| CRITICAL | | 9.1 | | CVE-2026-58016 | libglib2.0-0t64 | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" |
| CRITICAL | | 9.1 | | CVE-2026-58016 | libglib2.0-data | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" |
| CRITICAL | | 9.1 | | CVE-2026-13221 | libperl5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | perl: Perl: Incorrect regular expression processing via large regular expressions |
| CRITICAL | | 9.1 | | CVE-2026-42496 | libperl5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access |
| CRITICAL | | 9.8 | | CVE-2026-8376 | libperl5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds |
| CRITICAL | | 9.8 | | CVE-2026-6653 | libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | | libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free |
| CRITICAL | | | | CVE-2026-93221 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| CRITICAL | | | | CVE-2026-93221 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| CRITICAL | | | | CVE-2026-93221 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| CRITICAL | | | | CVE-2026-93221 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| CRITICAL | | | | CVE-2026-93221 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| CRITICAL | | | | CVE-2026-93221 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| CRITICAL | | | | CVE-2026-93221 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| CRITICAL | | | | CVE-2026-93221 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| CRITICAL | | | | CVE-2026-93221 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| CRITICAL | | | | CVE-2026-93221 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| CRITICAL | | | | CVE-2026-93221 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| CRITICAL | | | | CVE-2026-93221 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| CRITICAL | | | | CVE-2026-93221 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| CRITICAL | | | | CVE-2026-93221 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| CRITICAL | | | | CVE-2026-93221 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| CRITICAL | | 9.4 | | CVE-2026-60002 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side |
| CRITICAL | | 9.4 | | CVE-2026-60002 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side |
| CRITICAL | | 9.4 | | CVE-2026-60002 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side |
| CRITICAL | | 9.1 | | CVE-2026-13221 | perl-base | 5.40.1-6 | 5.40.1-6+deb13u1 | perl: Perl: Incorrect regular expression processing via large regular expressions |
| CRITICAL | | 9.1 | | CVE-2026-42496 | perl-base | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access |
| CRITICAL | | 9.8 | | CVE-2026-8376 | perl-base | 5.40.1-6 | 5.40.1-6+deb13u1 | perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds |
| CRITICAL | | 9.1 | | CVE-2026-13221 | perl-modules-5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | perl: Perl: Incorrect regular expression processing via large regular expressions |
| CRITICAL | | 9.1 | | CVE-2026-42496 | perl-modules-5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access |
| CRITICAL | | 9.8 | | CVE-2026-8376 | perl-modules-5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds |
| CRITICAL | | 9.1 | | CVE-2026-13221 | perl | 5.40.1-6 | 5.40.1-6+deb13u1 | perl: Perl: Incorrect regular expression processing via large regular expressions |
| CRITICAL | | 9.1 | | CVE-2026-42496 | perl | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access |
| CRITICAL | | 9.8 | | CVE-2026-8376 | perl | 5.40.1-6 | 5.40.1-6+deb13u1 | perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds |
| CRITICAL | | 9.1 | | CVE-2026-102266 | python3-jwt | 2.10.1-2+deb13u1 | | pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance |
| CRITICAL | | 9.1 | | CVE-2026-102267 | python3-jwt | 2.10.1-2+deb13u1 | | pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects |
| CRITICAL | | 9.1 | | CVE-2026-102268 | python3-jwt | 2.10.1-2+deb13u1 | | pyjwt: PyJWT: Authentication bypass via improper public key validation |
| CRITICAL | | 9.4 | | CVE-2026-60002 | ssh | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side |
| CRITICAL | | | | GHSA-6q48-6c7w-9gw2 | certifi | 2025.1.31 | 2026.10.19 | certifi bundles emSign root CAs with compromised intermediate CA keys |
| CRITICAL | | 9.1 | | CVE-2026-102268 | pyjwt | 2.10.1 | 2.14.0 | pyjwt: PyJWT: Authentication bypass via improper public key validation |
| HIGH | | 7.8 | | CVE-2026-14266 | 7zip | 25.01+dfsg-1~deb13u2 | | 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Executio ... |
| HIGH | | | | CVE-2026-48095 | 7zip | 25.01+dfsg-1~deb13u2 | | 7-Zip is a file archiver with a high compression ratio. Versions 26.00 ... |
| HIGH | | 8 | | CVE-2023-44431 | bluez | 5.82-1.1+rpt1 | | bluez: AVRCP stack-based buffer overflow remote code execution vulnerability |
| HIGH | | 8 | | CVE-2026-19774 | bluez | 5.82-1.1+rpt1 | | bluez: BlueZ: Arbitrary Code Execution via A2DP Stack-based Buffer Overflow |
| HIGH | | 7.6 | | CVE-2026-80186 | bluez | 5.82-1.1+rpt1 | | bluez: Stack Overflow in name2utf8 causes DoS and potential code execution |
| HIGH | | 7.1 | | CVE-2026-85218 | bluez | 5.82-1.1+rpt1 | | bluez: bluez: AVRCP ListPlayerAttributes double stack overflow in avrcp_list_player_attributes_rsp/avrcp_get_current_pla |
| HIGH | | 7 | | CVE-2026-53612 | bsdextrautils | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes |
| HIGH | | 7 | | CVE-2026-53613 | bsdextrautils | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path |
| HIGH | | 7 | | CVE-2026-53614 | bsdextrautils | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 |
| HIGH | | 8 | | CVE-2026-53615 | bsdextrautils | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser |
| HIGH | | 7.8 | | CVE-2026-76642 | bsdextrautils | 2.41-5 | | util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks |
| HIGH | | 7.9 | | CVE-2026-78408 | bsdextrautils | 2.41-5 | | util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority |
| HIGH | | 7 | | CVE-2026-78409 | bsdextrautils | 2.41-5 | | util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks |
| HIGH | | 7.8 | | CVE-2026-78410 | bsdextrautils | 2.41-5 | | util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection |
| HIGH | | 7 | | CVE-2026-53612 | bsdutils | 1:2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes |
| HIGH | | 7 | | CVE-2026-53613 | bsdutils | 1:2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path |
| HIGH | | 7 | | CVE-2026-53614 | bsdutils | 1:2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 |
| HIGH | | 8 | | CVE-2026-53615 | bsdutils | 1:2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser |
| HIGH | | 7.8 | | CVE-2026-76642 | bsdutils | 1:2.41-5 | | util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks |
| HIGH | | 7.9 | | CVE-2026-78408 | bsdutils | 1:2.41-5 | | util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority |
| HIGH | | 7 | | CVE-2026-78409 | bsdutils | 1:2.41-5 | | util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks |
| HIGH | | 7.8 | | CVE-2026-78410 | bsdutils | 1:2.41-5 | | util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection |
| HIGH | | 7.8 | | CVE-2023-39810 | busybox | 1:1.37.0-6+b8 | | busybox: CPIO command of Busybox allows attackers to execute a directory traversal |
| HIGH | | 7 | | CVE-2026-26157 | busybox | 1:1.37.0-6+b8 | | busybox: BusyBox: Arbitrary file overwrite and potential code execution via incomplete path sanitization |
| HIGH | | 7 | | CVE-2026-26158 | busybox | 1:1.37.0-6+b8 | | busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries |
| HIGH | | 8.8 | | CVE-2026-29004 | busybox | 1:1.37.0-6+b8 | | BusyBox: BusyBox: Arbitrary Code Execution via DHCPv6 Client Heap Buffer Overflow |
| HIGH | | 7.5 | | CVE-2026-38754 | busybox | 1:1.37.0-6+b8 | | busybox: Busybox: Denial of Service via heap overflow in ifsbreakup() function |
| HIGH | | 7.5 | | CVE-2026-88830 | busybox | 1:1.37.0-6+b8 | | busybox: busybox: TLS Montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflow |
| HIGH | | 7.3 | | CVE-2026-88832 | busybox | 1:1.37.0-6+b8 | | busybox: busybox: romfs volume ID parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow |
| HIGH | | 7.8 | | CVE-2026-90954 | busybox | 1:1.37.0-6+b8 | | busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush |
| HIGH | | 7.8 | | CVE-2026-104715 | cifs-utils | 2:7.4-1 | 2:7.4-1+deb13u1 | cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass |
| HIGH | | 7.8 | | CVE-2026-12505 | cifs-utils | 2:7.4-1 | 2:7.4-1+deb13u1 | cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall |
| HIGH | | 7.5 | | CVE-2026-12064 | curl | 8.14.1-2+deb13u3 | | curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP |
| HIGH | | 7.5 | | CVE-2026-5773 | curl | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse |
| HIGH | | 7.5 | | CVE-2026-6276 | curl | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers |
| HIGH | | 8.1 | | CVE-2026-8286 | curl | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u7 | curl: curl: Insecure connection establishment due to TLS configuration mismatch |
| HIGH | | 8.1 | | CVE-2026-8458 | curl | 8.14.1-2+deb13u3 | | curl: libcurl: Unauthorized connection reuse due to a logical error |
| HIGH | | 9.1 | | CVE-2026-8927 | curl | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u7 | curl: Information disclosure due to uncleared proxy authentication state |
| HIGH | | 8.1 | | CVE-2026-92392 | curl | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u7 | curl: curl: HTTP/2 upload Use-After-Free |
| HIGH | | 8.4 | | CVE-2026-24882 | dirmngr | 2.4.7-21+deb13u1+b3 | | GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution |
| HIGH | | 7.5 | | CVE-2026-15816 | dracut-install | 106-6 | | dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() |
| HIGH | | 7.5 | | CVE-2026-16445 | dracut-install | 106-6 | | dracut: dracut: Root code execution via DHCP options command injection in NetworkManager initrd module |
| HIGH | | 7.5 | | CVE-2026-6893 | dracut-install | 106-6 | | dracut: dracut: Root code execution via DHCP options command injection |
| HIGH | | 7 | | CVE-2026-53612 | eject | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes |
| HIGH | | 7 | | CVE-2026-53613 | eject | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path |
| HIGH | | 7 | | CVE-2026-53614 | eject | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 |
| HIGH | | 8 | | CVE-2026-53615 | eject | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser |
| HIGH | | 7.8 | | CVE-2026-76642 | eject | 2.41-5 | | util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks |
| HIGH | | 7.9 | | CVE-2026-78408 | eject | 2.41-5 | | util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority |
| HIGH | | 7 | | CVE-2026-78409 | eject | 2.41-5 | | util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks |
| HIGH | | 7.8 | | CVE-2026-78410 | eject | 2.41-5 | | util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection |
| HIGH | | 7 | | CVE-2026-53612 | fdisk | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes |
| HIGH | | 7 | | CVE-2026-53613 | fdisk | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path |
| HIGH | | 7 | | CVE-2026-53614 | fdisk | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 |
| HIGH | | 8 | | CVE-2026-53615 | fdisk | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser |
| HIGH | | 7.8 | | CVE-2026-76642 | fdisk | 2.41-5 | | util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks |
| HIGH | | 7.9 | | CVE-2026-78408 | fdisk | 2.41-5 | | util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority |
| HIGH | | 7 | | CVE-2026-78409 | fdisk | 2.41-5 | | util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks |
| HIGH | | 7.8 | | CVE-2026-78410 | fdisk | 2.41-5 | | util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection |
| HIGH | | 8.4 | | CVE-2026-24882 | gnupg-l10n | 2.4.7-21+deb13u1 | | GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution |
| HIGH | | 8.4 | | CVE-2026-24882 | gnupg-utils | 2.4.7-21+deb13u1+b3 | | GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution |
| HIGH | | 8.4 | | CVE-2026-24882 | gnupg | 2.4.7-21+deb13u1 | | GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution |
| HIGH | | 8.4 | | CVE-2026-24882 | gpg-agent | 2.4.7-21+deb13u1+b3 | | GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution |
| HIGH | | 8.4 | | CVE-2026-24882 | gpg-wks-client | 2.4.7-21+deb13u1+b3 | | GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution |
| HIGH | | 8.4 | | CVE-2026-24882 | gpg | 2.4.7-21+deb13u1+b3 | | GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution |
| HIGH | | 8.4 | | CVE-2026-24882 | gpgconf | 2.4.7-21+deb13u1+b3 | | GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution |
| HIGH | | 8.4 | | CVE-2026-24882 | gpgsm | 2.4.7-21+deb13u1+b3 | | GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution |
| HIGH | | 8.4 | | CVE-2026-24882 | gpgv | 2.4.7-21+deb13u1+b3 | | GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution |
| HIGH | | 7.5 | | CVE-2026-41992 | gzip | 1.13-1 | 1.13-1+deb13u1 | gzip: gzip: Information disclosure via global buffer overflow in LZH decompression |
| HIGH | | 7.1 | | CVE-2026-54369 | libacl1 | 2.3.2-2+b1 | | acl: Symlink traversal privilege escalation via libacl functions |
| HIGH | | 7 | | CVE-2026-53612 | libblkid1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes |
| HIGH | | 7 | | CVE-2026-53613 | libblkid1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path |
| HIGH | | 7 | | CVE-2026-53614 | libblkid1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 |
| HIGH | | 8 | | CVE-2026-53615 | libblkid1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser |
| HIGH | | 7.8 | | CVE-2026-76642 | libblkid1 | 2.41-5 | | util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks |
| HIGH | | 7.9 | | CVE-2026-78408 | libblkid1 | 2.41-5 | | util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority |
| HIGH | | 7 | | CVE-2026-78409 | libblkid1 | 2.41-5 | | util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks |
| HIGH | | 7.8 | | CVE-2026-78410 | libblkid1 | 2.41-5 | | util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection |
| HIGH | | 8 | | CVE-2023-44431 | libbluetooth3 | 5.82-1.1+rpt1 | | bluez: AVRCP stack-based buffer overflow remote code execution vulnerability |
| HIGH | | 8 | | CVE-2026-19774 | libbluetooth3 | 5.82-1.1+rpt1 | | bluez: BlueZ: Arbitrary Code Execution via A2DP Stack-based Buffer Overflow |
| HIGH | | 7.6 | | CVE-2026-80186 | libbluetooth3 | 5.82-1.1+rpt1 | | bluez: Stack Overflow in name2utf8 causes DoS and potential code execution |
| HIGH | | 7.1 | | CVE-2026-85218 | libbluetooth3 | 5.82-1.1+rpt1 | | bluez: bluez: AVRCP ListPlayerAttributes double stack overflow in avrcp_list_player_attributes_rsp/avrcp_get_current_pla |
| HIGH | | 8.1 | | CVE-2026-111497 | libbrotli1 | 1.1.0-2+b7 | 1.1.0-2+deb13u1 | brotli: Out-of-Bounds Write in Google Brotli Decoder |
| HIGH | | 7.5 | | CVE-2026-12064 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP |
| HIGH | | 7.5 | | CVE-2026-5773 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse |
| HIGH | | 7.5 | | CVE-2026-6276 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers |
| HIGH | | 8.1 | | CVE-2026-8286 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u7 | curl: curl: Insecure connection establishment due to TLS configuration mismatch |
| HIGH | | 8.1 | | CVE-2026-8458 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: libcurl: Unauthorized connection reuse due to a logical error |
| HIGH | | 9.1 | | CVE-2026-8927 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u7 | curl: Information disclosure due to uncleared proxy authentication state |
| HIGH | | 8.1 | | CVE-2026-92392 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u7 | curl: curl: HTTP/2 upload Use-After-Free |
| HIGH | | 7.5 | | CVE-2026-12064 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP |
| HIGH | | 7.5 | | CVE-2026-5773 | libcurl4t64 | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse |
| HIGH | | 7.5 | | CVE-2026-6276 | libcurl4t64 | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers |
| HIGH | | 8.1 | | CVE-2026-8286 | libcurl4t64 | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u7 | curl: curl: Insecure connection establishment due to TLS configuration mismatch |
| HIGH | | 8.1 | | CVE-2026-8458 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: libcurl: Unauthorized connection reuse due to a logical error |
| HIGH | | 9.1 | | CVE-2026-8927 | libcurl4t64 | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u7 | curl: Information disclosure due to uncleared proxy authentication state |
| HIGH | | 8.1 | | CVE-2026-92392 | libcurl4t64 | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u7 | curl: curl: HTTP/2 upload Use-After-Free |
| HIGH | | 7.5 | | CVE-2025-59375 | libexpat1 | 2.7.1-2 | 2.8.2-1~deb13u1 | firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small |
| HIGH | | 7.8 | | CVE-2026-25210 | libexpat1 | 2.7.1-2 | 2.8.2-1~deb13u1 | libexpat: libexpat: Information disclosure and data integrity issues due to integer overflow in buffer reallocation |
| HIGH | | 7.5 | | CVE-2026-45186 | libexpat1 | 2.7.1-2 | 2.8.2-1~deb13u1 | libexpat: denial of service via crafted XML input |
| HIGH | | 7.5 | | CVE-2026-66046 | libexpat1 | 2.7.1-2 | 2.9.0-1~deb13u1 | expat: Expat: Denial of Service via quadratic complexity in attribute processing |
| HIGH | | 7.5 | | CVE-2026-76956 | libexpat1 | 2.7.1-2 | 2.9.0-1~deb13u1 | libexpat: libexpat: Denial of Service via hash flooding attack with crafted XML |
| HIGH | | 7.8 | | CVE-2026-76957 | libexpat1 | 2.7.1-2 | 2.9.0-1~deb13u1 | libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service |
| HIGH | | 8.2 | | CVE-2026-77214 | libexpat1 | 2.7.1-2 | 2.9.0-1~deb13u1 | expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer |
| HIGH | | 7.5 | | CVE-2026-93990 | libexpat1 | 2.7.1-2 | 2.9.0-1~deb13u1 | expat: Expat: XML Injection via Malformed UTF-16 Input |
| HIGH | | 7 | | CVE-2026-53612 | libfdisk1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes |
| HIGH | | 7 | | CVE-2026-53613 | libfdisk1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path |
| HIGH | | 7 | | CVE-2026-53614 | libfdisk1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 |
| HIGH | | 8 | | CVE-2026-53615 | libfdisk1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser |
| HIGH | | 7.8 | | CVE-2026-76642 | libfdisk1 | 2.41-5 | | util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks |
| HIGH | | 7.9 | | CVE-2026-78408 | libfdisk1 | 2.41-5 | | util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority |
| HIGH | | 7 | | CVE-2026-78409 | libfdisk1 | 2.41-5 | | util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks |
| HIGH | | 7.8 | | CVE-2026-78410 | libfdisk1 | 2.41-5 | | util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection |
| HIGH | | 8.2 | | CVE-2026-58010 | libglib2.0-0t64 | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal() |
| HIGH | | 7.5 | | CVE-2026-58011 | libglib2.0-0t64 | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime |
| HIGH | | 8.2 | | CVE-2026-58012 | libglib2.0-0t64 | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() |
| HIGH | | 8.2 | | CVE-2026-58013 | libglib2.0-0t64 | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" |
| HIGH | | 8.6 | | CVE-2026-58014 | libglib2.0-0t64 | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" |
| HIGH | | 7.5 | | CVE-2026-58015 | libglib2.0-0t64 | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive |
| HIGH | | 8.2 | | CVE-2026-58010 | libglib2.0-data | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal() |
| HIGH | | 7.5 | | CVE-2026-58011 | libglib2.0-data | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime |
| HIGH | | 8.2 | | CVE-2026-58012 | libglib2.0-data | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() |
| HIGH | | 8.2 | | CVE-2026-58013 | libglib2.0-data | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" |
| HIGH | | 8.6 | | CVE-2026-58014 | libglib2.0-data | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" |
| HIGH | | 7.5 | | CVE-2026-58015 | libglib2.0-data | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive |
| HIGH | | 7 | | CVE-2026-53612 | liblastlog2-2 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes |
| HIGH | | 7 | | CVE-2026-53613 | liblastlog2-2 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path |
| HIGH | | 7 | | CVE-2026-53614 | liblastlog2-2 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 |
| HIGH | | 8 | | CVE-2026-53615 | liblastlog2-2 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser |
| HIGH | | 7.8 | | CVE-2026-76642 | liblastlog2-2 | 2.41-5 | | util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks |
| HIGH | | 7.9 | | CVE-2026-78408 | liblastlog2-2 | 2.41-5 | | util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority |
| HIGH | | 7 | | CVE-2026-78409 | liblastlog2-2 | 2.41-5 | | util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks |
| HIGH | | 7.8 | | CVE-2026-78410 | liblastlog2-2 | 2.41-5 | | util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection |
| HIGH | | 7 | | CVE-2026-53612 | libmount1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes |
| HIGH | | 7 | | CVE-2026-53613 | libmount1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path |
| HIGH | | 7 | | CVE-2026-53614 | libmount1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 |
| HIGH | | 8 | | CVE-2026-53615 | libmount1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser |
| HIGH | | 7.8 | | CVE-2026-76642 | libmount1 | 2.41-5 | | util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks |
| HIGH | | 7.9 | | CVE-2026-78408 | libmount1 | 2.41-5 | | util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority |
| HIGH | | 7 | | CVE-2026-78409 | libmount1 | 2.41-5 | | util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks |
| HIGH | | 7.8 | | CVE-2026-78410 | libmount1 | 2.41-5 | | util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection |
| HIGH | | 7.8 | | CVE-2025-69720 | libncursesw6 | 6.5+20250216-2 | | ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution. |
| HIGH | | 7.8 | | CVE-2026-42616 | libntfs-3g89t64 | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u2 | In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ... |
| HIGH | | 7.7 | | CVE-2026-46569 | libntfs-3g89t64 | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u2 | In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_c ... |
| HIGH | | 8.8 | | CVE-2026-16742 | libpam-systemd | 257.13-1~deb13u1 | | systemd: systemd-homed: Local privilege escalation via missing home-record signature verification |
| HIGH | | 8.7 | | CVE-2026-0799 | libpcap0.8t64 | 1.10.5-2 | | libpcap: libpcap: Out-of-bounds read and write vulnerability allows arbitrary memory access |
| HIGH | | 7.5 | | CVE-2026-6554 | libpcap0.8t64 | 1.10.5-2 | | libpcap: libpcap: Denial of Service via infinite loop in BPF interpreter |
| HIGH | | 7.6 | | CVE-2026-103111 | libpcre2-16-0 | 10.46-1~deb13u1 | 10.46-1~deb13u3 | pcre2: pcre2: Out-of-bounds write via crafted regular expression |
| HIGH | | 8.2 | | CVE-2026-86145 | libpcre2-16-0 | 10.46-1~deb13u1 | 10.46-1~deb13u2 | pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions |
| HIGH | | 7.4 | | CVE-2026-89157 | libpcre2-16-0 | 10.46-1~deb13u1 | 10.46-1~deb13u2 | pcre2: PCRE2: Out-of-bounds write via large pattern input |
| HIGH | | 7.8 | | CVE-2026-89161 | libpcre2-16-0 | 10.46-1~deb13u1 | 10.46-1~deb13u2 | pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match |
| HIGH | | 7.6 | | CVE-2026-103111 | libpcre2-8-0 | 10.46-1~deb13u1 | 10.46-1~deb13u3 | pcre2: pcre2: Out-of-bounds write via crafted regular expression |
| HIGH | | 8.2 | | CVE-2026-86145 | libpcre2-8-0 | 10.46-1~deb13u1 | 10.46-1~deb13u2 | pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions |
| HIGH | | 7.4 | | CVE-2026-89157 | libpcre2-8-0 | 10.46-1~deb13u1 | 10.46-1~deb13u2 | pcre2: PCRE2: Out-of-bounds write via large pattern input |
| HIGH | | 7.8 | | CVE-2026-89161 | libpcre2-8-0 | 10.46-1~deb13u1 | 10.46-1~deb13u2 | pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match |
| HIGH | | 7.5 | | CVE-2026-42497 | libperl5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction |
| HIGH | | 7.8 | | CVE-2026-48962 | libperl5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob |
| HIGH | | 8.4 | | CVE-2026-57432 | libperl5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | perl: Perl: Information disclosure via integer overflow in pack/unpack operations |
| HIGH | | 7.5 | | CVE-2026-57433 | libperl5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | Storable: Storable: Denial of Service via signed integer overflow in deserialization |
| HIGH | | 7.5 | | CVE-2026-9538 | libperl5.40 | 5.40.1-6 | | perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size |
| HIGH | | 7.3 | | CVE-2026-11940 | libpython3.13-minimal | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory |
| HIGH | | 7.5 | | CVE-2026-15308 | libpython3.13-minimal | 3.13.5-2+deb13u2 | | python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations |
| HIGH | | 8.1 | | CVE-2026-19445 | libpython3.13-minimal | 3.13.5-2+deb13u2 | | python: Use-after-free of a server-side SSLContext when sni_callback switches contexts |
| HIGH | | 7.4 | | CVE-2026-19553 | libpython3.13-minimal | 3.13.5-2+deb13u2 | | python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() |
| HIGH | | 7.5 | | CVE-2026-7210 | libpython3.13-minimal | 3.13.5-2+deb13u2 | | python: Python/Expat: Denial of Service via crafted XML document |
| HIGH | | 7.1 | | CVE-2026-82049 | libpython3.13-minimal | 3.13.5-2+deb13u2 | | python: Python tarfile module: File modification and content disclosure via crafted archives |
| HIGH | | 5.3 | | CVE-2026-8328 | libpython3.13-minimal | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python: FTP connection redirection via ftpcp() function bypass |
| HIGH | | 7.3 | | CVE-2026-11940 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory |
| HIGH | | 7.5 | | CVE-2026-15308 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | | python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations |
| HIGH | | 8.1 | | CVE-2026-19445 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | | python: Use-after-free of a server-side SSLContext when sni_callback switches contexts |
| HIGH | | 7.4 | | CVE-2026-19553 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | | python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() |
| HIGH | | 7.5 | | CVE-2026-7210 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | | python: Python/Expat: Denial of Service via crafted XML document |
| HIGH | | 7.1 | | CVE-2026-82049 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | | python: Python tarfile module: File modification and content disclosure via crafted archives |
| HIGH | | 5.3 | | CVE-2026-8328 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python: FTP connection redirection via ftpcp() function bypass |
| HIGH | | 7.3 | | CVE-2026-11940 | libpython3.13 | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory |
| HIGH | | 7.5 | | CVE-2026-15308 | libpython3.13 | 3.13.5-2+deb13u2 | | python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations |
| HIGH | | 8.1 | | CVE-2026-19445 | libpython3.13 | 3.13.5-2+deb13u2 | | python: Use-after-free of a server-side SSLContext when sni_callback switches contexts |
| HIGH | | 7.4 | | CVE-2026-19553 | libpython3.13 | 3.13.5-2+deb13u2 | | python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() |
| HIGH | | 7.5 | | CVE-2026-7210 | libpython3.13 | 3.13.5-2+deb13u2 | | python: Python/Expat: Denial of Service via crafted XML document |
| HIGH | | 7.1 | | CVE-2026-82049 | libpython3.13 | 3.13.5-2+deb13u2 | | python: Python tarfile module: File modification and content disclosure via crafted archives |
| HIGH | | 5.3 | | CVE-2026-8328 | libpython3.13 | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python: FTP connection redirection via ftpcp() function bypass |
| HIGH | | 7.5 | | CVE-2026-76151 | libqt6core6t64 | 6.8.2+dfsg-9+deb13u2 | | qt5-qtbase: qt6-qtbase: qt: Denial of Service via excessively large HTTP Cache-Control header |
| HIGH | | 7 | | CVE-2026-53612 | libsmartcols1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes |
| HIGH | | 7 | | CVE-2026-53613 | libsmartcols1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path |
| HIGH | | 7 | | CVE-2026-53614 | libsmartcols1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 |
| HIGH | | 8 | | CVE-2026-53615 | libsmartcols1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser |
| HIGH | | 7.8 | | CVE-2026-76642 | libsmartcols1 | 2.41-5 | | util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks |
| HIGH | | 7.9 | | CVE-2026-78408 | libsmartcols1 | 2.41-5 | | util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority |
| HIGH | | 7 | | CVE-2026-78409 | libsmartcols1 | 2.41-5 | | util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks |
| HIGH | | 7.8 | | CVE-2026-78410 | libsmartcols1 | 2.41-5 | | util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection |
| HIGH | | 7.8 | | CVE-2026-11822 | libsqlite3-0 | 3.46.1-7+deb13u1 | 3.46.1-7+deb13u2 | sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data |
| HIGH | | 7.8 | | CVE-2026-11824 | libsqlite3-0 | 3.46.1-7+deb13u1 | 3.46.1-7+deb13u2 | sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 |
| HIGH | | 7.5 | | CVE-2026-55199 | libssh2-1t64 | 1.11.1-1 | 1.11.1-1+deb13u1 | libssh2: libssh2: Denial of Service via crafted SSH_MSG_EXT_INFO message |
| HIGH | | 8.3 | | CVE-2026-55200 | libssh2-1t64 | 1.11.1-1 | 1.11.1-1+deb13u1 | libssh2: libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c |
| HIGH | | 7.5 | | CVE-2026-58050 | libssh2-1t64 | 1.11.1-1 | 1.11.1-1+deb13u2 | libssh2: libssh2: Heap buffer overflow via integer overflow in publickey attribute allocation |
| HIGH | | 9.1 | | CVE-2026-7598 | libssh2-1t64 | 1.11.1-1 | 1.11.1-1+deb13u1 | libssh2: integer overflow via large username or password arguments |
| HIGH | | 7.5 | | CVE-2026-14456 | libssl3t64 | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server |
| HIGH | | 7.4 | | CVE-2026-84782 | libssl3t64 | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission |
| HIGH | | 8.8 | | CVE-2026-16742 | libsystemd-shared | 257.13-1~deb13u1 | | systemd: systemd-homed: Local privilege escalation via missing home-record signature verification |
| HIGH | | 8.8 | | CVE-2026-16742 | libsystemd0 | 257.13-1~deb13u1 | | systemd: systemd-homed: Local privilege escalation via missing home-record signature verification |
| HIGH | | 8.8 | | CVE-2026-58221 | libtalloc2 | 2:2.4.3+samba4.22.8+dfsg-0+deb13u2 | 2:4.22.10+dfsg-0+deb13u2 | samba: authenticated LDAP access to internal LDB special DNs permits domain takeover |
| HIGH | | 8.8 | | CVE-2026-58222 | libtalloc2 | 2:2.4.3+samba4.22.8+dfsg-0+deb13u2 | 2:4.22.10+dfsg-0+deb13u2 | samba: Samba AD LDAP Compare filter injection and trusted-request confusion disclose protected attributes |
| HIGH | | 7.5 | | CVE-2026-6949 | libtalloc2 | 2:2.4.3+samba4.22.8+dfsg-0+deb13u2 | 2:4.22.10+dfsg-0+deb13u2 | samba: TSIG packet with crafted name compression can crash DNS server |
| HIGH | | 7.3 | | CVE-2026-12912 | libtiff6 | 4.7.0-3+deb13u2 | 4.7.0-3+deb13u3 | libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image |
| HIGH | | | | CVE-2026-36849 | libtiff6 | 4.7.0-3+deb13u2 | | [Denial of Service via large SamplesPerPixel tag] |
| HIGH | | 7.3 | | CVE-2026-52490 | libtiff6 | 4.7.0-3+deb13u2 | | libtiff: libtiff: Arbitrary code execution via process_command_opts() function |
| HIGH | | 7.8 | | CVE-2025-69720 | libtinfo6 | 6.5+20250216-2 | | ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution. |
| HIGH | | 8.8 | | CVE-2026-16742 | libudev1 | 257.13-1~deb13u1 | | systemd: systemd-homed: Local privilege escalation via missing home-record signature verification |
| HIGH | | 7.8 | | CVE-2026-7867 | libudisks2-0 | 2.10.1-12.1+deb13u1 | 2.10.1-12.1+deb13u2 | udisks2: udisks2: Local Privilege Escalation via as-user option spoofing |
| HIGH | | 7 | | CVE-2026-53612 | libuuid1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes |
| HIGH | | 7 | | CVE-2026-53613 | libuuid1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path |
| HIGH | | 7 | | CVE-2026-53614 | libuuid1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 |
| HIGH | | 8 | | CVE-2026-53615 | libuuid1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser |
| HIGH | | 7.8 | | CVE-2026-76642 | libuuid1 | 2.41-5 | | util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks |
| HIGH | | 7.9 | | CVE-2026-78408 | libuuid1 | 2.41-5 | | util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority |
| HIGH | | 7 | | CVE-2026-78409 | libuuid1 | 2.41-5 | | util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks |
| HIGH | | 7.8 | | CVE-2026-78410 | libuuid1 | 2.41-5 | | util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection |
| HIGH | | 8.8 | | CVE-2026-58221 | libwbclient0 | 2:4.22.8+dfsg-0+deb13u2 | 2:4.22.10+dfsg-0+deb13u2 | samba: authenticated LDAP access to internal LDB special DNs permits domain takeover |
| HIGH | | 8.8 | | CVE-2026-58222 | libwbclient0 | 2:4.22.8+dfsg-0+deb13u2 | 2:4.22.10+dfsg-0+deb13u2 | samba: Samba AD LDAP Compare filter injection and trusted-request confusion disclose protected attributes |
| HIGH | | 7.5 | | CVE-2026-6949 | libwbclient0 | 2:4.22.8+dfsg-0+deb13u2 | 2:4.22.10+dfsg-0+deb13u2 | samba: TSIG packet with crafted name compression can crash DNS server |
| HIGH | | 7.5 | | CVE-2026-88806 | libx11-6 | 2:1.8.12-1 | | libX11: libX11: Heap-based buffer overflow via malicious X server |
| HIGH | | 7.5 | | CVE-2026-88806 | libx11-data | 2:1.8.12-1 | | libX11: libX11: Heap-based buffer overflow via malicious X server |
| HIGH | | 8.5 | | CVE-2026-74860 | libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | | libxml2: double-free/UAF in libxml2 Python bindings |
| HIGH | | 7.8 | | CVE-2026-86138 | libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | | libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow |
| HIGH | | 7.8 | | CVE-2026-86139 | libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | | libxml2: libxml2: Integer overflow in xmlURIEscapeStr may lead to arbitrary code execution |
| HIGH | | 7.8 | | CVE-2026-86140 | libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | | libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements |
| HIGH | | 7.8 | | CVE-2026-86142 | libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | | libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation |
| HIGH | | 7.3 | | CVE-2026-86143 | libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | | libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks |
| HIGH | | 7.8 | | CVE-2026-86144 | libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | | libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation. |
| HIGH | | 7.8 | | CVE-2013-7445 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects |
| HIGH | | 7.8 | | CVE-2019-19449 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manage |
| HIGH | | 7.8 | | CVE-2019-19814 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c |
| HIGH | | 7.8 | | CVE-2021-3847 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: low-privileged user privileges escalation |
| HIGH | | 7 | | CVE-2021-3864 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: descendant's dumpable setting with certain SUID binaries |
| HIGH | | 7.8 | | CVE-2024-21803 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c |
| HIGH | | 7.1 | | CVE-2024-58015 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix for out-of bound access error |
| HIGH | | 7.8 | | CVE-2025-38137 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering |
| HIGH | | 7.8 | | CVE-2025-38187 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() |
| HIGH | | 7.8 | | CVE-2025-38421 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: platform/x86/amd: pmf: Use device managed allocations |
| HIGH | | 7.1 | | CVE-2025-38636 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rv: Use strings in da monitors tracepoints |
| HIGH | | 7.8 | | CVE-2025-39859 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog |
| HIGH | | 7.8 | | CVE-2025-39862 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7915: fix list corruption after hardware restart |
| HIGH | | 7.8 | | CVE-2025-39958 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/s390: Make attach succeed when the device was surprise removed |
| HIGH | | | | CVE-2025-40025 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer for non inode dnode |
| HIGH | | 7 | | CVE-2025-68174 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel AMD KFD: Race condition causes system crash |
| HIGH | | 7.8 | | CVE-2025-68735 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Privilege escalation via use-after-free in drm/panthor |
