← Packages
linux-lts
The Linux lts Kernel
- Current
- 6.18.62
- Candidate
- Stale
- License
- GPL-2.0-only
Advisory · 138
Provider matches do not establish RPM applicability. Local patches, bundled dependencies and binary artifacts are not evaluated.
- Summary
- The ugidd RPC interface, by design, allows remote attackers to enumerate valid usernames by specifying arbitrary UIDs that ugidd maps to local user and group names.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 1.55%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V2
- AV:N/AC:L/Au:N/C:P/I:N/A:NNVD
- References
- Web · exchange.xforce.ibmcloud.com
- Summary
- cp, when running with an option to preserve symlinks on multiple OSes, allows local, user-assisted attackers to overwrite arbitrary files via a symlink attack using crafted directories containing multiple source files that are copied to the same destination.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.347%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V2
- AV:L/AC:M/Au:N/C:C/I:C/A:CNVD
- Summary
- The Linux kernel, when using IPv6, allows remote attackers to determine whether a host is sniffing the network by sending an ICMPv6 Echo Request to a multicast address and determining whether an Echo Reply is sent, as demonstrated by thcping.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 2.89%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V2
- AV:N/AC:L/Au:N/C:P/I:N/A:NNVD
- Summary
- In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux kernel 4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD processors but Intel CPUs cannot be ruled out.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.619%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.16, cpe:2.3:o:linux:linux_kernel:4.10:*:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V2
- AV:L/AC:M/Au:N/C:P/I:N/A:NNVD
- CVSS_V3
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NNVD
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NNVD
- Summary
- A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ("root") can cause a system lock up and a denial of service. Versions from v4.18 and newer are vulnerable.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.457%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.18NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V2
- AV:L/AC:L/Au:N/C:N/I:N/A:CNVD
- CVSS_V3
- CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:HNVD
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled. A guest could use this flaw to potentially crash the host kernel resulting in DoS issue. Kernel versions from 4.16 and newer are vulnerable to this issue.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.358%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.16NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V2
- AV:L/AC:M/Au:N/C:N/I:N/A:CNVD
- CVSS_V3
- CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:HNVD
- CVSS_V3
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:HNVD
- Summary
- A memory leak vulnerability was found in Linux kernel in llcp_sock_connectNVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 3.26%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V2
- AV:N/AC:L/Au:N/C:N/I:N/A:PNVD
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set extended attributes to panic the system, causing memory corruption or escalating privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.788%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; > 4.4.249, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.10, < 4.14.213, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.15, < 4.19.164, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.20, < 5.4.86, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.5, < 4.9.249, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.5, < 5.10.4NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V2
- AV:L/AC:L/Au:N/C:P/I:P/A:CNVD
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Summary
- There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config params CONFIG_BPF_SYSCALL=y , CONFIG_BPF=y , CONFIG_CGROUPS=y , CONFIG_CGROUP_BPF=y , CONFIG_HARDENED_USERCOPY not set, and BPF hook to getsockopt is registered). As result of BPF execution, the local user can trigger bug in __cgroup_bpf_run_filter_getsockopt() function that can lead to heap overflow (because of non-hardened usercopy). The impact of attack could be deny of service or possibly privileges escalation.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.4%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; > 5.2NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V2
- AV:L/AC:L/Au:N/C:P/I:P/A:PNVD
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Summary
- A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the system. This flaw affects all the Linux kernel versions starting from 3.13.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.485%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 3.13NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V2
- AV:L/AC:L/Au:N/C:N/I:N/A:PNVD
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.297%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.797%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.20NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:HNVD
- Summary
- A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local attacker to leak KASLR base via prefetch side-channels based on TLB timing for Intel systems.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.982%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: functionfs: fix the open/removal races ffs_epfile_open() can race with removal, ending up with file->private_data pointing to freed object. There is a total count of opened files on functionfs (both ep0 and dynamic ones) and when it hits zero, dynamic files get removed. Unfortunately, that removal can happen while another thread is in ffs_epfile_open(), but has not incremented the count yet. In that case open will succeed, leaving us with UAF on any subsequent read() or write(). The root cause is that ffs->opened is misused; a…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.132%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 2.6.35.1, < 6.19, cpe:2.3:o:linux:linux_kernel:2.6.35:-:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 564NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle attr_set_size() errors when truncating files If attr_set_size() fails while truncating down, the error is silently ignored and the inode may be left in an inconsistent state.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.261%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.15, < 6.19.6NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: ima: Fix stack-out-of-bounds in is_bprm_creds_for_exec() KASAN reported a stack-out-of-bounds access in ima_appraise_measurement from is_bprm_creds_for_exec: BUG: KASAN: stack-out-of-bounds in ima_appraise_measurement+0x12dc/0x16a0 Read of size 1 at addr ffffc9000160f940 by task sudo/550 The buggy address belongs to stack of task sudo/550 and is located at offset 24 in frame: ima_appraise_measurement+0x0/0x16a0 This frame has 2 objects: [48, 56) 'file' [80, 148) 'hash' This is caused by using container_of on the *file pointer.…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.184%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.14, < 6.19.4NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HNVD
- Summary characters omitted
- 333NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix potential NULL pointer dereference in context cleanup aie_destroy_context() is invoked during error handling in aie2_create_context(). However, aie_destroy_context() assumes that the context's mailbox channel pointer is non-NULL. If mailbox channel creation fails, the pointer remains NULL and calling aie_destroy_context() can lead to a NULL pointer dereference. In aie2_create_context(), replace aie_destroy_context() with a function which request firmware to remove the context created previously.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.154%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.14, < 6.19.4NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Add missing NULL check for alloc_workqueue() alloc_workqueue() can return NULL on memory allocation failure. Without proper error checking, this may lead to a NULL pointer dereference when queue_work() is later called with the NULL workqueue pointer in epf_ntb_epc_init(). Add a NULL check immediately after alloc_workqueue() and return -ENOMEM on failure to prevent the driver from loading with an invalid workqueue pointer.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.156%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.12, < 6.19.4NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: ACPI: platform: Use acpi_bus_get_primary_device() The acpi_get_first_physical_node() usage in acpi_platform_fill_resource() and acpi_create_platform_device() is generally unsafe because in theory the device returned by it may be freed at any time [1]. It is also inefficient because acpi_get_first_physical_node() is called multiple times for the same argument which can be avoided. Address these issues by using acpi_bus_get_primary_device() instead of acpi_get_first_physical_node() and adjusting the code to call it just once at …NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.156%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.6, < 7.2.6NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 131NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: ext4: fix transaction overflow during writeback Commit 95ad8ee45cdb ("ext4: correct the reserved credits for extent conversion") was correct to note that we need to reserve enough credits for all extents possibly underlying a large folio. However it was too eager to reduce the number of reserved credits. Extent conversion may not only need to touch several leaf extent blocks, it may also need to split extents - for example a single large unwritten extent may need to be split into many small written ones in case of sparse folio…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.1%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.16.3, < 6.17, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.17, < 7.2.6NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 280NVD
- References
- Fix · git.kernel.orgFix · git.kernel.org
- Summary
- In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() cxl_payload_from_user_allowed() casts and dereferences the input payload without first verifying its size. When a raw mailbox command is sent with an undersized payload (ie: 1 byte for CXL_MBOX_OP_CLEAR_LOG, which expects a 16-byte UUID), uuid_equal() reads past the allocated buffer, triggering a KASAN splat: BUG: KASAN: slab-out-of-bounds in memcmp+0x176/0x1d0 lib/string.c:683 Read of size 8 at addr ffff88810130f5c0 by task syz.1.62/2…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.166%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.19.1, < 6.19.7, cpe:2.3:o:linux:linux_kernel:5.19:-:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HNVD
- Summary characters omitted
