USN-4426-1: linux Ubuntu
Published
Published 27-07-2020Last modified 03-06-2026
Vulnerability summary
USN-4426-1 is a vulnerability in linux Ubuntu with no CVSS score yet.
Priority
Insufficient evidence
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
Not scored
010
No CVSS score recordedEPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 4 · Downstream 0 · Related 4Timeline
- 27-07-2020PublishedVulnerability first disclosed.
- 03-06-2026Last modifiedVulnerability information updated.
Description
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities Jason A. Donenfeld discovered that the ACPI implementation in the Linux kernel did not properly restrict loading SSDT code from an EFI variable. A privileged attacker could use this to bypass Secure Boot lockdown restrictions and execute arbitrary code in the kernel. (CVE-2019-20908) Fan Yang discovered that the mremap implementation in the Linux kernel did not properly handle DAX Huge Pages. A local attacker with access to DAX storage could use this to gain administrative privileges. (CVE-2020-10757) Mauricio Faria de Oliveira discovered that the aufs implementation in the Linux kernel improperly managed inode reference counts in the vfsub_dentry_open() method. A local attacker could use this vulnerability to cause a denial of service. (CVE-2020-11935) Jason A. Donenfeld discovered that the ACPI implementation in the Linux kernel did not properly restrict loading ACPI tables via configfs. A privileged attacker could use this to bypass Secure Boot lockdown restrictions and execute arbitrary code in the kernel. (CVE-2020-15780)
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: not stated in public data.
Ubuntu14 products
- linux< 4.15.0-112.113
- linux-aws< 4.15.0-1079.83
- linux-aws-hwe< 4.15.0-1079.83~16.04.1
- linux-azure< 4.15.0-1092.102~16.04.1
- linux-azure-4.15< 4.15.0-1092.102
- linux-gcp< 4.15.0-1080.90~16.04.1
- linux-gcp-4.15< 4.15.0-1080.90
- linux-gke-4.15< 4.15.0-1066.69
- linux-hwe< 4.15.0-112.113~16.04.1
- linux-kvm< 4.15.0-1071.72
- linux-oem< 4.15.0-1093.103
- linux-oracle< 4.15.0-1050.54~16.04.1 | < 4.15.0-1050.54
- linux-raspi2< 4.15.0-1067.71
- linux-snapdragon< 4.15.0-1083.91
1 vendor · 14 products
References
5 linksRelated vulnerabilities
Insufficient evidenceLSN-0122-1ubuntu · linux +16 moreubuntu linuxKernel Live Patch Security Notice
In the Linux kernel, the following vulnerability has been
resolved: fs: dlm: fix use after free in midcomms commit While working on
processing dlm message in softirq context I experienced the following KASAN
use-after-free warning: .
In the Linux kernel, the following vulnerability has been
resolved: wifi: brcmfmac: Fix oops due to NULL pointer dereference in
brcmf_sdiod_sglist_rw() This patch fixes a NULL pointer dereference bug in
brcmfmac that occurs when a high 'sd_sgentry_align' value applies (e.g.
512) and a lot of queued SKBs are sent from the pkt queue.
In the Linux kernel, the following vulnerability has been
resolved: padata: fix UAF in padata_reorder A bug was found when run ltp
test: BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0 Read
of size 4 at addr ffff88bbfe003524 by task kworker/u113:2/3039206 CPU: 0
PID: 3039206 Comm: kworker/u113:2 Kdump: loaded Not tainted 6.6.0+
Workqueue: pdecrypt_parallel padata_parallel_worker Call Trace: <TASK>
dump_stack_lvl+0x32/0x50 print_address_description.constprop.0+0x6b/0x3d0
print_report+0xdd/0x2c0 kasan_report+0xa5/0xd0 padata_find_next+0x29/0x1a0
padata_reorder+0x131/0x220 padata_parallel_worker+0x3d/0xc0
process_one_work+0x2ec/0x5a0 If 'mdelay(10)' is added before calling
'padata_find_next' in the 'padata_reorder' function, this issue could be
reproduced easily with ltp test (pcrypt_aead01).
In the Linux kernel, the following vulnerability has been
resolved: geneve: Fix use-after-free in geneve_find_dev().
In the Linux kernel, the following vulnerability has been
resolved: ksmbd: fix use-after-free in ksmbd_sessions_deregister() In
multichannel mode, UAF issue can occur in session_deregister when the
second channel sets up a session through the connection of the first
channel.
In the Linux kernel, the following vulnerability has been
resolved: netfilter: nft_tunnel: fix geneve_opt type confusion addition
When handling multiple NFTA_TUNNEL_KEY_OPTS_GENEVE attributes, the parsing
logic should place every geneve_opt structure one by one compactly.
In the Linux kernel, the following vulnerability has been
resolved: ext4: ignore xattrs past end Once inside
'ext4_xattr_inode_dec_ref_all' we should ignore xattrs entries past the
'end' entry.
In the Linux kernel, the following vulnerability has been
resolved: ksmbd: fix use-after-free in __smb2_lease_break_noti() Move
tcp_transport free to ksmbd_conn_free.
In the Linux kernel, the following vulnerability has been
resolved: ksmbd: Fix dangling pointer in krb_authenticate krb_authenticate
frees sess->user and does not set the pointer to NULL.