| HIGH | | 7.8 | | CVE-2026-100072 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ACPI: platform: Use acpi_bus_get_primary_device() |
| HIGH | | 7.1 | | CVE-2026-23102 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to incorrect SVE context restoration |
| HIGH | | 7.8 | | CVE-2026-23208 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: usb-audio: Prevent excessive number of frames |
| HIGH | | 7.1 | | CVE-2026-23327 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() |
| HIGH | | 7.8 | | CVE-2026-31493 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/efa: Fix use of completion ctx after free |
| HIGH | | 7.1 | | CVE-2026-31568 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Add missing secure storage access fixups for donated memory |
| HIGH | | | | CVE-2026-43185 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() |
| HIGH | | 7.1 | | CVE-2026-46130 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dm-verity-fec: fix reading parity bytes split across blocks (take 3) |
| HIGH | | 7 | | CVE-2026-46181 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() |
| HIGH | | 7.8 | | CVE-2026-46279 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/alloc_tag: clear codetag for pages allocated before page_ext initialization |
| HIGH | | 7 | | CVE-2026-52991 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched/psi: fix race between file release and pressure write |
| HIGH | | 7 | | CVE-2026-53000 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nat: use kfree_rcu to release ops |
| HIGH | | 7 | | CVE-2026-53091 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: pull headers in qdisc_pkt_len_segs_init() |
| HIGH | | 7.8 | | CVE-2026-53109 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy |
| HIGH | | 7.8 | | CVE-2026-53118 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vdpa: use generic driver_override infrastructure |
| HIGH | | 7 | | CVE-2026-53277 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation |
| HIGH | | 7.1 | | CVE-2026-53330 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() |
| HIGH | | 7 | | CVE-2026-63879 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages |
| HIGH | | 7 | | CVE-2026-64283 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values |
| HIGH | | | | CVE-2026-64389 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: validate NTLMv2 response before updating session key |
| HIGH | | | | CVE-2026-64400 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: prevent path traversal bypass by restricting caseless retry |
| HIGH | | 7.1 | | CVE-2026-68409 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: defer link RX stats percpu free to RCU |
| HIGH | | 7.3 | | CVE-2026-68426 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment |
| HIGH | | 7.6 | | CVE-2026-68470 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate extension-frame layout before RX |
| HIGH | | 7.8 | | CVE-2026-72042 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipmi: Fix user refcount underflow in event delivery |
| HIGH | | 7.8 | | CVE-2026-72098 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dm-verity: fix buffer overflow in FEC calculation |
| HIGH | | 7 | | CVE-2026-74269 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt: fix head underflow on XDP head-grow |
| HIGH | | 7 | | CVE-2026-74520 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/iommufd: Fix IOPF group ownership UAF |
| HIGH | | 8.8 | | CVE-2026-74752 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cookie AUTH state before use |
| HIGH | | 8.1 | | CVE-2026-89631 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject a tree connect response whose byte count is too small |
| HIGH | | 7 | | CVE-2026-89675 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix UAF in async copy cancel and shutdown |
| HIGH | | | | CVE-2026-89788 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| HIGH | | 7 | | CVE-2026-89811 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension |
| HIGH | | 7 | | CVE-2026-90111 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ip6mr: do not clone dst in ip6mr_cache_report() |
| HIGH | | 7 | | CVE-2026-90206 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvmet: fix max_qid race between configfs and controller allocation |
| HIGH | | 7 | | CVE-2026-90315 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers |
| HIGH | | | | CVE-2026-98084 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| HIGH | | 7 | | CVE-2026-98364 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfrm: hold net_device reference under RCU in bundle creation |
| HIGH | | 8.2 | | CVE-2026-98466 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| HIGH | | 7.8 | | CVE-2026-98715 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| HIGH | | 7.5 | | CVE-2026-98853 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: gso: limit recursive IP-in-IP segmentation |
| HIGH | | 7.8 | | CVE-2013-7445 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects |
| HIGH | | 7.8 | | CVE-2019-19449 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manage |
| HIGH | | 7.8 | | CVE-2019-19814 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c |
| HIGH | | 7.8 | | CVE-2021-3847 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: low-privileged user privileges escalation |
| HIGH | | 7 | | CVE-2021-3864 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: descendant's dumpable setting with certain SUID binaries |
| HIGH | | 7.8 | | CVE-2024-21803 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c |
| HIGH | | 7.1 | | CVE-2024-58015 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix for out-of bound access error |
| HIGH | | 7.8 | | CVE-2025-38137 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering |
| HIGH | | 7.8 | | CVE-2025-38187 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() |
| HIGH | | 7.8 | | CVE-2025-38421 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: platform/x86/amd: pmf: Use device managed allocations |
| HIGH | | 7.1 | | CVE-2025-38636 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rv: Use strings in da monitors tracepoints |
| HIGH | | 7.8 | | CVE-2025-39859 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog |
| HIGH | | 7.8 | | CVE-2025-39862 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7915: fix list corruption after hardware restart |
| HIGH | | 7.8 | | CVE-2025-39958 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/s390: Make attach succeed when the device was surprise removed |
| HIGH | | | | CVE-2025-40025 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer for non inode dnode |
| HIGH | | 7 | | CVE-2025-68174 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel AMD KFD: Race condition causes system crash |
| HIGH | | 7.8 | | CVE-2025-68735 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Privilege escalation via use-after-free in drm/panthor |
| HIGH | | 7.8 | | CVE-2026-100072 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ACPI: platform: Use acpi_bus_get_primary_device() |
| HIGH | | 7.1 | | CVE-2026-23102 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to incorrect SVE context restoration |
| HIGH | | 7.8 | | CVE-2026-23208 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: usb-audio: Prevent excessive number of frames |
| HIGH | | 7.1 | | CVE-2026-23327 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() |
| HIGH | | 7.8 | | CVE-2026-31493 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/efa: Fix use of completion ctx after free |
| HIGH | | 7.1 | | CVE-2026-31568 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Add missing secure storage access fixups for donated memory |
| HIGH | | | | CVE-2026-43185 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() |
| HIGH | | 7.1 | | CVE-2026-46130 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dm-verity-fec: fix reading parity bytes split across blocks (take 3) |
| HIGH | | 7 | | CVE-2026-46181 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() |
| HIGH | | 7.8 | | CVE-2026-46279 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/alloc_tag: clear codetag for pages allocated before page_ext initialization |
| HIGH | | 7 | | CVE-2026-52991 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched/psi: fix race between file release and pressure write |
| HIGH | | 7 | | CVE-2026-53000 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nat: use kfree_rcu to release ops |
| HIGH | | 7 | | CVE-2026-53091 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: pull headers in qdisc_pkt_len_segs_init() |
| HIGH | | 7.8 | | CVE-2026-53109 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy |
| HIGH | | 7.8 | | CVE-2026-53118 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vdpa: use generic driver_override infrastructure |
| HIGH | | 7 | | CVE-2026-53277 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation |
| HIGH | | 7.1 | | CVE-2026-53330 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() |
| HIGH | | 7 | | CVE-2026-63879 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages |
| HIGH | | 7 | | CVE-2026-64283 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values |
| HIGH | | | | CVE-2026-64389 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: validate NTLMv2 response before updating session key |
| HIGH | | | | CVE-2026-64400 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: prevent path traversal bypass by restricting caseless retry |
| HIGH | | 7.1 | | CVE-2026-68409 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: defer link RX stats percpu free to RCU |
| HIGH | | 7.3 | | CVE-2026-68426 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment |
| HIGH | | 7.6 | | CVE-2026-68470 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate extension-frame layout before RX |
| HIGH | | 7.8 | | CVE-2026-72042 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipmi: Fix user refcount underflow in event delivery |
| HIGH | | 7.8 | | CVE-2026-72098 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dm-verity: fix buffer overflow in FEC calculation |
| HIGH | | 7 | | CVE-2026-74269 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt: fix head underflow on XDP head-grow |
| HIGH | | 7 | | CVE-2026-74520 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/iommufd: Fix IOPF group ownership UAF |
| HIGH | | 8.8 | | CVE-2026-74752 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cookie AUTH state before use |
| HIGH | | 8.1 | | CVE-2026-89631 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject a tree connect response whose byte count is too small |
| HIGH | | 7 | | CVE-2026-89675 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix UAF in async copy cancel and shutdown |
| HIGH | | | | CVE-2026-89788 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| HIGH | | 7 | | CVE-2026-89811 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension |
| HIGH | | 7 | | CVE-2026-90111 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ip6mr: do not clone dst in ip6mr_cache_report() |
| HIGH | | 7 | | CVE-2026-90206 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvmet: fix max_qid race between configfs and controller allocation |
| HIGH | | 7 | | CVE-2026-90315 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers |
| HIGH | | | | CVE-2026-98084 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| HIGH | | 7 | | CVE-2026-98364 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfrm: hold net_device reference under RCU in bundle creation |
| HIGH | | 8.2 | | CVE-2026-98466 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| HIGH | | 7.8 | | CVE-2026-98715 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| HIGH | | 7.5 | | CVE-2026-98853 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: gso: limit recursive IP-in-IP segmentation |
| HIGH | | 7.8 | | CVE-2013-7445 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects |
| HIGH | | 7.8 | | CVE-2019-19449 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manage |
| HIGH | | 7.8 | | CVE-2019-19814 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c |
| HIGH | | 7.8 | | CVE-2021-3847 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: low-privileged user privileges escalation |
| HIGH | | 7 | | CVE-2021-3864 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: descendant's dumpable setting with certain SUID binaries |
| HIGH | | 7.8 | | CVE-2024-21803 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c |
| HIGH | | 7.1 | | CVE-2024-58015 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix for out-of bound access error |
| HIGH | | 7.8 | | CVE-2025-38137 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering |
| HIGH | | 7.8 | | CVE-2025-38187 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() |
| HIGH | | 7.8 | | CVE-2025-38421 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: platform/x86/amd: pmf: Use device managed allocations |
| HIGH | | 7.1 | | CVE-2025-38636 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rv: Use strings in da monitors tracepoints |
| HIGH | | 7.8 | | CVE-2025-39859 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog |
| HIGH | | 7.8 | | CVE-2025-39862 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7915: fix list corruption after hardware restart |
| HIGH | | 7.8 | | CVE-2025-39958 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/s390: Make attach succeed when the device was surprise removed |
| HIGH | | | | CVE-2025-40025 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer for non inode dnode |
| HIGH | | 7 | | CVE-2025-68174 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel AMD KFD: Race condition causes system crash |
| HIGH | | 7.8 | | CVE-2025-68735 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Privilege escalation via use-after-free in drm/panthor |
| HIGH | | 7.8 | | CVE-2026-100072 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ACPI: platform: Use acpi_bus_get_primary_device() |
| HIGH | | 7.1 | | CVE-2026-23102 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to incorrect SVE context restoration |
| HIGH | | 7.8 | | CVE-2026-23208 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: usb-audio: Prevent excessive number of frames |
| HIGH | | 7.1 | | CVE-2026-23327 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() |
| HIGH | | 7.8 | | CVE-2026-31493 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/efa: Fix use of completion ctx after free |
| HIGH | | 7.1 | | CVE-2026-31568 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Add missing secure storage access fixups for donated memory |
| HIGH | | | | CVE-2026-43185 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() |
| HIGH | | 7.1 | | CVE-2026-46130 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dm-verity-fec: fix reading parity bytes split across blocks (take 3) |
| HIGH | | 7 | | CVE-2026-46181 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() |
| HIGH | | 7.8 | | CVE-2026-46279 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/alloc_tag: clear codetag for pages allocated before page_ext initialization |
| HIGH | | 7 | | CVE-2026-52991 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched/psi: fix race between file release and pressure write |
| HIGH | | 7 | | CVE-2026-53000 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nat: use kfree_rcu to release ops |
| HIGH | | 7 | | CVE-2026-53091 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: pull headers in qdisc_pkt_len_segs_init() |
| HIGH | | 7.8 | | CVE-2026-53109 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy |
| HIGH | | 7.8 | | CVE-2026-53118 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vdpa: use generic driver_override infrastructure |
| HIGH | | 7 | | CVE-2026-53277 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation |
| HIGH | | 7.1 | | CVE-2026-53330 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() |
| HIGH | | 7 | | CVE-2026-63879 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages |
| HIGH | | 7 | | CVE-2026-64283 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values |
| HIGH | | | | CVE-2026-64389 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: validate NTLMv2 response before updating session key |
| HIGH | | | | CVE-2026-64400 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: prevent path traversal bypass by restricting caseless retry |
| HIGH | | 7.1 | | CVE-2026-68409 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: defer link RX stats percpu free to RCU |
| HIGH | | 7.3 | | CVE-2026-68426 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment |
| HIGH | | 7.6 | | CVE-2026-68470 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate extension-frame layout before RX |
| HIGH | | 7.8 | | CVE-2026-72042 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipmi: Fix user refcount underflow in event delivery |
| HIGH | | 7.8 | | CVE-2026-72098 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dm-verity: fix buffer overflow in FEC calculation |
| HIGH | | 7 | | CVE-2026-74269 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt: fix head underflow on XDP head-grow |
| HIGH | | 7 | | CVE-2026-74520 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/iommufd: Fix IOPF group ownership UAF |
| HIGH | | 8.8 | | CVE-2026-74752 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cookie AUTH state before use |
| HIGH | | 8.1 | | CVE-2026-89631 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject a tree connect response whose byte count is too small |
| HIGH | | 7 | | CVE-2026-89675 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix UAF in async copy cancel and shutdown |
| HIGH | | | | CVE-2026-89788 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| HIGH | | 7 | | CVE-2026-89811 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension |
| HIGH | | 7 | | CVE-2026-90111 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ip6mr: do not clone dst in ip6mr_cache_report() |
| HIGH | | 7 | | CVE-2026-90206 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvmet: fix max_qid race between configfs and controller allocation |
| HIGH | | 7 | | CVE-2026-90315 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers |
| HIGH | | | | CVE-2026-98084 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| HIGH | | 7 | | CVE-2026-98364 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfrm: hold net_device reference under RCU in bundle creation |
| HIGH | | 8.2 | | CVE-2026-98466 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| HIGH | | 7.8 | | CVE-2026-98715 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| HIGH | | 7.5 | | CVE-2026-98853 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: gso: limit recursive IP-in-IP segmentation |
| HIGH | | 7.8 | | CVE-2013-7445 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects |
| HIGH | | 7.8 | | CVE-2019-19449 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manage |
| HIGH | | 7.8 | | CVE-2019-19814 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c |
| HIGH | | 7.8 | | CVE-2021-3847 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: low-privileged user privileges escalation |
| HIGH | | 7 | | CVE-2021-3864 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: descendant's dumpable setting with certain SUID binaries |
| HIGH | | 7.8 | | CVE-2024-21803 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c |
| HIGH | | 7.1 | | CVE-2024-58015 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix for out-of bound access error |
| HIGH | | 7.8 | | CVE-2025-38137 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering |
| HIGH | | 7.8 | | CVE-2025-38187 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() |
| HIGH | | 7.8 | | CVE-2025-38421 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: platform/x86/amd: pmf: Use device managed allocations |
| HIGH | | 7.1 | | CVE-2025-38636 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rv: Use strings in da monitors tracepoints |
| HIGH | | 7.8 | | CVE-2025-39859 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog |
| HIGH | | 7.8 | | CVE-2025-39862 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7915: fix list corruption after hardware restart |
| HIGH | | 7.8 | | CVE-2025-39958 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/s390: Make attach succeed when the device was surprise removed |
| HIGH | | | | CVE-2025-40025 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer for non inode dnode |
| HIGH | | 7 | | CVE-2025-68174 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel AMD KFD: Race condition causes system crash |
| HIGH | | 7.8 | | CVE-2025-68735 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Privilege escalation via use-after-free in drm/panthor |
| HIGH | | 7.8 | | CVE-2026-100072 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ACPI: platform: Use acpi_bus_get_primary_device() |
| HIGH | | 7.1 | | CVE-2026-23102 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to incorrect SVE context restoration |
| HIGH | | 7.8 | | CVE-2026-23208 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: usb-audio: Prevent excessive number of frames |
| HIGH | | 7.1 | | CVE-2026-23327 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() |
| HIGH | | 7.8 | | CVE-2026-31493 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/efa: Fix use of completion ctx after free |
| HIGH | | 7.1 | | CVE-2026-31568 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Add missing secure storage access fixups for donated memory |
| HIGH | | | | CVE-2026-43185 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() |
| HIGH | | 7.1 | | CVE-2026-46130 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dm-verity-fec: fix reading parity bytes split across blocks (take 3) |
| HIGH | | 7 | | CVE-2026-46181 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() |
| HIGH | | 7.8 | | CVE-2026-46279 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/alloc_tag: clear codetag for pages allocated before page_ext initialization |
| HIGH | | 7 | | CVE-2026-52991 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched/psi: fix race between file release and pressure write |
| HIGH | | 7 | | CVE-2026-53000 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nat: use kfree_rcu to release ops |
| HIGH | | 7 | | CVE-2026-53091 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: pull headers in qdisc_pkt_len_segs_init() |
| HIGH | | 7.8 | | CVE-2026-53109 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy |
| HIGH | | 7.8 | | CVE-2026-53118 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vdpa: use generic driver_override infrastructure |
| HIGH | | 7 | | CVE-2026-53277 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation |
| HIGH | | 7.1 | | CVE-2026-53330 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() |
| HIGH | | 7 | | CVE-2026-63879 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages |
| HIGH | | 7 | | CVE-2026-64283 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values |
| HIGH | | | | CVE-2026-64389 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: validate NTLMv2 response before updating session key |
| HIGH | | | | CVE-2026-64400 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: prevent path traversal bypass by restricting caseless retry |
| HIGH | | 7.1 | | CVE-2026-68409 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: defer link RX stats percpu free to RCU |
| HIGH | | 7.3 | | CVE-2026-68426 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment |
| HIGH | | 7.6 | | CVE-2026-68470 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate extension-frame layout before RX |
| HIGH | | 7.8 | | CVE-2026-72042 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipmi: Fix user refcount underflow in event delivery |
| HIGH | | 7.8 | | CVE-2026-72098 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dm-verity: fix buffer overflow in FEC calculation |
| HIGH | | 7 | | CVE-2026-74269 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt: fix head underflow on XDP head-grow |
| HIGH | | 7 | | CVE-2026-74520 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/iommufd: Fix IOPF group ownership UAF |
| HIGH | | 8.8 | | CVE-2026-74752 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cookie AUTH state before use |
| HIGH | | 8.1 | | CVE-2026-89631 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject a tree connect response whose byte count is too small |
| HIGH | | 7 | | CVE-2026-89675 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix UAF in async copy cancel and shutdown |
| HIGH | | | | CVE-2026-89788 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| HIGH | | 7 | | CVE-2026-89811 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension |
| HIGH | | 7 | | CVE-2026-90111 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ip6mr: do not clone dst in ip6mr_cache_report() |
| HIGH | | 7 | | CVE-2026-90206 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvmet: fix max_qid race between configfs and controller allocation |
| HIGH | | 7 | | CVE-2026-90315 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers |
| HIGH | | | | CVE-2026-98084 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| HIGH | | 7 | | CVE-2026-98364 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfrm: hold net_device reference under RCU in bundle creation |
| HIGH | | 8.2 | | CVE-2026-98466 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| HIGH | | 7.8 | | CVE-2026-98715 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| HIGH | | 7.5 | | CVE-2026-98853 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: gso: limit recursive IP-in-IP segmentation |
| HIGH | | 7.8 | | CVE-2013-7445 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects |
| HIGH | | 7.8 | | CVE-2019-19449 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manage |
| HIGH | | 7.8 | | CVE-2019-19814 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c |
| HIGH | | 7.8 | | CVE-2021-3847 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: low-privileged user privileges escalation |
| HIGH | | 7 | | CVE-2021-3864 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: descendant's dumpable setting with certain SUID binaries |
| HIGH | | 7.8 | | CVE-2024-21803 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c |
| HIGH | | 7.1 | | CVE-2024-58015 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix for out-of bound access error |
| HIGH | | 7.8 | | CVE-2025-38137 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering |
| HIGH | | 7.8 | | CVE-2025-38187 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() |
| HIGH | | 7.8 | | CVE-2025-38421 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: platform/x86/amd: pmf: Use device managed allocations |
| HIGH | | 7.1 | | CVE-2025-38636 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: rv: Use strings in da monitors tracepoints |
| HIGH | | 7.8 | | CVE-2025-39859 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog |
| HIGH | | 7.8 | | CVE-2025-39862 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7915: fix list corruption after hardware restart |
| HIGH | | 7.8 | | CVE-2025-39958 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: iommu/s390: Make attach succeed when the device was surprise removed |
| HIGH | | | | CVE-2025-40025 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer for non inode dnode |
| HIGH | | 7 | | CVE-2025-68174 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Linux kernel AMD KFD: Race condition causes system crash |
| HIGH | | 7.8 | | CVE-2025-68735 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Kernel: Privilege escalation via use-after-free in drm/panthor |
| HIGH | | 7.8 | | CVE-2026-100072 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ACPI: platform: Use acpi_bus_get_primary_device() |
| HIGH | | 7.1 | | CVE-2026-23102 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to incorrect SVE context restoration |
| HIGH | | 7.8 | | CVE-2026-23208 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ALSA: usb-audio: Prevent excessive number of frames |
| HIGH | | 7.1 | | CVE-2026-23327 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() |
| HIGH | | 7.8 | | CVE-2026-31493 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: RDMA/efa: Fix use of completion ctx after free |
| HIGH | | 7.1 | | CVE-2026-31568 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Add missing secure storage access fixups for donated memory |
| HIGH | | | | CVE-2026-43185 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() |
| HIGH | | 7.1 | | CVE-2026-46130 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: dm-verity-fec: fix reading parity bytes split across blocks (take 3) |
| HIGH | | 7 | | CVE-2026-46181 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() |
| HIGH | | 7.8 | | CVE-2026-46279 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: mm/alloc_tag: clear codetag for pages allocated before page_ext initialization |
| HIGH | | 7 | | CVE-2026-52991 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: sched/psi: fix race between file release and pressure write |
| HIGH | | 7 | | CVE-2026-53000 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfilter: nat: use kfree_rcu to release ops |
| HIGH | | 7 | | CVE-2026-53091 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: pull headers in qdisc_pkt_len_segs_init() |
| HIGH | | 7.8 | | CVE-2026-53109 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy |
| HIGH | | 7.8 | | CVE-2026-53118 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: vdpa: use generic driver_override infrastructure |
| HIGH | | 7 | | CVE-2026-53277 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation |
| HIGH | | 7.1 | | CVE-2026-53330 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() |
| HIGH | | 7 | | CVE-2026-63879 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages |
| HIGH | | 7 | | CVE-2026-64283 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values |
| HIGH | | | | CVE-2026-64389 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ksmbd: validate NTLMv2 response before updating session key |
| HIGH | | | | CVE-2026-64400 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ksmbd: prevent path traversal bypass by restricting caseless retry |
| HIGH | | 7.1 | | CVE-2026-68409 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: defer link RX stats percpu free to RCU |
| HIGH | | 7.3 | | CVE-2026-68426 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment |
| HIGH | | 7.6 | | CVE-2026-68470 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate extension-frame layout before RX |
| HIGH | | 7.8 | | CVE-2026-72042 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ipmi: Fix user refcount underflow in event delivery |
| HIGH | | 7.8 | | CVE-2026-72098 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: dm-verity: fix buffer overflow in FEC calculation |
| HIGH | | 7 | | CVE-2026-74269 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bnxt: fix head underflow on XDP head-grow |
| HIGH | | 7 | | CVE-2026-74520 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: iommu/iommufd: Fix IOPF group ownership UAF |
| HIGH | | 8.8 | | CVE-2026-74752 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cookie AUTH state before use |
| HIGH | | 8.1 | | CVE-2026-89631 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject a tree connect response whose byte count is too small |
| HIGH | | 7 | | CVE-2026-89675 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix UAF in async copy cancel and shutdown |
| HIGH | | | | CVE-2026-89788 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| HIGH | | 7 | | CVE-2026-89811 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension |
| HIGH | | 7 | | CVE-2026-90111 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ip6mr: do not clone dst in ip6mr_cache_report() |
| HIGH | | 7 | | CVE-2026-90206 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: nvmet: fix max_qid race between configfs and controller allocation |
| HIGH | | 7 | | CVE-2026-90315 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers |
| HIGH | | | | CVE-2026-98084 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| HIGH | | 7 | | CVE-2026-98364 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: xfrm: hold net_device reference under RCU in bundle creation |
| HIGH | | 8.2 | | CVE-2026-98466 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| HIGH | | 7.8 | | CVE-2026-98715 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| HIGH | | 7.5 | | CVE-2026-98853 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: gso: limit recursive IP-in-IP segmentation |
| HIGH | | 7.8 | | CVE-2013-7445 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects |
| HIGH | | 7.8 | | CVE-2019-19449 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manage |
| HIGH | | 7.8 | | CVE-2019-19814 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c |
| HIGH | | 7.8 | | CVE-2021-3847 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: low-privileged user privileges escalation |
| HIGH | | 7 | | CVE-2021-3864 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: descendant's dumpable setting with certain SUID binaries |
| HIGH | | 7.8 | | CVE-2024-21803 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c |
| HIGH | | 7.1 | | CVE-2024-58015 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix for out-of bound access error |
| HIGH | | 7.8 | | CVE-2025-38137 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering |
| HIGH | | 7.8 | | CVE-2025-38187 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() |
| HIGH | | 7.8 | | CVE-2025-38421 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: platform/x86/amd: pmf: Use device managed allocations |
| HIGH | | 7.1 | | CVE-2025-38636 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rv: Use strings in da monitors tracepoints |
| HIGH | | 7.8 | | CVE-2025-39859 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog |
| HIGH | | 7.8 | | CVE-2025-39862 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7915: fix list corruption after hardware restart |
| HIGH | | 7.8 | | CVE-2025-39958 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/s390: Make attach succeed when the device was surprise removed |
| HIGH | | | | CVE-2025-40025 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer for non inode dnode |
| HIGH | | 7 | | CVE-2025-68174 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel AMD KFD: Race condition causes system crash |
| HIGH | | 7.8 | | CVE-2025-68735 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Privilege escalation via use-after-free in drm/panthor |
| HIGH | | 7.8 | | CVE-2026-100072 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ACPI: platform: Use acpi_bus_get_primary_device() |
| HIGH | | 7.1 | | CVE-2026-23102 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to incorrect SVE context restoration |
| HIGH | | 7.8 | | CVE-2026-23208 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: usb-audio: Prevent excessive number of frames |
| HIGH | | 7.1 | | CVE-2026-23327 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() |
| HIGH | | 7.8 | | CVE-2026-31493 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/efa: Fix use of completion ctx after free |
| HIGH | | 7.1 | | CVE-2026-31568 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Add missing secure storage access fixups for donated memory |
| HIGH | | | | CVE-2026-43185 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() |
| HIGH | | 7.1 | | CVE-2026-46130 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dm-verity-fec: fix reading parity bytes split across blocks (take 3) |
| HIGH | | 7 | | CVE-2026-46181 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() |
| HIGH | | 7.8 | | CVE-2026-46279 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/alloc_tag: clear codetag for pages allocated before page_ext initialization |
| HIGH | | 7 | | CVE-2026-52991 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched/psi: fix race between file release and pressure write |
| HIGH | | 7 | | CVE-2026-53000 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nat: use kfree_rcu to release ops |
| HIGH | | 7 | | CVE-2026-53091 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: pull headers in qdisc_pkt_len_segs_init() |
| HIGH | | 7.8 | | CVE-2026-53109 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy |
| HIGH | | 7.8 | | CVE-2026-53118 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vdpa: use generic driver_override infrastructure |
| HIGH | | 7 | | CVE-2026-53277 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation |
| HIGH | | 7.1 | | CVE-2026-53330 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() |
| HIGH | | 7 | | CVE-2026-63879 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages |
| HIGH | | 7 | | CVE-2026-64283 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values |
| HIGH | | | | CVE-2026-64389 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: validate NTLMv2 response before updating session key |