- 1935NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix NULL pointer dereference of mgmt_chann mgmt_chann may be set to NULL if the firmware returns an unexpected error in aie2_send_mgmt_msg_wait(). This can later lead to a NULL pointer dereference in aie2_hw_stop(). Fix this by introducing a dedicated helper to destroy mgmt_chann and by adding proper NULL checks before accessing it.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.125%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.14.1, < 6.19.7, cpe:2.3:o:linux:linux_kernel:6.14:-:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting Running stress-ng --schedpolicy 0 on an RT kernel on a big machine might lead to the following WARNINGs (edited). sched: DL de-boosted task PID 22725: REPLENISH flag missing WARNING: CPU: 93 PID: 0 at kernel/sched/deadline.c:239 dequeue_task_dl+0x15c/0x1f8 ... (running_bw underflow) Call trace: dequeue_task_dl+0x15c/0x1f8 (P) dequeue_task+0x80/0x168 deactivate_task+0x24/0x50 push_dl_task+0x264/0x2e0 dl_task_timer+0x1b0/0x228 __hrtimer_run_queues+0x188/0x378 hr…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.169%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.19.257, < 4.20, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.10.1, < 6.19.7, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.4.212, < 5.5, cpe:2.3:o:linux:linux_kernel:5.10:-:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 1218NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: blktrace: fix __this_cpu_read/write in preemptible context tracing_record_cmdline() internally uses __this_cpu_read() and __this_cpu_write() on the per-CPU variable trace_cmdline_save, and trace_save_cmdline() explicitly asserts preemption is disabled via lockdep_assert_preemption_disabled(). These operations are only safe when preemption is off, as they were designed to be called from the scheduler context (probe_wakeup_sched_switch() / probe_wakeup()). __blk_add_trace() was calling tracing_record_cmdline(current) early in th…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.124%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 3.8.1, < 6.12.82, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.13, < 6.19.7, cpe:2.3:o:linux:linux_kernel:3.8:-:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 3182NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz The only user of frag_size field in XDP RxQ info is bpf_xdp_frags_increase_tail(). It clearly expects whole buff size instead of DMA write size. Different assumptions in ice driver configuration lead to negative tailroom. This allows to trigger kernel panic, when using XDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver test and changing packet size to 6912 and the requested offset to a huge value, e.g. XSK_UMEM__MAX_FRAME_SIZE * 100. Due to other quirks of the ZC conf…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.162%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.3, < 6.19.7, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 219NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: ipv6: add NULL checks for idev in SRv6 paths __in6_dev_get() can return NULL when the device has no IPv6 configuration (e.g. MTU < IPV6_MIN_MTU or after NETDEV_UNREGISTER). Add NULL checks for idev returned by __in6_dev_get() in both seg6_hmac_validate_skb() and ipv6_srh_rcv() to prevent potential NULL pointer dereferences.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.134%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.10.1, < 6.12.83, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.13, < 6.19.10, cpe:2.3:o:linux:linux_kernel:4.10:-:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS Blamed commits forgot that vxlan/geneve use udp_tunnel[6]_xmit_skb() which call iptunnel_xmit_stats(). iptunnel_xmit_stats() was assuming tunnels were only using NETDEV_PCPU_STAT_TSTATS. @syncp offset in pcpu_sw_netstats and pcpu_dstats is different. 32bit kernels would either have corruptions or freezes if the syncp sequence was overwritten. This patch also moves pcpu_stat_type closer to dev->{t,d}stats to avoid a potential cache line miss since iptunnel_xmit_s…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.503%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.14, < 6.19.10, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:HNVD
- Summary characters omitted
- 24NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: bridge: mrp: reject zero test interval to avoid OOM panic br_mrp_start_test() and br_mrp_start_in_test() accept the user-supplied interval value from netlink without validation. When interval is 0, usecs_to_jiffies(0) yields 0, causing the delayed work (br_mrp_test_work_expired / br_mrp_in_test_work_expired) to reschedule itself with zero delay. This creates a tight loop on system_percpu_wq that allocates and transmits MRP test frames at maximum rate, exhausting all system memory and causing a kernel panic via OOM deadlock. Th…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.091%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.8, < 6.19.12, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 479NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path cppi5_hdesc_get_psdata() returns a pointer into the CPPI descriptor. In both emac_rx_packet() and emac_rx_packet_zc(), the descriptor is freed via k3_cppi_desc_pool_free() before the psdata pointer is used by emac_rx_timestamp(), which dereferences psdata[0] and psdata[1]. This constitutes a use-after-free on every received packet that goes through the timestamp path. Defer the descriptor free until after all accesses through the psdata pointer are complet…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.43%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.15.1, < 6.19.11, cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 291NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: spi: spi-dw-dma: fix print error log when wait finish transaction If an error occurs, the device may not have a current message. In this case, the system will crash. In this case, it's better to use dev from the struct ctlr (struct spi_controller*).NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.156%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.8.1, < 6.19.11, cpe:2.3:o:linux:linux_kernel:5.8:-:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: mm: call ->free_folio() directly in folio_unmap_invalidate() We can only call filemap_free_folio() if we have a reference to (or hold a lock on) the mapping. Otherwise, we've already removed the folio from the mapping so it no longer pins the mapping and the mapping can be removed, causing a use-after-free when accessing mapping->a_ops. Follow the same pattern as __remove_mapping() and load the free_folio function pointer before dropping the lock on the mapping. That lets us make filemap_free_folio() static as this was the onl…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.444%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.14, < 6.19.14, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 7.0, < 7.0.1NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 27NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the whole DACL before rewriting it in cifsacl build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a server-supplied dacloffset and then use the incoming ACL to rebuild the chmod/chown security descriptor. The original fix only checked that the struct smb_acl header fits before reading dacl_ptr->size or dacl_ptr->num_aces. That avoids the immediate header-field OOB read, but the rewrite helpers still walk ACEs based on pdacl->num_aces with no structural validation of the incoming DACL bod…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.345%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.12, < 7.0.2NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HNVD
- Additional references
- 8NVD
- Summary characters omitted
- 575NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: move wake reason storage into validated event handlers hci_store_wake_reason() is called from hci_event_packet() immediately after stripping the HCI event header but before hci_event_func() enforces the per-event minimum payload length from hci_ev_table. This means a short HCI event frame can reach bacpy() before any bounds check runs. Rather than duplicating skb parsing and per-event length checks inside hci_store_wake_reason(), move wake-address storage into the individual event handlers after their exi…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.32%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.10, < 6.19.12, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HNVD
- Summary characters omitted
- 780NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Check the error for index mapping The ctxfi driver blindly assumed a proper value returned from daio_device_index(), but it's not always true. Add a proper error check to deal with the error from the function.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.121%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 2.6.31, < 6.19.12, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: bpf: Fix incorrect pruning due to atomic fetch precision tracking When backtrack_insn encounters a BPF_STX instruction with BPF_ATOMIC and BPF_FETCH, the src register (or r0 for BPF_CMPXCHG) also acts as a destination, thus receiving the old value from the memory location. The current backtracking logic does not account for this. It treats atomic fetch operations the same as regular stores where the src register is only an input. This leads the backtrack_insn to fail to propagate precision to the stack location, which is then …NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.164%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.12, < 6.19.12, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 1900NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists hci_cmd_sync_queue_once() needs to indicate whether a queue item was added, so caller can know if callbacks are called, so it can avoid leaking resources. Change the function to return -EEXIST if queue item already exists. Modify all callsites to handle that.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.156%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.9, < 6.19.12, cpe:2.3:o:linux:linux_kernel:6.1.120:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.6.51:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.8.9:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: mpls: add seqcount to protect the platform_label{,s} pair The RCU-protected codepaths (mpls_forward, mpls_dump_routes) can have an inconsistent view of platform_labels vs platform_label in case of a concurrent resize (resize_platform_label_table, under platform_mutex). This can lead to OOB accesses. This patch adds a seqcount, so that we get a consistent snapshot. Note that mpls_label_ok is also susceptible to this, so the check against RTA_DST in rtm_to_route_config, done outside platform_mutex, is not sufficient. This value …NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.134%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.1, < 6.19.12, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HNVD
- Summary characters omitted
- 150NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: mshv: Fix error handling in mshv_region_pin The current error handling has two issues: First, pin_user_pages_fast() can return a short pin count (less than requested but greater than zero) when it cannot pin all requested pages. This is treated as success, leading to partially pinned regions being used, which causes memory corruption. Second, when an error occurs mid-loop, already pinned pages from the current batch are not properly accounted for before calling mshv_region_invalidate_pages(), causing a page reference leak. Tre…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.112%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.15, < 6.19.12, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 72NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: xfs: close crash window in attr dabtree inactivation When inactivating an inode with node-format extended attributes, xfs_attr3_node_inactive() invalidates all child leaf/node blocks via xfs_trans_binval(), but intentionally does not remove the corresponding entries from their parent node blocks. The implicit assumption is that xfs_attr_inactive() will truncate the entire attr fork to zero extents afterwards, so log recovery will never reach the root node and follow those stale pointers. However, if a log shutdown occurs after…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.117%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 2.6.12.1, < 6.19.12, cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 2929NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Fix errors in IRQ cleanup IRQs are enabled through sdca_irq_populate() from component probe using devm_request_threaded_irq(), this however means the IRQs can persist if the sound card is torn down. Some of the IRQ handlers store references to the card and the kcontrols which can then fail. Some detail of the crash was explained in [1]. Generally it is not advised to use devm outside of bus probe, so the code is updated to not use devm. The IRQ requests are not moved to bus probe time as it makes passing the snd_so…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.107%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.17.1, < 6.19.14, cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 216NVD