In the Linux kernel, the following vulnerability has been
resolved: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
Similarly to the previous patch, we need to safe guard hfsc_dequeue() too.
But for this one, we don't have a reliable reproducer.)(CVE-2025-37823).
In the Linux kernel, the following vulnerability has been
resolved: jbd2: remove wrong sb->s_sequence check Journal emptiness is not
determined by sb->s_sequence .
In the Linux kernel, the following vulnerability has been
resolved: drm/amdkfd: Fix mode1 reset crash issue If HW scheduler hangs and
mode1 reset is used to recover GPU, KFD signal user space to abort the
processes.
In the Linux kernel, the following vulnerability has been
resolved: drm/xe: Use local fence in error path of xe_migrate_clear The
intent of the error path in xe_migrate_clear is to wait on locally
generated fence and then return.
In the Linux kernel, the following vulnerability has been
resolved: net_sched: qfq: Fix double list add in class with netem as child
qdisc As described in Gerrard's report .
In the Linux kernel, the following vulnerability has been
resolved: net_sched: ets: Fix double list add in class with netem as child
qdisc As described in Gerrard's report .
In the Linux kernel, the following vulnerability has been
resolved: vxlan: vnifilter: Fix unlocked deletion of default FDB entry When
a VNI is deleted from a VXLAN device in 'vnifilter' mode, the FDB entry
associated with the default remote (assuming one was configured) is deleted
without holding the hash lock.
In the Linux kernel, the following vulnerability has been
resolved: wifi: ath12k: Fix invalid data access in
ath12k_dp_rx_h_undecap_nwifi In certain cases, hardware might provide
packets with a length greater than the maximum native Wi-Fi header length.
This can lead to accessing and modifying fields in the header within the
ath12k_dp_rx_h_undecap_nwifi function for DP_RX_DECAP_TYPE_NATIVE_WIFI
decap type and potentially resulting in invalid data access and memory
corruption.
In the Linux kernel, the following vulnerability has been
resolved: wifi: ath12k: Fix invalid entry fetch in
ath12k_dp_mon_srng_process Currently, ath12k_dp_mon_srng_process uses
ath12k_hal_srng_src_get_next_entry to fetch the next entry from the
destination ring.
In the Linux kernel, the following vulnerability has been
resolved: ksmbd: Fix UAF in __close_file_table_ids A use-after-free is
possible if one thread destroys the file via __ksmbd_close_fd while another
thread holds a reference to it.
In the Linux kernel, the following vulnerability has been
resolved: RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 .
In the Linux kernel, the following vulnerability has been
resolved: crypto: algif_hash - fix double free in hash_accept If accept(2)
is called on socket type algif_hash with MSG_MORE flag set and
crypto_ahash_import fails, sk2 is freed.
In the Linux kernel, the following vulnerability has been
resolved: net/sched: fix use-after-free in taprio_dev_notifier Since
taprio’s taprio_dev_notifier() isn’t protected by an RCU read-side critical
section, a race with advance_sched() can lead to a use-after-free.
In the Linux kernel, the following vulnerability has been
resolved: page_pool: Fix use-after-free in page_pool_recycle_in_ring syzbot
reported a uaf in page_pool_recycle_in_ring: BUG: KASAN: slab-use-after-
free in lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862 Read of size
8 at addr ffff8880286045a0 by task syz.0.284/6943 CPU: 0 UID: 0 PID: 6943
Comm: syz.0.284 Not tainted 6.13.0-rc3-syzkaller-gdfa94ce54f41 #0 Hardware
name: Google Google Compute Engine/Google Compute Engine, BIOS Google
09/13/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 .
In the Linux kernel, the following vulnerability has been
resolved: net: openvswitch: Fix the dead loop of MPLS parse The unexpected
MPLS packet may not end with the bottom label stack.
In the Linux kernel, the following vulnerability has been
resolved: RDMA/iwcm: Fix use-after-free of work objects after cm_id
destruction The commit 59c68ac31e15 ('iw_cm: free cm_id resources on the
last deref') simplified cm_id resource management by freeing cm_id once all
references to the cm_id were removed.
In the Linux kernel, the following vulnerability has been
resolved: ipc: fix to protect IPCS lookups using RCU syzbot reported that
it discovered a use-after-free vulnerability, .
In the Linux kernel, the following vulnerability has been
resolved: media: vivid: Change the siize of the composing syzkaller found a
bug: BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern
drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2608 .
In the Linux kernel, the following vulnerability has been
resolved: bridge: mcast: Fix use-after-free during router port
configuration The bridge maintains a global list of ports behind which a
multicast router resides.
In the Linux kernel, the following vulnerability has been
resolved: s390/pkey: Prevent overflow in size calculation for memdup_user()
Number of apqn target list entries contained in 'nr_apqns' variable is
determined by userspace via an ioctl call so the result of the product in
calculation of size passed to memdup_user() may overflow.
In the Linux kernel, the following vulnerability has been
resolved: eventpoll: don't decrement ep refcount while still holding the ep
mutex Jann Horn points out that epoll is decrementing the ep refcount and
then doing a mutex_unlock(&ep->mtx); afterwards.
In the Linux kernel, the following vulnerability has been
resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and
posix_cpu_timer_del() If an exiting non-autoreaping task has already passed
exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be
reaped by its parent or debugger right after unlock_task_sighand().