| HIGH | | | | CVE-2026-64400 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: prevent path traversal bypass by restricting caseless retry |
| HIGH | | 7.1 | | CVE-2026-68409 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: defer link RX stats percpu free to RCU |
| HIGH | | 7.3 | | CVE-2026-68426 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment |
| HIGH | | 7.6 | | CVE-2026-68470 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate extension-frame layout before RX |
| HIGH | | 7.8 | | CVE-2026-72042 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipmi: Fix user refcount underflow in event delivery |
| HIGH | | 7.8 | | CVE-2026-72098 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dm-verity: fix buffer overflow in FEC calculation |
| HIGH | | 7 | | CVE-2026-74269 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt: fix head underflow on XDP head-grow |
| HIGH | | 7 | | CVE-2026-74520 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/iommufd: Fix IOPF group ownership UAF |
| HIGH | | 8.8 | | CVE-2026-74752 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cookie AUTH state before use |
| HIGH | | 8.1 | | CVE-2026-89631 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject a tree connect response whose byte count is too small |
| HIGH | | 7 | | CVE-2026-89675 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix UAF in async copy cancel and shutdown |
| HIGH | | | | CVE-2026-89788 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| HIGH | | 7 | | CVE-2026-89811 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension |
| HIGH | | 7 | | CVE-2026-90111 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ip6mr: do not clone dst in ip6mr_cache_report() |
| HIGH | | 7 | | CVE-2026-90206 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvmet: fix max_qid race between configfs and controller allocation |
| HIGH | | 7 | | CVE-2026-90315 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers |
| HIGH | | | | CVE-2026-98084 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| HIGH | | 7 | | CVE-2026-98364 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfrm: hold net_device reference under RCU in bundle creation |
| HIGH | | 8.2 | | CVE-2026-98466 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| HIGH | | 7.8 | | CVE-2026-98715 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| HIGH | | 7.5 | | CVE-2026-98853 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: gso: limit recursive IP-in-IP segmentation |
| HIGH | | 7.8 | | CVE-2013-7445 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects |
| HIGH | | 7.8 | | CVE-2019-19449 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manage |
| HIGH | | 7.8 | | CVE-2019-19814 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c |
| HIGH | | 7.8 | | CVE-2021-3847 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: low-privileged user privileges escalation |
| HIGH | | 7 | | CVE-2021-3864 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: descendant's dumpable setting with certain SUID binaries |
| HIGH | | 7.8 | | CVE-2024-21803 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c |
| HIGH | | 7.1 | | CVE-2024-58015 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix for out-of bound access error |
| HIGH | | 7.8 | | CVE-2025-38137 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering |
| HIGH | | 7.8 | | CVE-2025-38187 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() |
| HIGH | | 7.8 | | CVE-2025-38421 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: platform/x86/amd: pmf: Use device managed allocations |
| HIGH | | 7.1 | | CVE-2025-38636 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rv: Use strings in da monitors tracepoints |
| HIGH | | 7.8 | | CVE-2025-39859 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog |
| HIGH | | 7.8 | | CVE-2025-39862 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7915: fix list corruption after hardware restart |
| HIGH | | 7.8 | | CVE-2025-39958 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/s390: Make attach succeed when the device was surprise removed |
| HIGH | | | | CVE-2025-40025 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer for non inode dnode |
| HIGH | | 7 | | CVE-2025-68174 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel AMD KFD: Race condition causes system crash |
| HIGH | | 7.8 | | CVE-2025-68735 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Privilege escalation via use-after-free in drm/panthor |
| HIGH | | 7.8 | | CVE-2026-100072 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ACPI: platform: Use acpi_bus_get_primary_device() |
| HIGH | | 7.1 | | CVE-2026-23102 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to incorrect SVE context restoration |
| HIGH | | 7.8 | | CVE-2026-23208 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: usb-audio: Prevent excessive number of frames |
| HIGH | | 7.1 | | CVE-2026-23327 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() |
| HIGH | | 7.8 | | CVE-2026-31493 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/efa: Fix use of completion ctx after free |
| HIGH | | 7.1 | | CVE-2026-31568 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Add missing secure storage access fixups for donated memory |
| HIGH | | | | CVE-2026-43185 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() |
| HIGH | | 7.1 | | CVE-2026-46130 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dm-verity-fec: fix reading parity bytes split across blocks (take 3) |
| HIGH | | 7 | | CVE-2026-46181 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() |
| HIGH | | 7.8 | | CVE-2026-46279 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/alloc_tag: clear codetag for pages allocated before page_ext initialization |
| HIGH | | 7 | | CVE-2026-52991 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched/psi: fix race between file release and pressure write |
| HIGH | | 7 | | CVE-2026-53000 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nat: use kfree_rcu to release ops |
| HIGH | | 7 | | CVE-2026-53091 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: pull headers in qdisc_pkt_len_segs_init() |
| HIGH | | 7.8 | | CVE-2026-53109 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy |
| HIGH | | 7.8 | | CVE-2026-53118 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vdpa: use generic driver_override infrastructure |
| HIGH | | 7 | | CVE-2026-53277 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation |
| HIGH | | 7.1 | | CVE-2026-53330 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() |
| HIGH | | 7 | | CVE-2026-63879 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages |
| HIGH | | 7 | | CVE-2026-64283 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values |
| HIGH | | | | CVE-2026-64389 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: validate NTLMv2 response before updating session key |
| HIGH | | | | CVE-2026-64400 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: prevent path traversal bypass by restricting caseless retry |
| HIGH | | 7.1 | | CVE-2026-68409 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: defer link RX stats percpu free to RCU |
| HIGH | | 7.3 | | CVE-2026-68426 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment |
| HIGH | | 7.6 | | CVE-2026-68470 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate extension-frame layout before RX |
| HIGH | | 7.8 | | CVE-2026-72042 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipmi: Fix user refcount underflow in event delivery |
| HIGH | | 7.8 | | CVE-2026-72098 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dm-verity: fix buffer overflow in FEC calculation |
| HIGH | | 7 | | CVE-2026-74269 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt: fix head underflow on XDP head-grow |
| HIGH | | 7 | | CVE-2026-74520 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/iommufd: Fix IOPF group ownership UAF |
| HIGH | | 8.8 | | CVE-2026-74752 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cookie AUTH state before use |
| HIGH | | 8.1 | | CVE-2026-89631 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject a tree connect response whose byte count is too small |
| HIGH | | 7 | | CVE-2026-89675 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix UAF in async copy cancel and shutdown |
| HIGH | | | | CVE-2026-89788 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| HIGH | | 7 | | CVE-2026-89811 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension |
| HIGH | | 7 | | CVE-2026-90111 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ip6mr: do not clone dst in ip6mr_cache_report() |
| HIGH | | 7 | | CVE-2026-90206 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvmet: fix max_qid race between configfs and controller allocation |
| HIGH | | 7 | | CVE-2026-90315 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers |
| HIGH | | | | CVE-2026-98084 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| HIGH | | 7 | | CVE-2026-98364 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfrm: hold net_device reference under RCU in bundle creation |
| HIGH | | 8.2 | | CVE-2026-98466 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| HIGH | | 7.8 | | CVE-2026-98715 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| HIGH | | 7.5 | | CVE-2026-98853 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: gso: limit recursive IP-in-IP segmentation |
| HIGH | | 7.8 | | CVE-2013-7445 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects |
| HIGH | | 7.8 | | CVE-2019-19449 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manage |
| HIGH | | 7.8 | | CVE-2019-19814 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c |
| HIGH | | 7.8 | | CVE-2021-3847 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: low-privileged user privileges escalation |
| HIGH | | 7 | | CVE-2021-3864 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: descendant's dumpable setting with certain SUID binaries |
| HIGH | | 7.8 | | CVE-2024-21803 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c |
| HIGH | | 7.1 | | CVE-2024-58015 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix for out-of bound access error |
| HIGH | | 7.8 | | CVE-2025-38137 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering |
| HIGH | | 7.8 | | CVE-2025-38187 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() |
| HIGH | | 7.8 | | CVE-2025-38421 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: platform/x86/amd: pmf: Use device managed allocations |
| HIGH | | 7.1 | | CVE-2025-38636 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rv: Use strings in da monitors tracepoints |
| HIGH | | 7.8 | | CVE-2025-39859 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog |
| HIGH | | 7.8 | | CVE-2025-39862 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7915: fix list corruption after hardware restart |
| HIGH | | 7.8 | | CVE-2025-39958 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/s390: Make attach succeed when the device was surprise removed |
| HIGH | | | | CVE-2025-40025 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer for non inode dnode |
| HIGH | | 7 | | CVE-2025-68174 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel AMD KFD: Race condition causes system crash |
| HIGH | | 7.8 | | CVE-2025-68735 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Privilege escalation via use-after-free in drm/panthor |
| HIGH | | 7.8 | | CVE-2026-100072 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ACPI: platform: Use acpi_bus_get_primary_device() |
| HIGH | | 7.1 | | CVE-2026-23102 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to incorrect SVE context restoration |
| HIGH | | 7.8 | | CVE-2026-23208 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: usb-audio: Prevent excessive number of frames |
| HIGH | | 7.1 | | CVE-2026-23327 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() |
| HIGH | | 7.8 | | CVE-2026-31493 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/efa: Fix use of completion ctx after free |
| HIGH | | 7.1 | | CVE-2026-31568 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Add missing secure storage access fixups for donated memory |
| HIGH | | | | CVE-2026-43185 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() |
| HIGH | | 7.1 | | CVE-2026-46130 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dm-verity-fec: fix reading parity bytes split across blocks (take 3) |
| HIGH | | 7 | | CVE-2026-46181 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() |
| HIGH | | 7.8 | | CVE-2026-46279 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/alloc_tag: clear codetag for pages allocated before page_ext initialization |
| HIGH | | 7 | | CVE-2026-52991 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched/psi: fix race between file release and pressure write |
| HIGH | | 7 | | CVE-2026-53000 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nat: use kfree_rcu to release ops |
| HIGH | | 7 | | CVE-2026-53091 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: pull headers in qdisc_pkt_len_segs_init() |
| HIGH | | 7.8 | | CVE-2026-53109 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy |
| HIGH | | 7.8 | | CVE-2026-53118 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vdpa: use generic driver_override infrastructure |
| HIGH | | 7 | | CVE-2026-53277 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation |
| HIGH | | 7.1 | | CVE-2026-53330 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() |
| HIGH | | 7 | | CVE-2026-63879 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages |
| HIGH | | 7 | | CVE-2026-64283 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values |
| HIGH | | | | CVE-2026-64389 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: validate NTLMv2 response before updating session key |
| HIGH | | | | CVE-2026-64400 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: prevent path traversal bypass by restricting caseless retry |
| HIGH | | 7.1 | | CVE-2026-68409 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: defer link RX stats percpu free to RCU |
| HIGH | | 7.3 | | CVE-2026-68426 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment |
| HIGH | | 7.6 | | CVE-2026-68470 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate extension-frame layout before RX |
| HIGH | | 7.8 | | CVE-2026-72042 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipmi: Fix user refcount underflow in event delivery |
| HIGH | | 7.8 | | CVE-2026-72098 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dm-verity: fix buffer overflow in FEC calculation |
| HIGH | | 7 | | CVE-2026-74269 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt: fix head underflow on XDP head-grow |
| HIGH | | 7 | | CVE-2026-74520 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/iommufd: Fix IOPF group ownership UAF |
| HIGH | | 8.8 | | CVE-2026-74752 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cookie AUTH state before use |
| HIGH | | 8.1 | | CVE-2026-89631 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject a tree connect response whose byte count is too small |
| HIGH | | 7 | | CVE-2026-89675 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix UAF in async copy cancel and shutdown |
| HIGH | | | | CVE-2026-89788 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| HIGH | | 7 | | CVE-2026-89811 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension |
| HIGH | | 7 | | CVE-2026-90111 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ip6mr: do not clone dst in ip6mr_cache_report() |
| HIGH | | 7 | | CVE-2026-90206 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvmet: fix max_qid race between configfs and controller allocation |
| HIGH | | 7 | | CVE-2026-90315 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers |
| HIGH | | | | CVE-2026-98084 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| HIGH | | 7 | | CVE-2026-98364 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfrm: hold net_device reference under RCU in bundle creation |
| HIGH | | 8.2 | | CVE-2026-98466 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| HIGH | | 7.8 | | CVE-2026-98715 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| HIGH | | 7.5 | | CVE-2026-98853 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: gso: limit recursive IP-in-IP segmentation |
| HIGH | | 7.8 | | CVE-2013-7445 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects |
| HIGH | | 7.8 | | CVE-2019-19449 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manage |
| HIGH | | 7.8 | | CVE-2019-19814 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c |
| HIGH | | 7.8 | | CVE-2021-3847 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: low-privileged user privileges escalation |
| HIGH | | 7 | | CVE-2021-3864 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: descendant's dumpable setting with certain SUID binaries |
| HIGH | | 7.8 | | CVE-2024-21803 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c |
| HIGH | | 7.1 | | CVE-2024-58015 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix for out-of bound access error |
| HIGH | | 7.8 | | CVE-2025-38137 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering |
| HIGH | | 7.8 | | CVE-2025-38187 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() |
| HIGH | | 7.8 | | CVE-2025-38421 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: platform/x86/amd: pmf: Use device managed allocations |
| HIGH | | 7.1 | | CVE-2025-38636 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rv: Use strings in da monitors tracepoints |
| HIGH | | 7.8 | | CVE-2025-39859 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog |
| HIGH | | 7.8 | | CVE-2025-39862 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7915: fix list corruption after hardware restart |
| HIGH | | 7.8 | | CVE-2025-39958 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/s390: Make attach succeed when the device was surprise removed |
| HIGH | | | | CVE-2025-40025 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer for non inode dnode |
| HIGH | | 7 | | CVE-2025-68174 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel AMD KFD: Race condition causes system crash |
| HIGH | | 7.8 | | CVE-2025-68735 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Privilege escalation via use-after-free in drm/panthor |
| HIGH | | 7.8 | | CVE-2026-100072 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ACPI: platform: Use acpi_bus_get_primary_device() |
| HIGH | | 7.1 | | CVE-2026-23102 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to incorrect SVE context restoration |
| HIGH | | 7.8 | | CVE-2026-23208 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: usb-audio: Prevent excessive number of frames |
| HIGH | | 7.1 | | CVE-2026-23327 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() |
| HIGH | | 7.8 | | CVE-2026-31493 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/efa: Fix use of completion ctx after free |
| HIGH | | 7.1 | | CVE-2026-31568 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Add missing secure storage access fixups for donated memory |
| HIGH | | | | CVE-2026-43185 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() |
| HIGH | | 7.1 | | CVE-2026-46130 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dm-verity-fec: fix reading parity bytes split across blocks (take 3) |
| HIGH | | 7 | | CVE-2026-46181 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() |
| HIGH | | 7.8 | | CVE-2026-46279 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/alloc_tag: clear codetag for pages allocated before page_ext initialization |
| HIGH | | 7 | | CVE-2026-52991 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched/psi: fix race between file release and pressure write |
| HIGH | | 7 | | CVE-2026-53000 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nat: use kfree_rcu to release ops |
| HIGH | | 7 | | CVE-2026-53091 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: pull headers in qdisc_pkt_len_segs_init() |
| HIGH | | 7.8 | | CVE-2026-53109 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy |
| HIGH | | 7.8 | | CVE-2026-53118 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vdpa: use generic driver_override infrastructure |
| HIGH | | 7 | | CVE-2026-53277 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation |
| HIGH | | 7.1 | | CVE-2026-53330 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() |
| HIGH | | 7 | | CVE-2026-63879 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages |
| HIGH | | 7 | | CVE-2026-64283 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values |
| HIGH | | | | CVE-2026-64389 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: validate NTLMv2 response before updating session key |
| HIGH | | | | CVE-2026-64400 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: prevent path traversal bypass by restricting caseless retry |
| HIGH | | 7.1 | | CVE-2026-68409 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: defer link RX stats percpu free to RCU |
| HIGH | | 7.3 | | CVE-2026-68426 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment |
| HIGH | | 7.6 | | CVE-2026-68470 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate extension-frame layout before RX |
| HIGH | | 7.8 | | CVE-2026-72042 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipmi: Fix user refcount underflow in event delivery |
| HIGH | | 7.8 | | CVE-2026-72098 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dm-verity: fix buffer overflow in FEC calculation |
| HIGH | | 7 | | CVE-2026-74269 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt: fix head underflow on XDP head-grow |
| HIGH | | 7 | | CVE-2026-74520 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/iommufd: Fix IOPF group ownership UAF |
| HIGH | | 8.8 | | CVE-2026-74752 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cookie AUTH state before use |
| HIGH | | 8.1 | | CVE-2026-89631 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject a tree connect response whose byte count is too small |
| HIGH | | 7 | | CVE-2026-89675 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix UAF in async copy cancel and shutdown |
| HIGH | | | | CVE-2026-89788 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| HIGH | | 7 | | CVE-2026-89811 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension |
| HIGH | | 7 | | CVE-2026-90111 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ip6mr: do not clone dst in ip6mr_cache_report() |
| HIGH | | 7 | | CVE-2026-90206 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvmet: fix max_qid race between configfs and controller allocation |
| HIGH | | 7 | | CVE-2026-90315 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers |
| HIGH | | | | CVE-2026-98084 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| HIGH | | 7 | | CVE-2026-98364 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfrm: hold net_device reference under RCU in bundle creation |
| HIGH | | 8.2 | | CVE-2026-98466 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| HIGH | | 7.8 | | CVE-2026-98715 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| HIGH | | 7.5 | | CVE-2026-98853 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: gso: limit recursive IP-in-IP segmentation |
| HIGH | | 7.8 | | CVE-2013-7445 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects |
| HIGH | | 7.8 | | CVE-2019-19449 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manage |
| HIGH | | 7.8 | | CVE-2019-19814 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c |
| HIGH | | 7.8 | | CVE-2021-3847 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: low-privileged user privileges escalation |
| HIGH | | 7 | | CVE-2021-3864 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: descendant's dumpable setting with certain SUID binaries |
| HIGH | | 7.8 | | CVE-2024-21803 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c |
| HIGH | | 7.1 | | CVE-2024-58015 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix for out-of bound access error |
| HIGH | | 7.8 | | CVE-2025-38137 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering |
| HIGH | | 7.8 | | CVE-2025-38187 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() |
| HIGH | | 7.8 | | CVE-2025-38421 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: platform/x86/amd: pmf: Use device managed allocations |
| HIGH | | 7.1 | | CVE-2025-38636 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rv: Use strings in da monitors tracepoints |
| HIGH | | 7.8 | | CVE-2025-39859 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog |
| HIGH | | 7.8 | | CVE-2025-39862 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7915: fix list corruption after hardware restart |
| HIGH | | 7.8 | | CVE-2025-39958 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/s390: Make attach succeed when the device was surprise removed |
| HIGH | | | | CVE-2025-40025 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer for non inode dnode |
| HIGH | | 7 | | CVE-2025-68174 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel AMD KFD: Race condition causes system crash |
| HIGH | | 7.8 | | CVE-2025-68735 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Privilege escalation via use-after-free in drm/panthor |
| HIGH | | 7.8 | | CVE-2026-100072 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ACPI: platform: Use acpi_bus_get_primary_device() |
| HIGH | | 7.1 | | CVE-2026-23102 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to incorrect SVE context restoration |
| HIGH | | 7.8 | | CVE-2026-23208 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: usb-audio: Prevent excessive number of frames |
| HIGH | | 7.1 | | CVE-2026-23327 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() |
| HIGH | | 7.8 | | CVE-2026-31493 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/efa: Fix use of completion ctx after free |
| HIGH | | 7.1 | | CVE-2026-31568 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Add missing secure storage access fixups for donated memory |
| HIGH | | | | CVE-2026-43185 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() |
| HIGH | | 7.1 | | CVE-2026-46130 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dm-verity-fec: fix reading parity bytes split across blocks (take 3) |
| HIGH | | 7 | | CVE-2026-46181 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() |
| HIGH | | 7.8 | | CVE-2026-46279 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/alloc_tag: clear codetag for pages allocated before page_ext initialization |
| HIGH | | 7 | | CVE-2026-52991 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched/psi: fix race between file release and pressure write |
| HIGH | | 7 | | CVE-2026-53000 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nat: use kfree_rcu to release ops |
| HIGH | | 7 | | CVE-2026-53091 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: pull headers in qdisc_pkt_len_segs_init() |
| HIGH | | 7.8 | | CVE-2026-53109 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy |
| HIGH | | 7.8 | | CVE-2026-53118 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vdpa: use generic driver_override infrastructure |
| HIGH | | 7 | | CVE-2026-53277 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation |
| HIGH | | 7.1 | | CVE-2026-53330 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() |
| HIGH | | 7 | | CVE-2026-63879 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages |
| HIGH | | 7 | | CVE-2026-64283 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values |
| HIGH | | | | CVE-2026-64389 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: validate NTLMv2 response before updating session key |
| HIGH | | | | CVE-2026-64400 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: prevent path traversal bypass by restricting caseless retry |
| HIGH | | 7.1 | | CVE-2026-68409 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: defer link RX stats percpu free to RCU |
| HIGH | | 7.3 | | CVE-2026-68426 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment |
| HIGH | | 7.6 | | CVE-2026-68470 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate extension-frame layout before RX |
| HIGH | | 7.8 | | CVE-2026-72042 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipmi: Fix user refcount underflow in event delivery |
| HIGH | | 7.8 | | CVE-2026-72098 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dm-verity: fix buffer overflow in FEC calculation |
| HIGH | | 7 | | CVE-2026-74269 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt: fix head underflow on XDP head-grow |
| HIGH | | 7 | | CVE-2026-74520 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/iommufd: Fix IOPF group ownership UAF |
| HIGH | | 8.8 | | CVE-2026-74752 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cookie AUTH state before use |
| HIGH | | 8.1 | | CVE-2026-89631 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject a tree connect response whose byte count is too small |
| HIGH | | 7 | | CVE-2026-89675 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix UAF in async copy cancel and shutdown |
| HIGH | | | | CVE-2026-89788 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| HIGH | | 7 | | CVE-2026-89811 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension |
| HIGH | | 7 | | CVE-2026-90111 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ip6mr: do not clone dst in ip6mr_cache_report() |
| HIGH | | 7 | | CVE-2026-90206 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvmet: fix max_qid race between configfs and controller allocation |
| HIGH | | 7 | | CVE-2026-90315 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers |
| HIGH | | | | CVE-2026-98084 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| HIGH | | 7 | | CVE-2026-98364 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfrm: hold net_device reference under RCU in bundle creation |
| HIGH | | 8.2 | | CVE-2026-98466 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| HIGH | | 7.8 | | CVE-2026-98715 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| HIGH | | 7.5 | | CVE-2026-98853 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: gso: limit recursive IP-in-IP segmentation |
| HIGH | | 7.8 | | CVE-2013-7445 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects |
| HIGH | | 7.8 | | CVE-2019-19449 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manage |
| HIGH | | 7.8 | | CVE-2019-19814 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c |
| HIGH | | 7.8 | | CVE-2021-3847 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: low-privileged user privileges escalation |
| HIGH | | 7 | | CVE-2021-3864 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: descendant's dumpable setting with certain SUID binaries |
| HIGH | | 7.8 | | CVE-2024-21803 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c |
| HIGH | | 7.1 | | CVE-2024-58015 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix for out-of bound access error |
| HIGH | | 7.8 | | CVE-2025-38137 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering |
| HIGH | | 7.8 | | CVE-2025-38187 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() |
| HIGH | | 7.8 | | CVE-2025-38421 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: platform/x86/amd: pmf: Use device managed allocations |
| HIGH | | 7.1 | | CVE-2025-38636 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rv: Use strings in da monitors tracepoints |
| HIGH | | 7.8 | | CVE-2025-39859 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog |
| HIGH | | 7.8 | | CVE-2025-39862 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7915: fix list corruption after hardware restart |
| HIGH | | 7.8 | | CVE-2025-39958 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/s390: Make attach succeed when the device was surprise removed |
| HIGH | | | | CVE-2025-40025 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer for non inode dnode |
| HIGH | | 7 | | CVE-2025-68174 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel AMD KFD: Race condition causes system crash |
| HIGH | | 7.8 | | CVE-2025-68735 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Privilege escalation via use-after-free in drm/panthor |
| HIGH | | 7.8 | | CVE-2026-100072 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ACPI: platform: Use acpi_bus_get_primary_device() |
| HIGH | | 7.1 | | CVE-2026-23102 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to incorrect SVE context restoration |
| HIGH | | 7.8 | | CVE-2026-23208 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: usb-audio: Prevent excessive number of frames |
| HIGH | | 7.1 | | CVE-2026-23327 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() |
| HIGH | | 7.8 | | CVE-2026-31493 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/efa: Fix use of completion ctx after free |
| HIGH | | 7.1 | | CVE-2026-31568 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Add missing secure storage access fixups for donated memory |
| HIGH | | | | CVE-2026-43185 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() |
| HIGH | | 7.1 | | CVE-2026-46130 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dm-verity-fec: fix reading parity bytes split across blocks (take 3) |
| HIGH | | 7 | | CVE-2026-46181 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() |
| HIGH | | 7.8 | | CVE-2026-46279 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/alloc_tag: clear codetag for pages allocated before page_ext initialization |
| HIGH | | 7 | | CVE-2026-52991 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched/psi: fix race between file release and pressure write |
| HIGH | | 7 | | CVE-2026-53000 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nat: use kfree_rcu to release ops |
| HIGH | | 7 | | CVE-2026-53091 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: pull headers in qdisc_pkt_len_segs_init() |
| HIGH | | 7.8 | | CVE-2026-53109 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy |
| HIGH | | 7.8 | | CVE-2026-53118 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vdpa: use generic driver_override infrastructure |
| HIGH | | 7 | | CVE-2026-53277 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation |
| HIGH | | 7.1 | | CVE-2026-53330 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() |
| HIGH | | 7 | | CVE-2026-63879 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages |
| HIGH | | 7 | | CVE-2026-64283 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values |
| HIGH | | | | CVE-2026-64389 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: validate NTLMv2 response before updating session key |
| HIGH | | | | CVE-2026-64400 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: prevent path traversal bypass by restricting caseless retry |
| HIGH | | 7.1 | | CVE-2026-68409 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: defer link RX stats percpu free to RCU |
| HIGH | | 7.3 | | CVE-2026-68426 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment |
| HIGH | | 7.6 | | CVE-2026-68470 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate extension-frame layout before RX |
| HIGH | | 7.8 | | CVE-2026-72042 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipmi: Fix user refcount underflow in event delivery |
| HIGH | | 7.8 | | CVE-2026-72098 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dm-verity: fix buffer overflow in FEC calculation |
| HIGH | | 7 | | CVE-2026-74269 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt: fix head underflow on XDP head-grow |
| HIGH | | 7 | | CVE-2026-74520 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/iommufd: Fix IOPF group ownership UAF |
| HIGH | | 8.8 | | CVE-2026-74752 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cookie AUTH state before use |
| HIGH | | 8.1 | | CVE-2026-89631 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject a tree connect response whose byte count is too small |
| HIGH | | 7 | | CVE-2026-89675 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix UAF in async copy cancel and shutdown |
| HIGH | | | | CVE-2026-89788 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| HIGH | | 7 | | CVE-2026-89811 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension |
| HIGH | | 7 | | CVE-2026-90111 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ip6mr: do not clone dst in ip6mr_cache_report() |
| HIGH | | 7 | | CVE-2026-90206 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvmet: fix max_qid race between configfs and controller allocation |
| HIGH | | 7 | | CVE-2026-90315 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers |
| HIGH | | | | CVE-2026-98084 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| HIGH | | 7 | | CVE-2026-98364 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfrm: hold net_device reference under RCU in bundle creation |
| HIGH | | 8.2 | | CVE-2026-98466 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| HIGH | | 7.8 | | CVE-2026-98715 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| HIGH | | 7.5 | | CVE-2026-98853 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: gso: limit recursive IP-in-IP segmentation |