- References
- Fix · git.kernel.orgFix · git.kernel.org
- Summary
- In the Linux kernel, the following vulnerability has been resolved: srcu: Use irq_work to start GP in tiny SRCU Tiny SRCU's srcu_gp_start_if_needed() directly calls schedule_work(), which acquires the workqueue pool->lock. This causes a lockdep splat when call_srcu() is called with a scheduler lock held, due to: call_srcu() [holding pi_lock] srcu_gp_start_if_needed() schedule_work() -> pool->lock workqueue_init() / create_worker() [holding pool->lock] wake_up_process() -> try_to_wake_up() -> pi_lock Also add irq_work_sync() to cleanup_srcu_struct() to prevent a use-after-free if a queued irq_w…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.149%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.12, < 6.19.14, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 191NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Fix null pointer dereference issue If SMU is disabled, during RAS initialization, there will be null pointer dereference issue here.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.112%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; < 6.19.6NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- References
- Fix · git.kernel.orgFix · git.kernel.org
- Summary
- In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix post open error handling Closing a queue doesn't guarantee that all associated page pools are terminated right away, let the refcounting do the work instead of releasing the zcrx ctx directly.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.112%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.15, < 6.19.6NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- References
- Fix · git.kernel.orgFix · git.kernel.org
- Summary
- In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 [Why] A backport of the change made for DCN401 that addresses an issue where we turn off the PHY PLL when disabling TMDS output, which causes the OTG to remain stuck. The OTG being stuck can lead to a hang in the DCHVM's ability to ACK invalidations when it thinks the HUBP is still on but it's not receiving global sync. The transition to PLL_ON needs to be atomic as there's no guarantee that the thread isn't pre-empted or is able to complete before…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.162%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.7, < 6.19.6NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 214NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6asm: drop DSP responses for closed data streams 'Commit a354f030dbce ("ASoC: qcom: q6asm: handle the responses after closing")' attempted to ignore DSP responses arriving after a stream had been closed. However, those responses were still handled, causing lockups. Fix this by unconditionally dropping all DSP responses associated with closed data streams.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.162%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.18, < 6.19.6NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: hfs: Replace BUG_ON with error handling for CNID count checks In a06ec283e125 next_id, folder_count, and file_count in the super block info were expanded to 64 bits, and BUG_ONs were added to detect overflow. This triggered an error reported by syzbot: if the MDB is corrupted, the BUG_ON is triggered. This patch replaces this mechanism with proper error handling and resolves the syzbot reported bug. Singed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.126%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.18, < 6.19.6NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() [BUG] There is a bug report that when btrfs hits ENOSPC error in a critical path, btrfs flips RO (this part is expected, although the ENOSPC bug still needs to be addressed). The problem is after the RO flip, if there is a read repair pending, we can hit the ASSERT() inside btrfs_repair_io_failure() like the following: BTRFS info (device vdc): relocating block group 30408704 flags metadata|raid1 ------------[ cut here ]------------ BTRFS: Transaction …NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.131%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 3.13, < 6.19.6NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 2438NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() There is no need to BUG(), we can just return an error and log an error message.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.123%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 2.6.31, < 6.19.6NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC For the i.MX8MQ platform, there is a hardware limitation: the g1 VPU and g2 VPU cannot decode simultaneously; otherwise, it will cause below bus error and produce corrupted pictures, even potentially lead to system hang. [ 110.527986] hantro-vpu 38310000.video-codec: frame decode timed out. [ 110.583517] hantro-vpu 38310000.video-codec: bus error detected. Therefore, it is necessary to ensure that g1 and g2 operate alternately. This allows for successful mult…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.123%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.14, < 6.19.6NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 147NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: soc/tegra: pmc: Fix unsafe generic_handle_irq() call Currently, when resuming from system suspend on Tegra platforms, the following warning is observed: WARNING: CPU: 0 PID: 14459 at kernel/irq/irqdesc.c:666 Call trace: handle_irq_desc+0x20/0x58 (P) tegra186_pmc_wake_syscore_resume+0xe4/0x15c syscore_resume+0x3c/0xb8 suspend_devices_and_enter+0x510/0x540 pm_suspend+0x16c/0x1d8 The warning occurs because generic_handle_irq() is being called from a non-interrupt context which is considered as unsafe. Fix this warning by deferrin…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.122%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.2, < 6.19.6NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 735NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback SCX_KICK_WAIT busy-waits in kick_cpus_irq_workfn() using smp_cond_load_acquire() until the target CPU's kick_sync advances. Because the irq_work runs in hardirq context, the waiting CPU cannot reschedule and its own kick_sync never advances. If multiple CPUs form a wait cycle, all CPUs deadlock. Replace the busy-wait in kick_cpus_irq_workfn() with resched_curr() to force the CPU through do_pick_task_scx(), which queues a balance callback to perform the…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.083%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.12, < 6.19.12, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 354NVD
- References
- Fix · git.kernel.orgFix · git.kernel.org
- Summary
- In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix die ID init and look up bugs In snbep_pci2phy_map_init(), in the nr_node_ids > 8 path, uncore_device_to_die() may return -1 when all CPUs associated with the UBOX device are offline. Remove the WARN_ON_ONCE(die_id == -1) check for two reasons: - The current code breaks out of the loop. This is incorrect because pci_get_device() does not guarantee iteration in domain or bus order, so additional UBOX devices may be skipped during the scan. - Returning -EINVAL is incorrect, since marking offline buses w…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.117%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.12, < 6.19.14, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 716NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: nsfs: tighten permission checks for handle opening Even privileged services should not necessarily be able to see other privileged service's namespaces so they can't leak information to each other. Use may_see_all_namespaces() helper that centralizes this policy until the nstree adapts.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.128%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.18, < 6.19.9, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free(). When an error happens, this function is called by qla2x00_sp_release(), when kref_put() releases the first and the last reference. qla2x00_els_dcmd_sp_free() frees fcport by calling qla2x00_free_fcport(). Doing it one more time after kref_put() is a bad idea.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.6%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.15.154, < 5.16, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.1.84, < 6.2, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.6.24, < 6.7, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.7.12, < 6.8, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.8.3, < 6.9, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.9.1, < 6.19.9, cpe:2.3:o:linux:linux_kernel:6.9:-:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.9:rc7:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-mach-common: Add missing error check for clock acquisition The acp_card_rt5682_init() and acp_card_rt5682s_init() functions did not check the return values of clk_get(). This could lead to a kernel crash when the invalid pointers are later dereferenced by clock core functions. Fix this by: 1. Changing clk_get() to the device-managed devm_clk_get(). 2. Adding IS_ERR() checks immediately after each clock acquisition.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.123%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.16, < 6.19.9, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_counter: serialize reset with spinlock Add a global static spinlock to serialize counter fetch+reset operations, preventing concurrent dump-and-reset from underrunning values. The lock is taken before fetching the total so that two parallel resets cannot both read the same counter values and then both subtract them. A global lock is used for simplicity since resets are infrequent. If this becomes a bottleneck, it can be replaced with a per-net lock later.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.16%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.1.107, < 6.2, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.6.48, < 6.19.4NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: revert commit_mutex usage in reset path It causes circular lock dependency between commit_mutex, nfnl_subsys_ipset and nlk_cb_mutex when nft reset, ipset list, and iptables-nft with '-m set' rule run at the same time. Previous patches made it safe to run individual reset handlers concurrently so commit_mutex is no longer required to prevent this.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.182%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.1.107, < 6.2, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.6.48, < 6.19.4NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix race condition during PASID entry replacement The Intel VT-d PASID table entry is 512 bits (64 bytes). When replacing an active PASID entry (e.g., during domain replacement), the current implementation calculates a new entry on the stack and copies it to the table using a single structure assignment. struct pasid_entry *pte, new_pte; pte = intel_pasid_get_entry(dev, pasid); pasid_pte_config_first_level(iommu, &new_pte, ...); *pte = new_pte; Because the hardware may fetch the 512-bit PASID entry in multiple 128-…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.134%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.13, < 6.19.4NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HNVD
- Summary characters omitted
