Kernel vulnerabilities (Linux)
31,035 vulnerabilities.
KernelLinuxcan: peak_usb: add bounds check for USB channel index5.1 MediumKernelLinuxcan: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error7.8 HighKernelLinuxcan: peak_usb: validate uCAN receive record lengths5.2 MediumKernelLinuxdrm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size7.8 HighKernelLinuxdrm/vc4: Zero the tile state data array before each BIN job7.8 HighKernelLinuxdrm/panthor: reject firmware sections with oversized data7.8 HighKernelLinuxdrm/panthor: validate firmware interface structure sizes7.8 HighKernelLinuxdrm/amd/pm: fix pptable use-after-free7.8 HighKernelLinuxdrm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport7.8 HighKernelLinuxdrm/amdkfd: fix QID bit leak in pqm_create_queue()1.8 LowKernelLinuxdrm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment7.8 HighKernelLinuxdrm/amdkfd: hold event_mutex while checkpointing CRIU events7.8 HighKernelLinuxdrm/vmwgfx: reject DX_BIND_QUERY without a DX context6.8 MediumKernelLinuxdrm/vmwgfx: validate DRAW_PRIMITIVES header size before division7.8 HighKernelLinuxdrm/vmwgfx: bound DMA command body size against suffix pointer8.8 HighKernelLinuxdrm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failureNo scoreKernelLinuxusb: typec: ucsi: Fix race condition and ordering in port unregistrationNo scoreKernelLinuxdrm/xe: Wait on external BO kernel fences in exec IOCTL7.8 HighKernelLinuxiommu/vt-d: Clear Present bit before tearing down scalable-mode context entry9.3 CriticalKernelLinuxcrypto: sun4i-ss - Remove insecure and unused rng_alg7.8 HighKernelLinuxmedia: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work5.7 MediumKernelLinuxrxrpc: serialize kernel accept preallocation with socket teardown9.8 CriticalKernelLinuxrxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc7.5 HighKernelLinuxrxrpc: Don't move a peeked OOB message onto the pending queue9.8 CriticalKernelLinuxrxrpc: Fix UAF in rxgk_issue_challenge()9.8 CriticalKernelLinuxrxrpc: Fix leak of released call in recvmsg(MSG_PEEK)5.7 MediumKernelLinuxrxrpc: Fix potential infinite loop in rxrpc_recvmsg()7.5 HighKernelLinuxrxrpc: Fix ACKALL packet handling7.5 HighKernelLinuxrxrpc: Fix the reception of a reply packet before data transmission7.5 HighKernelLinuxrxrpc: Fix double unlock in rxrpc_recvmsg()9.8 CriticalKernelLinuxafs: Fix netns teardown to cancel the preallocation charger9.8 CriticalKernelLinuxafs: fix NULL pointer dereference in afs_get_tree()No scoreKernelLinuxafs: handle CB.InitCallBackState3 requests without a server record7.5 HighKernelLinuxfbcon: fix NULL pointer dereference for a console without vc_dataNo scoreKernelLinuxaccel/amdxdna: Fix leak when pinning ubuf pages5.7 MediumKernelLinuxdrm/rockchip: inno-hdmi: Switch to drmm_kzalloc()No scoreKernelLinuxdrm/rockchip: dw_dp: Switch to drmm_kzalloc()No scoreKernelLinuxdrm/gpusvm: Reject VMAs with VM_IO or VM_PFNMAP when creating SVM ranges6.8 MediumKernelLinuxaccel/amdxdna: Adjust size for copy_to_user()7.3 HighKernelLinuxdma-fence: Fix potential tracepoint null pointer dereferencesNo scoreKernelLinuxdrm/radeon: fix integer overflow in radeon_align_pitch()7.8 HighKernelLinuxdrm/radeon: fix memory leak in radeon_ring_restore() on lock failure5.7 MediumKernelLinuxspi: atcspi200: fix use-after-free when driver unbindNo scoreKernelLinuxhfsplus: Remove the duplicate attr inode dirty marking action7.1 HighKernelLinuxwifi: rtw89: fix wrong pci_get_drvdata type in AER handlers8.8 HighKernelLinuxwifi: rtw88: fix wrong pci_get_drvdata type in AER handlers8.8 HighKernelLinuxwifi: rtw89: Correct data type for scan index to avoid infinite loop8.8 HighKernelLinuxwifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer8.1 HighKernelLinuxwifi: rtw89: add bounds check on firmware mac_id in link lookup8.8 HighKernelLinuxwifi: ath9k: fix OOB access from firmware tx status queue ID8.8 High- Show moreLoading…