| HIGH | | 7.8 | | CVE-2013-7445 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects |
| HIGH | | 7.8 | | CVE-2019-19449 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manage |
| HIGH | | 7.8 | | CVE-2019-19814 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c |
| HIGH | | 7.8 | | CVE-2021-3847 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: low-privileged user privileges escalation |
| HIGH | | 7 | | CVE-2021-3864 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: descendant's dumpable setting with certain SUID binaries |
| HIGH | | 7.8 | | CVE-2024-21803 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c |
| HIGH | | 7.1 | | CVE-2024-58015 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix for out-of bound access error |
| HIGH | | 7.8 | | CVE-2025-38137 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering |
| HIGH | | 7.8 | | CVE-2025-38187 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() |
| HIGH | | 7.8 | | CVE-2025-38421 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: platform/x86/amd: pmf: Use device managed allocations |
| HIGH | | 7.1 | | CVE-2025-38636 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rv: Use strings in da monitors tracepoints |
| HIGH | | 7.8 | | CVE-2025-39859 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog |
| HIGH | | 7.8 | | CVE-2025-39862 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7915: fix list corruption after hardware restart |
| HIGH | | 7.8 | | CVE-2025-39958 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/s390: Make attach succeed when the device was surprise removed |
| HIGH | | | | CVE-2025-40025 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer for non inode dnode |
| HIGH | | 7 | | CVE-2025-68174 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel AMD KFD: Race condition causes system crash |
| HIGH | | 7.8 | | CVE-2025-68735 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Privilege escalation via use-after-free in drm/panthor |
| HIGH | | 7.8 | | CVE-2026-100072 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ACPI: platform: Use acpi_bus_get_primary_device() |
| HIGH | | 7.1 | | CVE-2026-23102 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to incorrect SVE context restoration |
| HIGH | | 7.8 | | CVE-2026-23208 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: usb-audio: Prevent excessive number of frames |
| HIGH | | 7.1 | | CVE-2026-23327 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() |
| HIGH | | 7.8 | | CVE-2026-31493 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/efa: Fix use of completion ctx after free |
| HIGH | | 7.1 | | CVE-2026-31568 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Add missing secure storage access fixups for donated memory |
| HIGH | | | | CVE-2026-43185 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() |
| HIGH | | 7.1 | | CVE-2026-46130 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dm-verity-fec: fix reading parity bytes split across blocks (take 3) |
| HIGH | | 7 | | CVE-2026-46181 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() |
| HIGH | | 7.8 | | CVE-2026-46279 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/alloc_tag: clear codetag for pages allocated before page_ext initialization |
| HIGH | | 7 | | CVE-2026-52991 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched/psi: fix race between file release and pressure write |
| HIGH | | 7 | | CVE-2026-53000 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nat: use kfree_rcu to release ops |
| HIGH | | 7 | | CVE-2026-53091 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: pull headers in qdisc_pkt_len_segs_init() |
| HIGH | | 7.8 | | CVE-2026-53109 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy |
| HIGH | | 7.8 | | CVE-2026-53118 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vdpa: use generic driver_override infrastructure |
| HIGH | | 7 | | CVE-2026-53277 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation |
| HIGH | | 7.1 | | CVE-2026-53330 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() |
| HIGH | | 7 | | CVE-2026-63879 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages |
| HIGH | | 7 | | CVE-2026-64283 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values |
| HIGH | | | | CVE-2026-64389 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: validate NTLMv2 response before updating session key |
| HIGH | | | | CVE-2026-64400 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: prevent path traversal bypass by restricting caseless retry |
| HIGH | | 7.1 | | CVE-2026-68409 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: defer link RX stats percpu free to RCU |
| HIGH | | 7.3 | | CVE-2026-68426 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment |
| HIGH | | 7.6 | | CVE-2026-68470 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate extension-frame layout before RX |
| HIGH | | 7.8 | | CVE-2026-72042 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipmi: Fix user refcount underflow in event delivery |
| HIGH | | 7.8 | | CVE-2026-72098 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dm-verity: fix buffer overflow in FEC calculation |
| HIGH | | 7 | | CVE-2026-74269 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt: fix head underflow on XDP head-grow |
| HIGH | | 7 | | CVE-2026-74520 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/iommufd: Fix IOPF group ownership UAF |
| HIGH | | 8.8 | | CVE-2026-74752 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cookie AUTH state before use |
| HIGH | | 8.1 | | CVE-2026-89631 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject a tree connect response whose byte count is too small |
| HIGH | | 7 | | CVE-2026-89675 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix UAF in async copy cancel and shutdown |
| HIGH | | | | CVE-2026-89788 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| HIGH | | 7 | | CVE-2026-89811 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension |
| HIGH | | 7 | | CVE-2026-90111 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ip6mr: do not clone dst in ip6mr_cache_report() |
| HIGH | | 7 | | CVE-2026-90206 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvmet: fix max_qid race between configfs and controller allocation |
| HIGH | | 7 | | CVE-2026-90315 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers |
| HIGH | | | | CVE-2026-98084 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| HIGH | | 7 | | CVE-2026-98364 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfrm: hold net_device reference under RCU in bundle creation |
| HIGH | | 8.2 | | CVE-2026-98466 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| HIGH | | 7.8 | | CVE-2026-98715 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| HIGH | | 7.5 | | CVE-2026-98853 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: gso: limit recursive IP-in-IP segmentation |
| HIGH | | 7.8 | | CVE-2013-7445 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects |
| HIGH | | 7.8 | | CVE-2019-19449 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manage |
| HIGH | | 7.8 | | CVE-2019-19814 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c |
| HIGH | | 7.8 | | CVE-2021-3847 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: low-privileged user privileges escalation |
| HIGH | | 7 | | CVE-2021-3864 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: descendant's dumpable setting with certain SUID binaries |
| HIGH | | 7.8 | | CVE-2024-21803 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c |
| HIGH | | 7.1 | | CVE-2024-58015 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix for out-of bound access error |
| HIGH | | 7.8 | | CVE-2025-38137 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering |
| HIGH | | 7.8 | | CVE-2025-38187 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() |
| HIGH | | 7.8 | | CVE-2025-38421 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: platform/x86/amd: pmf: Use device managed allocations |
| HIGH | | 7.1 | | CVE-2025-38636 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rv: Use strings in da monitors tracepoints |
| HIGH | | 7.8 | | CVE-2025-39859 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog |
| HIGH | | 7.8 | | CVE-2025-39862 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7915: fix list corruption after hardware restart |
| HIGH | | 7.8 | | CVE-2025-39958 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/s390: Make attach succeed when the device was surprise removed |
| HIGH | | | | CVE-2025-40025 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer for non inode dnode |
| HIGH | | 7 | | CVE-2025-68174 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel AMD KFD: Race condition causes system crash |
| HIGH | | 7.8 | | CVE-2025-68735 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Privilege escalation via use-after-free in drm/panthor |
| HIGH | | 7.8 | | CVE-2026-100072 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ACPI: platform: Use acpi_bus_get_primary_device() |
| HIGH | | 7.1 | | CVE-2026-23102 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to incorrect SVE context restoration |
| HIGH | | 7.8 | | CVE-2026-23208 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: usb-audio: Prevent excessive number of frames |
| HIGH | | 7.1 | | CVE-2026-23327 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() |
| HIGH | | 7.8 | | CVE-2026-31493 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/efa: Fix use of completion ctx after free |
| HIGH | | 7.1 | | CVE-2026-31568 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Add missing secure storage access fixups for donated memory |
| HIGH | | | | CVE-2026-43185 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() |
| HIGH | | 7.1 | | CVE-2026-46130 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dm-verity-fec: fix reading parity bytes split across blocks (take 3) |
| HIGH | | 7 | | CVE-2026-46181 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() |
| HIGH | | 7.8 | | CVE-2026-46279 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/alloc_tag: clear codetag for pages allocated before page_ext initialization |
| HIGH | | 7 | | CVE-2026-52991 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched/psi: fix race between file release and pressure write |
| HIGH | | 7 | | CVE-2026-53000 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nat: use kfree_rcu to release ops |
| HIGH | | 7 | | CVE-2026-53091 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: pull headers in qdisc_pkt_len_segs_init() |
| HIGH | | 7.8 | | CVE-2026-53109 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy |
| HIGH | | 7.8 | | CVE-2026-53118 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vdpa: use generic driver_override infrastructure |
| HIGH | | 7 | | CVE-2026-53277 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation |
| HIGH | | 7.1 | | CVE-2026-53330 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() |
| HIGH | | 7 | | CVE-2026-63879 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages |
| HIGH | | 7 | | CVE-2026-64283 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values |
| HIGH | | | | CVE-2026-64389 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: validate NTLMv2 response before updating session key |
| HIGH | | | | CVE-2026-64400 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: prevent path traversal bypass by restricting caseless retry |
| HIGH | | 7.1 | | CVE-2026-68409 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: defer link RX stats percpu free to RCU |
| HIGH | | 7.3 | | CVE-2026-68426 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment |
| HIGH | | 7.6 | | CVE-2026-68470 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate extension-frame layout before RX |
| HIGH | | 7.8 | | CVE-2026-72042 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipmi: Fix user refcount underflow in event delivery |
| HIGH | | 7.8 | | CVE-2026-72098 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dm-verity: fix buffer overflow in FEC calculation |
| HIGH | | 7 | | CVE-2026-74269 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt: fix head underflow on XDP head-grow |
| HIGH | | 7 | | CVE-2026-74520 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/iommufd: Fix IOPF group ownership UAF |
| HIGH | | 8.8 | | CVE-2026-74752 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cookie AUTH state before use |
| HIGH | | 8.1 | | CVE-2026-89631 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject a tree connect response whose byte count is too small |
| HIGH | | 7 | | CVE-2026-89675 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix UAF in async copy cancel and shutdown |
| HIGH | | | | CVE-2026-89788 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| HIGH | | 7 | | CVE-2026-89811 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension |
| HIGH | | 7 | | CVE-2026-90111 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ip6mr: do not clone dst in ip6mr_cache_report() |
| HIGH | | 7 | | CVE-2026-90206 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvmet: fix max_qid race between configfs and controller allocation |
| HIGH | | 7 | | CVE-2026-90315 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers |
| HIGH | | | | CVE-2026-98084 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| HIGH | | 7 | | CVE-2026-98364 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfrm: hold net_device reference under RCU in bundle creation |
| HIGH | | 8.2 | | CVE-2026-98466 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| HIGH | | 7.8 | | CVE-2026-98715 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| HIGH | | 7.5 | | CVE-2026-98853 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: gso: limit recursive IP-in-IP segmentation |
| HIGH | | 7.8 | | CVE-2013-7445 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects |
| HIGH | | 7.8 | | CVE-2019-19449 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manage |
| HIGH | | 7.8 | | CVE-2019-19814 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c |
| HIGH | | 7.8 | | CVE-2021-3847 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: low-privileged user privileges escalation |
| HIGH | | 7 | | CVE-2021-3864 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: descendant's dumpable setting with certain SUID binaries |
| HIGH | | 7.8 | | CVE-2024-21803 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c |
| HIGH | | 7.1 | | CVE-2024-58015 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix for out-of bound access error |
| HIGH | | 7.8 | | CVE-2025-38137 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering |
| HIGH | | 7.8 | | CVE-2025-38187 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() |
| HIGH | | 7.8 | | CVE-2025-38421 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: platform/x86/amd: pmf: Use device managed allocations |
| HIGH | | 7.1 | | CVE-2025-38636 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: rv: Use strings in da monitors tracepoints |
| HIGH | | 7.8 | | CVE-2025-39859 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog |
| HIGH | | 7.8 | | CVE-2025-39862 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7915: fix list corruption after hardware restart |
| HIGH | | 7.8 | | CVE-2025-39958 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: iommu/s390: Make attach succeed when the device was surprise removed |
| HIGH | | | | CVE-2025-40025 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer for non inode dnode |
| HIGH | | 7 | | CVE-2025-68174 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Linux kernel AMD KFD: Race condition causes system crash |
| HIGH | | 7.8 | | CVE-2025-68735 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Kernel: Privilege escalation via use-after-free in drm/panthor |
| HIGH | | 7.8 | | CVE-2026-100072 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ACPI: platform: Use acpi_bus_get_primary_device() |
| HIGH | | 7.1 | | CVE-2026-23102 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to incorrect SVE context restoration |
| HIGH | | 7.8 | | CVE-2026-23208 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ALSA: usb-audio: Prevent excessive number of frames |
| HIGH | | 7.1 | | CVE-2026-23327 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() |
| HIGH | | 7.8 | | CVE-2026-31493 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: RDMA/efa: Fix use of completion ctx after free |
| HIGH | | 7.1 | | CVE-2026-31568 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Add missing secure storage access fixups for donated memory |
| HIGH | | | | CVE-2026-43185 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() |
| HIGH | | 7.1 | | CVE-2026-46130 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: dm-verity-fec: fix reading parity bytes split across blocks (take 3) |
| HIGH | | 7 | | CVE-2026-46181 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() |
| HIGH | | 7.8 | | CVE-2026-46279 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: mm/alloc_tag: clear codetag for pages allocated before page_ext initialization |
| HIGH | | 7 | | CVE-2026-52991 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: sched/psi: fix race between file release and pressure write |
| HIGH | | 7 | | CVE-2026-53000 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfilter: nat: use kfree_rcu to release ops |
| HIGH | | 7 | | CVE-2026-53091 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: pull headers in qdisc_pkt_len_segs_init() |
| HIGH | | 7.8 | | CVE-2026-53109 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy |
| HIGH | | 7.8 | | CVE-2026-53118 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: vdpa: use generic driver_override infrastructure |
| HIGH | | 7 | | CVE-2026-53277 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation |
| HIGH | | 7.1 | | CVE-2026-53330 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() |
| HIGH | | 7 | | CVE-2026-63879 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages |
| HIGH | | 7 | | CVE-2026-64283 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values |
| HIGH | | | | CVE-2026-64389 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ksmbd: validate NTLMv2 response before updating session key |
| HIGH | | | | CVE-2026-64400 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ksmbd: prevent path traversal bypass by restricting caseless retry |
| HIGH | | 7.1 | | CVE-2026-68409 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: defer link RX stats percpu free to RCU |
| HIGH | | 7.3 | | CVE-2026-68426 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment |
| HIGH | | 7.6 | | CVE-2026-68470 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate extension-frame layout before RX |
| HIGH | | 7.8 | | CVE-2026-72042 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ipmi: Fix user refcount underflow in event delivery |
| HIGH | | 7.8 | | CVE-2026-72098 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: dm-verity: fix buffer overflow in FEC calculation |
| HIGH | | 7 | | CVE-2026-74269 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bnxt: fix head underflow on XDP head-grow |
| HIGH | | 7 | | CVE-2026-74520 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: iommu/iommufd: Fix IOPF group ownership UAF |
| HIGH | | 8.8 | | CVE-2026-74752 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cookie AUTH state before use |
| HIGH | | 8.1 | | CVE-2026-89631 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject a tree connect response whose byte count is too small |
| HIGH | | 7 | | CVE-2026-89675 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix UAF in async copy cancel and shutdown |
| HIGH | | | | CVE-2026-89788 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| HIGH | | 7 | | CVE-2026-89811 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension |
| HIGH | | 7 | | CVE-2026-90111 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ip6mr: do not clone dst in ip6mr_cache_report() |
| HIGH | | 7 | | CVE-2026-90206 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: nvmet: fix max_qid race between configfs and controller allocation |
| HIGH | | 7 | | CVE-2026-90315 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers |
| HIGH | | | | CVE-2026-98084 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| HIGH | | 7 | | CVE-2026-98364 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: xfrm: hold net_device reference under RCU in bundle creation |
| HIGH | | 8.2 | | CVE-2026-98466 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| HIGH | | 7.8 | | CVE-2026-98715 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| HIGH | | 7.5 | | CVE-2026-98853 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: gso: limit recursive IP-in-IP segmentation |
| HIGH | | 7.8 | | CVE-2013-7445 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects |
| HIGH | | 7.8 | | CVE-2019-19449 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manage |
| HIGH | | 7.8 | | CVE-2019-19814 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c |
| HIGH | | 7.8 | | CVE-2021-3847 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: low-privileged user privileges escalation |
| HIGH | | 7 | | CVE-2021-3864 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: descendant's dumpable setting with certain SUID binaries |
| HIGH | | 7.8 | | CVE-2024-21803 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c |
| HIGH | | 7.1 | | CVE-2024-58015 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix for out-of bound access error |
| HIGH | | 7.8 | | CVE-2025-38137 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering |
| HIGH | | 7.8 | | CVE-2025-38187 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() |
| HIGH | | 7.8 | | CVE-2025-38421 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: platform/x86/amd: pmf: Use device managed allocations |
| HIGH | | 7.1 | | CVE-2025-38636 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: rv: Use strings in da monitors tracepoints |
| HIGH | | 7.8 | | CVE-2025-39859 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog |
| HIGH | | 7.8 | | CVE-2025-39862 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7915: fix list corruption after hardware restart |
| HIGH | | 7.8 | | CVE-2025-39958 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: iommu/s390: Make attach succeed when the device was surprise removed |
| HIGH | | | | CVE-2025-40025 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer for non inode dnode |
| HIGH | | 7 | | CVE-2025-68174 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Linux kernel AMD KFD: Race condition causes system crash |
| HIGH | | 7.8 | | CVE-2025-68735 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Kernel: Privilege escalation via use-after-free in drm/panthor |
| HIGH | | 7.8 | | CVE-2026-100072 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ACPI: platform: Use acpi_bus_get_primary_device() |
| HIGH | | 7.1 | | CVE-2026-23102 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to incorrect SVE context restoration |
| HIGH | | 7.8 | | CVE-2026-23208 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ALSA: usb-audio: Prevent excessive number of frames |
| HIGH | | 7.1 | | CVE-2026-23327 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() |
| HIGH | | 7.8 | | CVE-2026-31493 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: RDMA/efa: Fix use of completion ctx after free |
| HIGH | | 7.1 | | CVE-2026-31568 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Add missing secure storage access fixups for donated memory |
| HIGH | | | | CVE-2026-43185 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() |
| HIGH | | 7.1 | | CVE-2026-46130 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: dm-verity-fec: fix reading parity bytes split across blocks (take 3) |
| HIGH | | 7 | | CVE-2026-46181 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() |
| HIGH | | 7.8 | | CVE-2026-46279 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: mm/alloc_tag: clear codetag for pages allocated before page_ext initialization |
| HIGH | | 7 | | CVE-2026-52991 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: sched/psi: fix race between file release and pressure write |
| HIGH | | 7 | | CVE-2026-53000 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfilter: nat: use kfree_rcu to release ops |
| HIGH | | 7 | | CVE-2026-53091 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: pull headers in qdisc_pkt_len_segs_init() |
| HIGH | | 7.8 | | CVE-2026-53109 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy |
| HIGH | | 7.8 | | CVE-2026-53118 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: vdpa: use generic driver_override infrastructure |
| HIGH | | 7 | | CVE-2026-53277 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation |
| HIGH | | 7.1 | | CVE-2026-53330 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() |
| HIGH | | 7 | | CVE-2026-63879 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages |
| HIGH | | 7 | | CVE-2026-64283 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values |
| HIGH | | | | CVE-2026-64389 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ksmbd: validate NTLMv2 response before updating session key |
| HIGH | | | | CVE-2026-64400 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ksmbd: prevent path traversal bypass by restricting caseless retry |
| HIGH | | 7.1 | | CVE-2026-68409 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: defer link RX stats percpu free to RCU |
| HIGH | | 7.3 | | CVE-2026-68426 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment |
| HIGH | | 7.6 | | CVE-2026-68470 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate extension-frame layout before RX |
| HIGH | | 7.8 | | CVE-2026-72042 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ipmi: Fix user refcount underflow in event delivery |
| HIGH | | 7.8 | | CVE-2026-72098 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: dm-verity: fix buffer overflow in FEC calculation |
| HIGH | | 7 | | CVE-2026-74269 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bnxt: fix head underflow on XDP head-grow |
| HIGH | | 7 | | CVE-2026-74520 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: iommu/iommufd: Fix IOPF group ownership UAF |
| HIGH | | 8.8 | | CVE-2026-74752 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cookie AUTH state before use |
| HIGH | | 8.1 | | CVE-2026-89631 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject a tree connect response whose byte count is too small |
| HIGH | | 7 | | CVE-2026-89675 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix UAF in async copy cancel and shutdown |
| HIGH | | | | CVE-2026-89788 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| HIGH | | 7 | | CVE-2026-89811 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension |
| HIGH | | 7 | | CVE-2026-90111 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ip6mr: do not clone dst in ip6mr_cache_report() |
| HIGH | | 7 | | CVE-2026-90206 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: nvmet: fix max_qid race between configfs and controller allocation |
| HIGH | | 7 | | CVE-2026-90315 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers |
| HIGH | | | | CVE-2026-98084 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| HIGH | | 7 | | CVE-2026-98364 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: xfrm: hold net_device reference under RCU in bundle creation |
| HIGH | | 8.2 | | CVE-2026-98466 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| HIGH | | 7.8 | | CVE-2026-98715 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| HIGH | | 7.5 | | CVE-2026-98853 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: gso: limit recursive IP-in-IP segmentation |
| HIGH | | 7 | | CVE-2026-53612 | login | 1:4.16.0-2+really2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes |
| HIGH | | 7 | | CVE-2026-53613 | login | 1:4.16.0-2+really2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path |
| HIGH | | 7 | | CVE-2026-53614 | login | 1:4.16.0-2+really2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 |
| HIGH | | 8 | | CVE-2026-53615 | login | 1:4.16.0-2+really2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser |
| HIGH | | 7.8 | | CVE-2026-76642 | login | 1:4.16.0-2+really2.41-5 | | util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks |
| HIGH | | 7.9 | | CVE-2026-78408 | login | 1:4.16.0-2+really2.41-5 | | util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority |
| HIGH | | 7 | | CVE-2026-78409 | login | 1:4.16.0-2+really2.41-5 | | util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks |
| HIGH | | 7.8 | | CVE-2026-78410 | login | 1:4.16.0-2+really2.41-5 | | util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection |
| HIGH | | 7 | | CVE-2026-53612 | mount | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes |
| HIGH | | 7 | | CVE-2026-53613 | mount | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path |
| HIGH | | 7 | | CVE-2026-53614 | mount | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 |
| HIGH | | 8 | | CVE-2026-53615 | mount | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser |
| HIGH | | 7.8 | | CVE-2026-76642 | mount | 2.41-5 | | util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks |
| HIGH | | 7.9 | | CVE-2026-78408 | mount | 2.41-5 | | util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority |
| HIGH | | 7 | | CVE-2026-78409 | mount | 2.41-5 | | util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks |
| HIGH | | 7.8 | | CVE-2026-78410 | mount | 2.41-5 | | util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection |
| HIGH | | 7.8 | | CVE-2025-69720 | ncurses-base | 6.5+20250216-2 | | ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution. |
| HIGH | | 7.8 | | CVE-2025-69720 | ncurses-bin | 6.5+20250216-2 | | ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution. |
| HIGH | | 7.8 | | CVE-2025-69720 | ncurses-term | 6.5+20250216-2 | | ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution. |
| HIGH | | 7.8 | | CVE-2026-42616 | ntfs-3g | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u2 | In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ... |
| HIGH | | 7.7 | | CVE-2026-46569 | ntfs-3g | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u2 | In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_c ... |
| HIGH | | 7.5 | | CVE-2026-106553 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Credential disclosure via failed GSSAPI authentication |
| HIGH | | 7.5 | | CVE-2026-106555 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Information disclosure via GSSAPI authentication state persistence |
| HIGH | | 7.8 | | CVE-2026-106583 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: openssh: Command injection via unvalidated command-line username |
| HIGH | | 7.5 | | CVE-2026-59999 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options |
| HIGH | | 7.5 | | CVE-2026-60000 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts |
| HIGH | | 7.5 | | CVE-2026-106553 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Credential disclosure via failed GSSAPI authentication |
| HIGH | | 7.5 | | CVE-2026-106555 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Information disclosure via GSSAPI authentication state persistence |
| HIGH | | 7.8 | | CVE-2026-106583 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: openssh: Command injection via unvalidated command-line username |
| HIGH | | 7.5 | | CVE-2026-59999 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options |
| HIGH | | 7.5 | | CVE-2026-60000 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts |
| HIGH | | 7.5 | | CVE-2026-106553 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Credential disclosure via failed GSSAPI authentication |
| HIGH | | 7.5 | | CVE-2026-106555 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Information disclosure via GSSAPI authentication state persistence |
| HIGH | | 7.8 | | CVE-2026-106583 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: openssh: Command injection via unvalidated command-line username |
| HIGH | | 7.5 | | CVE-2026-59999 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options |
| HIGH | | 7.5 | | CVE-2026-60000 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts |
| HIGH | | 7.5 | | CVE-2026-14456 | openssl-provider-legacy | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server |
| HIGH | | 7.4 | | CVE-2026-84782 | openssl-provider-legacy | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission |
| HIGH | | 7.5 | | CVE-2026-14456 | openssl | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server |
| HIGH | | 7.4 | | CVE-2026-84782 | openssl | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission |
| HIGH | | 7.5 | | CVE-2026-42497 | perl-base | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction |
| HIGH | | 7.8 | | CVE-2026-48962 | perl-base | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob |
| HIGH | | 8.4 | | CVE-2026-57432 | perl-base | 5.40.1-6 | 5.40.1-6+deb13u1 | perl: Perl: Information disclosure via integer overflow in pack/unpack operations |
| HIGH | | 7.5 | | CVE-2026-57433 | perl-base | 5.40.1-6 | 5.40.1-6+deb13u1 | Storable: Storable: Denial of Service via signed integer overflow in deserialization |
| HIGH | | 7.5 | | CVE-2026-9538 | perl-base | 5.40.1-6 | | perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size |
| HIGH | | 7.5 | | CVE-2026-42497 | perl-modules-5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction |
| HIGH | | 7.8 | | CVE-2026-48962 | perl-modules-5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob |
| HIGH | | 8.4 | | CVE-2026-57432 | perl-modules-5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | perl: Perl: Information disclosure via integer overflow in pack/unpack operations |
| HIGH | | 7.5 | | CVE-2026-57433 | perl-modules-5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | Storable: Storable: Denial of Service via signed integer overflow in deserialization |
| HIGH | | 7.5 | | CVE-2026-9538 | perl-modules-5.40 | 5.40.1-6 | | perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size |
| HIGH | | 7.5 | | CVE-2026-42497 | perl | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction |
| HIGH | | 7.8 | | CVE-2026-48962 | perl | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob |
| HIGH | | 8.4 | | CVE-2026-57432 | perl | 5.40.1-6 | 5.40.1-6+deb13u1 | perl: Perl: Information disclosure via integer overflow in pack/unpack operations |
| HIGH | | 7.5 | | CVE-2026-57433 | perl | 5.40.1-6 | 5.40.1-6+deb13u1 | Storable: Storable: Denial of Service via signed integer overflow in deserialization |
| HIGH | | 7.5 | | CVE-2026-9538 | perl | 5.40.1-6 | | perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size |
| HIGH | | 7.5 | | CVE-2026-69249 | python3-cryptography | 43.0.0-3+deb13u1 | | python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building |
| HIGH | | 7.5 | | CVE-2026-101917 | python3-jwt | 2.10.1-2+deb13u1 | | pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers |
| HIGH | | 7.5 | | CVE-2026-101918 | python3-jwt | 2.10.1-2+deb13u1 | | pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload |
| HIGH | | 7.4 | | CVE-2026-102271 | python3-jwt | 2.10.1-2+deb13u1 | | pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets |
| HIGH | | 7.4 | | CVE-2026-102272 | python3-jwt | 2.10.1-2+deb13u1 | | pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling |
| HIGH | | 7.4 | | CVE-2026-102273 | python3-jwt | 2.10.1-2+deb13u1 | | pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets |
| HIGH | | 7.5 | | CVE-2026-102274 | python3-jwt | 2.10.1-2+deb13u1 | | pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set |
| HIGH | | 8.2 | | CVE-2026-102275 | python3-jwt | 2.10.1-2+deb13u1 | | pyjwt: PyJWT: Token verification bypass via mismatched OKP key components |
| HIGH | | 7.4 | | CVE-2026-48526 | python3-jwt | 2.10.1-2+deb13u1 | | python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens |
| HIGH | | 8.6 | | CVE-2026-23949 | python3-setuptools-whl | 78.1.1-0.1 | | jaraco.context: jaraco.context: Path traversal via malicious tar archives |
| HIGH | | 7.5 | | CVE-2025-66471 | python3-urllib3 | 2.3.0-3+deb13u1 | | urllib3: urllib3 Streaming API improperly handles highly compressed data |
| HIGH | | 8.1 | | CVE-2026-97687 | python3-urllib3 | 2.3.0-3+deb13u1 | | urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override |
| HIGH | | 7.5 | | CVE-2026-97689 | python3-urllib3 | 2.3.0-3+deb13u1 | | urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser |
| HIGH | | 7.3 | | CVE-2026-11940 | python3.13-minimal | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory |
| HIGH | | 7.5 | | CVE-2026-15308 | python3.13-minimal | 3.13.5-2+deb13u2 | | python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations |
| HIGH | | 8.1 | | CVE-2026-19445 | python3.13-minimal | 3.13.5-2+deb13u2 | | python: Use-after-free of a server-side SSLContext when sni_callback switches contexts |
| HIGH | | 7.4 | | CVE-2026-19553 | python3.13-minimal | 3.13.5-2+deb13u2 | | python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() |
| HIGH | | 7.5 | | CVE-2026-7210 | python3.13-minimal | 3.13.5-2+deb13u2 | | python: Python/Expat: Denial of Service via crafted XML document |
| HIGH | | 7.1 | | CVE-2026-82049 | python3.13-minimal | 3.13.5-2+deb13u2 | | python: Python tarfile module: File modification and content disclosure via crafted archives |
| HIGH | | 5.3 | | CVE-2026-8328 | python3.13-minimal | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python: FTP connection redirection via ftpcp() function bypass |
| HIGH | | 7.3 | | CVE-2026-11940 | python3.13-venv | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory |
| HIGH | | 7.5 | | CVE-2026-15308 | python3.13-venv | 3.13.5-2+deb13u2 | | python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations |
| HIGH | | 8.1 | | CVE-2026-19445 | python3.13-venv | 3.13.5-2+deb13u2 | | python: Use-after-free of a server-side SSLContext when sni_callback switches contexts |
| HIGH | | 7.4 | | CVE-2026-19553 | python3.13-venv | 3.13.5-2+deb13u2 | | python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() |
| HIGH | | 7.5 | | CVE-2026-7210 | python3.13-venv | 3.13.5-2+deb13u2 | | python: Python/Expat: Denial of Service via crafted XML document |
| HIGH | | 7.1 | | CVE-2026-82049 | python3.13-venv | 3.13.5-2+deb13u2 | | python: Python tarfile module: File modification and content disclosure via crafted archives |
| HIGH | | 5.3 | | CVE-2026-8328 | python3.13-venv | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python: FTP connection redirection via ftpcp() function bypass |
| HIGH | | 7.3 | | CVE-2026-11940 | python3.13 | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory |
| HIGH | | 7.5 | | CVE-2026-15308 | python3.13 | 3.13.5-2+deb13u2 | | python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations |
| HIGH | | 8.1 | | CVE-2026-19445 | python3.13 | 3.13.5-2+deb13u2 | | python: Use-after-free of a server-side SSLContext when sni_callback switches contexts |
| HIGH | | 7.4 | | CVE-2026-19553 | python3.13 | 3.13.5-2+deb13u2 | | python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() |
| HIGH | | 7.5 | | CVE-2026-7210 | python3.13 | 3.13.5-2+deb13u2 | | python: Python/Expat: Denial of Service via crafted XML document |
| HIGH | | 7.1 | | CVE-2026-82049 | python3.13 | 3.13.5-2+deb13u2 | | python: Python tarfile module: File modification and content disclosure via crafted archives |
| HIGH | | 5.3 | | CVE-2026-8328 | python3.13 | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python: FTP connection redirection via ftpcp() function bypass |
| HIGH | | 7 | | CVE-2026-53612 | rfkill | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes |
| HIGH | | 7 | | CVE-2026-53613 | rfkill | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path |
| HIGH | | 7 | | CVE-2026-53614 | rfkill | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 |
| HIGH | | 8 | | CVE-2026-53615 | rfkill | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser |
| HIGH | | 7.8 | | CVE-2026-76642 | rfkill | 2.41-5 | | util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks |
| HIGH | | 7.9 | | CVE-2026-78408 | rfkill | 2.41-5 | | util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority |
| HIGH | | 7 | | CVE-2026-78409 | rfkill | 2.41-5 | | util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks |
| HIGH | | 7.8 | | CVE-2026-78410 | rfkill | 2.41-5 | | util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection |
| HIGH | | 8.1 | | CVE-2026-53783 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Directory escape via TOCTOU race condition in rrsync |
| HIGH | | 7.1 | | CVE-2026-53784 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Unauthorized File Access via Symlink Module Root |
| HIGH | | 7.1 | | CVE-2026-53785 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Arbitrary file write via path traversal in --relative mode |
| HIGH | | 8.1 | | CVE-2026-53789 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Arbitrary file deletion via malicious file list |
| HIGH | | 8.1 | | CVE-2026-53790 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths |
| HIGH | | 7.4 | | CVE-2026-53791 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header |
| HIGH | | 7.4 | | CVE-2026-53793 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode |
| HIGH | | 8.1 | | CVE-2026-53795 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options |
| HIGH | | 7.1 | | CVE-2026-53802 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Arbitrary File Read via Symlink Following |
| HIGH | | 7 | | CVE-2026-53803 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Local Privilege Escalation via Symlink Following |
| HIGH | | 7.4 | | CVE-2026-70452 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure |
| HIGH | | 7.5 | | CVE-2026-70455 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Denial of Service via Zstandard compression thread exhaustion |
| HIGH | | 8.2 | | CVE-2026-70456 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Heap Out-of-Bounds Write via crafted argument list |
| HIGH | | 8.2 | | CVE-2026-70457 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Memory corruption via out-of-bounds write in size parsing |
| HIGH | | 8.2 | | CVE-2026-70458 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Memory corruption via crafted file entries |
| HIGH | | 8.1 | | CVE-2026-70460 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink |
| HIGH | | 8.2 | | CVE-2026-70461 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Information disclosure and denial of service via crafted files-from entry |
| HIGH | | 8.1 | | CVE-2026-70463 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Authorization bypass via `auth users` directive parsing |
| HIGH | | 7.5 | | CVE-2026-70464 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Denial of Service via handshake stall |
| HIGH | | 7.5 | | CVE-2026-106553 | ssh | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Credential disclosure via failed GSSAPI authentication |
| HIGH | | 7.5 | | CVE-2026-106555 | ssh | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Information disclosure via GSSAPI authentication state persistence |
| HIGH | | 7.8 | | CVE-2026-106583 | ssh | 1:10.0p1-7+deb13u4 | | openssh: openssh: Command injection via unvalidated command-line username |
| HIGH | | 7.5 | | CVE-2026-59999 | ssh | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options |
| HIGH | | 7.5 | | CVE-2026-60000 | ssh | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts |
| HIGH | | 7.8 | | CVE-2026-96512 | sudo | 1.9.16p2-3+deb13u2 | | sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization |
| HIGH | | 8.8 | | CVE-2026-16742 | systemd-sysv | 257.13-1~deb13u1 | | systemd: systemd-homed: Local privilege escalation via missing home-record signature verification |
| HIGH | | 8.8 | | CVE-2026-16742 | systemd-timesyncd | 257.13-1~deb13u1 | | systemd: systemd-homed: Local privilege escalation via missing home-record signature verification |
| HIGH | | 8.8 | | CVE-2026-16742 | systemd | 257.13-1~deb13u1 | | systemd: systemd-homed: Local privilege escalation via missing home-record signature verification |
| HIGH | | 8.8 | | CVE-2026-16742 | udev | 257.13-1~deb13u1 | | systemd: systemd-homed: Local privilege escalation via missing home-record signature verification |
| HIGH | | 7.8 | | CVE-2026-7867 | udisks2 | 2.10.1-12.1+deb13u1 | 2.10.1-12.1+deb13u2 | udisks2: udisks2: Local Privilege Escalation via as-user option spoofing |
| HIGH | | 7 | | CVE-2026-53612 | util-linux | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes |
| HIGH | | 7 | | CVE-2026-53613 | util-linux | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path |
| HIGH | | 7 | | CVE-2026-53614 | util-linux | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 |
| HIGH | | 8 | | CVE-2026-53615 | util-linux | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser |
| HIGH | | 7.8 | | CVE-2026-76642 | util-linux | 2.41-5 | | util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks |
| HIGH | | 7.9 | | CVE-2026-78408 | util-linux | 2.41-5 | | util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority |
| HIGH | | 7 | | CVE-2026-78409 | util-linux | 2.41-5 | | util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks |
| HIGH | | 7.8 | | CVE-2026-78410 | util-linux | 2.41-5 | | util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection |
| HIGH | | 7.5 | | CVE-2026-26269 | vim-common | 2:9.1.1230-2 | | vim: Netbeans specialKeys stack buffer overflow |
| HIGH | | 7.8 | | CVE-2026-28417 | vim-common | 2:9.1.1230-2 | | vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin |
| HIGH | | 7.8 | | CVE-2026-28421 | vim-common | 2:9.1.1230-2 | | vim: Vim: Denial of service and information disclosure via crafted swap file |
| HIGH | | 7.3 | | CVE-2026-33412 | vim-common | 2:9.1.1230-2 | | vim: Vim: Arbitrary code execution via command injection in glob() function |
| HIGH | | 8.2 | | CVE-2026-34982 | vim-common | 2:9.1.1230-2 | | vim: arbitrary command execution via modeline sandbox bypass |
| HIGH | | 7.1 | | CVE-2026-35177 | vim-common | 2:9.1.1230-2 | | vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass |
| HIGH | | 7.8 | | CVE-2026-39881 | vim-common | 2:9.1.1230-2 | | vim: Vim: Arbitrary code execution via command injection in NetBeans interface |
| HIGH | | 7.8 | | CVE-2026-43961 | vim-common | 2:9.1.1230-2 | | vim: Vimscript injection via unescaped filename in netrw s:NetrwMarkFile() filter() expression allows arbitrary code exe |
| HIGH | | 7 | | CVE-2026-46483 | vim-common | 2:9.1.1230-2 | | vim: command injection when decompressing .tgz archives |
| HIGH | | 8.8 | | CVE-2026-47162 | vim-common | 2:9.1.1230-2 | | vim: Vim: Arbitrary Code Execution via crafted directory names |
| HIGH | | 7.8 | | CVE-2026-52858 | vim-common | 2:9.1.1230-2 | | vim: Vim: Arbitrary code execution via Python omni-completion |
| HIGH | | 8 | | CVE-2026-52860 | vim-common | 2:9.1.1230-2 | | vim: Vim: Arbitrary code execution through Python omni-completion. |
| HIGH | | 7.8 | | CVE-2026-55693 | vim-common | 2:9.1.1230-2 | | vim: Vim: Out-of-bounds Write in Spell File Word Count |
| HIGH | | 7.8 | | CVE-2026-55895 | vim-common | 2:9.1.1230-2 | | vim: Vim: Arbitrary code execution via Vimscript code injection in netrw plugin |
| HIGH | | 7.8 | | CVE-2026-57455 | vim-common | 2:9.1.1230-2 | | vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() |
| HIGH | | 7.8 | | CVE-2026-57456 | vim-common | 2:9.1.1230-2 | | vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion |
| HIGH | | 7.8 | | CVE-2026-59856 | vim-common | 2:9.1.1230-2 | | vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion |
| HIGH | | 7.8 | | CVE-2026-59858 | vim-common | 2:9.1.1230-2 | | vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion |
| HIGH | | 7.8 | | CVE-2026-73072 | vim-common | 2:9.1.1230-2 | | vim: Vim: Heap buffer overflow allows arbitrary code execution |
| HIGH | | 7.8 | | CVE-2026-73073 | vim-common | 2:9.1.1230-2 | | vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion |
| HIGH | | 7.8 | | CVE-2026-73076 | vim-common | 2:9.1.1230-2 | | vim: Vim: Arbitrary command execution via crafted vimball |
| HIGH | | 7.8 | | CVE-2026-73077 | vim-common | 2:9.1.1230-2 | | vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling |
| HIGH | | 8.8 | | CVE-2026-73078 | vim-common | 2:9.1.1230-2 | | vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries |
| HIGH | | 7.5 | | CVE-2026-26269 | vim-tiny | 2:9.1.1230-2 | | vim: Netbeans specialKeys stack buffer overflow |
| HIGH | | 7.8 | | CVE-2026-28417 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin |
| HIGH | | 7.8 | | CVE-2026-28421 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Denial of service and information disclosure via crafted swap file |
| HIGH | | 7.3 | | CVE-2026-33412 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Arbitrary code execution via command injection in glob() function |
| HIGH | | 8.2 | | CVE-2026-34982 | vim-tiny | 2:9.1.1230-2 | | vim: arbitrary command execution via modeline sandbox bypass |
| HIGH | | 7.1 | | CVE-2026-35177 | vim-tiny | 2:9.1.1230-2 | | vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass |
| HIGH | | 7.8 | | CVE-2026-39881 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Arbitrary code execution via command injection in NetBeans interface |
| HIGH | | 7.8 | | CVE-2026-43961 | vim-tiny | 2:9.1.1230-2 | | vim: Vimscript injection via unescaped filename in netrw s:NetrwMarkFile() filter() expression allows arbitrary code exe |
| HIGH | | 7 | | CVE-2026-46483 | vim-tiny | 2:9.1.1230-2 | | vim: command injection when decompressing .tgz archives |
| HIGH | | 8.8 | | CVE-2026-47162 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Arbitrary Code Execution via crafted directory names |
| HIGH | | 7.8 | | CVE-2026-52858 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Arbitrary code execution via Python omni-completion |
| HIGH | | 8 | | CVE-2026-52860 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Arbitrary code execution through Python omni-completion. |
| HIGH | | 7.8 | | CVE-2026-55693 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Out-of-bounds Write in Spell File Word Count |
| HIGH | | 7.8 | | CVE-2026-55895 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Arbitrary code execution via Vimscript code injection in netrw plugin |
| HIGH | | 7.8 | | CVE-2026-57455 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() |
| HIGH | | 7.8 | | CVE-2026-57456 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion |
| HIGH | | 7.8 | | CVE-2026-59856 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion |
| HIGH | | 7.8 | | CVE-2026-59858 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion |
| HIGH | | 7.8 | | CVE-2026-73072 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Heap buffer overflow allows arbitrary code execution |
| HIGH | | 7.8 | | CVE-2026-73073 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion |
| HIGH | | 7.8 | | CVE-2026-73076 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Arbitrary command execution via crafted vimball |
| HIGH | | 7.8 | | CVE-2026-73077 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling |
| HIGH | | 8.8 | | CVE-2026-73078 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries |
| HIGH | | 7.1 | | CVE-2026-58471 | wget | 1.25.0-2 | | wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption |
| HIGH | | 7.1 | | CVE-2026-58472 | wget | 1.25.0-2 | | wget: GNU Wget: Arbitrary code execution or denial of service via crafted HTML attribute |
| HIGH | | 7.1 | | CVE-2026-78807 | wpasupplicant | 2:2.10-24 | | wpa_supplicant: wpa_supplicant: Security bypass via missing PMKSA validation |
| HIGH | | 6.8 | | CVE-2026-56854 | golang.org/x/crypto | v0.53.0 | 0.55.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions |
| HIGH | | 7.5 | | CVE-2026-46600 | golang.org/x/net | v0.55.0 | 0.56.0 | golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing |
| HIGH | | 7.5 | | CVE-2026-78669 | golang.org/x/net | v0.55.0 | 0.60.0 | net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS fra |
| HIGH | | 6.8 | | CVE-2026-111943 | stdlib | 1.26.4 | 1.26.10, 1.27.3 | crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates |
| HIGH | | 7.5 | | CVE-2026-33818 | stdlib | 1.26.4 | 1.25.13, 1.26.6, 1.27.0-rc.3 | encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal |
| HIGH | | 8.2 | | CVE-2026-39821 | stdlib | 1.26.4 | 1.25.13, 1.26.6, 1.27.0-rc.3 | golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label proces |
| HIGH | | 7.8 | | CVE-2026-39822 | stdlib | 1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | golang: Go os.Root: Symlink following vulnerability allows directory traversal |
| HIGH | | 7.5 | | CVE-2026-46600 | stdlib | 1.26.4 | 1.26.6, 1.27.0-rc.3 | golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing |
| HIGH | | 7.5 | | CVE-2026-56853 | stdlib | 1.26.4 | 1.25.13, 1.26.6, 1.27.0-rc.3 | net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service |
| HIGH | | 8.1 | | CVE-2026-56858 | stdlib | 1.26.4 | 1.25.13, 1.26.6, 1.27.0-rc.3 | html/template: golang: Go html/template: Cross-Site Scripting via pathological input |
| HIGH | | 7.5 | | CVE-2026-56859 | stdlib | 1.26.4 | 1.25.13, 1.26.6, 1.27.0-rc.3 | encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue |
| HIGH | | 7.5 | | CVE-2026-56860 | stdlib | 1.26.4 | 1.25.13, 1.26.6, 1.27.0-rc.3 | net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution |
| HIGH | | 7.5 | | CVE-2026-56862 | stdlib | 1.26.4 | 1.25.13, 1.26.6, 1.27.0-rc.3 | crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages |
| HIGH | | 7.5 | | CVE-2026-78667 | stdlib | 1.26.4 | 1.26.9, 1.27.2 | net/http: golang: golang: Denial of Service via crafted HTTP Range headers |
| HIGH | | 7.5 | | CVE-2026-78669 | stdlib | 1.26.4 | 1.26.9, 1.27.2 | net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS fra |
| HIGH | | 7.5 | | CVE-2026-97031 | stdlib | 1.26.4 | 1.26.9, 1.27.2 | crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references |
| HIGH | | 7.4 | | CVE-2026-26007 | cryptography | 43.0.0 | 46.0.5 | cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves |
| HIGH | | 7.5 | | CVE-2026-69249 | cryptography | 43.0.0 | 49.0.0 | python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building |
| HIGH | | 7.5 | | GHSA-537c-gmf6-5ccf | cryptography | 43.0.0 | 48.0.1 | Vulnerable OpenSSL included in cryptography wheels |
| HIGH | | 9.1 | | CVE-2026-102267 | pyjwt | 2.10.1 | 2.14.0 | pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects |
| HIGH | | 7.4 | | CVE-2026-102271 | pyjwt | 2.10.1 | 2.14.0 | pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets |
| HIGH | | 7.5 | | CVE-2026-32597 | pyjwt | 2.10.1 | 2.12.0 | pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) |
| HIGH | | 7.4 | | CVE-2026-48526 | pyjwt | 2.10.1 | 2.13.0 | python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens |
| HIGH | | 7.4 | | GHSA-pxh4-856f-4h89 | pyjwt | 2.10.1 | 2.14.0 | PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery |
| HIGH | | 7.5 | | CVE-2025-66418 | urllib3 | 2.3.0 | 2.6.0 | urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion |
| HIGH | | 7.5 | | CVE-2025-66471 | urllib3 | 2.3.0 | 2.6.0 | urllib3: urllib3 Streaming API improperly handles highly compressed data |
| HIGH | | 7.5 | | CVE-2026-21441 | urllib3 | 2.3.0 | 2.6.3 | urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) |
| HIGH | | 5.9 | | CVE-2026-44431 | urllib3 | 2.3.0 | 2.7.0 | urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers |
| HIGH | | 8.1 | | CVE-2026-97687 | urllib3 | 2.3.0 | 2.8.0 | urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override |
| HIGH | | 7.5 | | CVE-2026-97689 | urllib3 | 2.3.0 | 2.8.0 | urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser |
| HIGH | | 7.1 | | CVE-2026-24049 | wheel | 0.45.1 | 0.46.2 | wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking |
| MEDIUM | | 3.3 | | CVE-2026-58052 | 7zip | 25.01+dfsg-1~deb13u2 | | 7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web ... |
| MEDIUM | | 5.3 | | CVE-2024-52615 | avahi-daemon | 0.8-16 | | avahi: Avahi Wide-Area DNS Uses Constant Source Port |
| MEDIUM | | 5.3 | | CVE-2024-52616 | avahi-daemon | 0.8-16 | | avahi: Avahi Wide-Area DNS Predictable Transaction IDs |
| MEDIUM | | 5.5 | | CVE-2025-59529 | avahi-daemon | 0.8-16 | | avahi: simple clients denial-of-service |
| MEDIUM | | 5.5 | | CVE-2025-68276 | avahi-daemon | 0.8-16 | | avahi: Avahi: Denial of Service via D-Bus record browsers with AVAHI_LOOKUP_USE_WIDE_AREA flag |
| MEDIUM | | 6.5 | | CVE-2025-68468 | avahi-daemon | 0.8-16 | | avahi: Avahi: Denial of Service via crafted mDNS/DNS-SD announcements |
| MEDIUM | | 6.5 | | CVE-2025-68471 | avahi-daemon | 0.8-16 | | avahi: Avahi: Denial of Service via unsolicited CNAME announcements |
| MEDIUM | | 6.5 | | CVE-2026-24401 | avahi-daemon | 0.8-16 | | avahi: Avahi: Denial of Service via recursive CNAME record in mDNS response |
| MEDIUM | | 5.5 | | CVE-2026-34933 | avahi-daemon | 0.8-16 | | avahi: avahi-daemon: Avahi: Denial of Service via D-Bus method call |
| MEDIUM | | 5.7 | | CVE-2023-51580 | bluez | 5.82-1.1+rpt1 | | bluez: avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability |
| MEDIUM | | 5.7 | | CVE-2023-51589 | bluez | 5.82-1.1+rpt1 | | bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability |
| MEDIUM | | 5.7 | | CVE-2023-51592 | bluez | 5.82-1.1+rpt1 | | bluez: audio profile avrcp parse_media_folder out-of-bounds read information disclosure vulnerability |
| MEDIUM | | 5.7 | | CVE-2023-51594 | bluez | 5.82-1.1+rpt1 | | bluez: OBEX library out-of-bounds read information disclosure vulnerability |
| MEDIUM | | 7.1 | | CVE-2023-51596 | bluez | 5.82-1.1+rpt1 | | bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability |
| MEDIUM | | 6.3 | | CVE-2026-75032 | bluez | 5.82-1.1+rpt1 | | bluez: BlueZ: Out-of-bounds read in AVRCP parse_media_element and parse_media_folder |
| MEDIUM | | 5.7 | | CVE-2026-80185 | bluez | 5.82-1.1+rpt1 | | bluez: sdp-xml: BlueZ 5.86: unprivileged-local and adjacent-LE-peer leads to arbitrary code execution as root |
| MEDIUM | | 6.8 | | CVE-2026-13595 | bsdextrautils | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: heap use-after-free in libblkid nested partition probing |
| MEDIUM | | 4.7 | | CVE-2026-27456 | bsdextrautils | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: TOCTOU in the mount program when setting up loop devices |
| MEDIUM | | 5.3 | | CVE-2026-3184 | bsdextrautils | 2.41-5 | | util-linux: util-linux: Access control bypass due to improper hostname canonicalization |
| MEDIUM | | 6.8 | | CVE-2026-13595 | bsdutils | 1:2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: heap use-after-free in libblkid nested partition probing |
| MEDIUM | | 4.7 | | CVE-2026-27456 | bsdutils | 1:2.41-5 | 2.41.5-0+deb13u1 | util-linux: TOCTOU in the mount program when setting up loop devices |
| MEDIUM | | 5.3 | | CVE-2026-3184 | bsdutils | 1:2.41-5 | | util-linux: util-linux: Access control bypass due to improper hostname canonicalization |
| MEDIUM | | 7.1 | | CVE-2023-42366 | busybox | 1:1.37.0-6+b8 | | busybox: A heap-buffer-overflow |
| MEDIUM | | | | CVE-2024-58251 | busybox | 1:1.37.0-6+b8 | | In netstat in BusyBox through 1.37.0, local users can launch of networ ... |
| MEDIUM | | 6.3 | | CVE-2026-108119 | busybox | 1:1.37.0-6+b8 | | busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses CVE-2026-26158 fix |
| MEDIUM | | 6.5 | | CVE-2026-38752 | busybox | 1:1.37.0-6+b8 | | busybox: BusyBox: Denial of Service via crafted AWK script |
| MEDIUM | | 7.5 | | CVE-2026-38753 | busybox | 1:1.37.0-6+b8 | | busybox: Busybox: Denial of Service via crafted AWK script in awk_sub() function |
| MEDIUM | | 5.5 | | CVE-2026-38755 | busybox | 1:1.37.0-6+b8 | | busybox: Busybox: Denial of Service via heap overflow in evalcommand() function |
| MEDIUM | | 7.2 | | CVE-2026-88829 | busybox | 1:1.37.0-6+b8 | | busybox: busybox: HTTP request smuggling via pipelined requests in httpd reverse proxy |
| MEDIUM | | 5.3 | | CVE-2026-88831 | busybox | 1:1.37.0-6+b8 | | busybox: busybox: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths |
| MEDIUM | | 6.5 | | CVE-2026-88833 | busybox | 1:1.37.0-6+b8 | | busybox: busybox: udhcpc integer underflow in DHCP packet length calculation causes denial of service |
| MEDIUM | | 6.5 | | CVE-2026-88837 | busybox | 1:1.37.0-6+b8 | | busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication |
| MEDIUM | | 5.5 | | CVE-2026-88838 | busybox | 1:1.37.0-6+b8 | | busybox: busybox: non-root mount option filter bypass allows clearing fstab security restrictions |
| MEDIUM | | 6.7 | | CVE-2026-88839 | busybox | 1:1.37.0-6+b8 | | busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint |
| MEDIUM | | 6.1 | | CVE-2026-92205 | busybox | 1:1.37.0-6+b8 | | busybox: busybox: Arbitrary file creation via directory traversal |
| MEDIUM | | 5 | | CVE-2026-42250 | bzip2 | 1.0.8-6 | | bzip2: bzip2: Denial of Service in bzip2recover via a specially crafted file |
| MEDIUM | | 5 | | CVE-2026-66485 | cpio | 2.15+dfsg-2 | | cpio: GNU cpio: Denial of Service via uncontrolled memory allocation from crafted archives |
| MEDIUM | | 6.1 | | CVE-2026-66486 | cpio | 2.15+dfsg-2 | | cpio: GNU cpio: Terminal control sequence injection via crafted archive member names |
| MEDIUM | | 7 | | CVE-2026-102010 | cpp-14-aarch64-linux-gnu | 14.2.0-19 | | gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if |
| MEDIUM | | 7.7 | | CVE-2026-95619 | cpp-14-aarch64-linux-gnu | 14.2.0-19 | | gcc: libstdc++ integer overflow in `new` operator |
| MEDIUM | | 7 | | CVE-2026-102010 | cpp-14-for-host | 14.2.0-19 | | gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if |
| MEDIUM | | 7.7 | | CVE-2026-95619 | cpp-14-for-host | 14.2.0-19 | | gcc: libstdc++ integer overflow in `new` operator |
| MEDIUM | | 7 | | CVE-2026-102010 | cpp-14 | 14.2.0-19 | | gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if |
| MEDIUM | | 7.7 | | CVE-2026-95619 | cpp-14 | 14.2.0-19 | | gcc: libstdc++ integer overflow in `new` operator |
| MEDIUM | | 9.8 | | CVE-2026-10536 | curl | 8.14.1-2+deb13u3 | | libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service |
| MEDIUM | | 9.8 | | CVE-2026-11856 | curl | 8.14.1-2+deb13u3 | | curl: curl: Information disclosure via incorrect Digest authentication header reuse |
| MEDIUM | | 6.8 | | CVE-2026-1965 | curl | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication |
| MEDIUM | | 6.5 | | CVE-2026-19931 | curl | 8.14.1-2+deb13u3 | | curl: libcurl: Information disclosure via incorrect connection reuse with Negotiate authentication |
| MEDIUM | | 5.7 | | CVE-2026-3783 | curl | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect |
| MEDIUM | | 6.5 | | CVE-2026-3784 | curl | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: curl: Unauthorized access due to improper HTTP proxy connection reuse |
| MEDIUM | | 7.5 | | CVE-2026-3805 | curl | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: curl: Arbitrary code execution or Denial of Service via use-after-free in SMB request handling |
| MEDIUM | | 5.9 | | CVE-2026-4873 | curl | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: curl: Information disclosure due to incorrect TLS connection reuse |
| MEDIUM | | 6.5 | | CVE-2026-5545 | curl | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse |
| MEDIUM | | 5.9 | | CVE-2026-6253 | curl | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies |
| MEDIUM | | 6.5 | | CVE-2026-6429 | curl | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: libcurl: Credential leak via reused proxy connection during HTTP redirects |
| MEDIUM | | 5.3 | | CVE-2026-7168 | curl | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse |
| MEDIUM | | 9.1 | | CVE-2026-8924 | curl | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u7 | curl: curl: Cookie injection via malicious HTTP server using super cookies |
| MEDIUM | | 9.1 | | CVE-2026-8926 | curl | 8.14.1-2+deb13u3 | | curl: curl: Information disclosure via incorrect .netrc password lookup |
| MEDIUM | | 7.5 | | CVE-2026-8932 | curl | 8.14.1-2+deb13u3 | | libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse |
| MEDIUM | | 9.8 | | CVE-2026-9079 | curl | 8.14.1-2+deb13u3 | | libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials |
| MEDIUM | | 7.3 | | CVE-2026-9080 | curl | 8.14.1-2+deb13u3 | | libcurl: libcurl: Use-after-free via curl_easy_pause() in CURLMOPT_SOCKETFUNCTION callback |
| MEDIUM | | 6.5 | | CVE-2026-92388 | curl | 8.14.1-2+deb13u3 | | curl: curl: FTP wildcard write callback mixup |
| MEDIUM | | 7.5 | | CVE-2026-9545 | curl | 8.14.1-2+deb13u3 | | libcurl: libcurl: Information disclosure via cached SSL session and early data |
| MEDIUM | | 4.4 | | CVE-2025-70102 | dhcpcd-base | 1:10.1.0-11+deb13u2 | 1:10.1.0-11+deb13u3 | dhcpcd: dhcpcd: Denial of Service via NULL pointer dereference during configuration option parsing |
| MEDIUM | | 6.5 | | CVE-2026-14258 | dhcpcd-base | 1:10.1.0-11+deb13u2 | 1:10.1.0-11+deb13u4 | dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length IPv6 ND option in Router Advertisement handling |
| MEDIUM | | 6.5 | | CVE-2026-56113 | dhcpcd-base | 1:10.1.0-11+deb13u2 | 1:10.1.0-11+deb13u3 | dhcpcd: dhcpcd: Denial of Service via crafted DHCPv6 RENEW reply |
| MEDIUM | | 6.5 | | CVE-2026-56114 | dhcpcd-base | 1:10.1.0-11+deb13u2 | 1:10.1.0-11+deb13u3 | dhcpcd: dhcpcd: Denial of Service due to stack out-of-bounds write via crafted DHCPv6 message |
| MEDIUM | | 6.5 | | CVE-2026-56116 | dhcpcd-base | 1:10.1.0-11+deb13u2 | 1:10.1.0-11+deb13u3 | dhcpcd: dhcpcd: Denial of Service via IPv6 Router Advertisement memory leak |
| MEDIUM | | 5.5 | | CVE-2026-56117 | dhcpcd-base | 1:10.1.0-11+deb13u2 | 1:10.1.0-11+deb13u3 | dhcpcd: dhcpcd: Local heap use-after-free vulnerability leads to denial of service. |
| MEDIUM | | 5.9 | | CVE-2025-68972 | dirmngr | 2.4.7-21+deb13u1+b3 | | gnupg: GnuPG: Signature bypass via form feed character in signed messages |
| MEDIUM | | 5.9 | | CVE-2026-12725 | dnsmasq-base | 2.91-1+deb13u1 | 2.91-1+deb13u2 | dnsmasq: dnsmasq: heap buffer overflow in log_query() when logging unsupported DS/DNSKEY replies |
| MEDIUM | | 6.8 | | CVE-2026-13595 | eject | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: heap use-after-free in libblkid nested partition probing |
| MEDIUM | | 4.7 | | CVE-2026-27456 | eject | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: TOCTOU in the mount program when setting up loop devices |
| MEDIUM | | 5.3 | | CVE-2026-3184 | eject | 2.41-5 | | util-linux: util-linux: Access control bypass due to improper hostname canonicalization |
| MEDIUM | | 6.8 | | CVE-2026-13595 | fdisk | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: heap use-after-free in libblkid nested partition probing |
| MEDIUM | | 4.7 | | CVE-2026-27456 | fdisk | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: TOCTOU in the mount program when setting up loop devices |
| MEDIUM | | 5.3 | | CVE-2026-3184 | fdisk | 2.41-5 | | util-linux: util-linux: Access control bypass due to improper hostname canonicalization |
| MEDIUM | | 6.1 | | CVE-2026-20731 | firmware-atheros | 1:20250410-2+rpt1 | | intel-npu-driver: Intel NPU Driver: Denial of Service via Improper Buffer Restrictions |
| MEDIUM | | 6.1 | | CVE-2026-20769 | firmware-atheros | 1:20250410-2+rpt1 | | intel-npu-driver: Intel NPU Driver: Denial of Service via improper conditions check |
| MEDIUM | | 6.1 | | CVE-2026-20783 | firmware-atheros | 1:20250410-2+rpt1 | | intel-npu-driver: Intel NPU Driver: Denial of Service via improper conditions check |
| MEDIUM | | 6.1 | | CVE-2026-20786 | firmware-atheros | 1:20250410-2+rpt1 | | intel-npu-driver: Intel NPU Driver: Denial of service via out-of-bounds read |
| MEDIUM | | 6.1 | | CVE-2026-20731 | firmware-brcm80211 | 1:20250410-2+rpt1 | | intel-npu-driver: Intel NPU Driver: Denial of Service via Improper Buffer Restrictions |
| MEDIUM | | 6.1 | | CVE-2026-20769 | firmware-brcm80211 | 1:20250410-2+rpt1 | | intel-npu-driver: Intel NPU Driver: Denial of Service via improper conditions check |
| MEDIUM | | 6.1 | | CVE-2026-20783 | firmware-brcm80211 | 1:20250410-2+rpt1 | | intel-npu-driver: Intel NPU Driver: Denial of Service via improper conditions check |
| MEDIUM | | 6.1 | | CVE-2026-20786 | firmware-brcm80211 | 1:20250410-2+rpt1 | | intel-npu-driver: Intel NPU Driver: Denial of service via out-of-bounds read |
| MEDIUM | | 6.1 | | CVE-2026-20731 | firmware-libertas | 1:20250410-2+rpt1 | | intel-npu-driver: Intel NPU Driver: Denial of Service via Improper Buffer Restrictions |
| MEDIUM | | 6.1 | | CVE-2026-20769 | firmware-libertas | 1:20250410-2+rpt1 | | intel-npu-driver: Intel NPU Driver: Denial of Service via improper conditions check |
| MEDIUM | | 6.1 | | CVE-2026-20783 | firmware-libertas | 1:20250410-2+rpt1 | | intel-npu-driver: Intel NPU Driver: Denial of Service via improper conditions check |
| MEDIUM | | 6.1 | | CVE-2026-20786 | firmware-libertas | 1:20250410-2+rpt1 | | intel-npu-driver: Intel NPU Driver: Denial of service via out-of-bounds read |
| MEDIUM | | 6.1 | | CVE-2026-20731 | firmware-mediatek | 1:20250410-2+rpt1 | | intel-npu-driver: Intel NPU Driver: Denial of Service via Improper Buffer Restrictions |
| MEDIUM | | 6.1 | | CVE-2026-20769 | firmware-mediatek | 1:20250410-2+rpt1 | | intel-npu-driver: Intel NPU Driver: Denial of Service via improper conditions check |
| MEDIUM | | 6.1 | | CVE-2026-20783 | firmware-mediatek | 1:20250410-2+rpt1 | | intel-npu-driver: Intel NPU Driver: Denial of Service via improper conditions check |
| MEDIUM | | 6.1 | | CVE-2026-20786 | firmware-mediatek | 1:20250410-2+rpt1 | | intel-npu-driver: Intel NPU Driver: Denial of service via out-of-bounds read |
| MEDIUM | | 6.1 | | CVE-2026-20731 | firmware-realtek | 1:20250410-2+rpt1 | | intel-npu-driver: Intel NPU Driver: Denial of Service via Improper Buffer Restrictions |
| MEDIUM | | 6.1 | | CVE-2026-20769 | firmware-realtek | 1:20250410-2+rpt1 | | intel-npu-driver: Intel NPU Driver: Denial of Service via improper conditions check |
| MEDIUM | | 6.1 | | CVE-2026-20783 | firmware-realtek | 1:20250410-2+rpt1 | | intel-npu-driver: Intel NPU Driver: Denial of Service via improper conditions check |
| MEDIUM | | 6.1 | | CVE-2026-20786 | firmware-realtek | 1:20250410-2+rpt1 | | intel-npu-driver: Intel NPU Driver: Denial of service via out-of-bounds read |
| MEDIUM | | 7 | | CVE-2026-102010 | g++-14-aarch64-linux-gnu | 14.2.0-19 | | gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if |
| MEDIUM | | 7.7 | | CVE-2026-95619 | g++-14-aarch64-linux-gnu | 14.2.0-19 | | gcc: libstdc++ integer overflow in `new` operator |
| MEDIUM | | 7 | | CVE-2026-102010 | g++-14 | 14.2.0-19 | | gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if |
| MEDIUM | | 7.7 | | CVE-2026-95619 | g++-14 | 14.2.0-19 | | gcc: libstdc++ integer overflow in `new` operator |
| MEDIUM | | 7 | | CVE-2026-102010 | gcc-14-aarch64-linux-gnu | 14.2.0-19 | | gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if |
| MEDIUM | | 7.7 | | CVE-2026-95619 | gcc-14-aarch64-linux-gnu | 14.2.0-19 | | gcc: libstdc++ integer overflow in `new` operator |
| MEDIUM | | 7 | | CVE-2026-102010 | gcc-14-base | 14.2.0-19 | | gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if |
| MEDIUM | | 7.7 | | CVE-2026-95619 | gcc-14-base | 14.2.0-19 | | gcc: libstdc++ integer overflow in `new` operator |
| MEDIUM | | 7 | | CVE-2026-102010 | gcc-14-for-host | 14.2.0-19 | | gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if |
| MEDIUM | | 7.7 | | CVE-2026-95619 | gcc-14-for-host | 14.2.0-19 | | gcc: libstdc++ integer overflow in `new` operator |
| MEDIUM | | 7 | | CVE-2026-102010 | gcc-14 | 14.2.0-19 | | gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if |
| MEDIUM | | 7.7 | | CVE-2026-95619 | gcc-14 | 14.2.0-19 | | gcc: libstdc++ integer overflow in `new` operator |
| MEDIUM | | 5.9 | | CVE-2025-68972 | gnupg-l10n | 2.4.7-21+deb13u1 | | gnupg: GnuPG: Signature bypass via form feed character in signed messages |
| MEDIUM | | 5.9 | | CVE-2025-68972 | gnupg-utils | 2.4.7-21+deb13u1+b3 | | gnupg: GnuPG: Signature bypass via form feed character in signed messages |
| MEDIUM | | 5.9 | | CVE-2025-68972 | gnupg | 2.4.7-21+deb13u1 | | gnupg: GnuPG: Signature bypass via form feed character in signed messages |
| MEDIUM | | 5.9 | | CVE-2025-68972 | gpg-agent | 2.4.7-21+deb13u1+b3 | | gnupg: GnuPG: Signature bypass via form feed character in signed messages |
| MEDIUM | | 5.9 | | CVE-2025-68972 | gpg-wks-client | 2.4.7-21+deb13u1+b3 | | gnupg: GnuPG: Signature bypass via form feed character in signed messages |
| MEDIUM | | 5.9 | | CVE-2025-68972 | gpg | 2.4.7-21+deb13u1+b3 | | gnupg: GnuPG: Signature bypass via form feed character in signed messages |
| MEDIUM | | 5.9 | | CVE-2025-68972 | gpgconf | 2.4.7-21+deb13u1+b3 | | gnupg: GnuPG: Signature bypass via form feed character in signed messages |
| MEDIUM | | 5.9 | | CVE-2025-68972 | gpgsm | 2.4.7-21+deb13u1+b3 | | gnupg: GnuPG: Signature bypass via form feed character in signed messages |
| MEDIUM | | 5.9 | | CVE-2025-68972 | gpgv | 2.4.7-21+deb13u1+b3 | | gnupg: GnuPG: Signature bypass via form feed character in signed messages |
| MEDIUM | | 6 | | CVE-2026-41991 | gzip | 1.13-1 | 1.13-1+deb13u1 | gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility |
| MEDIUM | | 7.8 | | CVE-2026-72693 | kbd | 2.7.1-2 | | kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login |
| MEDIUM | | 6.3 | | CVE-2026-54370 | libacl1 | 2.3.2-2+b1 | | acl: TOCTOU Symlink Traversal via getfacl/setfacl |
| MEDIUM | | 7 | | CVE-2026-102010 | libasan8 | 14.2.0-19 | | gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if |
| MEDIUM | | 7.7 | | CVE-2026-95619 | libasan8 | 14.2.0-19 | | gcc: libstdc++ integer overflow in `new` operator |