- 497NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: gfs2: fix memory leaks in gfs2_fill_super error path Fix two memory leaks in the gfs2_fill_super() error handling path when transitioning a filesystem to read-write mode fails. First leak: kthread objects (thread_struct, task_struct, etc.) When gfs2_freeze_lock_shared() fails after init_threads() succeeds, the created kernel threads (logd and quotad) are never destroyed. This occurs because the fail_per_node label doesn't call gfs2_destroy_threads(). Second leak: quota bitmap buffer (8192 bytes) When gfs2_make_fs_rw() fails af…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.163%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.10.173, < 5.11, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.15.99, < 5.16, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.1.16, < 6.2, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.2.3, < 6.19.4NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 1054NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: ASoC: nau8821: Cancel delayed work on component remove Attempting to unload the driver while a jack detection work is pending would likely crash the kernel when it is eventually scheduled for execution: [ 1984.896308] BUG: unable to handle page fault for address: ffffffffc10c2a20 [...] [ 1984.896388] Hardware name: Valve Jupiter/Jupiter, BIOS F7A0131 01/30/2024 [ 1984.896396] Workqueue: events nau8821_jdet_work [snd_soc_nau8821] [ 1984.896414] RIP: 0010:__mutex_lock+0x9f/0x11d0 [...] [ 1984.896504] Call Trace: [ 1984.896511] <…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.13%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.16, < 6.19.4NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 502NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: udf: fix partition descriptor append bookkeeping Mounting a crafted UDF image with repeated partition descriptors can trigger a heap out-of-bounds write in part_descs_loc[]. handle_partition_descriptor() deduplicates entries by partition number, but appended slots never record partnum. As a result duplicate Partition Descriptors are appended repeatedly and num_part_descs keeps growing. Once the table is full, the growth path still sizes the allocation from partnum even though inserts are indexed by num_part_descs. If partnum i…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.177%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.18.7, < 4.19, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.19.1, < 6.6.140, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.13, < 7.0.4, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.7, < 6.12.88, cpe:2.3:o:linux:linux_kernel:4.19:-:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:4.19:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:4.19:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:4.19:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:4.19:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:4.19:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:4.19:rc7:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:4.19:rc8:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 283NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: fix damos_walk() vs kdamond_fn() exit race When kdamond_fn() main loop is finished, the function cancels remaining damos_walk() request and unset the damon_ctx->kdamond so that API callers and API functions themselves can show the context is terminated. damos_walk() adds the caller's request to the queue first. After that, it shows if the kdamond of the damon_ctx is still running (damon_ctx->kdamond is set). Only if the kdamond is running, damos_walk() starts waiting for the kdamond's handling of the newly added…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.09%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.14, < 7.0.4NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 1380NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: mm: fix deferred split queue races during migration migrate_folio_move() records the deferred split queue state from src and replays it on dst. Replaying it after remove_migration_ptes(src, dst, 0) makes dst visible before it is requeued, so a concurrent rmap-removal path can mark dst partially mapped and trip the WARN in deferred_split_folio(). Move the requeue before remove_migration_ptes() so dst is back on the deferred split queue before it becomes visible again. Because migration still holds dst locked at that point, teac…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.105%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; < 7.0.4NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 214NVD
- References
- Fix · git.kernel.orgFix · git.kernel.org
- Summary
- In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT If loading L1's CR3 fails on a nested #VMEXIT, nested_svm_vmexit() returns an error code that is ignored by most callers, and continues to run L1 with corrupted state. A sane recovery is not possible in this case, and HW behavior is to cause a shutdown. Inject a triple fault instead, and do not return early from nested_svm_vmexit(). Continue cleaning up the vCPU state (e.g. clear pending exceptions), to handle the failure as gracefully as possible. From the AP…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.13%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.9, < 7.0.4NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 332NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: selinux: fix overlayfs mmap() and mprotect() access checks The existing SELinux security model for overlayfs is to allow access if the current task is able to access the top level file (the "user" file) and the mounter's credentials are sufficient to access the lower level file (the "backing" file). Unfortunately, the current code does not properly enforce these access controls for both mmap() and mprotect() operations on overlayfs filesystems. This patch makes use of the newly created security_mmap_backing_file() LSM hook to …NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.123%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.19, < 7.0.4NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NNVD
- Additional references
- 8NVD
- Summary characters omitted
- 208NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: check for PCI upstream bridge existence pci_upstream_bridge() returns NULL if the device is on a root bus. If 8821CE is installed in the system with such a PCI topology, the probing routine will crash. This has probably been unnoticed as 8821CE is mostly supplied in laptops where there is a PCI-to-PCI bridge located upstream from the device. However the card might be installed on a system with different configuration. Check if the bridge does exist for the specific workaround to be applied. Found by Linux Verifica…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.136%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.15.17, < 5.16, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.16.3, < 7.1NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 63NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: dm-verity-fec: fix reading parity bytes split across blocks (take 3) fec_decode_bufs() assumes that the parity bytes of the first RS codeword it decodes are never split across parity blocks. This assumption is false. Consider v->fec->block_size == 4096 && v->fec->roots == 17 && fio->nbufs == 1, for example. In that case, each call to fec_decode_bufs() consumes v->fec->roots * (fio->nbufs << DM_VERITY_FEC_BUF_RS_BITS) = 272 parity bytes. Considering that the parity data for each message block starts on a block boundary, the byt…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.126%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.1.125, < 6.2, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.12.10, < 6.13, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.13.1, < 7.0.7, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.6.72, < 6.7, cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.13:rc7:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HNVD
- Summary characters omitted
- 807NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: 8021q: delete cleared egress QoS mappings vlan_dev_set_egress_priority() currently keeps cleared egress priority mappings in the hash as tombstones. Repeated set/clear cycles with distinct skb priorities therefore accumulate mapping nodes until device teardown and leak memory. Delete mappings when vlan_prio is cleared instead of keeping tombstones. Now that the egress mapping lists are RCU protected, the node can be unlinked safely and freed after a grace period.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.112%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 2.6.12.1, < 7.0.7, cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- References
- Fix · git.kernel.orgFix · git.kernel.org
- Summary
- In the Linux kernel, the following vulnerability has been resolved: spi: cadence-quadspi: fix unclocked access on unbind Make sure that the controller is runtime resumed before disabling it during driver unbind to avoid an unclocked register access. This issue was flagged by Sashiko when reviewing a controller deregistration fix.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.131%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.7, < 7.0.9, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: media: iris: fix use-after-free of fmt_src during MBPF check During concurrency testing, multiple instances can run in parallel, and each instance uses its own inst->lock while the core->lock protects the list of active instances. The race happens because these locks cover different scopes, inst->lock protects only the internals of a single instance, while the Macro Blocks Per Frame (MBPF) checker walks the core list under core->lock and reads fields like fmt_src->width and fmt_src->height. At the same time, iris_close() may f…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.133%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.18, < 7.0.9, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 775NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dc_link NULL handling in HPD init amdgpu_dm_hpd_init() may see connectors without a valid dc_link. The code already checks dc_link for the polling decision, but later unconditionally dereferences it when setting up HPD interrupts. Assign dc_link early and skip connectors where it is NULL. Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c:940 amdgpu_dm_hpd_init() error: we previously assumed 'dc_link' could be null (see line 931) drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.155%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.15, < 6.19.4NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 1114NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: regulator: core: fix locking in regulator_resolve_supply() error path If late enabling of a supply regulator fails in regulator_resolve_supply(), the code currently triggers a lockdep warning: WARNING: drivers/regulator/core.c:2649 at _regulator_put+0x80/0xa0, CPU#6: kworker/u32:4/596 ... Call trace: _regulator_put+0x80/0xa0 (P) regulator_resolve_supply+0x7cc/0xbe0 regulator_register_resolve_supply+0x28/0xb8 as the regulator_list_mutex must be held when calling _regulator_put(). To solve this, simply switch to using regulator_…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.091%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.2.1, < 6.19.4, cpe:2.3:o:linux:linux_kernel:4.2:-:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:4.2:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:4.2:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:4.2:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:4.2:rc7:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:4.2:rc8:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 339NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: pseries/papr-hvpipe: Fix race with interrupt handler While executing ->ioctl handler or ->release handler, if an interrupt fires on the same cpu, then we can enter into a deadlock. This patch fixes both these handlers to take spin_lock_irq{save|restore} versions of the lock to prevent this deadlock.