In the Linux kernel, the following vulnerability has been
resolved: rose: fix dangling neighbour pointers in rose_rt_device_down()
There are two bugs in rose_rt_device_down() that can cause use-after-free:
1.
In the Linux kernel, the following vulnerability has been
resolved: mtk-sd: Prevent memory corruption from DMA map failure If
msdc_prepare_data() fails to map the DMA region, the request is not
prepared for data receiving, but msdc_start_data() proceeds the DMA with
previous setting.
In the Linux kernel, the following vulnerability has been
resolved: NFC: nci: uart: Set tty->disc_data only in success path Setting
tty->disc_data before opening the NCI device means we need to clean it up
on error paths.
In the Linux kernel, the following vulnerability has been
resolved: i2c: tegra: check msg length in SMBUS block read For SMBUS block
read, do not continue to read if the message length passed from the device
is '0' or greater than the maximum allowed bytes.)(CVE-2025-38425).
In the Linux kernel, the following vulnerability has been
resolved: ksmbd: fix potential use-after-free in oplock/lease break ack If
ksmbd_iov_pin_rsp return error, use-after-free can happen by accessing
opinfo->state and opinfo_put and ksmbd_fd_put could called twice.)(CVE-2025-38437).
In the Linux kernel, the following vulnerability has been
resolved: tipc: Fix use-after-free in tipc_conn_close().
In the Linux kernel, the following vulnerability has been
resolved: HID: core: do not bypass hid_hw_raw_request hid_hw_raw_request()
is actually useful to ensure the provided buffer and length are valid.
Directly calling in the low level transport driver function bypassed those
checks and allowed invalid paramto be used.)(CVE-2025-38494).
In the Linux kernel, the following vulnerability has been
resolved: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() pmc->idev is
still used in ip6_mc_clear_src(), so as mld_clear_delrec() does, the
reference should be put after ip6_mc_clear_src() return.)(CVE-2025-38550).
In the Linux kernel, the following vulnerability has been
resolved: net/packet: fix a race in packet_set_ring() and packet_notifier()
When packet_set_ring() releases po->bind_lock, another thread can run
packet_notifier() and process an NETDEV_UP event.
In the Linux kernel, the following vulnerability has been
resolved: jfs: upper bound check of tree index in dbAllocAG When computing
the tree index in dbAllocAG, we never check if we are out of bounds
realative to the size of the stree.
In the Linux kernel, the following vulnerability has been
resolved: fs/ntfs3: Add sanity check for file name The length of the file
name should be smaller than the directory entry size.)(CVE-2025-38707).
In the Linux kernel, the following vulnerability has been
resolved: nfsd: handle get_client_locked() failure in
nfsd4_setclientid_confirm() Lei Lu recently reported that
nfsd4_setclientid_confirm() did not check the return value from
get_client_locked().
In the Linux kernel, the following vulnerability has been
resolved: io_uring/net: commit partial buffers on retry Ring provided
buffers are potentially only valid within the single execution context in
which they were acquired.
In the Linux kernel, the following vulnerability has been
resolved: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() The
function needs to check the minimal filehandle length before it can access
the embedded filehandle.)(CVE-2025-39730).
In the Linux kernel, the following vulnerability has been
resolved: jfs: fix slab-out-of-bounds read in ea_get() During the
'size_check' label in ea_get(), the code checks if the extended attribute
list (xattr) size matches ea_size.
In the Linux kernel, the following vulnerability has been
resolved: jfs: truncate good inode pages when hard link is 0 The fileset
value of the inode copy from the disk by the reproducer is AGGR_RESERVED_I.
When executing evict, its hard link number is 0, so its inode pages are not
truncated.
In the Linux kernel, the following vulnerability has been
resolved: bus: mhi: host: Detect events pointing to unexpected TREs When a
remote device sends a completion event to the host, it contains a pointer
to the consumed TRE.
In the Linux kernel, the following vulnerability has been
resolved: HID: asus: fix UAF via HID_CLAIMED_INPUT validation After
hid_hw_start() is called hidinput_connect() will eventually be called to
set up the device with the input layer since the HID_CONNECT_DEFAULT
connect mask is used.
In the Linux kernel, the following vulnerability has been
resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path
Fix a use-after-free window by correcting the buffer release sequence in
the deferred receive path.
In the Linux kernel, the following vulnerability has been
resolved: wifi: cfg80211: sme: cap SSID length in
__cfg80211_connect_result() If the ssid->datalen is more than
IEEE80211_MAX_SSID_LEN (32) it would lead to memory corruption so add some
bounds checking.)(CVE-2025-39849).
In the Linux kernel, the following vulnerability has been
resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
syzbot reported the splat below without a repro.
In the Linux kernel, the following vulnerability has been
resolved: wifi: brcmfmac: fix use-after-free when rescheduling
brcmf_btcoex_info work The brcmf_btcoex_detach() only shuts down the btcoex
timer, if the flag timer_on is false.
In the Linux kernel, the following vulnerability has been
resolved: wifi: cfg80211: fix use-after-free in cmp_bss() Following
bss_free() quirk introduced in commit 776b3580178f ('cfg80211: track hidden
SSID networks properly'), adjust cfg80211_update_known_bss() to free the
last beacon frame elements only if they're not shared via the corresponding
'hidden_beacon_bss' pointer.)(CVE-2025-39864).