| MEDIUM | | 6.1 | | CVE-2026-90781 | libasound2-data | 1.2.14-1+rpt1 | | alsa-lib: alsa-lib: Denial of Service via off-by-one stack buffer overflow |
| MEDIUM | | 4.4 | | CVE-2026-96674 | libasound2-data | 1.2.14-1+rpt1 | | alsa-lib: alsa-lib: Integer Overflow via Crafted Topology Files |
| MEDIUM | | 5.5 | | CVE-2026-96675 | libasound2-data | 1.2.14-1+rpt1 | | alsa-lib: alsa-lib: Denial of Service via malicious ALSA configuration file |
| MEDIUM | | 6.1 | | CVE-2026-90781 | libasound2t64 | 1.2.14-1+rpt1 | | alsa-lib: alsa-lib: Denial of Service via off-by-one stack buffer overflow |
| MEDIUM | | 4.4 | | CVE-2026-96674 | libasound2t64 | 1.2.14-1+rpt1 | | alsa-lib: alsa-lib: Integer Overflow via Crafted Topology Files |
| MEDIUM | | 5.5 | | CVE-2026-96675 | libasound2t64 | 1.2.14-1+rpt1 | | alsa-lib: alsa-lib: Denial of Service via malicious ALSA configuration file |
| MEDIUM | | 7 | | CVE-2026-102010 | libatomic1 | 14.2.0-19 | | gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if |
| MEDIUM | | 7.7 | | CVE-2026-95619 | libatomic1 | 14.2.0-19 | | gcc: libstdc++ integer overflow in `new` operator |
| MEDIUM | | 6.1 | | CVE-2026-90781 | libatopology2t64 | 1.2.14-1+rpt1 | | alsa-lib: alsa-lib: Denial of Service via off-by-one stack buffer overflow |
| MEDIUM | | 4.4 | | CVE-2026-96674 | libatopology2t64 | 1.2.14-1+rpt1 | | alsa-lib: alsa-lib: Integer Overflow via Crafted Topology Files |
| MEDIUM | | 5.5 | | CVE-2026-96675 | libatopology2t64 | 1.2.14-1+rpt1 | | alsa-lib: alsa-lib: Denial of Service via malicious ALSA configuration file |
| MEDIUM | | 6.3 | | CVE-2026-54371 | libattr1 | 1:2.5.2-3 | | attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr |
| MEDIUM | | 5.3 | | CVE-2024-52615 | libavahi-common-data | 0.8-16 | | avahi: Avahi Wide-Area DNS Uses Constant Source Port |
| MEDIUM | | 5.3 | | CVE-2024-52616 | libavahi-common-data | 0.8-16 | | avahi: Avahi Wide-Area DNS Predictable Transaction IDs |
| MEDIUM | | 5.5 | | CVE-2025-59529 | libavahi-common-data | 0.8-16 | | avahi: simple clients denial-of-service |
| MEDIUM | | 5.5 | | CVE-2025-68276 | libavahi-common-data | 0.8-16 | | avahi: Avahi: Denial of Service via D-Bus record browsers with AVAHI_LOOKUP_USE_WIDE_AREA flag |
| MEDIUM | | 6.5 | | CVE-2025-68468 | libavahi-common-data | 0.8-16 | | avahi: Avahi: Denial of Service via crafted mDNS/DNS-SD announcements |
| MEDIUM | | 6.5 | | CVE-2025-68471 | libavahi-common-data | 0.8-16 | | avahi: Avahi: Denial of Service via unsolicited CNAME announcements |
| MEDIUM | | 6.5 | | CVE-2026-24401 | libavahi-common-data | 0.8-16 | | avahi: Avahi: Denial of Service via recursive CNAME record in mDNS response |
| MEDIUM | | 5.5 | | CVE-2026-34933 | libavahi-common-data | 0.8-16 | | avahi: avahi-daemon: Avahi: Denial of Service via D-Bus method call |
| MEDIUM | | 5.3 | | CVE-2024-52615 | libavahi-common3 | 0.8-16 | | avahi: Avahi Wide-Area DNS Uses Constant Source Port |
| MEDIUM | | 5.3 | | CVE-2024-52616 | libavahi-common3 | 0.8-16 | | avahi: Avahi Wide-Area DNS Predictable Transaction IDs |
| MEDIUM | | 5.5 | | CVE-2025-59529 | libavahi-common3 | 0.8-16 | | avahi: simple clients denial-of-service |
| MEDIUM | | 5.5 | | CVE-2025-68276 | libavahi-common3 | 0.8-16 | | avahi: Avahi: Denial of Service via D-Bus record browsers with AVAHI_LOOKUP_USE_WIDE_AREA flag |
| MEDIUM | | 6.5 | | CVE-2025-68468 | libavahi-common3 | 0.8-16 | | avahi: Avahi: Denial of Service via crafted mDNS/DNS-SD announcements |
| MEDIUM | | 6.5 | | CVE-2025-68471 | libavahi-common3 | 0.8-16 | | avahi: Avahi: Denial of Service via unsolicited CNAME announcements |
| MEDIUM | | 6.5 | | CVE-2026-24401 | libavahi-common3 | 0.8-16 | | avahi: Avahi: Denial of Service via recursive CNAME record in mDNS response |
| MEDIUM | | 5.5 | | CVE-2026-34933 | libavahi-common3 | 0.8-16 | | avahi: avahi-daemon: Avahi: Denial of Service via D-Bus method call |
| MEDIUM | | 5.3 | | CVE-2024-52615 | libavahi-core7 | 0.8-16 | | avahi: Avahi Wide-Area DNS Uses Constant Source Port |
| MEDIUM | | 5.3 | | CVE-2024-52616 | libavahi-core7 | 0.8-16 | | avahi: Avahi Wide-Area DNS Predictable Transaction IDs |
| MEDIUM | | 5.5 | | CVE-2025-59529 | libavahi-core7 | 0.8-16 | | avahi: simple clients denial-of-service |
| MEDIUM | | 5.5 | | CVE-2025-68276 | libavahi-core7 | 0.8-16 | | avahi: Avahi: Denial of Service via D-Bus record browsers with AVAHI_LOOKUP_USE_WIDE_AREA flag |
| MEDIUM | | 6.5 | | CVE-2025-68468 | libavahi-core7 | 0.8-16 | | avahi: Avahi: Denial of Service via crafted mDNS/DNS-SD announcements |
| MEDIUM | | 6.5 | | CVE-2025-68471 | libavahi-core7 | 0.8-16 | | avahi: Avahi: Denial of Service via unsolicited CNAME announcements |
| MEDIUM | | 6.5 | | CVE-2026-24401 | libavahi-core7 | 0.8-16 | | avahi: Avahi: Denial of Service via recursive CNAME record in mDNS response |
| MEDIUM | | 5.5 | | CVE-2026-34933 | libavahi-core7 | 0.8-16 | | avahi: avahi-daemon: Avahi: Denial of Service via D-Bus method call |
| MEDIUM | | 6.8 | | CVE-2026-13595 | libblkid1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: heap use-after-free in libblkid nested partition probing |
| MEDIUM | | 4.7 | | CVE-2026-27456 | libblkid1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: TOCTOU in the mount program when setting up loop devices |
| MEDIUM | | 5.3 | | CVE-2026-3184 | libblkid1 | 2.41-5 | | util-linux: util-linux: Access control bypass due to improper hostname canonicalization |
| MEDIUM | | 5.7 | | CVE-2023-51580 | libbluetooth3 | 5.82-1.1+rpt1 | | bluez: avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability |
| MEDIUM | | 5.7 | | CVE-2023-51589 | libbluetooth3 | 5.82-1.1+rpt1 | | bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability |
| MEDIUM | | 5.7 | | CVE-2023-51592 | libbluetooth3 | 5.82-1.1+rpt1 | | bluez: audio profile avrcp parse_media_folder out-of-bounds read information disclosure vulnerability |
| MEDIUM | | 5.7 | | CVE-2023-51594 | libbluetooth3 | 5.82-1.1+rpt1 | | bluez: OBEX library out-of-bounds read information disclosure vulnerability |
| MEDIUM | | 7.1 | | CVE-2023-51596 | libbluetooth3 | 5.82-1.1+rpt1 | | bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability |
| MEDIUM | | 6.3 | | CVE-2026-75032 | libbluetooth3 | 5.82-1.1+rpt1 | | bluez: BlueZ: Out-of-bounds read in AVRCP parse_media_element and parse_media_folder |
| MEDIUM | | 5.7 | | CVE-2026-80185 | libbluetooth3 | 5.82-1.1+rpt1 | | bluez: sdp-xml: BlueZ 5.86: unprivileged-local and adjacent-LE-peer leads to arbitrary code execution as root |
| MEDIUM | | 5 | | CVE-2026-42250 | libbz2-1.0 | 1.0.8-6 | | bzip2: bzip2: Denial of Service in bzip2recover via a specially crafted file |
| MEDIUM | | 4.9 | | CVE-2026-18374 | libc-bin | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string |
| MEDIUM | | 6.8 | | CVE-2026-19499 | libc-bin | 2.41-12+rpt1+deb13u3 | | glibc: Buffer Overflow in strfmon right-justification padding |
| MEDIUM | | 4.2 | | CVE-2026-19542 | libc-bin | 2.41-12+rpt1+deb13u3 | | glibc: Fix out-of-bounds array write in tdelete |
| MEDIUM | | 5.9 | | CVE-2026-5435 | libc-bin | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Out-of-bounds write via TSIG record processing |
| MEDIUM | | 6.5 | | CVE-2026-6238 | libc-bin | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Application crash or uninitialized memory read via crafted DNS response |
| MEDIUM | | 5.5 | | CVE-2026-6368 | libc-bin | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Process abort due to invalid memory in wordexp |
| MEDIUM | | 5.9 | | CVE-2026-6791 | libc-bin | 2.41-12+rpt1+deb13u3 | | glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion |
| MEDIUM | | 5.9 | | CVE-2026-77117 | libc-bin | 2.41-12+rpt1+deb13u3 | | glibc: Non-progress DoS in SHIFT_JISX0213 -> |
| MEDIUM | | 5.9 | | CVE-2026-80489 | libc-bin | 2.41-12+rpt1+deb13u3 | | glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state |
| MEDIUM | | 5.3 | | CVE-2026-8674 | libc-bin | 2.41-12+rpt1+deb13u3 | | glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration |
| MEDIUM | | 7 | | CVE-2026-86805 | libc-bin | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader |
| MEDIUM | | 4.2 | | CVE-2026-89092 | libc-bin | 2.41-12+rpt1+deb13u3 | | glibc: nscd stack overflow leads to degraded DNS resolution |
| MEDIUM | | 7 | | CVE-2026-95818 | libc-bin | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow. |
| MEDIUM | | 4.9 | | CVE-2026-18374 | libc-dev-bin | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string |
| MEDIUM | | 6.8 | | CVE-2026-19499 | libc-dev-bin | 2.41-12+rpt1+deb13u3 | | glibc: Buffer Overflow in strfmon right-justification padding |
| MEDIUM | | 4.2 | | CVE-2026-19542 | libc-dev-bin | 2.41-12+rpt1+deb13u3 | | glibc: Fix out-of-bounds array write in tdelete |
| MEDIUM | | 5.9 | | CVE-2026-5435 | libc-dev-bin | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Out-of-bounds write via TSIG record processing |
| MEDIUM | | 6.5 | | CVE-2026-6238 | libc-dev-bin | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Application crash or uninitialized memory read via crafted DNS response |
| MEDIUM | | 5.5 | | CVE-2026-6368 | libc-dev-bin | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Process abort due to invalid memory in wordexp |
| MEDIUM | | 5.9 | | CVE-2026-6791 | libc-dev-bin | 2.41-12+rpt1+deb13u3 | | glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion |
| MEDIUM | | 5.9 | | CVE-2026-77117 | libc-dev-bin | 2.41-12+rpt1+deb13u3 | | glibc: Non-progress DoS in SHIFT_JISX0213 -> |
| MEDIUM | | 5.9 | | CVE-2026-80489 | libc-dev-bin | 2.41-12+rpt1+deb13u3 | | glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state |
| MEDIUM | | 5.3 | | CVE-2026-8674 | libc-dev-bin | 2.41-12+rpt1+deb13u3 | | glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration |
| MEDIUM | | 7 | | CVE-2026-86805 | libc-dev-bin | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader |
| MEDIUM | | 4.2 | | CVE-2026-89092 | libc-dev-bin | 2.41-12+rpt1+deb13u3 | | glibc: nscd stack overflow leads to degraded DNS resolution |
| MEDIUM | | 7 | | CVE-2026-95818 | libc-dev-bin | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow. |
| MEDIUM | | 4.9 | | CVE-2026-18374 | libc-l10n | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string |
| MEDIUM | | 6.8 | | CVE-2026-19499 | libc-l10n | 2.41-12+rpt1+deb13u3 | | glibc: Buffer Overflow in strfmon right-justification padding |
| MEDIUM | | 4.2 | | CVE-2026-19542 | libc-l10n | 2.41-12+rpt1+deb13u3 | | glibc: Fix out-of-bounds array write in tdelete |
| MEDIUM | | 5.9 | | CVE-2026-5435 | libc-l10n | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Out-of-bounds write via TSIG record processing |
| MEDIUM | | 6.5 | | CVE-2026-6238 | libc-l10n | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Application crash or uninitialized memory read via crafted DNS response |
| MEDIUM | | 5.5 | | CVE-2026-6368 | libc-l10n | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Process abort due to invalid memory in wordexp |
| MEDIUM | | 5.9 | | CVE-2026-6791 | libc-l10n | 2.41-12+rpt1+deb13u3 | | glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion |
| MEDIUM | | 5.9 | | CVE-2026-77117 | libc-l10n | 2.41-12+rpt1+deb13u3 | | glibc: Non-progress DoS in SHIFT_JISX0213 -> |
| MEDIUM | | 5.9 | | CVE-2026-80489 | libc-l10n | 2.41-12+rpt1+deb13u3 | | glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state |
| MEDIUM | | 5.3 | | CVE-2026-8674 | libc-l10n | 2.41-12+rpt1+deb13u3 | | glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration |
| MEDIUM | | 7 | | CVE-2026-86805 | libc-l10n | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader |
| MEDIUM | | 4.2 | | CVE-2026-89092 | libc-l10n | 2.41-12+rpt1+deb13u3 | | glibc: nscd stack overflow leads to degraded DNS resolution |
| MEDIUM | | 7 | | CVE-2026-95818 | libc-l10n | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow. |
| MEDIUM | | 4.9 | | CVE-2026-18374 | libc6-dev | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string |
| MEDIUM | | 6.8 | | CVE-2026-19499 | libc6-dev | 2.41-12+rpt1+deb13u3 | | glibc: Buffer Overflow in strfmon right-justification padding |
| MEDIUM | | 4.2 | | CVE-2026-19542 | libc6-dev | 2.41-12+rpt1+deb13u3 | | glibc: Fix out-of-bounds array write in tdelete |
| MEDIUM | | 5.9 | | CVE-2026-5435 | libc6-dev | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Out-of-bounds write via TSIG record processing |
| MEDIUM | | 6.5 | | CVE-2026-6238 | libc6-dev | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Application crash or uninitialized memory read via crafted DNS response |
| MEDIUM | | 5.5 | | CVE-2026-6368 | libc6-dev | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Process abort due to invalid memory in wordexp |
| MEDIUM | | 5.9 | | CVE-2026-6791 | libc6-dev | 2.41-12+rpt1+deb13u3 | | glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion |
| MEDIUM | | 5.9 | | CVE-2026-77117 | libc6-dev | 2.41-12+rpt1+deb13u3 | | glibc: Non-progress DoS in SHIFT_JISX0213 -> |
| MEDIUM | | 5.9 | | CVE-2026-80489 | libc6-dev | 2.41-12+rpt1+deb13u3 | | glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state |
| MEDIUM | | 5.3 | | CVE-2026-8674 | libc6-dev | 2.41-12+rpt1+deb13u3 | | glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration |
| MEDIUM | | 7 | | CVE-2026-86805 | libc6-dev | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader |
| MEDIUM | | 4.2 | | CVE-2026-89092 | libc6-dev | 2.41-12+rpt1+deb13u3 | | glibc: nscd stack overflow leads to degraded DNS resolution |
| MEDIUM | | 7 | | CVE-2026-95818 | libc6-dev | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow. |
| MEDIUM | | 4.9 | | CVE-2026-18374 | libc6 | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string |
| MEDIUM | | 6.8 | | CVE-2026-19499 | libc6 | 2.41-12+rpt1+deb13u3 | | glibc: Buffer Overflow in strfmon right-justification padding |
| MEDIUM | | 4.2 | | CVE-2026-19542 | libc6 | 2.41-12+rpt1+deb13u3 | | glibc: Fix out-of-bounds array write in tdelete |
| MEDIUM | | 5.9 | | CVE-2026-5435 | libc6 | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Out-of-bounds write via TSIG record processing |
| MEDIUM | | 6.5 | | CVE-2026-6238 | libc6 | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Application crash or uninitialized memory read via crafted DNS response |
| MEDIUM | | 5.5 | | CVE-2026-6368 | libc6 | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Process abort due to invalid memory in wordexp |
| MEDIUM | | 5.9 | | CVE-2026-6791 | libc6 | 2.41-12+rpt1+deb13u3 | | glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion |
| MEDIUM | | 5.9 | | CVE-2026-77117 | libc6 | 2.41-12+rpt1+deb13u3 | | glibc: Non-progress DoS in SHIFT_JISX0213 -> |
| MEDIUM | | 5.9 | | CVE-2026-80489 | libc6 | 2.41-12+rpt1+deb13u3 | | glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state |
| MEDIUM | | 5.3 | | CVE-2026-8674 | libc6 | 2.41-12+rpt1+deb13u3 | | glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration |
| MEDIUM | | 7 | | CVE-2026-86805 | libc6 | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader |
| MEDIUM | | 4.2 | | CVE-2026-89092 | libc6 | 2.41-12+rpt1+deb13u3 | | glibc: nscd stack overflow leads to degraded DNS resolution |
| MEDIUM | | 7 | | CVE-2026-95818 | libc6 | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow. |
| MEDIUM | | 7 | | CVE-2026-102010 | libcc1-0 | 14.2.0-19 | | gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if |
| MEDIUM | | 7.7 | | CVE-2026-95619 | libcc1-0 | 14.2.0-19 | | gcc: libstdc++ integer overflow in `new` operator |
| MEDIUM | | 9.8 | | CVE-2026-10536 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service |
| MEDIUM | | 9.8 | | CVE-2026-11856 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: Information disclosure via incorrect Digest authentication header reuse |
| MEDIUM | | 6.8 | | CVE-2026-1965 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication |
| MEDIUM | | 6.5 | | CVE-2026-19931 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: libcurl: Information disclosure via incorrect connection reuse with Negotiate authentication |
| MEDIUM | | 5.7 | | CVE-2026-3783 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect |
| MEDIUM | | 6.5 | | CVE-2026-3784 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: curl: Unauthorized access due to improper HTTP proxy connection reuse |
| MEDIUM | | 7.5 | | CVE-2026-3805 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: curl: Arbitrary code execution or Denial of Service via use-after-free in SMB request handling |
| MEDIUM | | 5.9 | | CVE-2026-4873 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: curl: Information disclosure due to incorrect TLS connection reuse |
| MEDIUM | | 6.5 | | CVE-2026-5545 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse |
| MEDIUM | | 5.9 | | CVE-2026-6253 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies |
| MEDIUM | | 6.5 | | CVE-2026-6429 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: libcurl: Credential leak via reused proxy connection during HTTP redirects |
| MEDIUM | | 5.3 | | CVE-2026-7168 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse |
| MEDIUM | | 9.1 | | CVE-2026-8924 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u7 | curl: curl: Cookie injection via malicious HTTP server using super cookies |
| MEDIUM | | 9.1 | | CVE-2026-8926 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: Information disclosure via incorrect .netrc password lookup |
| MEDIUM | | 7.5 | | CVE-2026-8932 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse |
| MEDIUM | | 9.8 | | CVE-2026-9079 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials |
| MEDIUM | | 7.3 | | CVE-2026-9080 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | libcurl: libcurl: Use-after-free via curl_easy_pause() in CURLMOPT_SOCKETFUNCTION callback |
| MEDIUM | | 6.5 | | CVE-2026-92388 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: FTP wildcard write callback mixup |
| MEDIUM | | 7.5 | | CVE-2026-9545 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | libcurl: libcurl: Information disclosure via cached SSL session and early data |
| MEDIUM | | 9.8 | | CVE-2026-10536 | libcurl4t64 | 8.14.1-2+deb13u3 | | libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service |
| MEDIUM | | 9.8 | | CVE-2026-11856 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: Information disclosure via incorrect Digest authentication header reuse |
| MEDIUM | | 6.8 | | CVE-2026-1965 | libcurl4t64 | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication |
| MEDIUM | | 6.5 | | CVE-2026-19931 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: libcurl: Information disclosure via incorrect connection reuse with Negotiate authentication |
| MEDIUM | | 5.7 | | CVE-2026-3783 | libcurl4t64 | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect |
| MEDIUM | | 6.5 | | CVE-2026-3784 | libcurl4t64 | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: curl: Unauthorized access due to improper HTTP proxy connection reuse |
| MEDIUM | | 7.5 | | CVE-2026-3805 | libcurl4t64 | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: curl: Arbitrary code execution or Denial of Service via use-after-free in SMB request handling |
| MEDIUM | | 5.9 | | CVE-2026-4873 | libcurl4t64 | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: curl: Information disclosure due to incorrect TLS connection reuse |
| MEDIUM | | 6.5 | | CVE-2026-5545 | libcurl4t64 | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse |
| MEDIUM | | 5.9 | | CVE-2026-6253 | libcurl4t64 | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies |
| MEDIUM | | 6.5 | | CVE-2026-6429 | libcurl4t64 | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: libcurl: Credential leak via reused proxy connection during HTTP redirects |
| MEDIUM | | 5.3 | | CVE-2026-7168 | libcurl4t64 | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse |
| MEDIUM | | 9.1 | | CVE-2026-8924 | libcurl4t64 | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u7 | curl: curl: Cookie injection via malicious HTTP server using super cookies |
| MEDIUM | | 9.1 | | CVE-2026-8926 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: Information disclosure via incorrect .netrc password lookup |
| MEDIUM | | 7.5 | | CVE-2026-8932 | libcurl4t64 | 8.14.1-2+deb13u3 | | libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse |
| MEDIUM | | 9.8 | | CVE-2026-9079 | libcurl4t64 | 8.14.1-2+deb13u3 | | libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials |
| MEDIUM | | 7.3 | | CVE-2026-9080 | libcurl4t64 | 8.14.1-2+deb13u3 | | libcurl: libcurl: Use-after-free via curl_easy_pause() in CURLMOPT_SOCKETFUNCTION callback |
| MEDIUM | | 6.5 | | CVE-2026-92388 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: FTP wildcard write callback mixup |
| MEDIUM | | 7.5 | | CVE-2026-9545 | libcurl4t64 | 8.14.1-2+deb13u3 | | libcurl: libcurl: Information disclosure via cached SSL session and early data |
| MEDIUM | | 4.8 | | CVE-2026-12216 | libduktape207 | 2.7.0-2+b2 | | Duktape: svaarala duktape duk_api_bytecode.c memory corruption |
| MEDIUM | | 5.5 | | CVE-2025-66382 | libexpat1 | 2.7.1-2 | | libexpat: libexpat: Denial of service via crafted file processing |
| MEDIUM | | 5.9 | | CVE-2026-102633 | libexpat1 | 2.7.1-2 | 2.9.0-1~deb13u1 | expat: expat: Denial of Service via integer overflow in expat_realloc |
| MEDIUM | | 5.9 | | CVE-2026-113351 | libexpat1 | 2.7.1-2 | | expat: expat: Denial of Service via improper memory tracking in XML_ParserReset |
| MEDIUM | | 6.2 | | CVE-2026-32776 | libexpat1 | 2.7.1-2 | 2.8.2-1~deb13u1 | libexpat: libexpat: Denial of Service due to NULL pointer dereference |
| MEDIUM | | 5.5 | | CVE-2026-32777 | libexpat1 | 2.7.1-2 | 2.8.2-1~deb13u1 | libexpat: libexpat: Denial of Service via infinite loop in DTD content parsing |
| MEDIUM | | 5.5 | | CVE-2026-32778 | libexpat1 | 2.7.1-2 | 2.8.2-1~deb13u1 | libexpat: libexpat: Denial of Service via NULL pointer dereference after out-of-memory condition |
| MEDIUM | | 5.9 | | CVE-2026-50219 | libexpat1 | 2.7.1-2 | 2.8.2-1~deb13u1 | expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking |
| MEDIUM | | 4.9 | | CVE-2026-56131 | libexpat1 | 2.7.1-2 | 2.8.2-1~deb13u1 | libexpat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking |
| MEDIUM | | 6.9 | | CVE-2026-56132 | libexpat1 | 2.7.1-2 | 2.8.2-1~deb13u1 | expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow |
| MEDIUM | | 6.9 | | CVE-2026-56403 | libexpat1 | 2.7.1-2 | 2.8.2-1~deb13u1 | libexpat: libexpat: Arbitrary code execution due to integer overflow in storeAtts |
| MEDIUM | | 6.9 | | CVE-2026-56404 | libexpat1 | 2.7.1-2 | 2.8.2-1~deb13u1 | libexpat: libexpat: Arbitrary Code Execution via integer overflow in addBinding |
| MEDIUM | | 6.9 | | CVE-2026-56405 | libexpat1 | 2.7.1-2 | 2.8.2-1~deb13u1 | libexpat: libexpat: Information disclosure and arbitrary code execution via integer overflow |
| MEDIUM | | 6.9 | | CVE-2026-56406 | libexpat1 | 2.7.1-2 | 2.8.2-1~deb13u1 | libexpat: libexpat: Arbitrary code execution via integer overflow in XML_ParseBuffer |
| MEDIUM | | 6.9 | | CVE-2026-56407 | libexpat1 | 2.7.1-2 | 2.8.2-1~deb13u1 | libexpat: libexpat: Arbitrary code execution due to integer overflow |
| MEDIUM | | 6.9 | | CVE-2026-56408 | libexpat1 | 2.7.1-2 | 2.8.2-1~deb13u1 | libexpat before 2.8.2 has an integer overflow in copyString. |
| MEDIUM | | 6.5 | | CVE-2026-56409 | libexpat1 | 2.7.1-2 | 2.8.2-1~deb13u1 | xmlwf in libexpat before 2.8.2 has an integer overflow for the output ... |
| MEDIUM | | 6.9 | | CVE-2026-56410 | libexpat1 | 2.7.1-2 | 2.8.2-1~deb13u1 | libexpat: libexpat: Integer overflow in xmlwf can lead to information disclosure and arbitrary code execution. |
| MEDIUM | | 6.9 | | CVE-2026-56411 | libexpat1 | 2.7.1-2 | 2.8.2-1~deb13u1 | expat: libexpat: Integer Overflow Vulnerability Leading to Information Disclosure or Code Execution |
| MEDIUM | | 5.9 | | CVE-2026-56412 | libexpat1 | 2.7.1-2 | 2.8.2-1~deb13u1 | libexpat: libexpat: Use-after-free vulnerability due to improper handling of XML CDATA sections |
| MEDIUM | | 6.2 | | CVE-2026-72522 | libexpat1 | 2.7.1-2 | 2.8.3-1~deb13u1 | expat: libexpat: Denial of Service due to incorrect Unicode surrogate handling |
| MEDIUM | | 6.8 | | CVE-2026-13595 | libfdisk1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: heap use-after-free in libblkid nested partition probing |
| MEDIUM | | 4.7 | | CVE-2026-27456 | libfdisk1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: TOCTOU in the mount program when setting up loop devices |
| MEDIUM | | 5.3 | | CVE-2026-3184 | libfdisk1 | 2.41-5 | | util-linux: util-linux: Access control bypass due to improper hostname canonicalization |
| MEDIUM | | 7 | | CVE-2026-102010 | libgcc-14-dev | 14.2.0-19 | | gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if |
| MEDIUM | | 7.7 | | CVE-2026-95619 | libgcc-14-dev | 14.2.0-19 | | gcc: libstdc++ integer overflow in `new` operator |
| MEDIUM | | 7 | | CVE-2026-102010 | libgcc-s1 | 14.2.0-19 | | gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if |
| MEDIUM | | 7.7 | | CVE-2026-95619 | libgcc-s1 | 14.2.0-19 | | gcc: libstdc++ integer overflow in `new` operator |
| MEDIUM | | 5.3 | | CVE-2026-15588 | libglib2.0-0t64 | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering |
| MEDIUM | | 7.1 | | CVE-2026-16118 | libglib2.0-0t64 | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u5 | xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c |
| MEDIUM | | 5.3 | | CVE-2026-86469 | libglib2.0-0t64 | 2.84.4-3~deb13u3 | | glib2: TOCTOU Symlink Race in `G_FILE_CREATE_REPLACE_DESTINATION` Fallback Path |
| MEDIUM | | 5.3 | | CVE-2026-15588 | libglib2.0-data | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering |
| MEDIUM | | 7.1 | | CVE-2026-16118 | libglib2.0-data | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u5 | xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c |
| MEDIUM | | 5.3 | | CVE-2026-86469 | libglib2.0-data | 2.84.4-3~deb13u3 | | glib2: TOCTOU Symlink Race in `G_FILE_CREATE_REPLACE_DESTINATION` Fallback Path |
| MEDIUM | | 7 | | CVE-2026-102010 | libgomp1 | 14.2.0-19 | | gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if |
| MEDIUM | | 7.7 | | CVE-2026-95619 | libgomp1 | 14.2.0-19 | | gcc: libstdc++ integer overflow in `new` operator |
| MEDIUM | | 4.9 | | CVE-2026-107708 | libgssapi-krb5-2 | 1.21.3-5+deb13u1 | | krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests |
| MEDIUM | | 6.5 | | CVE-2026-107778 | libgssapi-krb5-2 | 1.21.3-5+deb13u1 | | krb5: krb5: Denial of Service via crafted forwarded credentials |
| MEDIUM | | 7 | | CVE-2026-102010 | libhwasan0 | 14.2.0-19 | | gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if |
| MEDIUM | | 7.7 | | CVE-2026-95619 | libhwasan0 | 14.2.0-19 | | gcc: libstdc++ integer overflow in `new` operator |
| MEDIUM | | 7 | | CVE-2026-102010 | libitm1 | 14.2.0-19 | | gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if |
| MEDIUM | | 7.7 | | CVE-2026-95619 | libitm1 | 14.2.0-19 | | gcc: libstdc++ integer overflow in `new` operator |
| MEDIUM | | 4.9 | | CVE-2026-107708 | libk5crypto3 | 1.21.3-5+deb13u1 | | krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests |
| MEDIUM | | 6.5 | | CVE-2026-107778 | libk5crypto3 | 1.21.3-5+deb13u1 | | krb5: krb5: Denial of Service via crafted forwarded credentials |
| MEDIUM | | 4.9 | | CVE-2026-107708 | libkrb5-3 | 1.21.3-5+deb13u1 | | krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests |
| MEDIUM | | 6.5 | | CVE-2026-107778 | libkrb5-3 | 1.21.3-5+deb13u1 | | krb5: krb5: Denial of Service via crafted forwarded credentials |
| MEDIUM | | 4.9 | | CVE-2026-107708 | libkrb5support0 | 1.21.3-5+deb13u1 | | krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests |
| MEDIUM | | 6.5 | | CVE-2026-107778 | libkrb5support0 | 1.21.3-5+deb13u1 | | krb5: krb5: Denial of Service via crafted forwarded credentials |
| MEDIUM | | 6.8 | | CVE-2026-13595 | liblastlog2-2 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: heap use-after-free in libblkid nested partition probing |
| MEDIUM | | 4.7 | | CVE-2026-27456 | liblastlog2-2 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: TOCTOU in the mount program when setting up loop devices |
| MEDIUM | | 5.3 | | CVE-2026-3184 | liblastlog2-2 | 2.41-5 | | util-linux: util-linux: Access control bypass due to improper hostname canonicalization |
| MEDIUM | | 7 | | CVE-2026-102010 | liblsan0 | 14.2.0-19 | | gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if |
| MEDIUM | | 7.7 | | CVE-2026-95619 | liblsan0 | 14.2.0-19 | | gcc: libstdc++ integer overflow in `new` operator |
| MEDIUM | | 5.3 | | CVE-2026-34743 | liblzma5 | 5.8.1-1 | 5.8.1-1+deb13u1 | xz: XZ Utils: Denial of Service via buffer overflow in index decoding |
| MEDIUM | | 6.5 | | CVE-2026-95622 | libmm-glib0 | 1.24.0-1+deb13u1 | | ModemManager: ModemManager: Reachable assertion in Cell Broadcast encoding parse causes denial of service |
| MEDIUM | | 6.8 | | CVE-2026-13595 | libmount1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: heap use-after-free in libblkid nested partition probing |
| MEDIUM | | 4.7 | | CVE-2026-27456 | libmount1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: TOCTOU in the mount program when setting up loop devices |
| MEDIUM | | 5.3 | | CVE-2026-3184 | libmount1 | 2.41-5 | | util-linux: util-linux: Access control bypass due to improper hostname canonicalization |
| MEDIUM | | 5.4 | | CVE-2026-58055 | libnghttp2-14 | 1.64.0-1.1+deb13u1 | | nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests |
| MEDIUM | | 6.7 | | CVE-2026-10805 | libnm0 | 1.52.1-1+rpt4 | | NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend |
| MEDIUM | | 6.1 | | CVE-2026-16389 | libnss3 | 2:3.110-1+deb13u2 | 2:3.110-1+deb13u4 | firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Libraries component in NSS |
| MEDIUM | | | | CVE-2026-42617 | libntfs-3g89t64 | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u2 | In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_t ... |
| MEDIUM | | | | CVE-2026-42618 | libntfs-3g89t64 | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u2 | In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_deco ... |
| MEDIUM | | | | CVE-2026-46570 | libntfs-3g89t64 | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u2 | In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_inde ... |
| MEDIUM | | | | CVE-2026-46571 | libntfs-3g89t64 | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u2 | In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_fi ... |
| MEDIUM | | | | CVE-2026-46572 | libntfs-3g89t64 | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u2 | In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_c ... |
| MEDIUM | | | | CVE-2026-56135 | libntfs-3g89t64 | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u2 | In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in t ... |
| MEDIUM | | | | CVE-2026-56136 | libntfs-3g89t64 | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u2 | In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_ ... |
| MEDIUM | | 6.2 | | CVE-2026-13757 | libp11-kit0 | 0.25.5-3 | | p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing |
| MEDIUM | | 6.2 | | CVE-2026-18938 | libp11-kit0 | 0.25.5-3 | | p11-kit: Integer overflow in RPC attribute-array length calculation can under-allocate nested attribute storage on 32 bi |
| MEDIUM | | 4.8 | | CVE-2026-54411 | libpam-modules-bin | 1.7.0-5 | | linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module |
| MEDIUM | | 4.8 | | CVE-2026-54411 | libpam-modules | 1.7.0-5 | | linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module |
| MEDIUM | | 4.8 | | CVE-2026-54411 | libpam-runtime | 1.7.0-5 | | linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module |
| MEDIUM | | 5.5 | | CVE-2026-15059 | libpam-systemd | 257.13-1~deb13u1 | | systemd: systemd-oomd: Unprivileged users can terminate arbitrary processes via IPC API |
| MEDIUM | | 4.8 | | CVE-2026-54411 | libpam0g | 1.7.0-5 | | linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module |
| MEDIUM | | 6.6 | | CVE-2026-89085 | libparted2t64 | 3.6-5 | | parted: parted: Heap-based buffer overflow via crafted FAT32 filesystem image |
| MEDIUM | | 5.5 | | CVE-2026-89088 | libparted2t64 | 3.6-5 | | parted: parted: Denial of Service via heap buffer overflow during FAT16 resize |
| MEDIUM | | 5.5 | | CVE-2026-31911 | libpcap0.8t64 | 1.10.5-2 | | libpcap: libpcap: Denial of Service via crafted BPF opcode |
| MEDIUM | | 6.1 | | CVE-2026-31912 | libpcap0.8t64 | 1.10.5-2 | | libpcap: libpcap: Denial of service via crafted BPF filter program |
| MEDIUM | | 5.5 | | CVE-2026-6244 | libpcap0.8t64 | 1.10.5-2 | | libpcap: libpcap: Denial of Service via crafted BPF filter program |
| MEDIUM | | 5.9 | | CVE-2026-89156 | libpcre2-16-0 | 10.46-1~deb13u1 | 10.46-1~deb13u2 | PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback |
| MEDIUM | | 6.5 | | CVE-2026-89158 | libpcre2-16-0 | 10.46-1~deb13u1 | 10.46-1~deb13u2 | PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms |
| MEDIUM | | 6.5 | | CVE-2026-89160 | libpcre2-16-0 | 10.46-1~deb13u1 | 10.46-1~deb13u2 | pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching |
| MEDIUM | | 5.9 | | CVE-2026-89156 | libpcre2-8-0 | 10.46-1~deb13u1 | 10.46-1~deb13u2 | PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback |
| MEDIUM | | 6.5 | | CVE-2026-89158 | libpcre2-8-0 | 10.46-1~deb13u1 | 10.46-1~deb13u2 | PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms |
| MEDIUM | | 6.5 | | CVE-2026-89160 | libpcre2-8-0 | 10.46-1~deb13u1 | 10.46-1~deb13u2 | pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching |
| MEDIUM | | 6.5 | | CVE-2025-15649 | libperl5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-IO-Compress: perl-IO-Compress: Denial of Service via malformed DOS date in zip header |
| MEDIUM | | 5.3 | | CVE-2026-12087 | libperl5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-Socket: perl-Socket: Information Disclosure due to Out-of-Bounds Read |
| MEDIUM | | 5.7 | | CVE-2026-15534 | libperl5.40 | 5.40.1-6 | | perl: Perl: Arbitrary code execution via out-of-bounds memory access in regular expression engine. |
| MEDIUM | | 6.5 | | CVE-2026-19487 | libperl5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | perl: Perl: Incorrect regular expression matching can lead to wrong access or filtering decisions. |
| MEDIUM | | 5 | | CVE-2026-48959 | libperl5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-IO-Compress: perl-IO-Compress: CPU exhaustion via per-byte read loop in fastForward |
| MEDIUM | | 5 | | CVE-2026-48961 | libperl5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-IO-Compress: IO::Compress: Denial of Service in zipdetails CLI tool via malformed Info-ZIP Unix Extra Field |
| MEDIUM | | | | CVE-2026-7010 | libperl5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP ... |
| MEDIUM | | | | CVE-2026-7017 | libperl5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | HTTP::Tiny versions before 0.095 for Perl forward credential headers t ... |
| MEDIUM | | 5.9 | | CVE-2026-46675 | libpng16-16t64 | 1.6.48-1+deb13u5 | 1.6.48-1+deb13u6 | libpng: libpng: Use-after-free in sequential reader when png_read_end called without reading image rows |
| MEDIUM | | 5.5 | | CVE-2026-4897 | libpolkit-agent-1-0 | 126-2 | | polkit: Polkit: Denial of Service via unbounded input processing through standard input |
| MEDIUM | | 5.5 | | CVE-2026-4897 | libpolkit-gobject-1-0 | 126-2 | | polkit: Polkit: Denial of Service via unbounded input processing through standard input |
| MEDIUM | | 5.3 | | CVE-2025-12781 | libpython3.13-minimal | 3.13.5-2+deb13u2 | | cpython: base64.b64decode() always accepts "+/" characters, despite setting altchars |
| MEDIUM | | 7.1 | | CVE-2025-15366 | libpython3.13-minimal | 3.13.5-2+deb13u2 | | cpython: IMAP command injection in user-controlled commands |
| MEDIUM | | 7.1 | | CVE-2025-15367 | libpython3.13-minimal | 3.13.5-2+deb13u2 | | cpython: POP3 command injection in user-controlled commands |
| MEDIUM | | 5.5 | | CVE-2026-0864 | libpython3.13-minimal | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: cpython: Python configparser: Configuration injection via crafted multi-line input |
| MEDIUM | | 6.5 | | CVE-2026-11972 | libpython3.13-minimal | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: Python tarfile module: Denial of Service via improper EOF handling in streaming mode |
| MEDIUM | | 6.3 | | CVE-2026-12345 | libpython3.13-minimal | 3.13.5-2+deb13u2 | | python: python: Arbitrary file deletion via race condition during temporary directory cleanup |
| MEDIUM | | 4.5 | | CVE-2026-1502 | libpython3.13-minimal | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python: HTTP header injection via CR/LF in proxy tunnel headers |
| MEDIUM | | 6.5 | | CVE-2026-15310 | libpython3.13-minimal | 3.13.5-2+deb13u2 | | python: Python: Denial of Service via crafted zip file memory pre-allocation |
| MEDIUM | | 5.3 | | CVE-2026-15806 | libpython3.13-minimal | 3.13.5-2+deb13u2 | | python: Python: Information disclosure due to incorrect URL scheme matching |
