Linux kernel vulnerabilities

Linux kernel versions 2.2.3 and earlier allow a remote attacker to perform an IP fragmentation attack, leading to a denial of service.

In do_fault_around of memory.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed.

In kvm_vfio_pviommu_attach of vfio.c, there is a possible double free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In fuse_backing_mmap of backing.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed.

In multiple functions of base.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed.

In multiple functions of dma-buf.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed.

In ksys_unshare of fork.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed.

In multiple functions of fork.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed.

In the Linux kernel, a race between fallocate and mmap reads in NTFS was fixed. Fallocate only took invalidate_lock for punch hole, collapse range and insert range operations, and during standard allocation new clusters were mapped before being zeroed, allowing concurrent mmap page faults to read uninitialized disk data.

In the Linux kernel, a missing lock in ntfs_filemap_page_mkwrite() was fixed; it called iomap_page_mkwrite() without holding mapping->invalidate_lock. A concurrent truncate or fallocate could be invalidating pagecache and rewriting the runlist while the write fault mapped blocks and dirtied the folio.

In the Linux kernel, the DAMON subsystem (mm/damon/core) has a division-by-zero bug when a DAMOS quota goal has a target_value of zero. The fix moves handling of this corner case to the core layer by adding validation in damos_commit_quota_goal(), which now returns an error for zero target values.

A TOCTOU race in the Linux kernel Bluetooth L2CAP subsystem allowed an l2cap_chan to be linked to an l2cap_conn more than once, violating an invariant assumed during cleanup. The fix adds an invariant check in __l2cap_chan_add and a l2cap_lock_chan guard in l2cap_sock_bind().

A use-after-free in the Linux kernel tracing subsystem: trace_module_record() walks ftrace_trace_arrays from the module notifier without trace_types_lock, while a concurrent rmdir of an instance removes and frees it under that lock. A module load or unload can therefore walk into a freed trace_array.

A double-free/use-after-free in the Linux kernel tracing subsystem: update_last_data_if_empty() is called from tracing_open() with O_TRUNC, tracing_read_pipe() and tracing_buffers_read() without trace_types_lock. Two readers can both pass the LAST_BOOT test and free module_delta twice, and a module notifier can update module_delta while it is being freed.

A Linux kernel tracing vulnerability: incomplete event filter expressions (e.g., ending with a logical operator) left unresolved operator state, causing an out-of-bounds read (prog[-1]) or copying an out-of-bounds word into a branch target. This could be reached via PERF_EVENT_IOC_SET_FILTER on a self-targeted perf tracepoint counting event.

A use-after-free in the Linux kernel tracing/histograms subsystem: create_field_var_hist() saved a pointer to a compatible histogram (hist_data) rather than the one it created. Since find_compatible_hist() matches on keys alone, the user could remove that histogram while the target still pointed at it, leading to a use-after-free in event_hist_trigger_free().

In the Linux kernel tracing subsystem, a failed hist command that creates a field variable histogram leaves a registered trigger without a corresponding entry in field_var_hists[]. As a result, the trigger remains active and keeps counting even though the operation failed with -EINVAL, causing a resource leak and inconsistent state.

A use-after-free in the Linux kernel tracing/histograms subsystem: find_synth_event() compared only the event basename, so registering or removing a histogram on a non-synthetic event whose basename matched a synthetic event erroneously modified the synthetic event's refcount. This could free the synthetic event while an active histogram action still held a pointer to it.

In the Linux kernel, syscall_copy_user_array() was fixed to use copy_from_user() instead of __copy_from_user() when copying the buffer argument of faultable syscalls (write, pwrite64, etc.). Skipping access_ok() allowed a non-user address to be accepted.

In the Linux kernel's io_uring waitid implementation, a use-after-free occurs. io_waitid_wait() clears ->head before taking ownership of the request by incrementing ->refs, allowing another thread to complete and free the request while the wake-up handler still touches it.

In the Linux kernel, io_uring_cmd_del_cancelable() was fixed to not leave LIST_POISON in ->hash_node; it used hlist_del(). Requests are recycled without reinitialisation and not every user of ->hash_node sets it up before use, leading to a write through LIST_POISON2 and a general protection fault.