In the Linux kernel, the following vulnerability has been
resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-
after-free issue occurred when __mark_inode_dirty() get the bdi_writeback
that was in the progress of switching.
In the Linux kernel, the following vulnerability has been
resolved: kernfs: Fix UAF in polling when open file is released A use-
after-free (UAF) vulnerability was identified in the PSI (Pressure Stall
Information) monitoring mechanism: BUG: KASAN: slab-use-after-free in
psi_trigger_poll+0x3c/0x140 Read of size 8 at addr ffff3de3d50bd308 by task
systemd/1 psi_trigger_poll+0x3c/0x140 cgroup_pressure_poll+0x70/0xa0
cgroup_file_poll+0x8c/0x100 kernfs_fop_poll+0x11c/0x1c0
ep_item_poll.isra.0+0x188/0x2c0 Allocated by task 1:
cgroup_file_open+0x88/0x388 kernfs_fop_open+0x73c/0xaf0
do_dentry_open+0x5fc/0x1200 vfs_open+0xa0/0x3f0 do_open+0x7e8/0xd08
path_openat+0x2fc/0x6b0 do_filp_open+0x174/0x368 Freed by task 8462:
cgroup_file_release+0x130/0x1f8 kernfs_drain_open_files+0x17c/0x440
kernfs_drain+0x2dc/0x360 kernfs_show+0x1b8/0x288
cgroup_file_show+0x150/0x268 cgroup_pressure_write+0x1dc/0x340
cgroup_file_write+0x274/0x548 Reproduction Steps: 1.
In the Linux kernel, the following vulnerability has been
resolved: svcrdma: bound check rq_pages index in inline path
svc_rdma_copy_inline_range indexed rqstp->rq_pages.
In the Linux kernel, the following vulnerability has been
resolved: Bluetooth: btusb: revert use of devm_kzalloc in btusb This
reverts commit 98921dbd00c4e ('Bluetooth: Use devm_kzalloc in btusb.c
file').
In the Linux kernel, the following vulnerability has been
resolved: iommu: disable SVA when CONFIG_X86 is set Patch series 'Fix stale
IOTLB entries for kernel address space', v7.
In the Linux kernel, the following vulnerability has been
resolved: dmaengine: tegra-adma: Fix use-after-free A use-after-free bug
exists in the Tegra ADMA driver when audio streams are terminated,
particularly during XRUN conditions.
In the Linux kernel, the following vulnerability has been
resolved: mm/page_alloc: prevent pcp corruption with SMP.
In the Linux kernel, the following vulnerability has been
resolved: net/sched: Enforce that teql can only be used as root qdisc
Design intent of teql is that it is only supposed to be used as root qdisc.
We need to check for that constraint.
In the Linux kernel, the following vulnerability has been
resolved: net/sched: qfq: Use cl_is_active to determine whether class is
active in qfq_rm_from_ag This is more of a preventive patch to make the
code more consistent and to prevent possible exploits that employ child
qlen manipulations on qfq.
In the Linux kernel, the following vulnerability has been
resolved: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() syzbot and
Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id() and/or
mptcp_pm_nl_is_backup() Root cause is list_splice_init() in
mptcp_pm_nl_flush_addrs_doit() which is not RCU ready.
list_splice_init_rcu() can not be called here while holding pernet->lock
spinlock.
In the Linux kernel, the following vulnerability has been
resolved: macvlan: fix error recovery in macvlan_common_newlink() valis
provided a nice repro to crash the kernel: ip link add p1 type veth peer p2
ip link set address 00:00:00:00:00:20 dev p1 ip link set up dev p1 ip link
set up dev p2 ip link add mv0 link p2 type macvlan mode source ip link add
invalid% link p2 type macvlan mode source macaddr add 00:00:00:00:00:20
ping -c1 -I p1 1.2.3.4 He also gave a very detailed analysis: <quote valis>
The issue is triggered when a new macvlan link is created with
MACVLAN_MODE_SOURCE mode and MACVLAN_MACADDR_ADD (or MACVLAN_MACADDR_SET)
parameter, lower device already has a macvlan port and register_netdevice()
called from macvlan_common_newlink() fails (e.g.
In the Linux kernel, the following vulnerability has been
resolved: scsi: target: iscsi: Fix use-after-free in
iscsit_dec_conn_usage_count() In iscsit_dec_conn_usage_count(), the
function calls complete() while holding the conn->conn_usage_lock.
In the Linux kernel, the following vulnerability has been
resolved: crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists
correctly The existing allocation of scatterlists in
omap_crypto_copy_sg_lists() was allocating an array of scatterlist
pointers, not scatterlist objects, resulting in a 4x too small allocation.
Use sizeof(*new_sg) to get the correct object size.)(CVE-2026-23222).
In the Linux kernel, the following vulnerability has been
resolved: media: dvb-core: fix wrong reinitialization of ringbuffer on
reopen dvb_dvr_open() calls dvb_ringbuffer_init() when a new reader opens
the DVR device.
In the Linux kernel, the following vulnerability has been
resolved: macvlan: observe an RCU grace period in macvlan_common_newlink()
error path valis reported that a race condition still happens after my
prior patch.