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.085%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.18, < 7.0.7, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: selinux: allow multiple opens of /sys/fs/selinux/policy Currently there can only be a single open of /sys/fs/selinux/policy at any time. This allows any process to block any other process from reading the kernel policy. The original motivation seems to have been a mix of preventing an inconsistent view of the policy size and preventing userspace from allocating kernel memory without bound, but this is arguably equally bad. Eliminate the policy_opened flag and shrink the critical section that the policy mutex is held. While we …NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.115%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 2.6.37, < 7.0.7, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 61NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix access to stale wptr mapping Use drm_exec to take both locks i.e vm root bo and wptr_obj bo to access the mapping data properly. This fixes the security issue of unmap the wptr_obj while a queue creation is in progress and passing other bo at same address. (cherry picked from commit 1fc6c8ab45dbee096469c08c13f6099d57a52d6c)NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.095%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.16, < 7.0.9, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP ULP support" This reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40. As reported by Al Viro, the TCP ULP support for SMC is fundamentally broken. The implementation attempts to convert an active TCP socket into an SMC socket by modifying the underlying `struct file`, dentry, and inode in-place, which violates core VFS invariants that assume these structures are immutable for an open file, creating a risk of use after free errors and general system instability. Given the severity of this des…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.152%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.17, < 6.19.4NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 179NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure Apply the same fix as b2ed01e7ad ("drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure") to the ttm_bo_shrink() path. Move del_bulk_move from before the backup to after success only, using ttm_resource_del_bulk_move_unevictable() since the resource is now unevictable once fully backed up.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.16%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.15, < 7.0.10, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() In __ceph_x_decrypt(), a part of the buffer p is interpreted as a ceph_x_encrypt_header, and the magic field of this struct is accessed. This happens without any guarantee that the buffer is large enough to hold this struct. The function parameter ciphertext_len represents the length of the ciphertext to decrypt and is guaranteed to be at most the remaining size of the allocated buffer p. However, this value is not necessarily greater than sizeof(ceph_x_encrypt_…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.611%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.10, < 7.0.10, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.9.6, < 4.10, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 389NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: ceph: put folios not suitable for writeback The batch holds references to the folios (see `filemap_get_folios`, `folio_batch_release`), so we need to `folio_put` the folios we remove. Tested on v6.18.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.609%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.15, < 7.0.10, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure When ttm_tt_swapout() fails, the current code calls ttm_resource_add_bulk_move() followed by ttm_resource_move_to_lru_tail() to restore the resource's bulk_move membership. However, ttm_resource_move_to_lru_tail() places the resource at the tail of the LRU list which, relative to the walk cursor's hitch node (placed immediately after the resource when it was yielded), puts the resource *in front of the* the hitch. The next list_for_each_entry_continue() from th…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.172%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.13, < 7.0.10, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 440NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase Publish new hooks in the list into the basechain/flowtable using splice_list_rcu() to ensure netlink dump list traversal via rcu is safe while concurrent ruleset update is going on.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.102%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.8, < 7.0.10, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: af_unix: Drop all SCM attributes for SOCKMAP. SOCKMAP can hide inflight fd from AF_UNIX GC. When a socket in SOCKMAP receives skb with inflight fd, sk_psock_verdict_data_ready() looks up the mapped socket and enqueue skb to its psock->ingress_skb. Since neither the old nor the new GC can inspect the psock queue, the hidden skb leaks the inflight sockets. Note that this cannot be detected via kmemleak because inflight sockets are linked to a global list. In addition, SOCKMAP redirect breaks the Tarjan-based GC's assumption that…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.135%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.15, < 7.0.10NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 2502NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: ice: fix potential NULL pointer deref in error path of ice_set_ringparam() ice_set_ringparam nullifies tstamp_ring of temporary tx_rings, without clearing ICE_TX_RING_FLAGS_TXTIME bit. When ICE_TX_RING_FLAGS_TXTIME is set and the subsequent ice_setup_tx_ring() call fails, a NULL pointer dereference could happen in the unwinding sequence: ice_clean_tx_ring() -> ice_is_txtime_cfg() == true (ICE_TX_RING_FLAGS_TXTIME is set) -> ice_free_tx_tstamp_ring() -> ice_free_tstamp_ring() -> tstamp_ring->desc (NULL deref) Clear ICE_TX_RING_…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.16%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.18, < 7.0.10NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 174NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: ice: fix race condition in TX timestamp ring cleanup Fix a race condition between ice_free_tx_tstamp_ring() and ice_tx_map() that can cause a NULL pointer dereference. ice_free_tx_tstamp_ring currently clears the ICE_TX_FLAGS_TXTIME flag after NULLing the tstamp_ring. This could allow a concurrent ice_tx_map call on another CPU to dereference the tstamp_ring, which could lead to a NULL pointer dereference. CPU A:ice_free_tx_tstamp_ring() | CPU B:ice_tx_map() --------------------------------|--------------------------------- tx…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.109%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.18, < 7.0.10NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 759NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: ice: fix double-free of tx_buf skb If ice_tso() or ice_tx_csum() fail, the error path in ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points to it and is marked as valid (ICE_TX_BUF_SKB). 'next_to_use' remains unchanged, so the potential problem will likely fix itself when the next packet is transmitted and the tx_buf gets overwritten. But if there is no next packet and the interface is brought down instead, ice_clean_tx_ring() -> ice_unmap_and_free_tx_buf() will find the tx_buf and free the skb for the se…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.182%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.17, < 7.0.10NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Additional references
- 2NVD
- Summary characters omitted
- 525NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: f2fs: fix data loss caused by incorrect use of nat_entry flag Data loss can occur when fsync is performed on a newly created file (before any checkpoint has been written) concurrently with a checkpoint operation. The scenario is as follows: create & write & fsync 'file A' write checkpoint - f2fs_do_sync_file // inline inode - f2fs_write_inode // inode folio is dirty - f2fs_write_checkpoint - f2fs_flush_merged_writes - f2fs_sync_node_pages - f2fs_flush_nat_entries - f2fs_fsync_node_pages // no dirty node - f2fs_need_inode_block…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.162%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 3.8, < 7.0.10NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 724NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-free if write is called after disconnect If a user writes to the chardev after disconnect has been called, the kernel panics with the following trace (with CONFIG_INIT_ON_FREE_DEFAULT_ON=y): BUG: kernel NULL pointer dereference, address: 0000000000000218 ... Call Trace: <TASK> gb_operation_create_common+0x61/0x180 gb_operation_create_flags+0x28/0xa0 gb_operation_sync_timeout+0x6f/0x100 raw_write+0x7b/0xc7 [gb_raw] vfs_write+0xcf/0x420 ? task_mm_cid_work+0x136/0x220 ksys_write+0x63/0xe0 do_syscall_64…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.17%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.9, < 7.0.10NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 622NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-free on cdev close This addresses a use-after-free bug when a raw bundle is disconnected but its chardev is still opened by an application. When the application releases the cdev, it causes the following panic when init on free is enabled (CONFIG_INIT_ON_FREE_DEFAULT_ON=y): refcount_t: underflow; use-after-free. WARNING: CPU: 0 PID: 139 at lib/refcount.c:28 refcount_warn_saturate+0xd0/0x130 ... Call Trace: <TASK> cdev_put+0x18/0x30 __fput+0x255/0x2a0 __x64_sys_close+0x3d/0x80 do_syscall_64+0xa4/0x29…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.171%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.9, < 7.0.10NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 654NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() When a compressed or sparse attribute has its clusters frame-aligned, vcn is rounded down to the frame start using cmask, which can result in vcn != vcn0. In this case, vcn and vcn0 may reside in different attribute segments. The code already handles the case where vcn is in a different segment by loading its runs before allocation. However, it fails to load runs for vcn0 when vcn0 resides in a different segment than vcn. This causes run_lookup_entry() to …NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.123%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.1.132, < 6.2, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.2, < 7.0.10NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 662NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops When a BPF sock_ops program accesses ctx fields with dst_reg == src_reg, the SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros fail to zero the destination register in the !fullsock / !locked_tcp_sock path. Both macros borrow a temporary register to check is_fullsock / is_locked_tcp_sock when dst_reg == src_reg, because dst_reg holds the ctx pointer. When the check is false (e.g., TCP_NEW_SYN_RECV state with a request_sock), dst_reg should be zeroed but is no…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.121%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.4.61, < 5.5, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.7.18, < 5.8, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.8.4, < 5.9, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.9.1, < 7.0.10, cpe:2.3:o:linux:linux_kernel:5.9:-:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:5.9:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:5.9:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:5.9:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:5.9:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:5.9:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:5.9:rc7:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:5.9:rc8:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 676NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in offloaded map/prog info fill When querying info for an offloaded BPF map or program, bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns() obtain the network namespace with get_net(dev_net(offmap->netdev)). However, the associated netdev's netns may be racing with teardown during netns destruction. If the netns refcount has already reached 0, get_net() performs a refcount_t increment on 0, triggering: refcount_t: addition on 0; use-after-free. Although rtnl_lock and bpf_devs_lock ensure …NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.117%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.16, < 7.0.10NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 373NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: bpf: Fix ld_{abs,ind} failure path analysis in subprogs Usage of ld_{abs,ind} instructions got extended into subprogs some time ago via commit 09b28d76eac4 ("bpf: Add abnormal return checks."). These are only allowed in subprograms when the latter are BTF annotated and have scalar return types. The code generator in bpf_gen_ld_abs() has an abnormal exit path (r0=0 + exit) from legacy cBPF times. While the enforcement is on scalar return types, the verifier must also simulate the path of abnormal exit if the packet data load vi…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.141%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.10, < 7.0.10NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HNVD