| MEDIUM | | 6.5 | | CVE-2026-17084 | libpython3.13-minimal | 3.13.5-2+deb13u2 | | python: Python stringprep module: Incorrect domain name processing breaks IDNA interoperability |
| MEDIUM | | 5.3 | | CVE-2026-19672 | libpython3.13-minimal | 3.13.5-2+deb13u2 | | python: Python tarfile module: Directory traversal allows creation of empty directories outside extraction destination |
| MEDIUM | | 5.3 | | CVE-2026-3276 | libpython3.13-minimal | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python unicodedata: Denial of Service due to excessive CPU consumption |
| MEDIUM | | 5.3 | | CVE-2026-4360 | libpython3.13-minimal | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: Python Tarfile: Unexpected file ownership when extracting hardlinks |
| MEDIUM | | 6.5 | | CVE-2026-7774 | libpython3.13-minimal | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: CPython: Python tarfile: Arbitrary file write via crafted link entries |
| MEDIUM | | 5.7 | | CVE-2026-87910 | libpython3.13-minimal | 3.13.5-2+deb13u2 | | python: Python tarfile module: Security filter bypass allows arbitrary file write |
| MEDIUM | | 5.9 | | CVE-2026-9669 | libpython3.13-minimal | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python: Denial of Service via out-of-bounds write in BZ2 decompression |
| MEDIUM | | 5.3 | | CVE-2025-12781 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | | cpython: base64.b64decode() always accepts "+/" characters, despite setting altchars |
| MEDIUM | | 7.1 | | CVE-2025-15366 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | | cpython: IMAP command injection in user-controlled commands |
| MEDIUM | | 7.1 | | CVE-2025-15367 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | | cpython: POP3 command injection in user-controlled commands |
| MEDIUM | | 5.5 | | CVE-2026-0864 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: cpython: Python configparser: Configuration injection via crafted multi-line input |
| MEDIUM | | 6.5 | | CVE-2026-11972 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: Python tarfile module: Denial of Service via improper EOF handling in streaming mode |
| MEDIUM | | 6.3 | | CVE-2026-12345 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | | python: python: Arbitrary file deletion via race condition during temporary directory cleanup |
| MEDIUM | | 4.5 | | CVE-2026-1502 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python: HTTP header injection via CR/LF in proxy tunnel headers |
| MEDIUM | | 6.5 | | CVE-2026-15310 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | | python: Python: Denial of Service via crafted zip file memory pre-allocation |
| MEDIUM | | 5.3 | | CVE-2026-15806 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | | python: Python: Information disclosure due to incorrect URL scheme matching |
| MEDIUM | | 6.5 | | CVE-2026-17084 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | | python: Python stringprep module: Incorrect domain name processing breaks IDNA interoperability |
| MEDIUM | | 5.3 | | CVE-2026-19672 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | | python: Python tarfile module: Directory traversal allows creation of empty directories outside extraction destination |
| MEDIUM | | 5.3 | | CVE-2026-3276 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python unicodedata: Denial of Service due to excessive CPU consumption |
| MEDIUM | | 5.3 | | CVE-2026-4360 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: Python Tarfile: Unexpected file ownership when extracting hardlinks |
| MEDIUM | | 6.5 | | CVE-2026-7774 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: CPython: Python tarfile: Arbitrary file write via crafted link entries |
| MEDIUM | | 5.7 | | CVE-2026-87910 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | | python: Python tarfile module: Security filter bypass allows arbitrary file write |
| MEDIUM | | 5.9 | | CVE-2026-9669 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python: Denial of Service via out-of-bounds write in BZ2 decompression |
| MEDIUM | | 5.3 | | CVE-2025-12781 | libpython3.13 | 3.13.5-2+deb13u2 | | cpython: base64.b64decode() always accepts "+/" characters, despite setting altchars |
| MEDIUM | | 7.1 | | CVE-2025-15366 | libpython3.13 | 3.13.5-2+deb13u2 | | cpython: IMAP command injection in user-controlled commands |
| MEDIUM | | 7.1 | | CVE-2025-15367 | libpython3.13 | 3.13.5-2+deb13u2 | | cpython: POP3 command injection in user-controlled commands |
| MEDIUM | | 5.5 | | CVE-2026-0864 | libpython3.13 | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: cpython: Python configparser: Configuration injection via crafted multi-line input |
| MEDIUM | | 6.5 | | CVE-2026-11972 | libpython3.13 | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: Python tarfile module: Denial of Service via improper EOF handling in streaming mode |
| MEDIUM | | 6.3 | | CVE-2026-12345 | libpython3.13 | 3.13.5-2+deb13u2 | | python: python: Arbitrary file deletion via race condition during temporary directory cleanup |
| MEDIUM | | 4.5 | | CVE-2026-1502 | libpython3.13 | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python: HTTP header injection via CR/LF in proxy tunnel headers |
| MEDIUM | | 6.5 | | CVE-2026-15310 | libpython3.13 | 3.13.5-2+deb13u2 | | python: Python: Denial of Service via crafted zip file memory pre-allocation |
| MEDIUM | | 5.3 | | CVE-2026-15806 | libpython3.13 | 3.13.5-2+deb13u2 | | python: Python: Information disclosure due to incorrect URL scheme matching |
| MEDIUM | | 6.5 | | CVE-2026-17084 | libpython3.13 | 3.13.5-2+deb13u2 | | python: Python stringprep module: Incorrect domain name processing breaks IDNA interoperability |
| MEDIUM | | 5.3 | | CVE-2026-19672 | libpython3.13 | 3.13.5-2+deb13u2 | | python: Python tarfile module: Directory traversal allows creation of empty directories outside extraction destination |
| MEDIUM | | 5.3 | | CVE-2026-3276 | libpython3.13 | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python unicodedata: Denial of Service due to excessive CPU consumption |
| MEDIUM | | 5.3 | | CVE-2026-4360 | libpython3.13 | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: Python Tarfile: Unexpected file ownership when extracting hardlinks |
| MEDIUM | | 6.5 | | CVE-2026-7774 | libpython3.13 | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: CPython: Python tarfile: Arbitrary file write via crafted link entries |
| MEDIUM | | 5.7 | | CVE-2026-87910 | libpython3.13 | 3.13.5-2+deb13u2 | | python: Python tarfile module: Security filter bypass allows arbitrary file write |
| MEDIUM | | 5.9 | | CVE-2026-9669 | libpython3.13 | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python: Denial of Service via out-of-bounds write in BZ2 decompression |
| MEDIUM | | 5.5 | | CVE-2026-105923 | libqt6core6t64 | 6.8.2+dfsg-9+deb13u2 | | qt6: qt6: Denial of Service via crafted SVG in VectorImage |
| MEDIUM | | 5.3 | | CVE-2026-15037 | libqt6core6t64 | 6.8.2+dfsg-9+deb13u2 | | qt: Qt XML: XML injection via improper output neutralization in QDom serialization. |
| MEDIUM | | 6.5 | | CVE-2026-19248 | libqt6core6t64 | 6.8.2+dfsg-9+deb13u2 | | qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing |
| MEDIUM | | 4.7 | | CVE-2026-78253 | libqt6core6t64 | 6.8.2+dfsg-9+deb13u2 | | qt: Qt: Denial of Service via uncontrolled recursion in XML processing |
| MEDIUM | | 7.5 | | CVE-2026-107161 | libsasl2-2 | 2.1.28+dfsg1-9 | | cyrus-sasl: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise DIGEST- |
| MEDIUM | | 7.5 | | CVE-2026-107161 | libsasl2-modules-db | 2.1.28+dfsg1-9 | | cyrus-sasl: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise DIGEST- |
| MEDIUM | | 7.5 | | CVE-2026-107161 | libsasl2-modules | 2.1.28+dfsg1-9 | | cyrus-sasl: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise DIGEST- |
| MEDIUM | | 6.8 | | CVE-2026-13595 | libsmartcols1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: heap use-after-free in libblkid nested partition probing |
| MEDIUM | | 4.7 | | CVE-2026-27456 | libsmartcols1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: TOCTOU in the mount program when setting up loop devices |
| MEDIUM | | 5.3 | | CVE-2026-3184 | libsmartcols1 | 2.41-5 | | util-linux: util-linux: Access control bypass due to improper hostname canonicalization |
| MEDIUM | | 5.5 | | CVE-2026-50812 | libsqlite3-0 | 3.46.1-7+deb13u1 | | sqlite: SQLite: Denial of Service via malformed changeset in Session Extension |
| MEDIUM | | 5.5 | | CVE-2026-50813 | libsqlite3-0 | 3.46.1-7+deb13u1 | | sqlite: SQLite: Information disclosure via Session Extension changeset merge path |
| MEDIUM | | 6.5 | | CVE-2025-15661 | libssh2-1t64 | 1.11.1-1 | 1.11.1-1+deb13u1 | libssh2: libssh2: Information disclosure and denial of service via crafted SFTP response |
| MEDIUM | | 6.5 | | CVE-2026-58051 | libssh2-1t64 | 1.11.1-1 | 1.11.1-1+deb13u2 | libssh2: libssh2: Denial of service or information disclosure via malformed SSH publickey response |
| MEDIUM | | 8.8 | | CVE-2026-66032 | libssh2-1t64 | 1.11.1-1 | 1.11.1-1+deb13u2 | libssh2: libssh2: Arbitrary code execution via double-free in SFTP session |
| MEDIUM | | 7.5 | | CVE-2026-66033 | libssh2-1t64 | 1.11.1-1 | 1.11.1-1+deb13u2 | libssh2: libssh2: Denial of Service via integer underflow in AES-GCM cipher negotiation |
| MEDIUM | | 7.5 | | CVE-2026-66034 | libssh2-1t64 | 1.11.1-1 | 1.11.1-1+deb13u2 | libssh2: libssh2: Information disclosure and potential arbitrary code execution via heap out-of-bounds read |
| MEDIUM | | 7.5 | | CVE-2026-66035 | libssh2-1t64 | 1.11.1-1 | 1.11.1-1+deb13u2 | libssh2: libssh2: Arbitrary code execution via heap buffer overflow during SSH negotiation |
| MEDIUM | | 7.5 | | CVE-2026-18798 | libssl3t64 | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: QUIC server may trigger double free when processing INITIAL packet |
| MEDIUM | | 5.3 | | CVE-2026-42772 | libssl3t64 | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: openssl: Denial of Service via inefficient QUIC stream reassembly |
| MEDIUM | | 5.9 | | CVE-2026-54872 | libssl3t64 | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: OpenSSL: Private key recovery via timing side-channel in generic elliptic curve operations |
| MEDIUM | | 5.3 | | CVE-2026-54873 | libssl3t64 | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: openssl: Denial of Service via excessive QUIC packet buffer retention |
| MEDIUM | | 4.7 | | CVE-2026-54875 | libssl3t64 | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: openssl: information disclosure via non-constant-time SM2 scalar multiplication on ARM64 and RISC-V |
| MEDIUM | | 7.5 | | CVE-2026-63072 | libssl3t64 | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: heap buffer overflow in CMS key unwrapping |
| MEDIUM | | 7.5 | | CVE-2026-63076 | libssl3t64 | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: invalid pointer dereference in CMP server via crafted protectionAlg |
| MEDIUM | | 5.9 | | CVE-2026-72897 | libssl3t64 | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: openssl: Denial of Service via out-of-bounds write during TLS context switch |
| MEDIUM | | 5.3 | | CVE-2026-75804 | libssl3t64 | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: OpenSSL: Denial of Service via unenforced QUIC connection flow control |
| MEDIUM | | 5.9 | | CVE-2026-75805 | libssl3t64 | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: openssl: Denial of Service via crafted CMP certificate revocation response |
| MEDIUM | | 5.3 | | CVE-2026-75806 | libssl3t64 | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: OpenSSL: Denial of Service via undersized DTLS record |
| MEDIUM | | 5.9 | | CVE-2026-77696 | libssl3t64 | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: OpenSSL: Private key recovery via SM2 timing side-channel |
| MEDIUM | | 5.3 | | CVE-2026-84784 | libssl3t64 | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: OpenSSL: Denial of Service via unbounded QUIC connection identifier backlog |
| MEDIUM | | 7 | | CVE-2026-102010 | libstdc++-14-dev | 14.2.0-19 | | gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if |
| MEDIUM | | 7.7 | | CVE-2026-95619 | libstdc++-14-dev | 14.2.0-19 | | gcc: libstdc++ integer overflow in `new` operator |
| MEDIUM | | 7 | | CVE-2026-102010 | libstdc++6 | 14.2.0-19 | | gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if |
| MEDIUM | | 7.7 | | CVE-2026-95619 | libstdc++6 | 14.2.0-19 | | gcc: libstdc++ integer overflow in `new` operator |
| MEDIUM | | 5.5 | | CVE-2026-15059 | libsystemd-shared | 257.13-1~deb13u1 | | systemd: systemd-oomd: Unprivileged users can terminate arbitrary processes via IPC API |
| MEDIUM | | 5.5 | | CVE-2026-15059 | libsystemd0 | 257.13-1~deb13u1 | | systemd: systemd-oomd: Unprivileged users can terminate arbitrary processes via IPC API |
| MEDIUM | | 6.1 | | CVE-2026-15779 | libtalloc2 | 2:2.4.3+samba4.22.8+dfsg-0+deb13u2 | | samba-winbind: samba: pam_winbind mkhomedir chowns critical system paths without validation |
| MEDIUM | | 5.3 | | CVE-2026-58216 | libtalloc2 | 2:2.4.3+samba4.22.8+dfsg-0+deb13u2 | 2:4.22.10+dfsg-0+deb13u2 | samba: kpasswd service: kpasswd packet that contains malformed ASN.1 might cause the server to access 6 bytes of unalloc |
| MEDIUM | | 5.3 | | CVE-2026-58218 | libtalloc2 | 2:2.4.3+samba4.22.8+dfsg-0+deb13u2 | 2:4.22.10+dfsg-0+deb13u2 | samba: DNS signing DoS via TKEY name cache exhaustion |
| MEDIUM | | 6.5 | | CVE-2026-58224 | libtalloc2 | 2:2.4.3+samba4.22.8+dfsg-0+deb13u2 | 2:4.22.10+dfsg-0+deb13u2 | samba: CTDB fails to do integrity checking of received packets |
| MEDIUM | | 6.1 | | CVE-2026-18495 | libtiff6 | 4.7.0-3+deb13u2 | | libtiff: libtiff: heap-buffer overflow via numeric truncation in the JPEG raw passthrough |
| MEDIUM | | 6.5 | | CVE-2026-85231 | libtirpc-common | 1.3.6+ds-1 | | libtirpc: libtirpc: Denial of service via unbounded memory allocation during RPCSEC_GSS decoding |
| MEDIUM | | 5.3 | | CVE-2026-85977 | libtirpc-common | 1.3.6+ds-1 | | libtirpc: libtirpc: Denial of Service via unbounded memory allocation during portmapper response decoding |
| MEDIUM | | 6.5 | | CVE-2026-85231 | libtirpc3t64 | 1.3.6+ds-1 | | libtirpc: libtirpc: Denial of service via unbounded memory allocation during RPCSEC_GSS decoding |
| MEDIUM | | 5.3 | | CVE-2026-85977 | libtirpc3t64 | 1.3.6+ds-1 | | libtirpc: libtirpc: Denial of Service via unbounded memory allocation during portmapper response decoding |
| MEDIUM | | 7 | | CVE-2026-102010 | libtsan2 | 14.2.0-19 | | gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if |
| MEDIUM | | 7.7 | | CVE-2026-95619 | libtsan2 | 14.2.0-19 | | gcc: libstdc++ integer overflow in `new` operator |
| MEDIUM | | 7 | | CVE-2026-102010 | libubsan1 | 14.2.0-19 | | gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if |
| MEDIUM | | 7.7 | | CVE-2026-95619 | libubsan1 | 14.2.0-19 | | gcc: libstdc++ integer overflow in `new` operator |
| MEDIUM | | 5.5 | | CVE-2026-15059 | libudev1 | 257.13-1~deb13u1 | | systemd: systemd-oomd: Unprivileged users can terminate arbitrary processes via IPC API |
| MEDIUM | | 6.2 | | CVE-2026-23679 | libusb-1.0-0 | 2:1.0.28-1 | | libusb: libusb: Denial of Service via malformed USB configuration descriptor |
| MEDIUM | | 5.5 | | CVE-2026-47104 | libusb-1.0-0 | 2:1.0.28-1 | | libusb: libusb: Denial of Service via malformed USB descriptor |
| MEDIUM | | 6.8 | | CVE-2026-13595 | libuuid1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: heap use-after-free in libblkid nested partition probing |
| MEDIUM | | 4.7 | | CVE-2026-27456 | libuuid1 | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: TOCTOU in the mount program when setting up loop devices |
| MEDIUM | | 5.3 | | CVE-2026-3184 | libuuid1 | 2.41-5 | | util-linux: util-linux: Access control bypass due to improper hostname canonicalization |
| MEDIUM | | 6.1 | | CVE-2026-15779 | libwbclient0 | 2:4.22.8+dfsg-0+deb13u2 | | samba-winbind: samba: pam_winbind mkhomedir chowns critical system paths without validation |
| MEDIUM | | 5.3 | | CVE-2026-58216 | libwbclient0 | 2:4.22.8+dfsg-0+deb13u2 | 2:4.22.10+dfsg-0+deb13u2 | samba: kpasswd service: kpasswd packet that contains malformed ASN.1 might cause the server to access 6 bytes of unalloc |
| MEDIUM | | 5.3 | | CVE-2026-58218 | libwbclient0 | 2:4.22.8+dfsg-0+deb13u2 | 2:4.22.10+dfsg-0+deb13u2 | samba: DNS signing DoS via TKEY name cache exhaustion |
| MEDIUM | | 6.5 | | CVE-2026-58224 | libwbclient0 | 2:4.22.8+dfsg-0+deb13u2 | 2:4.22.10+dfsg-0+deb13u2 | samba: CTDB fails to do integrity checking of received packets |
| MEDIUM | | 6.5 | | CVE-2026-94283 | libx11-6 | 2:1.8.12-1 | | libX11: libX11: Denial of Service via out-of-bounds read in XIM attribute parser |
| MEDIUM | | 5.5 | | CVE-2026-94284 | libx11-6 | 2:1.8.12-1 | | libX11: libX11: Denial of Service via out-of-bounds read in XIM trigger-key registration parser |
| MEDIUM | | 5.1 | | CVE-2026-94285 | libx11-6 | 2:1.8.12-1 | | libX11: libX11: Denial of Service via out-of-bounds read in byte-oriented codeset parser |
| MEDIUM | | 6.5 | | CVE-2026-94283 | libx11-data | 2:1.8.12-1 | | libX11: libX11: Denial of Service via out-of-bounds read in XIM attribute parser |
| MEDIUM | | 5.5 | | CVE-2026-94284 | libx11-data | 2:1.8.12-1 | | libX11: libX11: Denial of Service via out-of-bounds read in XIM trigger-key registration parser |
| MEDIUM | | 5.1 | | CVE-2026-94285 | libx11-data | 2:1.8.12-1 | | libX11: libX11: Denial of Service via out-of-bounds read in byte-oriented codeset parser |
| MEDIUM | | 5.9 | | CVE-2026-0990 | libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | libxml2: libxml2: Denial of Service via uncontrolled recursion in XML catalog processing |
| MEDIUM | | 5.5 | | CVE-2026-76781 | libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | | libxml2: libxml2: NULL pointer dereference parsing nextCatalog without catalog attribute |
| MEDIUM | | 6.1 | | CVE-2026-86137 | libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | | libxml2: libxml2: Denial of Service via out-of-bounds read in xmlFAParsePosCharGroup |
| MEDIUM | | 4.6 | | CVE-2019-15213 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: use-after-free caused by malicious USB device in drivers/media/usb/dvb-usb/dvb-usb-init.c |
| MEDIUM | | 4.1 | | CVE-2019-16089 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Improper return check in nbd_genl_status function in drivers/block/nbd.c |
| MEDIUM | | 4.7 | | CVE-2019-20794 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: task processes not being properly ended could lead to resource exhaustion |
| MEDIUM | | 4.4 | | CVE-2020-14304 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ethtool when reading eeprom of device could lead to memory leak |
| MEDIUM | | 6.7 | | CVE-2020-36694 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: use-after-free in the packet processing context |
| MEDIUM | | 5.5 | | CVE-2023-31082 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sleeping function called from an invalid context in gsmld_write |
| MEDIUM | | 7 | | CVE-2023-3397 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: slab-use-after-free Write in txEnd due to race condition |
| MEDIUM | | 5.5 | | CVE-2023-37454 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: udf: use-after-free write in udf_close_lvid |
| MEDIUM | | 6.7 | | CVE-2023-6238 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvme: memory corruption via unprivileged user passthrough |
| MEDIUM | | 6.5 | | CVE-2023-6240 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation |
| MEDIUM | | 5.5 | | CVE-2024-2193 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | hw: Spectre-SRC that is Speculative Race Conditions (SRCs) for synchronization primitives similar like Spectre V1 with p |
| MEDIUM | | 4.7 | | CVE-2024-24864 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | A race condition was found in the Linux kernel's media/dvb-core in dvb ... |
| MEDIUM | | 5.5 | | CVE-2024-25740 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory leak in ubi driver |
| MEDIUM | | 5.5 | | CVE-2024-56709 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring: check if iowq is killed before queuing |
| MEDIUM | | 5.5 | | CVE-2024-58074 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/i915: Grab intel_display from the encoder to avoid potential oopsies |
| MEDIUM | | 5.5 | | CVE-2025-21752 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents |
| MEDIUM | | 5.5 | | CVE-2025-21949 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Set hugetlb mmap base address aligned with pmd size |
| MEDIUM | | 5.5 | | CVE-2025-22109 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ax25: Remove broken autobind |
| MEDIUM | | 5.5 | | CVE-2025-23132 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: quota: fix to avoid warning in dquot_writeback_dquots() |
| MEDIUM | | 5.5 | | CVE-2025-23135 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Teardown riscv specific bits after kvm_exit |
| MEDIUM | | 5.5 | | CVE-2025-37743 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Avoid memory leak while enabling statistics |
| MEDIUM | | 5.5 | | CVE-2025-37746 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/dwc_pcie: fix duplicate pci_dev devices |
| MEDIUM | | 5.5 | | CVE-2025-37880 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: um: work around sched_yield not yielding in time-travel mode |
| MEDIUM | | 4.7 | | CVE-2025-37906 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: ublk race condition causes kernel crash |
| MEDIUM | | 5.5 | | CVE-2025-38029 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to sleepable page allocation in KASAN |
| MEDIUM | | 5.5 | | CVE-2025-38036 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to null pointer dereference in GT MMIO initialization for VFs |
| MEDIUM | | 5.5 | | CVE-2025-38041 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clk: sunxi-ng: h616: Reparent GPU clock during frequency changes |
| MEDIUM | | 5.5 | | CVE-2025-38042 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn |
| MEDIUM | | 6.7 | | CVE-2025-38064 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio: break and reset virtio devices on device_shutdown() |
| MEDIUM | | 5.5 | | CVE-2025-38132 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: holding cscfg_csdev_lock while removing cscfg from csdev |
| MEDIUM | | 5.5 | | CVE-2025-38140 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Local denial of service in device mapper |
| MEDIUM | | 5.5 | | CVE-2025-38199 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix memory leak due to multiple rx_stats allocation |
| MEDIUM | | 5.5 | | CVE-2025-38207 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm: fix uprobe pte be overwritten when expanding vma |
| MEDIUM | | 5.5 | | CVE-2025-38261 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv: save the SR_SUM status over switches |
| MEDIUM | | 5.5 | | CVE-2025-38284 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: configure manual DAC mode via PCI config API only |
| MEDIUM | | 5.5 | | CVE-2025-38311 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel (iavf): Denial of Service due to a locking issue |
| MEDIUM | | 5.5 | | CVE-2025-38359 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Fix in_atomic() handling in do_secure_storage_access() |
| MEDIUM | | 5.5 | | CVE-2025-38597 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port |
| MEDIUM | | 5.5 | | CVE-2025-38605 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() |
| MEDIUM | | 5.5 | | CVE-2025-39677 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Fix backlog accounting in qdisc_dequeue_internal |
| MEDIUM | | 5.5 | | CVE-2025-39762 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: add null check |
| MEDIUM | | 5.5 | | CVE-2025-39775 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: mremap local denial of service |
| MEDIUM | | 5.5 | | CVE-2025-39789 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: crypto: x86/aegis - Add missing error checks |
| MEDIUM | | 6.1 | | CVE-2025-39822 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/kbuf: fix signedness in this_len calculation |
| MEDIUM | | 5.5 | | CVE-2025-39830 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path |
| MEDIUM | | 5.5 | | CVE-2025-39834 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow |
| MEDIUM | | 6.2 | | CVE-2025-39910 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() |
| MEDIUM | | 7.1 | | CVE-2025-39933 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length |
| MEDIUM | | 2.5 | | CVE-2025-40113 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E |
| MEDIUM | | 6.8 | | CVE-2025-40130 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling |
| MEDIUM | | 6.2 | | CVE-2025-40146 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: fix potential deadlock while nr_requests grown |
| MEDIUM | | 5.2 | | CVE-2025-40217 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pidfs: validate extensible ioctls |
| MEDIUM | | | | CVE-2025-40247 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Fix pgtable prealloc error path |
| MEDIUM | | 5.2 | | CVE-2025-40338 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Do not share the name pointer between components |
| MEDIUM | | 6.1 | | CVE-2025-40355 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sysfs: check visibility before changing group attribute ownership |
| MEDIUM | | 5.5 | | CVE-2025-68209 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mlx5: Fix default values in create CQ |
| MEDIUM | | 5.5 | | CVE-2025-68236 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service during UFS power down |
| MEDIUM | | 5.5 | | CVE-2025-68304 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_core: lookup hci_conn on RX path on protocol side |
| MEDIUM | | | | CVE-2025-68318 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL |
| MEDIUM | | 6.1 | | CVE-2025-68319 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netconsole: Acquire su_mutex before navigating configs hierarchy |
| MEDIUM | | 5.5 | | CVE-2025-68353 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service via NULL pointer dereference in VXLAN module |
| MEDIUM | | 4.5 | | CVE-2025-68360 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks |
| MEDIUM | | 5.5 | | CVE-2025-68368 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service in md driver via uninitialized bioset |
| MEDIUM | | 6.5 | | CVE-2025-68729 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix MSDU buffer types handling in RX error path |
| MEDIUM | | 5.5 | | CVE-2025-68730 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() |
| MEDIUM | | 4.7 | | CVE-2025-68745 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset |
| MEDIUM | | 7.8 | | CVE-2025-71074 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel functionfs: Use-After-Free vulnerability due to open/removal races |
| MEDIUM | | 5.5 | | CVE-2025-71117 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service via deadlock in block layer sysfs store callbacks |
| MEDIUM | | 5.5 | | CVE-2025-71141 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/tilcdc: Fix removal actions in case of failed probe |
| MEDIUM | | 5.5 | | CVE-2025-71188 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: lpc18xx-dmamux: fix device leak on route allocation |
| MEDIUM | | 6.5 | | CVE-2025-71202 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Memory Corruption and Kernel Crashes via IOMMU SVA coherency issue |
| MEDIUM | | 5.5 | | CVE-2025-71227 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: don't WARN for connections on invalid channels |
| MEDIUM | | 5.5 | | CVE-2025-71285 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels |
| MEDIUM | | 5.5 | | CVE-2025-71302 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: fix for dma-fence safe access rules |
| MEDIUM | | 7 | | CVE-2025-71313 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI: endpoint: Add missing NULL check for alloc_workqueue() |
| MEDIUM | | 5.5 | | CVE-2025-71315 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/vkms: Convert to DRM's vblank timer |
| MEDIUM | | 5.5 | | CVE-2026-100074 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| MEDIUM | | 5.5 | | CVE-2026-100076 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths |
| MEDIUM | | 5.5 | | CVE-2026-100077 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Recover HW before retire hung submit |
| MEDIUM | | 5.5 | | CVE-2026-23007 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: block: zero non-PI portion of auto integrity buffer |
| MEDIUM | | 5.5 | | CVE-2026-23017 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: idpf: fix error handling in the init_task on load |
| MEDIUM | | 5.5 | | CVE-2026-23143 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix misalignment bug in struct virtnet_info |
| MEDIUM | | 7.1 | | CVE-2026-23152 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: correctly decode TTLM with default link map |
| MEDIUM | | 5.5 | | CVE-2026-23217 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv: trace: fix snapshot deadlock with sbi ecall |
| MEDIUM | | 5.5 | | CVE-2026-23259 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/rw: free potentially allocated iovec on cache put failure |
| MEDIUM | | 5.5 | | CVE-2026-23265 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer in {read,write}_end_io |
| MEDIUM | | 5.5 | | CVE-2026-23348 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix race of nvdimm_bus object when creating nvdimm objects |
| MEDIUM | | 5.5 | | CVE-2026-23371 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting |
| MEDIUM | | 5.5 | | CVE-2026-23377 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz |
| MEDIUM | | 5.5 | | CVE-2026-23385 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: clone set on flush only |
| MEDIUM | | 5.5 | | CVE-2026-23472 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN |
| MEDIUM | | 5.5 | | CVE-2026-31435 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix read abandonment during retry |
| MEDIUM | | 5.5 | | CVE-2026-31526 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix exception exit lock checking for subprogs |
| MEDIUM | | 5.5 | | CVE-2026-31537 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: server: make use of smbdirect_socket.send_io.bcredits |
| MEDIUM | | 5.5 | | CVE-2026-31562 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register |
| MEDIUM | | 5.5 | | CVE-2026-31579 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit |
| MEDIUM | | 5.5 | | CVE-2026-31591 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish |
| MEDIUM | | 5.5 | | CVE-2026-31592 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock |
| MEDIUM | | 5.5 | | CVE-2026-31630 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rxrpc: proc: size address buffers for %pISpc output |
| MEDIUM | | 7.1 | | CVE-2026-31692 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns |
| MEDIUM | | 5.5 | | CVE-2026-31771 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_event: move wake reason storage into validated event handlers |
| MEDIUM | | 5.5 | | CVE-2026-31777 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: ctxfi: Check the error for index mapping |
| MEDIUM | | 5.5 | | CVE-2026-43009 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix incorrect pruning due to atomic fetch precision tracking |
| MEDIUM | | 5.5 | | CVE-2026-43022 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists |
| MEDIUM | | 5.5 | | CVE-2026-43029 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mptcp: fix soft lockup in mptcp_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-43034 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: set backing store type from query type |
| MEDIUM | | 7.1 | | CVE-2026-43042 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mpls: add seqcount to protect the platform_label{,s} pair |
| MEDIUM | | 5.5 | | CVE-2026-43048 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: HID: core: Mitigate potential OOB by removing bogus memset() |
| MEDIUM | | 5.5 | | CVE-2026-43053 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: close crash window in attr dabtree inactivation |
| MEDIUM | | 5.5 | | CVE-2026-43083 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: ioam6: fix OOB and missing lock |
| MEDIUM | | 5.5 | | CVE-2026-43101 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() |
| MEDIUM | | 5.5 | | CVE-2026-43115 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: srcu: Use irq_work to start GP in tiny SRCU |
| MEDIUM | | 5.5 | | CVE-2026-43118 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix zero size inode with non-zero size after log replay |
| MEDIUM | | 5.5 | | CVE-2026-43127 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs3: fix circular locking dependency in run_unpack_ex |
| MEDIUM | | 5.5 | | CVE-2026-43172 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: fix 22000 series SMEM parsing |
| MEDIUM | | 5.5 | | CVE-2026-43191 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 |
| MEDIUM | | 5.5 | | CVE-2026-43204 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: qcom: q6asm: drop DSP responses for closed data streams |
| MEDIUM | | 5.5 | | CVE-2026-43213 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: validate sequence number of TX release report |
| MEDIUM | | 5.5 | | CVE-2026-43234 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: team: avoid NETDEV_CHANGEMTU event when unregistering slave |
| MEDIUM | | 5.5 | | CVE-2026-43272 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ring-buffer: Fix possible dereference of uninitialized pointer |
| MEDIUM | | 5.5 | | CVE-2026-43294 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels |
| MEDIUM | | 5.5 | | CVE-2026-43298 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Skip vcn poison irq release on VF |
| MEDIUM | | 5.5 | | CVE-2026-43299 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() |
| MEDIUM | | 5.5 | | CVE-2026-43301 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix PM runtime usage count underflow |
| MEDIUM | | 5.5 | | CVE-2026-43308 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() |
| MEDIUM | | 5.5 | | CVE-2026-43309 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md raid: fix hang when stopping arrays with metadata through dm-raid |
| MEDIUM | | 5.5 | | CVE-2026-43310 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC |
| MEDIUM | | 5.5 | | CVE-2026-43311 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soc/tegra: pmc: Fix unsafe generic_handle_irq() call |
| MEDIUM | | 5.5 | | CVE-2026-43325 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: don't send a 6E related command when not supported |
| MEDIUM | | 5.5 | | CVE-2026-43326 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback |
| MEDIUM | | 5.5 | | CVE-2026-43337 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() |
| MEDIUM | | 5.5 | | CVE-2026-43346 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ice: ptp: don't WARN when controlling PF is unavailable |
| MEDIUM | | 5.5 | | CVE-2026-43352 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue |
| MEDIUM | | 5.5 | | CVE-2026-43353 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue |
| MEDIUM | | 7.1 | | CVE-2026-43414 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Completely fix fcport double free |
| MEDIUM | | 5.5 | | CVE-2026-43416 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: powerpc, perf: Check that current->mm is alive before getting user callchain |
| MEDIUM | | 5.5 | | CVE-2026-43443 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: amd: acp-mach-common: Add missing error check for clock acquisition |
| MEDIUM | | 5.5 | | CVE-2026-43463 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() |
| MEDIUM | | 5.5 | | CVE-2026-43464 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ |
| MEDIUM | | 5.5 | | CVE-2026-43465 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ |
| MEDIUM | | 5.5 | | CVE-2026-43485 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nouveau/gsp: drop WARN_ON in ACPI probes |
| MEDIUM | | 6.4 | | CVE-2026-45932 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix tcx/netkit detach permissions when prog fd isn't given |
| MEDIUM | | 7 | | CVE-2026-45934 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation |
| MEDIUM | | 5.5 | | CVE-2026-45940 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix oops when split header is enabled |
| MEDIUM | | 5.5 | | CVE-2026-45961 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gfs2: fix memory leaks in gfs2_fill_super error path |
| MEDIUM | | 5.5 | | CVE-2026-46014 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Add missing save/restore handling of LBR MSRs |
| MEDIUM | | 7 | | CVE-2026-46017 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm: fix deferred split queue races during migration |
| MEDIUM | | 7 | | CVE-2026-46032 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT |
| MEDIUM | | 5.5 | | CVE-2026-46044 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipmi:ssif: Clean up kthread on errors |