In the Linux kernel, the following vulnerability has been
resolved: nfc: rawsock: cancel tx_work before socket teardown In
rawsock_release(), cancel any pending tx_work and purge the write queue
before orphaning the socket.
In the Linux kernel, the following vulnerability has been
resolved: netfilter: xt_CT: drop pending enqueued packets on template
removal Templates refer to objects that can go away while packets are
sitting in nfqueue refer to: - helper, this can be an issue on module
removal.
In the Linux kernel, the following vulnerability has been
resolved: netfilter: nf_tables: release flowtable after rcu grace period on
error Call synchronize_rcu() after unregistering the hooks from error path,
since a hook that already refers to this flowtable can be already
registered, exposing this flowtable to packet path and nfnetlink_hook
control plane.
In the Linux kernel, the following vulnerability has been
resolved: ksmbd: fix use-after-free of share_conf in compound request
smb2_get_ksmbd_tcon() reuses work->tcon in compound requests without
validating tcon->t_state.
In the Linux kernel, the following vulnerability has been
resolved: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
Syzkaller reported a panic in smc_tcp_syn_recv_sock() .
In the Linux kernel, the following vulnerability has been
resolved: netfilter: nf_conntrack_h323: check for zero length in
DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit
length from the packet, then decrements it by 1 to skip the protocol
discriminator byte before passing it to DecodeH323_UserInformation().
In the Linux kernel, the following vulnerability has been
resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0
replay cache uses a fixed 112-byte inline buffer
(rp_ibuf.
In the Linux kernel, the following vulnerability has been
resolved: media: dvb-net: fix OOB access in ULE extension header tables The
ule_mandatory_ext_handlers.
In the Linux kernel, the following vulnerability has been
resolved: netfilter: nf_conntrack_expect: use expect->helper Use
expect->helper in ctnetlink and /proc to dump the helper name.
In the Linux kernel, the following vulnerability has been
resolved: net: bonding: fix use-after-free in bond_xmit_broadcast()
bond_xmit_broadcast() reuses the original skb for the last slave
(determined by bond_is_last_slave()) and clones it for others.
In the Linux kernel, the following vulnerability has been
resolved: ksmbd: fix potencial OOB in get_file_all_info() for compound
requests When a compound request consists of QUERY_DIRECTORY + QUERY_INFO
(FILE_ALL_INFORMATION) and the first command consumes nearly the entire
max_trans_size, get_file_all_info() would blindly call smbConvertToUTF16()
with PATH_MAX, causing out-of-bounds write beyond the response buffer.
In the Linux kernel, the following vulnerability has been
resolved: dmaengine: idxd: fix possible wrong descriptor completion in
llist_abort_desc() At the end of this function, d is the traversal cursor
of flist, but the code completes found instead.
In the Linux kernel, the following vulnerability has been
resolved: ext4: reject mount if bigalloc with s_first_data_block !.
In the Linux kernel, the following vulnerability has been
resolved: xfs: save ailp before dropping the AIL lock in push callbacks In
xfs_inode_item_push() and xfs_qm_dquot_logitem_push(), the AIL lock is
dropped to perform buffer IO.
In the Linux kernel, the following vulnerability has been
resolved: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is
cleared and napi_tx is false A UAF issue occurs when the virtio_net driver
is configured with napi_tx.
In the Linux kernel, the following vulnerability has been
resolved: media: mc, v4l2: serialize REINIT and REQBUFS with
req_queue_mutex MEDIA_REQUEST_IOC_REINIT can run concurrently with
VIDIOC_REQBUFS(0) queue teardown paths.
In the Linux kernel, the following vulnerability has been
resolved: ksmbd: do not expire session on binding failure When a
multichannel session binding request fails (e.g.
In the Linux kernel, the following vulnerability has been
resolved: ksmbd: replace hardcoded hdr2_len with offsetof() in
smb2_calc_max_out_buf_len() After this commit (e2b76ab8b5c9 'ksmbd: add
support for read compound'), response buffer management was changed to use
dynamic iov array.
In the Linux kernel, the following vulnerability has been
resolved: net: fix fanout UAF in packet_release() via NETDEV_UP race
`packet_release()` has a race window where `NETDEV_UP` can re-register a
socket into a fanout group's `arr.
In the Linux kernel, the following vulnerability has been
resolved: can: raw: fix ro->uniq use-after-free in raw_rcv() raw_release()
unregisters raw CAN receive filters via can_rx_unregister(), but receiver
deletion is deferred with call_rcu().
In the Linux kernel, the following vulnerability has been
resolved: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
cgwb_release_workfn() calls css_put(wb->blkcg_css) and then later accesses
wb->blkcg_css again via blkcg_unpin_online().
In the Linux kernel, the following vulnerability has been
resolved: i2c: s3c24xx: check the size of the SMBUS message before using it
The first byte of an i2c SMBUS message is the size, and it should be
verified to ensure that it is in the range of 0..I2C_SMBUS_BLOCK_MAX before
processing it.
In the Linux kernel, the following vulnerability has been
resolved: drm/i915/gt: fix refcount underflow in
intel_engine_park_heartbeat A use-after-free / refcount underflow is
possible when the heartbeat worker and intel_engine_park_heartbeat() race
to release the same engine->heartbeat.systole request.
In the Linux kernel, the following vulnerability has been
resolved: batman-adv: hold claim backbone gateways by reference
batadv_bla_add_claim() can replace claim->backbone_gw and drop the old
gateway's last reference while readers still follow the pointer.