In the Linux kernel, a spin in io_cqring_wait_schedule() was fixed when IO_CHECK_CQ_OVERFLOW_BIT is set and the overflow list cannot be flushed. The task spins in the kernel and cannot be killed, e.g. with IORING_SETUP_CQE_MIXED or when the application moves the CQ head.

A bug was fixed in the Linux kernel's io_uring/io-wq where the signal ending work could be lost. When a thread exits, its io-wq is torn down and workers are signalled, but a worker that had not yet started the work could lose the signal. This caused the thread to hang in do_exit(), e.g. with IORING_OP_OPENAT of a FIFO without a writer and IOSQE_ASYNC.

In the Linux kernel, the io_uring/waitid mechanism has a reference counter bug where repeated failed cancellation attempts can wrap the 31-bit reference field to zero. A later cancellation can then claim ownership and complete the request a second time.

A use-after-free flaw was fixed in the Linux kernel's find_keyring_by_name() during named keyring lookup. The function read keyring->user->uid under keyring_name_lock, which does not protect the separate key_user object, so a concurrent KEYCTL_CHOWN could free the old key_user between the pointer load and the UID read. The fix uses the inline keyring->uid field instead of dereferencing the owner account.

A vulnerability exists in the Linux kernel's search_process_keyrings_rcu() function, which validates the authorization payload and saved credentials. Due to a race condition between a request-key helper's descendant and the requester, request_key_auth_revoke() can clear the payload pointer, leading to a NULL dereference and kernel oops.

A flaw was fixed in the Linux kernel's keyctl_describe_key(), where the key type's name could be freed by a module unload (e.g., AF_RXRPC) while the key description was being formatted. This led to a use-after-free and a page fault in string(). The fix holds key->sem across the kasprintf() call.

In the Linux kernel, keyring indexes contained kernel addresses (hashes of type and domain pointers), allowing an unprivileged user to predict key ordering and recover the kernel image address, defeating KASLR. The fix removes addresses from the entire index, replacing them with lazily allocated 64-bit IDs hashed with a SipHash key.

A use-after-free vulnerability exists in the Linux kernel key management subsystem. keyctl_read_key() checks key->type->read without holding key->sem, so a surviving RxRPC key can be read while the AF_RXRPC module is being unloaded, accessing freed module memory.

In the Linux kernel, trusted_tpm_unseal() proceeded to call pcrlock() after a TPM unseal failure; if pcrlock() succeeded, its return value overwrote the unseal error, causing key instantiation to succeed despite the failure.

In the Linux kernel, the PKCS#8 parser leaves the asym_key_ids slot empty, and key_or_keyring_common() unconditionally dereferences it when a PKCS#8 key is supplied to a key_or_keyring restriction. An unprivileged caller can trigger a NULL pointer dereference via KEYCTL_RESTRICT_KEYRING followed by add_key(), causing a kernel panic.

In the Linux kernel, print_rec() leaves 'modname' and 'offset' uninitialized, and kallsyms_lookup() only sets them on success. When the lookup fails (e.g., during module load or unload), 'modname' holds a garbage value, passes the 'if (modname)' check, and is dereferenced by seq_printf(), causing a general protection fault.

In the Linux kernel, coredump_finish() releases parked threads without holding a reference on the task and outside of RCU. If the coredump client is preempted between the store and wake_up_process(), the thread can be freed and try_to_wake_up() accesses freed memory.

A flaw was found in Red Hat Enterprise Linux 9 kernel builds. An incomplete backport of the CVE-2026-46099 fix in RHEL 9.6 through 9.10 left a local_bh imbalance in seg6_input_core(), where the drop path returns with bottom halves still disabled. This can lead to softirq starvation and denial of service on systems with SRv6 tunnels configured. Upstream and RHEL 10 are not affected.

In the Linux kernel, the Hyper-V (hv) driver incorrectly forces the VMBus connection state to DISCONNECTED before calling vmbus_disconnect(). As a result, vmbus_initiate_unload() does not unload the connection because it only acts when the state is CONNECTED, so the Hyper-V host may continue sending messages or posting VMBus interrupts.

In the Linux kernel, the drm/vc4 HDMI driver has an ordering issue with Packet RAM enabling. When audio is triggered by the HPD handler before video is restored, vc4_hdmi_write_infoframe() may attempt to store an infoframe while Packet RAM is disabled, causing a kernel warning (splat). The fix moves Packet RAM enable/disable into the Runtime PM hooks.