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 347NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: net: pull headers in qdisc_pkt_len_segs_init() Most ndo_start_xmit() methods expects headers of gso packets to be already in skb->head. net/core/tso.c users are particularly at risk, because tso_build_hdr() does a memcpy(hdr, skb->data, hdr_len); qdisc_pkt_len_segs_init() already does a dissection of gso packets. Use pskb_may_pull() instead of skb_header_pointer() to make sure drivers do not have to reimplement this. Some malicious packets could be fed, detect them so that we can drop them sooner with a new SKB_DROP_REASON_SKB…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.139%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 3.16, < 7.0.10NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:HNVD
- Summary characters omitted
- 21NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() mt76_connac_mcu_alloc_sta_req() allocates an skb which is expected to be freed eventually by mt76_mcu_skb_send_msg(). However, currently if an intermediate function fails before sending, the allocated skb is leaked. Specifically, mt76_connac_mcu_sta_wed_update() and mt76_connac_mcu_sta_key_tlv() may fail, leading to an immediate memory leak in the error path. Fix this by explicitly freeing the skb in these error paths. Commit 7c0f63fe37a5 ("wifi: mt76: mt7996: f…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.123%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.18, < 7.0.10NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 160NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: bpf: Do not allow deleting local storage in NMI Currently, local storage may deadlock when deferring freeing selem or local storage through kfree_rcu(), call_rcu() or call_rcu_tasks_trace() in NMI or reentrant. Since deleting selem in NMI is an unlikely use case, partially mitigate it by returning error when calling from bpf_xxx_storage_delete() helpers in NMI. Note that, it is still possible to deadlock through reentrant. A full mitigation requires returning error when irqs_disabled() is true, which, however is too heavy-hand…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.143%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.13, < 7.0.10NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 507NVD
- References
- Fix · git.kernel.orgFix · git.kernel.org
- Summary
- In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Fix unmap race with PMD migration entries The following race is possible with migration swap entries or device-private THP entries. e.g. when move_pages is called on a PMD THP page, then there maybe an intermediate state, where PMD entry acts as a migration swap entry (pmd_present() is true). Then if an munmap happens at the same time, then this VM_BUG_ON() can happen in pmdp_huge_get_and_clear_full(). This patch fixes that. Thread A: move_pages() syscall add_folio_for_migration() mmap_read_lock(mm) folio_isolate_…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.09%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.8, < 7.0.10NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 3177NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix memory leaks in beacon template setup The functions ath11k_mac_setup_bcn_tmpl_ema() and ath11k_mac_setup_bcn_tmpl_mbssid() allocate memory for beacon templates but fail to free it when parameter setup returns an error. Since beacon templates must be released during normal execution, they must also be released in the error handling paths to prevent memory leaks. Fix this by using unified exit paths with proper cleanup in the respective error paths. Compile tested only. Issue found using a prototype static anal…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.121%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.5, < 7.0.10NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 26NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: ublk: reset per-IO canceled flag on each fetch If a ublk server starts recovering devices but dies before issuing fetch commands for all IOs, cancellation of the fetch commands that were successfully issued may never complete. This is because the per-IO canceled flag can remain set even after the fetch for that IO has been submitted - the per-IO canceled flags for all IOs in a queue are reset together only once all IOs for that queue have been fetched. So if a nonempty proper subset of the IOs for a queue are fetched when the …NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.16%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.14.6, < 6.15, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.15.1, < 7.0.10, cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.15:rc7:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 401NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction Add guards to ensure ie_length is large enough before subtracting fixed IE offsets to prevent unsigned integer underflow.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.405%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.15, < 7.0.13, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: fix resource freeing order Commit a60fc3294a37 ("ptp: rework ptp_clock_unregister() to disable events") added a call to ptp_disable_all_events() which changes the configuration of pins if they support EXTTS events. In ptp_ocp_detach() pins resources are freed before ptp_clock_unregister() and it leads to use-after-free during driver removal. Fix it by changing the order of free/unregister calls. To avoid irq handler running on the other core while ptp device unregistering, call synchronize_irq() after HW is configure…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.155%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.18, < 7.0.13, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 51NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: net: phy: clean the sfp upstream if phy probing fails Sashiko reported that we don't call sfp_bus_del_upstream() in the probe failure path, so let's add it, otherwise the sfp-bus is left with a dangling 'upstream' field, that may be used later on during SFP events. This issue existed before the generic phylib sfp support, back when drivers were calling phy_sfp_probe themselves.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.257%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.5, < 7.1, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: enforce HE/EHT cap/oper consistency Xiang Mei reports that mac80211 could crash if eht_cap is set but eht_oper isn't. Rather than fixing that for the individual user(s), enforce that both HE/EHT have consistent elements.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.16%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.16, < 7.0.13, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.294%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.12, < 7.0.13, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 2794NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED [Why] dcn32_validate_bandwidth() wraps dcn32_internal_validate_bw() with DC_FP_START()/DC_FP_END(). In x86 non-RT, DC_FP_START takes fpregs_lock(), which disables local softirqs. The DML1 path through dcn32_enable_phantom_plane() calls kvzalloc() to allocate ~335 KiB for dc_plane_state. This triggers the vmalloc path, which calls BUG_ON(in_interrupt()) because it's invoked within the FPU-enabled (softirq disabled) region, leading to a kernel…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.122%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.0, < 7.0.10, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 227NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind syzbot reported a kernel BUG triggered from pn_socket_sendmsg() via pn_socket_autobind(): kernel BUG at net/phonet/socket.c:213! RIP: 0010:pn_socket_autobind net/phonet/socket.c:213 [inline] RIP: 0010:pn_socket_sendmsg+0x240/0x250 net/phonet/socket.c:421 Call Trace: sock_sendmsg_nosec+0x112/0x150 net/socket.c:797 __sock_sendmsg net/socket.c:812 [inline] __sys_sendto+0x402/0x590 net/socket.c:2280 ... pn_socket_autobind() calls pn_socket_bind() with port 0 and, …NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.162%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 2.6.28, < 7.0.10, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 820NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: power: supply: max77705: Free allocated workqueue and fix removal order Use devm interface for allocating workqueue to fix two bugs at the same time: 1. Driver leaks the memory on remove(), because the workqueue is not destroyed. 2. Driver allocates workqueue and then registers interrupt handlers with devm interface. This means that probe error paths will not use a reversed order, but first destroy the workqueue and then, via devm release handlers, free the interrupt. The interrupt handler schedules work on this exact workqueu…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.16%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.15, < 7.0.10NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 570NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths In dc_dmub_srv_log_diagnostic_data() and dc_dmub_srv_enable_dpia_trace(). Both functions check: if (!dc_dmub_srv || !dc_dmub_srv->dmub) and then call DC_LOG_ERROR() inside that block. DC_LOG_ERROR() uses dc_dmub_srv->ctx internally. So if dc_dmub_srv is NULL, the logging itself can dereference a NULL pointer and cause a crash. Fix this by splitting the checks. First check if dc_dmub_srv is NULL and return immediately. Then check dc_dmub_srv->dmub and log the er…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.115%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.14, < 7.0.10NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 328NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: fbdev: omap2: fix use-after-free in omapfb_mmap omapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that can lead to use-after-free: The fb_mmap() entry point holds mm_lock but not lock (fb_info->lock), while ioctl handlers like OMAPFB_SETUP_PLANE hold lock but not mm_lock. This allows concurrent execution. In omapfb_mmap(): 1. rg = omapfb_get_mem_region(ofbi->region); // Get old region ref 2. start = omapfb_get_region_paddr(ofbi); // Read from NEW region 3. len = fix->smem_len; // Read from NEW region 4. vm_iomap…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.14%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 2.6.36, < 7.1.3NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 524NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: ACPI: button: Fix ACPI GPE handler leak during removal Commit a7e23ec17fee ("ACPI: button: Install notifier for system events as well") changed the ACPI notify handler type for ACPI buttons to ACPI_ALL_NOTIFY, but it forgot to update acpi_button_remove() to reflect that change. This leads to leaking the notify handler past driver removal, which may cause a kernel crash to occur if ACPI notify on the given device is triggered after removing the driver, and causes a subsequent probe of the given device with the same driver to fa…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.121%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.15, < 7.0.12, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 106NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma mapping leak on data setup error We're leaking the initial DMA mapping during iteration if we fail to allocate the tracking descriptor for both PRP and SGL. Unmap the iterator directly; we can't use the existing unmap helper because it depends on the tracking descriptor being successfully allocated, so a new one for an in-use iterator is provided. The mappings were also leaking when the driver detects an invalid bio_vec when mapping PRPs, so fix that too.