6erspantunnelxmit, which treat metadata dst as a route. This results in a null pointer dereference, potentially leading to a kernel crash...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.18.53. This vulnerability arises because ksmbd holds a read lock on ci-mlock while waiting for confirmation that a lease has been terminated; this results in a write lock on the shutdown path becoming blocked. As a result, the...

PT-2026-121926

In the Linux kernel, the following vulnerability has been resolved: net: always dissect GSO packets in virtio net hdr to skb Commit 9e8db5913264 "net: avoid false positives in untrusted gso validation" added a '&& skb-network header' check before flow-dissecting GSO packets without VIRTIO NET HDR...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.18.53. This vulnerability stems from the amdgpu driver failing to limit the nesting depth of ATOM command tables, potentially leading to a kernel crash...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111, and 6.18.53. This vulnerability stems from an unremoved call to rcubarrier within brmulticastdevdel in net/bridge/brmulticast.c after switching to kfreercu. This results in severe RTN...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.6.158 and prior to 6.18.53. This vulnerability stems from the absence of an SEC2 entry in the GA100 chip table. As a result, when the booter constructor in tu102gsponeinit accesses SEC2 falcon, device-sec2 becomes a null pointer...

Red Hat: CVE-2026-98874: kernel: wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect Clearly, from a user perspective, it must be valid to configure WoWLAN and then suspend while not connected to a network. Since mac80211 doesn't distinguish these cas...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111, and 6.18.53. This vulnerability stems from a BUG in the vxfsbmaptyped function within the freevxfs file system, which calls an unknown typed-extent type. It can be triggered via...

Linux kernel security vulnerabilities

A security vulnerability exists in the Linux kernel. It stems from KVM x86’s per-vCPU MMIO cache failing to utilize active memslots; as a result, after an update to the SMM address space, old cache entries may remain valid. Consequently, clients can return access to valid RAM via KVMEXITMMIO,...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.0. It stems from the fact that the isosockconnect function in Bluetooth ISO fails to serialize concurrent connect calls. As a result, multiple callers can pass through admission checks and replace socket connections simultaneously, leading...

Linux kernel security vulnerabilities

A security vulnerability exists in the Linux kernel. It stems from dm-crypt failing to reject entries in the “capi:” table where AEAD passwords are paired with the lmk IV mode e.g., capi:gcmaes-lmk with integrity:28:aead. Additionally, lmk sets tfmscount to 64, while cryptalloctfmsaead allocates...

PT-2026-121845

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null pointer dereference occurs during GSP-RM boot in the nouveau driver. The booter-load and booter-unload firmware operate on the SEC2 falcon, and the tu102 gsp oneinit function...