In the Linux kernel, the following vulnerability has been
resolved: af_unix: read UNIX_DIAG_VFS data under unix_state_lock Exact UNIX
diag lookups hold a reference to the socket, but not to u->path.
In the Linux kernel, the following vulnerability has been
resolved: net: ipv6: flowlabel: defer exclusive option free until RCU
teardown `ip6fl_seq_show()` walks the global flowlabel hash under the seq-
file RCU read-side lock and prints `fl->opt->opt_nflen` when an option
block is present.
In the Linux kernel, the following vulnerability has been
resolved: fuse: reject oversized dirents in page cache
fuse_add_dirent_to_cache() computes a serialized dirent size from the
server-controlled namelen field and copies the dirent into a single page-
cache page.
In the Linux kernel, the following vulnerability has been
resolved: wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
Currently we execute `SET_NETDEV_DEV(dev, &priv->lowerdev->dev)` for the
virt_wifi net devices.
In the Linux kernel, the following vulnerability has been
resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
smb2_get_ea() applies 4-byte alignment padding via memset() after writing
each EA entry.
In the Linux kernel, the following vulnerability has been
resolved: ksmbd: validate num_aces and harden ACE walk in
smb_inherit_dacl() smb_inherit_dacl() trusts the on-disk num_aces value
from the parent directory's DACL xattr and uses it to size a heap
allocation: aces_base .
In the Linux kernel, the following vulnerability has been
resolved: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO
path smb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL
and the default QUERY_INFO path.
In the Linux kernel, the following vulnerability has been
resolved: fs/ntfs3: validate rec->used in journal-replay file record check
check_file_record() validates rec->total against the record size but never
validates rec->used.
In the Linux kernel, the following vulnerability has been
resolved: usb: gadget: f_uac1_legacy: validate control request size
f_audio_complete() copies req->length bytes into a 4-byte stack variable:
u32 data .
In the Linux kernel, the following vulnerability has been
resolved: usb: typec: ucsi: validate connector number in
ucsi_notify_common() The connector number extracted from CCI via
UCSI_CCI_CONNECTOR() is a 7-bit field (0-127) that is used to index into
the connector array in ucsi_connector_change().
In the Linux kernel, the following vulnerability has been
resolved: usb: usbtmc: Flush anchored URBs in usbtmc_release When calling
usbtmc_release, pending anchored URBs must be flushed or killed to prevent
use-after-free errors (e.g.
In the Linux kernel, the following vulnerability has been
resolved: usb: ulpi: fix double free in ulpi_register_interface() error
path When device_register() fails, ulpi_register() calls put_device() on
ulpi->dev.
In the Linux kernel, the following vulnerability has been
resolved: wifi: wilc1000: fix u8 overflow in SSID scan buffer size
calculation The variable valuesize is declared as u8 but accumulates the
total length of all SSIDs to scan.
In the Linux kernel, the following vulnerability has been
resolved: bpf: sockmap: Fix use-after-free of sk->sk_socket in
sk_psock_verdict_data_ready().
In the Linux kernel, the following vulnerability has been
resolved: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
hci_conn lookup and field access must be covered by hdev lock in
set_cig_params_sync, otherwise it's possible it is freed concurrently.
In the Linux kernel, the following vulnerability has been
resolved: Bluetooth: SCO: fix race conditions in sco_sock_connect()
sco_sock_connect() checks sk_state and sk_type without holding the socket
lock.
In the Linux kernel, the following vulnerability has been
resolved: bpf: Fix regsafe() for pointers to packet In case
rold->reg->range .
In the Linux kernel, the following vulnerability has been
resolved: ipv6: icmp: clear skb2->cb.
In the Linux kernel, the following vulnerability has been
resolved: HID: multitouch: Check to ensure report responses match the
request It is possible for a malicious (or clumsy) device to respond to a
specific report's feature request using a completely different report ID.
This can cause confusion in the HID core resulting in nasty side-effects
such as OOB writes.
In the Linux kernel, the following vulnerability has been
resolved: HID: logitech-hidpp: Prevent use-after-free on force feedback
initialisation failure Presently, if the force feedback initialisation
fails when probing the Logitech G920 Driving Force Racing Wheel for Xbox
One, an error number will be returned and propagated before the userspace
infrastructure (sysfs and /dev/input) has been torn down.
In the Linux kernel, the following vulnerability has been
resolved: net: ioam6: fix OOB and missing lock When trace->type.bit6 is
set: if (trace->type.bit6) { ...
In the Linux kernel, the following vulnerability has been
resolved: xfrm: Wait for RCU readers during policy netns exit
xfrm_policy_fini() frees the policy_bydst hash tables after flushing the
policy work items and deleting all policies, but it does not wait for
concurrent RCU readers to leave their read-side critical sections first.
The policy_bydst tables are published via rcu_assign_pointer() and are
looked up through rcu_dereference_check(), so netns teardown must also wait
for an RCU grace period before freeing the table memory.
In the Linux kernel, the following vulnerability has been
resolved: xsk: tighten UMEM headroom validation to account for tailroom and
min frame The current headroom validation in xdp_umem_reg() could leave us
with insufficient space dedicated to even receive minimum-sized ethernet
frame.