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.16%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.17, < 7.0.11, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma_vecs leak on p2p memory We don't unmap P2P memory, so we don't need to track it. The dma_vec allocation was getting leaked on the completion.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.609%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.17, < 7.0.11, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix error return when vfs_mkdir() fails When vfs_mkdir() fails, the error code is not extracted from the returned error pointer. This causes mkdir_error to be reached with ret=0, which leads to returning ERR_PTR(0) (NULL) instead of a proper error pointer. Fix this by extracting the error code from the error pointer when vfs_mkdir() fails.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.16%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.15, < 7.0.11, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: afs: Fix the locking used by afs_get_link() The afs filesystem in the kernel doesn't do locking correctly for symbolic links. There are a number of problems: (1) It doesn't do any locking around afs_read_single() to prevent races between multiple ->get_link() calls, thereby allowing the possibility of leaks. (2) It doesn't use RCU barriering when accessing the buffer pointers during RCU pathwalk. (3) It can race with another thread updating the contents of the symlink if a third party updated it on the server. Fix this by the …NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.134%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.14, < 7.0.11, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 734NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing barriers when accessing stream->subrequests locklessly The list of subrequests attached to stream->subrequests is accessed without locks by netfs_collect_read_results() and netfs_collect_write_results(), and then they access subreq->flags without taking a barrier after getting the subreq pointer from the list. Relatedly, the functions that build the list don't use any sort of write barrier when constructing the list to make sure that the NETFS_SREQ_IN_PROGRESS flag is perceived to be set first if no lock is …NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.502%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.10, < 7.0.11, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 555NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing locking around retry adding new subreqs Fix netfs_retry_read_subrequests() and netfs_retry_write_stream() to take the appropriate lock when adding extra subrequests into stream->subrequests.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.353%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.10, < 7.0.11, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: allocate hook ops while under mutex arp/ip(6)t_register_table() add the table to the per-netns list via xt_register_table() before allocating the per-netns hook ops copy via kmemdup_array(). This leaves a window where the table is visible in the list with ops=NULL. If the pernet exit happens runs concurrently the pre_exit callback finds the table via xt_find_table() and passes the NULL ops pointer to nf_unregister_net_hooks(), causing a NULL dereference: general protection fault in nf_unregister_net_hooks+…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.122%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.13, < 7.0.11, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 665NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: riscv: Fix register corruption from uninitialized cregs on error compat_riscv_gpr_set() calls cregs_to_regs() unconditionally, even when user_regset_copyin() fails. Since cregs is an uninitialized stack variable, a copyin failure causes uninitialized stack data to be written into the target task's pt_regs, corrupting its register state and potentially leaking kernel stack contents. compat_restore_sigcontext() has the same issue: it calls cregs_to_regs() even when __copy_from_user() fails, leading to the same corruption of the …NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.129%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.19, < 7.0.11, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 103NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb ieee80211_invoke_fast_rx() reads RX status through IEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage that ieee80211_rx_mesh_data() reuses as IEEE80211_TX_INFO. In the unicast forward path, mesh_data does: info = IEEE80211_SKB_CB(fwd_skb); memset(info, 0, sizeof(*info)); on the same skb the caller still names via rx->skb, then either queues the skb for TX (success) or kfree_skb()'s it (no-route) before returning RX_QUEUED. The caller's RX_QUEUED arm t…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.265%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.4, < 7.0.11, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 361NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: net: hsr: defer node table free until after RCU readers HSR node-list and node-status generic-netlink operations run under rcu_read_lock(). They walk hsr->node_db through hsr_get_next_node() and hsr_get_node_data(), but RTM_DELLINK teardown removes the same node table with plain list_del() and frees each node immediately. That lets a generic-netlink reader hold a struct hsr_node pointer across hsr_dellink(). In a KASAN build, widening the reader window after hsr_get_next_node() obtains the node reproduces a slab-use-after-free…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.126%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.11, < 5.15.210, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.16, < 6.1.176, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.2.12, < 5.10.259, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.13, < 7.0.11, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.2, < 6.6.143, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.7, < 6.12.93, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 312NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: erofs: fix metabuf leak in inode xattr initialization commit bb88e8da0025 ("erofs: use meta buffers for xattr operations") converted xattr operations to use on-stack erofs_buf instances. erofs_init_inode_xattrs() uses such a metabuf while reading the inline xattr header and shared xattr id array. Some error paths after erofs_read_metabuf() leave through out_unlock without dropping the metabuf, so the folio reference can leak. Consolidate the cleanup at out_unlock. erofs_put_metabuf() is a no-op if no folio has been acquired, a…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.128%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.17, < 7.0.11, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 91NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() In a6xx_gpu_init(), node is obtained via of_parse_phandle(). While there was a manual of_node_put() at the end of the common path, several early error returns would bypass this call, resulting in a reference leak. Fix this by using the __free(device_node) cleanup handler to release the reference when the variable goes out of scope. Patchwork: https://patchwork.freedesktop.org/patch/700661/NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.13%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.5, < 7.0.11, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: netfs: Fix zeropoint update where i_size > remote_i_size Fix the update of the zero point[*] by netfs_release_folio() when there is uncommitted data in the pagecache beyond the folio being released but the on-server EOF is in this folio (ie. i_size > remote_i_size). The update needs to limit zero_point to remote_i_size, not i_size as i_size is a local phenomenon reflecting updates made locally to the pagecache, not stuff written to the server. remote_i_size tracks the server's i_size. [*] The zero point is the file position fr…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.162%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.10.8, < 6.11, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.11.1, < 7.0.11, cpe:2.3:o:linux:linux_kernel:6.11:-:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.11:rc7:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 917NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point Fix potential tearing in using ->remote_i_size and ->zero_point by copying i_size_read() and i_size_write() and using the same seqcount as for i_size. We need to make sure that netfslib and the filesystems that use it always hold i_lock whilst updating any of the sizes to prevent i_size_seqcount from getting corrupted.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.427%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.18, < 7.0.11, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD
- References
- Fix · git.kernel.orgFix · git.kernel.org
- Summary
