Latest critical vulnerabilities
CVSS 9.0 and up.
- linuxSUNRPC: pin upper rpc_clnt across the TLS connect_worker9.8 Critical
- linuxdm era: fix NULL pointer dereference in metadata_open()9.8 Critical
- linuxtipc: restrict socket queue dumps in enqueue tracepoints9.8 Critical
- linuxnet: ife: require ETH_HLEN to be pullable in ife_decode()9.1 Critical
- linuxKVM: s390: Fix unlikely race in try_get_locked_pte()9.3 Critical
- linuxKVM: arm64: vgic: Check the interrupt is still ours before migrating it9.3 Critical
- linuxKVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling9.3 Critical
- linuxKVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR9.0 Critical
- linuxKVM: arm64: nv: Re-translate VNCR before injecting abort9.3 Critical
- linuxKVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory9.3 Critical
- linuxnetfilter: nf_nat_sip: reload possible stale data pointer9.8 Critical
- linuxnetfilter: flowtable: use dst in this direction when pushing IPIP header9.8 Critical
- linuxnetfilter: flowtable: support IPIP tunnel with direct xmit9.8 Critical
- linuxx86/virt/sev: Revert "Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN"9.3 Critical
- linuxbatman-adv: access unicast_ttvn skb->data only after skb realloc9.8 Critical
- linuxbatman-adv: tt: prevent TVLV OOB check overflow9.8 Critical
- linuxsunrpc: pin svc_xprt across the asynchronous TLS handshake callback9.8 Critical
- linuxsunrpc: wait for in-flight TLS handshake callback when cancel loses race9.8 Critical
- linuxsunrpc: harden rq_procinfo lifecycle to prevent double-free9.8 Critical
- linuxSUNRPC: Bound-check xdr_buf_to_bvec() stores before writing9.8 Critical
- linuxntfs: grow index root value before reparent header update9.8 Critical
- linuxntfs: fix off-by-one in mapping pairs decoding bounds checks9.8 Critical
- linuxntfs: validate attribute values on lookup9.8 Critical
- linuxntfs: add bounds check before accessing EA entries9.8 Critical
- linuxntfs: not change 0-byte $DATA attribute to non-resident9.8 Critical
- linuxntfs: validate index block header more strictly9.8 Critical
- linuxntfs: validate index entries on reading9.8 Critical
- linuxntfs: detect mapping-pairs LCN accumulator overflow9.8 Critical
- linuxntfs: validate resident index root values on lookup9.8 Critical
- linuxfs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow9.8 Critical
- linuxntfs3: bound to_move in indx_insert_into_root before hdr_insert_head9.8 Critical
- linuxntfs3: validate split-point offset in indx_insert_into_buffer9.8 Critical
- linuxntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()9.1 Critical
- linuxntfs: make system files immutable to prevent corruption9.1 Critical
- linuxntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock()9.8 Critical
- linuxtcp: defer md5sig_info kfree past RCU grace period in tcp_connect9.8 Critical
- linuxxfrm: nat_keepalive: avoid double free on send error9.8 Critical
- linuxnvmet-auth: reject short AUTH_RECEIVE buffers9.8 Critical
- linuxnvmet-rdma: handle inline data with a nonzero offset9.8 Critical
- linuxdm-ioctl: fix a possible overflow in list_version_get_info9.8 Critical
- linuxdm-verity: fix buffer overflow in FEC calculation9.8 Critical
- linuxscsi: xen: scsiback: Free unsubmitted command instead of double-putting it9.3 Critical
- linuxscsi: target: Bound PR-OUT TransportID parsing to the received buffer9.8 Critical
- linuxscsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE9.8 Critical
- linuxlocking/rt: Fix the incorrect RCU protection in rt_spin_unlock()9.8 Critical
- linuxnet: mana: Validate the packet length reported by the NIC9.8 Critical
- linuxnet: mana: Sync page pool RX frags for CPU9.8 Critical
- linuxgve: fix header buffer corruption with header-split and HW-GRO9.8 Critical
- linuxespintcp: use sk_msg_free_partial to fix partial send9.8 Critical
- linuxorangefs: keep the readdir entry size 64-bit in fill_from_part()9.8 Critical
- Show moreLoading…