In the Linux kernel vsock subsystem, the TCP_ESTABLISHED to TCP_CLOSING transition on OP_RST can race with the connect loop. Resetting a socket still present in connected_table can lead to memory corruption, including a double list add and a kernel BUG.

In the Linux kernel net/rds module, rds_rdma_cm_event_handler_cmn() returns the result of rdma_resolve_route() directly to rdma_cm on RDMA_CM_EVENT_ADDR_RESOLVED. A synchronous failure causes the id ic->i_cm_id to be destroyed while RDS still owns it, leading to use of a freed id during connection shutdown.

In the Linux kernel netlink subsystem, socket filters can use SKF_NET_OFF and SKF_LL_OFF to read relative to an skb's network and MAC headers. Netlink producers may reserve headroom without resetting those headers, allowing a receiving socket's filter to read data before the initialized message and disclose memory contents.

In the Linux kernel, the scsi target iscsi subsystem has a race in discovery auth updates. Concurrent configfs opens can free the same value in iscsi_update_param_value(), causing a double-free.

In the Linux kernel, pipe fasync handling has a bug in fasync_helper() when two enables of one O_RDWR FIFO race. The error path removes a pre-existing reader entry, leading to a use-after-free in send_sigio() triggerable by an unprivileged user under memory pressure.

In the Linux kernel, a vulnerability was fixed in the netlink subsystem where the rhashtable key included a raw struct net pointer and a user-controlled port ID. By binding and rebinding chosen NETLINK_USERSOCK port IDs, an unprivileged reader could distinguish equal buckets and recover the low bits of the Jenkins hash, then search offline to recover the address of init_net. The fix uses the namespace's unique, non-address net_cookie in the comparison key.

In the Linux kernel, the bcmgenet driver stores first_cb, last_cb and bytes_sent in the skb control block and reads them back on completion. Because ether_setup() leaves IFF_TX_SKB_SHARING set, the stack can resubmit a shared skb still in the ring, overwriting last_cb so earlier slots complete without crediting their bytes, stalling the BQL queue until the watchdog resets it.

A bug was fixed in the Linux kernel's calipso_skbuff_setattr() function, which incorrectly modified the IPv6 payload_len field for BIG TCP packets (larger than IPV6_MAXPLEN). This broke the fallback to skb->len in ipv6_payload_len(), affecting nf_tables, conntrack and sch_cake. The fix sets payload_len via ipv6_set_payload_len(), matching ipv6_gro_complete() behavior.

In the Linux kernel, gpiod_set_array_value_complex() returns immediately after a failed gpiochip_set_multiple() call, bypassing the freeing of possibly allocated bitmaps. This causes a memory leak on an unlikely but possible error path.

In the Linux kernel, __perf_pmu_remove() removes group leaders while iterating with perf_event_groups_for_cpu_pmu(), and perf_remove_from_context() takes the leader out of the rbtree so rb_next() returns NULL and the walk ends prematurely. Remaining groups stay in the source context and are torn down only when the CPU dies, running despite the PMU's interrupts and events being migrated to a new CPU.

In the Linux kernel firewire subsystem, a race condition exists in split transaction handling. Both the response handler and the timeout callback may process the same transaction entry, leading to a use-after-free on the transaction initiator side.

In the Linux kernel ASoC SOF component (ipc4-topology), a shift-out-of-bounds occurs for aggregated ALH capture. When ch_count is smaller than device_count, step = ch_count / device_count truncates to 0, and GENMASK(step - 1, 0) underflows, triggering a UBSAN shift-out-of-bounds error.

In the Linux kernel autofs subsystem, a flaw was fixed where a delayed write to a replaced notification pipe returned -EPIPE and re-entered catatonic mode. This closed the replacement pipe and released the new daemon generation's wait queues, causing lookups to fail with ENOENT. The fix ensures catatonic mode is entered only when the failed pipe is still the current pipe.

A use-after-free flaw in the Linux kernel Unicode handling was fixed. generic_ci_d_hash() and generic_ci_d_compare() read sb->s_encoding and dereference the Unicode map during RCU pathwalk, while ext4, f2fs and tmpfs drop the map via utf8_unload() in ->put_super() when the last mount reference goes away. A lookup still inside such a filesystem can then read freed memory.