In the Linux kernel, the following vulnerability has been
resolved: HID: roccat: fix use-after-free in roccat_report_event
roccat_report_event() iterates over the device->readers list without
holding the readers_lock.
In the Linux kernel, the following vulnerability has been
resolved: RDMA/irdma: Fix double free related to rereg_user_mr If
IB_MR_REREG_TRANS is set during rereg_user_mr, the umem will be released
and a new one will be allocated in irdma_rereg_mr_trans.
In the Linux kernel, the following vulnerability has been
resolved: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() The
kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via
memset without checking the buffer size parameter.
In the Linux kernel, the following vulnerability has been
resolved: drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after
release The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying
the atmel_hlcdc_plane state structure without properly duplicating the
drm_plane_state.
In the Linux kernel, the following vulnerability has been
resolved: dm: clear cloned request bio pointer when last clone bio
completes Stale rq->bio values have been observed to cause double-
initialization of cloned bios in request-based device-mapper targets,
leading to use-after-free and double-free scenarios.
In the Linux kernel, the following vulnerability has been
resolved: xfs: fix undersized l_iclog_roundoff values If the superblock
doesn't list a log stripe unit, we set the incore log roundoff value to
512.
In the Linux kernel, the following vulnerability has been
resolved: drm/amdgpu: Fix use-after-free race in VM acquire Replace non-
atomic vm->process_info assignment with cmpxchg() to prevent race when
parent/child processes sharing a drm_file both try to acquire the same VM
after fork().
In the Linux kernel, the following vulnerability has been
resolved: smb: server: fix use-after-free in smb2_open() The opinfo pointer
obtained via rcu_dereference(fp->f_opinfo) is dereferenced after
rcu_read_unlock(), creating a use-after-free window.)(CVE-2026-43378).
In the Linux kernel, the following vulnerability has been
resolved: ksmbd: validate inherited ACE SID length smb_inherit_dacl() walks
the parent directory DACL loaded from the security descriptor xattr.
In the Linux kernel, the following vulnerability has been
resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG
requests can return EBUSY.
In the Linux kernel, the following vulnerability has been
resolved: rtmutex: Use waiter::task instead of current in remove_waiter()
remove_waiter() is used by the slowlock paths, but it is also used for
proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from
futex_requeue().
In the Linux kernel, the following vulnerability has been
resolved: net/rds: handle zerocopy send cleanup before the message is
queued A zerocopy send can fail after user pages have been pinned but
before the message is attached to the sending socket.
It was discovered that a logic flaw existed in the XFRM ESP-in-TCP
subsystem in the Linux kernel when handling socket buffer fragments. This
flaw is known as Fragnesia. A local attacker could use this to escalate
privileges, or possibly escape a container.)(CVE-2026-43503)
In the Linux kernel, the following vulnerability has been
resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In
rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue'
before copying the SRQ number to user space.
In the Linux kernel, the following vulnerability has been
resolved: fs/ntfs3: prevent infinite loops caused by the next valid being
the same When processing valid within the range .
In the Linux kernel, the following vulnerability has been
resolved: ext4: drop extent cache when splitting extent fails When the
split extent fails, we might leave some extents still being processed and
return an error directly, which will result in stale extent entries
remaining in the extent status tree.
In the Linux kernel, the following vulnerability has been
resolved: smb/client: fix out-of-bounds read in symlink_data() Since
smb2_check_message() returns success without length validation for the
symlink error response, in symlink_data() it is possible for iov->iov_len
to be smaller than sizeof(struct smb2_err_rsp).
In the Linux kernel, the following vulnerability has been
resolved: smb: client: validate dacloffset before building DACL pointers
parse_sec_desc(), build_sec_desc(), and the chown path in
id_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd
before proving a DACL header fits inside the returned security descriptor.
On 32-bit builds a malicious server can return dacloffset near U32_MAX,
wrap the derived DACL pointer below end_of_acl, and then slip past the
later pointer-based bounds checks.
In the Linux kernel, the following vulnerability has been
resolved: procfs: fix missing RCU protection when reading real_parent in
do_task_stat() When reading /proc/.
It was discovered that a logic flaw existed in the XFRM ESP-in-TCP
subsystem in the Linux kernel when handling socket buffer fragments. This
flaw is known as Fragnesia. A local attacker could use this to escalate
privileges, or possibly escape a container.)(CVE-2026-46300)
In the Linux kernel, the following vulnerability has been
resolved: sctp: purge outqueue on stale COOKIE-ECHO handling
sctp_stream_update() is only invoked when the association is moved into
COOKIE_WAIT during association setup/reconfiguration.
In the Linux kernel, the following vulnerability has been
resolved: libceph: Fix potential out-of-bounds access in crush_decode() A
message of type CEPH_MSG_OSD_MAP containing a crush map with at least one
bucket has two fields holding the bucket algorithm.
In the Linux kernel, the following vulnerability has been
resolved: libceph: Fix potential out-of-bounds access in osdmap_decode()
When decoding osd_state and osd_weight from an incoming osdmap in
osdmap_decode(), both are decoded for each osd, i.e., map->max_osd times.
The ceph_decode_need() check only accounts for sizeof(*map->osd_weight)
once.
In the Linux kernel, the following vulnerability has been
resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its
callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-
bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue)
and returns early.