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix unlocked writing to ICOSQ During napi poll, when the affinity changes and there's still XSK work to be done, we trigger an ICOSQ interrupt on the new CPU. However, this triggering on the ICOSQ is done unprotected. There are 2 such races: A) mlx5e_trigger_irq() is called while mlx5e_xsk_alloc_rx_mpwqe() is running from a different CPU due to affinity change. This can happen because IRQ triggering is done after napi_complete_done(). At this point the NAPI can be scheduled on a different CPU. Like this: CPU A …NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.37%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.3, < 7.0.11, cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 2177NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values When binding a memslot to a guest_memfd file, treat the offset and size as unsigned values to fix a bug where the sum of the two can result in a false negative when checking for overflow against the size of the file. Passing unsigned values also avoids relying on somewhat obscure checks in other flows for safety, and tracks the offset and size as they are intended to be tracked, as unsigned values. On 64-bit kernels, the number of pages a memslot contains a…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.149%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.8, < 7.1.4NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 1730NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/20260502125824.425d7159@bongani-mini.home.org.za/ When a channel-switch announcement (CSA) beacon is received, cfg80211 queues a wiphy work item that eventually calls mt7921_channel_switch_rx_beacon(). If the station disconnects (or the channel context is otherwise torn down) between the time the work is queued and the time it runs, the driver's dev->new_ctx pointer can already …NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.16%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.14, < 7.1.4NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 790NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: USB: iowarrior: fix use-after-free on disconnect race mutex_unlock() may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly (unlike spinlocks and refcounts). [1][2] Use a kref to release the driver data to avoid use-after-free in mutex_unlock() when release() races with disconnect(). [1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is non-atomic") [2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most other sleeping locks, can s…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.126%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 2.6.21.1, < 6.12.97, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.13, < 7.1.4, cpe:2.3:o:linux:linux_kernel:2.6.21:-:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:2.6.21:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:2.6.21:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:2.6.21:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:2.6.21:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:2.6.21:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:2.6.21:rc7:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 46NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership (chown) and group (chgrp) modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID were also explicitly set. Fix this by checking for posix_extensions in cifs_setattr_nounix() when updating UID and GID, ensuring that id_mode_to_cifs_acl() is called to map and set the ownership/group information on the server.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.134%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.18, < 7.1.4NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent path traversal bypass by restricting caseless retry ksmbd_vfs_path_lookup() enforces LOOKUP_BENEATH to restrict path resolution within the share root. When a crafted path attempts to escape the share boundary using parent-directory components ('..'), vfs_path_parent_lookup() detects this and immediately fails, returning -EXDEV. However, a bug exists in __ksmbd_vfs_kern_path() under caseless mode. The function fails to intercept the -EXDEV error and erroneously falls through to the caseless retry logic, which is …NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.447%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.15.145, < 5.16, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.1.71, < 6.2, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.3.10, < 7.1.4NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:HNVD
- Summary characters omitted
- 463NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpxchg bpf_convert_ctx_accesses() rewrites an atomic on an arena pointer from BPF_STX | BPF_ATOMIC to BPF_STX | BPF_PROBE_ATOMIC, and it runs before bpf_opt_subreg_zext_lo32_rnd_hi32(). That pass emits an explicit zero extension for a 32-bit cmpxchg even when bpf_jit_needs_zext() is false. This is done because on some architectures 32-bit cmpxchg requires explicit zero extension for the dst register. E.g. on x86-64 'lock cmpxchg' does not change the %eax if comparison is successf…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.155%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.10, < 7.2.7, cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 301NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one session to run on multiple connections. Wait for all channels bound to a session before freeing shared session objects. A deferred byte-range lock remains counted as a running request and only wakes when its file closes. Wake blocked locks during the drain without unpublishing or modifying their file objects. Synchronous CANCEL requests must invoke their cancellation callback to wake pending operations, while CHANGE_NOTIFY completion remains s…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.275%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.10.7, < 6.11, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.11.1, < 7.2.7, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.6.48, < 6.7, cpe:2.3:o:linux:linux_kernel:6.11:-:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.11:rc7:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 238NVD
- References
- Fix · git.kernel.orgFix · git.kernel.org
- Summary
- In the Linux kernel, the following vulnerability has been resolved: netfs: Fix readahead synchronisation issues by loading all folios upfront There are some synchronisation issues that derive from the app thread adding more folios to the rolling buffer whilst the collector thread is looking at them or trying to clear them, such as determining the setting of front_folio_order when the next folio hasn't been added yet, The reason for the rolling buffer approach is that loading the buffer upfront and then dropping all the refs just acquired is quite a slow operation, and loading progressively all…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.091%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.12, < 7.2.7, cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.3:rc2:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HNVD
- Summary characters omitted
- 1027NVD
- References
- Fix · git.kernel.orgFix · git.kernel.org
- Summary
- In the Linux kernel, the following vulnerability has been resolved: smb/client: invalidate fscache for fallocate range operations smb3_zero_range(), smb3_punch_hole(), smb3_insert_range(), and smb3_collapse_range() modify file contents through server-side range operations. These operations discard the affected page cache, but leave the FS-Cache cookie valid, so a later read may return data cached before the range operation. Fix this by invalidating FS-Cache after outstanding I/O has completed and before modifying the file on the server. Run the following as root on a CIFS mount with fsc enable…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.186%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 3.17.1, < 6.6.160, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.13, < 7.2.7, cpe:2.3:o:linux:linux_kernel:*:-:*:*:*:*:*:*; >= 6.7, < 6.12.114, cpe:2.3:o:linux:linux_kernel:3.17:-:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:3.17:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:3.17:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:3.17:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:3.17:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:3.17:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:3.17:rc7:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 783NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: smb/client: fix stale page cache in insert/collapse range smb3_insert_range() and smb3_collapse_range() use truncate_pagecache_range() to invalidate the affected page cache. However, if off or old_eof is not page-aligned, the boundary pages are only partially zeroed and remain uptodate. As a result, the client may return stale data after a successful insert/collapse range operation. For example, with 4K pages: page 0 page 1 page 2 0------4K 4K------8K 8K------12K ^ ^ off=2K old_eof=10K Page 1 is removed from the page cache, wh…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.121%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.19.12, < 6.0, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.1, < 6.6.160, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.7, < 7.2.7, cpe:2.3:o:linux:linux_kernel:6.0:-:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.0:rc4:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.0:rc5:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.0:rc6:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:6.0:rc7:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 846NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix dma mapping leak in stmmac_tso_xmit() In stmmac_tso_xmit(), if the DMA mapping of an skb fragment fails, the frame is dropped but the DMA mappings already created for the linear part and for the fragments mapped before the failure are never unmapped, leaking DMA mappings. Fix the leak by walking back over the descriptors used by the frame and releasing each of them with stmmac_free_tx_buffer(). Moreover, release the descriptors with stmmac_release_tx_desc() unmapping the DMA buffers.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.122%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 4.7, < 7.2.7, cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: bpf: check_cond_jmp_op(): properly infer if register is null Nicholas Carlini reported a bug when verifier can incorrectly infer that a pointer is non-null. The bug occurs when two pointers are compared and one of them has a type w/o PTR_MAYBE_NULL flag, but which allows a value to be NULL at runtime. Here is an example: // `a` is PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED // `a` is 0 at runtime. // `b` is PTR_TO_MAP_VALUE | PTR_MAYBE_NULL void *a = bpf_rdonly_cast(0, 0); int *b = bpf_map_lookup_elem(...); if (a == b) *b = 42; //…NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.155%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.2, < 7.2.7, cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- Summary characters omitted
- 1383NVD
- Summary
- In the Linux kernel, the following vulnerability has been resolved: nvme: fix racy access to FDP placement id array nvme_query_fdp_info() is called per-path and therefore prone to races. It populates head->nr_plids/head->plids for fdp registration. But nothing protects that pair from concurrent access - two paths scanning the same namespace can race to populate it. Avoid the race by moving this initialization work to nvme_alloc_ns_head() which is called once per shared namespace.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.08%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.16, < 7.2.7, cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
- References
- Fix · git.kernel.orgFix · git.kernel.org
- Summary
- In the Linux kernel, the following vulnerability has been resolved: smb/server: fix tree connection leak in smb2_tree_connect() See the procedure below: smb2_tree_connect ksmbd_tree_conn_connect xa_store(&sess->tree_conns, tree_conn->id, tree_conn) ksmbd_counter_inc(KSMBD_COUNTER_TREE_CONNS) ksmbd_share_tree_conn_inc(sc) ksmbd_iov_pin_rsp // fail status.ret = KSMBD_TREE_CONN_STATUS_NOMEM // do not disconnect tree_conn Disconnect the new tree connection if ksmbd_iov_pin_rsp() fails.NVD
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.114%FIRST
- Vulnerable CPE criteria
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 5.15.145, < 5.16, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.1.71, < 6.2, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; >= 6.6, < 7.2.6NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD
Description
This is the meta package that handles standard linux-lts kernel installation.
Changelog
PR · 26
Checks
| Monitor | Observation | Last checked |
|---|---|---|
Stale Repository refresh: git fetch exited 128 (authentication) | ||
Stale Source last confirmed at 2026-11-10T17:23:44+00:00; repository refresh overdue. | ||
Checked | ||
Checked | ||
Checked Current source cycle 6.18; upstream lifecycle only. | Last attempted | |
Not configured No reliable monitor identity/configuration. | — | |
Not configured No reliable monitor identity/configuration. | — | |
Checked Current source component only; local patches, build options, bundled dependencies and binary artifacts are not evaluated. | Last attempted | |
Not configured No reliable monitor identity/configuration. | — |