In the Linux kernel, the following vulnerability has been
resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate()
can potentially reallocate the skb it is validating, freeing the old one.
In tipc_buf_append(), it was being called with a pointer to a local
variable which was a copy of the caller's skb pointer.
In the Linux kernel, the following vulnerability has been
resolved: netfilter: conntrack: remove sprintf usage Replace it with
scnprintf, the buffer sizes are expected to be large enough to hold the
result, no need for snprintf+overflow check.
In the Linux kernel, the following vulnerability has been
resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr
before pskb_pull() is problematic since skb->head can change.
In the Linux kernel, the following vulnerability has been
resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing
Fix modification of the received skbuff in rxrpc_input_soft_acks() and a
potential incorrect access of the buffer in a fragmented UDP packet (the
packet would probably have to be deliberately pre-generated as fragmented)
when AF_RXRPC tries to extract the contents of the SACK table by copying
out the contents of the SACK table into a buffer before attempting to parse
AF_RXRPC assumes that it can just call skb_condense() and then validly
access the SACK table from skb->data and that it will be a flat buffer -
but skb_condense() can silently fail to do anything under some
circumstances.
In the Linux kernel, the following vulnerability has been
resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In
drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes
the login request payload length as wc->byte_len minus ISER_HEADERS_LEN
with no lower bound, and login_req_len is a signed int.
In the Linux kernel, the following vulnerability has been
resolved: RDMA/srp: bound SRP_RSP sense copy by the received length
srp_process_rsp() copies sense data from rsp->data + resp_data_len, where
resp_data_len is the full 32-bit value supplied by the SRP target and is
never checked against the number of bytes actually received (wc->byte_len).
The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes
are copied, but the source offset is not bounded.
In the Linux kernel, the following vulnerability has been
resolved: netfilter: nft_tunnel: fix use-after-free on object destroy
nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s
the metadata_dst, ignoring the dst_entry refcount.
In the Linux kernel, the following vulnerability has been
resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error
path returns the current descriptor buffer to the hardware BM pool.
In the Linux kernel, the following vulnerability has been
resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role
Commit 0cb2af2ea66ad ('KVM: x86: Fix shadow paging use-after-free due to
unexpected GFN') fixed a shadow paging mismatch between stored and computed
GFNs; the bug could be triggered by changing a PDE mapping from outside the
guest, and then deleting a memslot.
In the Linux kernel, the following vulnerability has been
resolved: net: openvswitch: reject oversized nested action attrs Open
vSwitch stores generated flow actions as nlattrs, whose nla_len field is
u16.CVSSUnscoredInsufficient evidenceUSN-8819-3ubuntu · linux-aws-hwe +2 moreubuntu linux-aws-hwelinux-aws-hwe, linux-azure, linux-azure-4.15 vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Network file system (NFS) server daemon;
- IPv6 networking;
- Netfilter;
(CVE-2025-38724, CVE-2026-53131, CVE-2026-53221)CVSSUnscoredPrioritiseCVE-2026-53221linux +183 moreip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()In the Linux kernel, the following vulnerability has been resolved:
ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
In vti6_tnl_lookup(), when an exact match for a tunnel fails,
the code falls back to searching for wildcard tunnels:
- Tunnels matching the packet's local address, with any remote address
wildcard remote).
- Tunnels matching the packet's remote address, with any local address
(wildcard local).
However, vti6 stores all these different types of tunnels in the same
hash table (ip6n->tnls_r_l) prone to hash collisions.
The bug is that the fallback search loops in vti6_tnl_lookup() were
missing checks to ensure that the candidate tunnel actually has
a wildcard address.CVSS9.8CriticalEPSS0.58%PrioritiseCVE-2026-53131linux +181 morenetfilter: require Ethernet MAC header before using eth_hdr()In the Linux kernel, the following vulnerability has been resolved:
netfilter: require Ethernet MAC header before using eth_hdr()
`ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and
`hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)`
after either assuming that the skb is associated with an Ethernet
device or checking only that the `ETH_HLEN` bytes at
`skb_mac_header(skb)` lie between `skb->head` and `skb->data`.
Make these paths first verify that the skb is associated with an
Ethernet device, that the MAC header was set, and that it spans at
least a full Ethernet header before accessing `eth_hdr(skb)`.CVSS9.4CriticalEPSS0.43%PrioritiseCVE-2025-38724linux +151 morenfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()In the Linux kernel, the following vulnerability has been resolved:
nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
Lei Lu recently reported that nfsd4_setclientid_confirm() did not check
the return value from get_client_locked(). a SETCLIENTID_CONFIRM could
race with a confirmed client expiring and fail to get a reference. That
could later lead to a UAF.
Fix this by getting a reference early in the case where there is an
extant confirmed client. If that fails then treat it as if there were no
confirmed client found at all.
In the case where the unconfirmed client is expiring, just fail and
return the result from get_client_locked().CVSS9.8CriticalEPSS0.39%RoutineCVE-2021-47620linux +92 moreBluetooth: refactor malicious adv data checkIn the Linux kernel, the following vulnerability has been resolved:
Bluetooth: refactor malicious adv data check
Check for out-of-bound read was being performed at the end of while
num_reports loop, and would fill journal with false positives. Added
check to beginning of loop processing so that it doesn't get checked
after ptr has been advanced.CVSS8.1HighEPSS0.32%