| MEDIUM | | 5.5 | | CVE-2026-46059 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN |
| MEDIUM | | 5.5 | | CVE-2026-46066 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix num_ops off-by-one when crypto allocation fails |
| MEDIUM | | 5.5 | | CVE-2026-46071 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 |
| MEDIUM | | 5.5 | | CVE-2026-46096 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() |
| MEDIUM | | 5.5 | | CVE-2026-46147 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() |
| MEDIUM | | 5.5 | | CVE-2026-46148 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: spi: microchip-core-qspi: control built-in cs manually |
| MEDIUM | | 5.5 | | CVE-2026-46153 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: 8021q: delete cleared egress QoS mappings |
| MEDIUM | | 5.5 | | CVE-2026-46171 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv: kvm: fix vector context allocation leak |
| MEDIUM | | 5.5 | | CVE-2026-46228 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: spi: ch341: fix devres lifetime |
| MEDIUM | | 5.5 | | CVE-2026-46245 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dc_link NULL handling in HPD init |
| MEDIUM | | 5.5 | | CVE-2026-46256 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages |
| MEDIUM | | 4.7 | | CVE-2026-46272 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: tmc-etr: Fix race condition between sysfs and perf mode |
| MEDIUM | | 5.5 | | CVE-2026-46302 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: selinux: allow multiple opens of /sys/fs/selinux/policy |
| MEDIUM | | 5.5 | | CVE-2026-46314 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Reject empty multisync extension to prevent infinite loop |
| MEDIUM | | 7 | | CVE-2026-46317 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock |
| MEDIUM | | 7 | | CVE-2026-46324 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: netfilter nf_tables denial of service via race condition in netlink hook unregistration |
| MEDIUM | | 7 | | CVE-2026-46325 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE |
| MEDIUM | | 7 | | CVE-2026-46330 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Revert "net/smc: Introduce TCP ULP support" |
| MEDIUM | | 5.5 | | CVE-2026-52937 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR |
| MEDIUM | | 7 | | CVE-2026-52953 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Fix oops due to out of scope access |
| MEDIUM | | 7 | | CVE-2026-52956 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() |
| MEDIUM | | 5.5 | | CVE-2026-52994 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting |
| MEDIUM | | 7 | | CVE-2026-53009 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ice: fix double-free of tx_buf skb |
| MEDIUM | | 5.5 | | CVE-2026-53017 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix data loss caused by incorrect use of nat_entry flag |
| MEDIUM | | 5.5 | | CVE-2026-53018 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: avoid reading already updated pages during GC |
| MEDIUM | | 5.5 | | CVE-2026-53103 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync |
| MEDIUM | | 5.5 | | CVE-2026-53104 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: Fix memory leak destroying device |
| MEDIUM | | 5.5 | | CVE-2026-53106 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Do not allow deleting local storage in NMI |
| MEDIUM | | 5.5 | | CVE-2026-53107 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: libertas: don't kill URBs in interrupt context |
| MEDIUM | | 5.5 | | CVE-2026-53108 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: powerpc/64s: Fix unmap race with PMD migration entries |
| MEDIUM | | | | CVE-2026-53178 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction |
| MEDIUM | | 7 | | CVE-2026-53224 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate embedded INIT chunk and address list lengths in cookie |
| MEDIUM | | 7 | | CVE-2026-53246 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing |
| MEDIUM | | 5.5 | | CVE-2026-53258 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: fix leak if split 6 GHz scanning fails |
| MEDIUM | | 5.5 | | CVE-2026-53281 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption |
| MEDIUM | | 5.5 | | CVE-2026-53285 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED |
| MEDIUM | | 5.5 | | CVE-2026-53292 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind |
| MEDIUM | | 5.5 | | CVE-2026-53297 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: mana: Guard mana_remove against double invocation |
| MEDIUM | | 5.5 | | CVE-2026-53321 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/napi: cap busy_poll_to 10 msec |
| MEDIUM | | 5.5 | | CVE-2026-53377 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: always recover the gpu |
| MEDIUM | | | | CVE-2026-53401 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: omap2: fix use-after-free in omapfb_mmap |
| MEDIUM | | | | CVE-2026-63805 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: crypto: nx - fix nx_crypto_ctx_exit argument |
| MEDIUM | | | | CVE-2026-63811 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: read COW data with the original inode during atomic write |
| MEDIUM | | | | CVE-2026-63819 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on f2fs_get_node_folio_ra() |
| MEDIUM | | 5.5 | | CVE-2026-63832 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: add wcid publish check in mt76_sta_add |
| MEDIUM | | 5.5 | | CVE-2026-63853 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring |
| MEDIUM | | | | CVE-2026-63857 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-63858 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: add hook transactions for device deletions |
| MEDIUM | | | | CVE-2026-63859 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue() |
| MEDIUM | | 7 | | CVE-2026-63941 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor |
| MEDIUM | | 7 | | CVE-2026-63979 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/handshake: hand off the pinned file reference to accept_doit |
| MEDIUM | | 5.5 | | CVE-2026-63998 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ethtool: module: call ethnl_ops_complete() on module flash errors |
| MEDIUM | | 5.5 | | CVE-2026-63999 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure |
| MEDIUM | | 5.5 | | CVE-2026-64006 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: fix dst corruption in same register operation |
| MEDIUM | | 7 | | CVE-2026-64024 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction |
| MEDIUM | | 5.5 | | CVE-2026-64036 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cgroup/rstat: validate cpu before css_rstat_cpu() access |
| MEDIUM | | 5.5 | | CVE-2026-64038 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Stop work before releasing hwmon device |
| MEDIUM | | 5.5 | | CVE-2026-64060 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix leak of request in netfs_write_begin() error handling |
| MEDIUM | | 7.1 | | CVE-2026-64066 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_read_to_pagecache() to pause on subreq failure |
| MEDIUM | | 5.5 | | CVE-2026-64067 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing barriers when accessing stream->subrequests locklessly |
| MEDIUM | | 7 | | CVE-2026-64068 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing locking around retry adding new subreqs |
| MEDIUM | | 5.5 | | CVE-2026-64076 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: bridge: eb_tables: close module init race |
| MEDIUM | | 5.5 | | CVE-2026-64077 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: ebtables: move to two-stage removal scheme |
| MEDIUM | | 7.1 | | CVE-2026-64078 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: add and use xtables_unregister_table_exit |
| MEDIUM | | 5.5 | | CVE-2026-64079 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: allocate hook ops while under mutex |
| MEDIUM | | 7 | | CVE-2026-64117 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb |
| MEDIUM | | 5.5 | | CVE-2026-64146 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix metabuf leak in inode xattr initialization |
| MEDIUM | | 5.5 | | CVE-2026-64154 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() |
| MEDIUM | | 5.5 | | CVE-2026-64159 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix zeropoint update where i_size > remote_i_size |
| MEDIUM | | 7 | | CVE-2026-64160 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point |
| MEDIUM | | 5.5 | | CVE-2026-64190 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: team: fix NULL pointer dereference in team_xmit during mode change |
| MEDIUM | | 5.5 | | CVE-2026-64212 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it |
| MEDIUM | | 5.5 | | CVE-2026-64213 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Add lock protection to lm90_alert |
| MEDIUM | | 7 | | CVE-2026-64255 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers |
| MEDIUM | | 7 | | CVE-2026-64520 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies |
| MEDIUM | | 7 | | CVE-2026-68086 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/khugepaged: write all dirty file folios when collapsing |
| MEDIUM | | 5.5 | | CVE-2026-68211 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: stm32-dcmipp: Return queued buffers on start_streaming() failure |
| MEDIUM | | 5.5 | | CVE-2026-68233 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/vc4: Shut down BO cache timer before teardown |
| MEDIUM | | 5.5 | | CVE-2026-68242 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/gt: Fix NULL deref on sched_engine alloc failure |
| MEDIUM | | 5.5 | | CVE-2026-68258 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size |
| MEDIUM | | 5.5 | | CVE-2026-68291 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: idpf driver null pointer dereference leads to Denial of Service |
| MEDIUM | | 5.5 | | CVE-2026-68295 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: BPF: Zero-extend signed ALU32 div/mod results |
| MEDIUM | | 5.5 | | CVE-2026-68312 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths |
| MEDIUM | | 7 | | CVE-2026-68323 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tipc: serialize udp bearer replicast list updates |
| MEDIUM | | 5.5 | | CVE-2026-68382 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Hold device ref until queue teardown completes |
| MEDIUM | | 5.5 | | CVE-2026-68383 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Keep scheduler timeline name alive |
| MEDIUM | | 7 | | CVE-2026-68393 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: extend conn_hash lookup critical sections |
| MEDIUM | | 6.4 | | CVE-2026-68399 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix UAF in sock clone early bailouts |
| MEDIUM | | 7 | | CVE-2026-68400 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation |
| MEDIUM | | 7 | | CVE-2026-68401 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() |
| MEDIUM | | 7 | | CVE-2026-68404 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect |
| MEDIUM | | 5.5 | | CVE-2026-68421 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() |
| MEDIUM | | 5.5 | | CVE-2026-68435 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Fix address space mismatch in kexec command line lookup |
| MEDIUM | | 5.5 | | CVE-2026-68441 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains |
| MEDIUM | | 5.5 | | CVE-2026-68447 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size |
| MEDIUM | | 7 | | CVE-2026-68448 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ovl: check access to copy_file_range source with src mounter creds |
| MEDIUM | | 7 | | CVE-2026-68453 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey |
| MEDIUM | | 5.5 | | CVE-2026-68471 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ieee80211: validate MLE common info length |
| MEDIUM | | 5.5 | | CVE-2026-72073 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mmc: vub300: fix use-after-free on probe failure |
| MEDIUM | | 5.5 | | CVE-2026-72162 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec |
| MEDIUM | | 7 | | CVE-2026-72288 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling |
| MEDIUM | | 7 | | CVE-2026-72329 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/liquidio: drop cached VF pci_dev LUT |
| MEDIUM | | 5.5 | | CVE-2026-72337 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: 6lowpan: avoid untracked enable work |
| MEDIUM | | 5.5 | | CVE-2026-72341 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Fix publication race for priv->channel_stats[] |
| MEDIUM | | 5.5 | | CVE-2026-72355 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix barriering when walking subrequest list |
| MEDIUM | | 5.5 | | CVE-2026-72365 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix writethrough to use collection offload |
| MEDIUM | | 5.5 | | CVE-2026-72367 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iomap: guard io_size EOF trim against concurrent truncate underflow |
| MEDIUM | | 5.5 | | CVE-2026-72375 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix reinitialisation of the inode, in particular ->lock_work |
| MEDIUM | | 5.5 | | CVE-2026-72380 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xen/pvcalls: bound backend response req_id before indexing rsp[] |
| MEDIUM | | 5.5 | | CVE-2026-72383 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: fix addr_wq_timer race in sctp_free_addr_wq() |
| MEDIUM | | 5.5 | | CVE-2026-72388 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock |
| MEDIUM | | 5.5 | | CVE-2026-72397 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() |
| MEDIUM | | 7 | | CVE-2026-72398 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: add INIT verification after cookie unpacking |
| MEDIUM | | 5.5 | | CVE-2026-72404 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() |
| MEDIUM | | 5.5 | | CVE-2026-72423 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Guard conntrack opts error writes |
| MEDIUM | | 5.5 | | CVE-2026-72440 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1: fix writes_pending and barrier reference leaks on write failures |
| MEDIUM | | 5.5 | | CVE-2026-72454 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() |
| MEDIUM | | 5.5 | | CVE-2026-72488 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soundwire: fix bug in sdw_add_element_group_count found by syzkaller |
| MEDIUM | | 5.5 | | CVE-2026-72493 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: serialize netif_running() check in enqueue_to_backlog() |
| MEDIUM | | 5.5 | | CVE-2026-72495 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages |
| MEDIUM | | 7 | | CVE-2026-72499 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free CQ toggle page after firmware teardown |
| MEDIUM | | 7 | | CVE-2026-72500 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown |
| MEDIUM | | | | CVE-2026-72501 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: R ... |
| MEDIUM | | 5.5 | | CVE-2026-74257 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sockmap: Fix use-after-free in udp_bpf_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-74264 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: watchdog: fix refcount tracking races |
| MEDIUM | | 5.5 | | CVE-2026-74272 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Resolve region deletion races |
| MEDIUM | | 5.5 | | CVE-2026-74273 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Block region delete during region creation |
| MEDIUM | | 5.5 | | CVE-2026-74314 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Cancel special fields on map value recycle |
| MEDIUM | | 5.5 | | CVE-2026-74317 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ixgbe: do not configure xps for XDP queues |
| MEDIUM | | 5.5 | | CVE-2026-74324 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: validate skb length in testmode query |
| MEDIUM | | 5.5 | | CVE-2026-74337 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks |
| MEDIUM | | 5.5 | | CVE-2026-74342 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: kernfs: link kn to its parent before the LSM init hook |
| MEDIUM | | 5.5 | | CVE-2026-74344 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear rb node linkage when freeing bpf_rb_root |
| MEDIUM | | 5.5 | | CVE-2026-74350 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate fast symlink target during inode read |
| MEDIUM | | 5.5 | | CVE-2026-74354 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Take mmap_lock in zap_pages() |
| MEDIUM | | 5.5 | | CVE-2026-74368 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() |
| MEDIUM | | 6.5 | | CVE-2026-74385 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock |
| MEDIUM | | 5.5 | | CVE-2026-74388 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data |
| MEDIUM | | 7 | | CVE-2026-74405 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: OPP: Fix race between OPP addition and lookup |
| MEDIUM | | 5.5 | | CVE-2026-74407 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath11k: cancel SSR work items during PCI shutdown |
| MEDIUM | | 5.5 | | CVE-2026-74449 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport |
| MEDIUM | | 5.5 | | CVE-2026-74466 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Close speculative mem read possibility |
| MEDIUM | | 7 | | CVE-2026-74506 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix UAF when sending a message |
| MEDIUM | | 7 | | CVE-2026-74513 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister |
| MEDIUM | | 5.5 | | CVE-2026-74527 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-af: Block VFs from clobbering special CGX PKIND state |
| MEDIUM | | 5.5 | | CVE-2026-74529 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback |
| MEDIUM | | 5.5 | | CVE-2026-74530 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback |
| MEDIUM | | 7 | | CVE-2026-74533 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero |
| MEDIUM | | 7 | | CVE-2026-74537 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: hold sk properly in iso_conn_ready |
| MEDIUM | | 5.5 | | CVE-2026-74538 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: lock sk in iso_connect_ind |
| MEDIUM | | 5.5 | | CVE-2026-74542 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix folio_queue ENOMEM in writeback by adding a mempool |
| MEDIUM | | 5.5 | | CVE-2026-74544 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds |
| MEDIUM | | 5.5 | | CVE-2026-74600 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/page_table_check: skip special zero mappings |
| MEDIUM | | 5.5 | | CVE-2026-74605 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: eventfs: Use children field for rcu head and add memory barriers |
| MEDIUM | | 7 | | CVE-2026-74611 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tls: rx: restore msg_iter before TLS 1.3 optimistic retry |
| MEDIUM | | 5.5 | | CVE-2026-74638 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Serialize the scheduler timeout handlers |
| MEDIUM | | 5.5 | | CVE-2026-74687 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: watchdog: at91sam9_wdt: prevent timer rearm during teardown |
| MEDIUM | | 7 | | CVE-2026-74695 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() |
| MEDIUM | | 7 | | CVE-2026-74697 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Disable EOP for TPA on all chips to prevent data corruption |
| MEDIUM | | 5.5 | | CVE-2026-74711 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus) Fix type confusion in notification logic |
| MEDIUM | | 5.5 | | CVE-2026-74713 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vhost_iotlb: bound map allocation in add_range |
| MEDIUM | | 7 | | CVE-2026-74715 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix netns reference imbalance in conntrack kfuncs |
| MEDIUM | | 5.5 | | CVE-2026-74723 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject inline extents without valid headers |
| MEDIUM | | 5.5 | | CVE-2026-74729 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read |
| MEDIUM | | 5.5 | | CVE-2026-74747 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipvs: revalidate ihl to prevent out-of-bounds access |
| MEDIUM | | 5.5 | | CVE-2026-80579 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: clear fb_info->mode before deleting a videomode |
| MEDIUM | | 5.5 | | CVE-2026-80580 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: bound mode sysfs output to the sysfs buffer |
| MEDIUM | | 5.5 | | CVE-2026-80614 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: emac: Fix NULL pointer dereference in emac_probe |
| MEDIUM | | 5.5 | | CVE-2026-80623 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: ete: Always save state on power down |
| MEDIUM | | 5.5 | | CVE-2026-80628 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Serialize readq reset state with q->lock |
| MEDIUM | | 5.5 | | CVE-2026-80631 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject compressed segment that overflows the compressed input |
| MEDIUM | | 5.5 | | CVE-2026-80634 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag |
| MEDIUM | | 5.5 | | CVE-2026-80655 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soc: xilinx: Fix race condition in event registration |
| MEDIUM | | 5.5 | | CVE-2026-80662 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size |
| MEDIUM | | 7 | | CVE-2026-80668 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations |
| MEDIUM | | 5.5 | | CVE-2026-80670 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() |
| MEDIUM | | 5.5 | | CVE-2026-80692 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks |
| MEDIUM | | 7 | | CVE-2026-80693 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: idpf: bound interrupt-vector register fill to the allocated array |
| MEDIUM | | 5.5 | | CVE-2026-80698 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: idxd: fix double free of wq, engine, and group structs |
| MEDIUM | | 5.5 | | CVE-2026-80721 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: ensure no dangling hcon references in iso_conn |
| MEDIUM | | | | CVE-2026-80761 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| MEDIUM | | 5.5 | | CVE-2026-80905 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: tap: fix wrong transport_header when sending VLAN-tagged frame |
| MEDIUM | | 5.5 | | CVE-2026-80920 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring: defer eventfd signaling when queued from a wakeup handler |
| MEDIUM | | 5.5 | | CVE-2026-81010 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/waitid: honor task_work cancellation |
| MEDIUM | | 7 | | CVE-2026-89528 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Reject Read lists that exceed the page budget |
| MEDIUM | | 4.8 | | CVE-2026-89534 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| MEDIUM | | 7 | | CVE-2026-89537 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 |
| MEDIUM | | 7.2 | | CVE-2026-89610 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs: verify run length exceeding volume boundary |
| MEDIUM | | 5.5 | | CVE-2026-89611 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs: validate non-resident attribute offsets |
| MEDIUM | | 7.1 | | CVE-2026-89632 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() |
| MEDIUM | | 7 | | CVE-2026-89637 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 |
| MEDIUM | | 5.5 | | CVE-2026-89639 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC |
| MEDIUM | | 3.3 | | CVE-2026-89642 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cifs: call pagecache_isize_extended() in cifs_setsize() when extending |
| MEDIUM | | 6.2 | | CVE-2026-89648 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ceph: cap delegated inode count in ceph_parse_deleg_inos() |
| MEDIUM | | 7 | | CVE-2026-89654 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix UAF in check_new_map() on session freed during unlock |
| MEDIUM | | 5.3 | | CVE-2026-89682 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net |
| MEDIUM | | 5.3 | | CVE-2026-89705 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths |
| MEDIUM | | 5.9 | | CVE-2026-89709 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: lockd, nfsd: RCU-protect nlmsvc_ops dispatch |
| MEDIUM | | 5.5 | | CVE-2026-89722 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() |
| MEDIUM | | 5.5 | | CVE-2026-89757 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/mglru: fix and remove redundant unevictable folio handling |
| MEDIUM | | 4.7 | | CVE-2026-89810 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix error path at svm_migrate_copy_to_ram |
| MEDIUM | | | | CVE-2026-89826 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| MEDIUM | | | | CVE-2026-89833 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| MEDIUM | | | | CVE-2026-89866 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| MEDIUM | | | | CVE-2026-89906 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| MEDIUM | | 4.7 | | CVE-2026-89913 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables |
| MEDIUM | | 4.7 | | CVE-2026-89920 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Fix memory corruption by not reinjecting CK machine checks |
| MEDIUM | | | | CVE-2026-89935 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 3.6 | | CVE-2026-89987 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/huge_memory: transfer the pmd dirty bit to the folio on zap |
| MEDIUM | | 5.5 | | CVE-2026-90040 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped |
| MEDIUM | | 5.5 | | CVE-2026-90061 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: skip double clone set expressions on element insert |
| MEDIUM | | 5.5 | | CVE-2026-90083 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: act_ife: Only operate on Ethernet frames |
| MEDIUM | | 5.5 | | CVE-2026-90087 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: do not leak an hci_conn when a second LE connect is rejected |
| MEDIUM | | 7 | | CVE-2026-90093 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: access chan->conn safely in get/setsockopt |
| MEDIUM | | 5.5 | | CVE-2026-90098 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: fix sleep in atomic context in MAC table access |
| MEDIUM | | 7 | | CVE-2026-90099 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: account classifier filter allocations to memcg |
| MEDIUM | | 7 | | CVE-2026-90104 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFSv4.1: zero referring call lists before decoding |
| MEDIUM | | 5.5 | | CVE-2026-90105 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vxlan: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90106 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: arp/nd proxy: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90116 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: mtpav: shut down output timer before card teardown |
| MEDIUM | | 5.5 | | CVE-2026-90142 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix resize of the RX ring |
| MEDIUM | | 5.5 | | CVE-2026-90149 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers |
| MEDIUM | | 5.5 | | CVE-2026-90154 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: scope session state changes to bound connections |
| MEDIUM | | 5.5 | | CVE-2026-90155 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: detach blocked lock requests before freeing |
| MEDIUM | | 5.5 | | CVE-2026-90156 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely discard unregistered deferred locks |
| MEDIUM | | 7 | | CVE-2026-90161 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix interlaced ztailpacking pclusters |
| MEDIUM | | 5.5 | | CVE-2026-90162 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: defer publishing granted locks to prevent UAF/double-free race |
| MEDIUM | | 5.5 | | CVE-2026-90167 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: serialize oplock close with pending break ownership |
| MEDIUM | | 5.5 | | CVE-2026-90174 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() |
| MEDIUM | | 5.5 | | CVE-2026-90177 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check pointer type for all atomic RMW paths |
| MEDIUM | | 5.5 | | CVE-2026-90179 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix deadlock in complain-mode change_hat |
| MEDIUM | | 5.5 | | CVE-2026-90204 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate DIO orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90205 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90208 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type |
| MEDIUM | | 5.5 | | CVE-2026-90217 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Compare iterator types during state pruning |
| MEDIUM | | 5.5 | | CVE-2026-90231 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix unconfined user namespace restriction forced stack |
| MEDIUM | | 5.5 | | CVE-2026-90232 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: amt: Don't support cross-netns setup |
| MEDIUM | | 5.1 | | CVE-2026-90234 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFS: Return a delegation the client fails to record |
| MEDIUM | | 7 | | CVE-2026-90237 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nft_ct: move custom expectation support to helper |
| MEDIUM | | 7 | | CVE-2026-90240 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Flush context cache with correct SID when tearing down aliases |
| MEDIUM | | 5.5 | | CVE-2026-90247 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix mmap_lock leak in irq_work path |
| MEDIUM | | 5.9 | | CVE-2026-90256 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind |
| MEDIUM | | 5.5 | | CVE-2026-90259 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() |
| MEDIUM | | 4.7 | | CVE-2026-90260 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: don't clobber the extent buffer when zeroing it out |
| MEDIUM | | 3.3 | | CVE-2026-90263 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: check if root is readonly when setting posix acl |
| MEDIUM | | 5.5 | | CVE-2026-90264 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: always wait for ordered extents to avoid OE races |
| MEDIUM | | 5.5 | | CVE-2026-90265 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: defrag: fix deadlock between defrag and delalloc space reservation |
| MEDIUM | | 5.5 | | CVE-2026-90273 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable |
| MEDIUM | | 5.5 | | CVE-2026-90289 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Resize MST HDCP per-connector arrays to 32 |
| MEDIUM | | 5.5 | | CVE-2026-90300 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear buf on error in __bpf_get_task_stack |
| MEDIUM | | 5.5 | | CVE-2026-90301 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: o2hb: quiesce negotiate handlers and timeout work |
| MEDIUM | | 7 | | CVE-2026-90317 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Invalidate RCU pointers after final spin unlock |
| MEDIUM | | 5.5 | | CVE-2026-90320 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate external xattr entries when reading metadata |
| MEDIUM | | 5.5 | | CVE-2026-90321 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate inline xattrs during inode block validation |
| MEDIUM | | 5.5 | | CVE-2026-90324 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ublk: check import_ubuf() return value |
| MEDIUM | | 4.7 | | CVE-2026-90326 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-cgroup: fix race between policy activation and blkg destruction |
| MEDIUM | | 5.5 | | CVE-2026-90328 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: HID: steam: Reject short reads |
| MEDIUM | | 6.4 | | CVE-2026-90333 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dm-integrity: replace forgeable discard filler with a keyed sector marker |
| MEDIUM | | 4.1 | | CVE-2026-90336 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: clear freed pointers on uart_register_driver() failure |
| MEDIUM | | 5.5 | | CVE-2026-90337 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: do fallible allocations before the console can be registered |
| MEDIUM | | 7 | | CVE-2026-90343 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: stop PMSR before P2P and NAN teardown |
| MEDIUM | | 5.5 | | CVE-2026-90345 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: brcmfmac: fix P2P action frame handling without device vif |
| MEDIUM | | 7 | | CVE-2026-90347 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry |
| MEDIUM | | 5.5 | | CVE-2026-90351 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed |
| MEDIUM | | 4.4 | | CVE-2026-90359 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject >8 byte return values on return-reading trampoline paths |
| MEDIUM | | 5.5 | | CVE-2026-90363 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: don't tear down KMS twice when KMS init fails |
| MEDIUM | | 5.5 | | CVE-2026-90365 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: cancel reset and rc work on device unregister |
| MEDIUM | | 5.5 | | CVE-2026-90367 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER |
| MEDIUM | | 4.8 | | CVE-2026-90379 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash |
| MEDIUM | | 3.3 | | CVE-2026-90401 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md: remove REQ_NOWAIT support from raid1/10/456 |
| MEDIUM | | 5.5 | | CVE-2026-90408 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() |
| MEDIUM | | 5.5 | | CVE-2026-90409 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Add vm_bind region with kbo range overlap check |
| MEDIUM | | 4.7 | | CVE-2026-90417 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() |
| MEDIUM | | 5.5 | | CVE-2026-90421 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI: Fix UAF when probe runs concurrent to dyn ID removal |
| MEDIUM | | 5.5 | | CVE-2026-90422 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path |
| MEDIUM | | 4.7 | | CVE-2026-90427 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() |
| MEDIUM | | 5.5 | | CVE-2026-92480 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Validate string descriptors |
| MEDIUM | | 5.5 | | CVE-2026-92482 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip |
| MEDIUM | | 3.3 | | CVE-2026-92485 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix WARNING in bpf_tracing_link_release |
| MEDIUM | | 5.5 | | CVE-2026-92499 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext4: validate readdir offset before accessing dirent |
| MEDIUM | | 4.7 | | CVE-2026-92500 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext4: use fsdata to track inline data write state and fix race |
| MEDIUM | | 5.5 | | CVE-2026-92503 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() |
| MEDIUM | | 5.5 | | CVE-2026-92518 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv, bpf: Fix kernel stack corruption in tailcall with CFI |
| MEDIUM | | 5.5 | | CVE-2026-92520 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Zero queue and stack outputs on lock failure |
| MEDIUM | | 5.5 | | CVE-2026-93044 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for arena-related insns |
| MEDIUM | | 5.5 | | CVE-2026-93047 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Associate BOs with every job that accesses them |
| MEDIUM | | 5.5 | | CVE-2026-93058 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Only fini scheduler after successful init |
| MEDIUM | | 5.5 | | CVE-2026-93081 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_scmi: Fix SCMI device destroy lifetimes |
| MEDIUM | | 4.7 | | CVE-2026-93099 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Fix UAF from worker threads when domains are removed |
| MEDIUM | | 4.7 | | CVE-2026-93100 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() |
| MEDIUM | | 4.7 | | CVE-2026-93104 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rvt: Return NULL after port allocation failure |
| MEDIUM | | 7 | | CVE-2026-93105 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: esp: do not unref managed frag pages in esp_ssg_unref() |
| MEDIUM | | 5.5 | | CVE-2026-93122 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: usb: gadget: uac: validate rate list length before storing |
| MEDIUM | | 5.5 | | CVE-2026-93135 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject programs with inlined helpers if JIT is not available |
| MEDIUM | | 7 | | CVE-2026-93148 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject MEM_ALLOC BTF accesses past object bounds |
| MEDIUM | | 7 | | CVE-2026-93154 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Add refcounting to user ring MRs |
| MEDIUM | | 5.5 | | CVE-2026-93168 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout |
| MEDIUM | | 5.5 | | CVE-2026-93175 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in CRTC reset function |
| MEDIUM | | 4.7 | | CVE-2026-93176 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in plane reset function |
| MEDIUM | | 5.5 | | CVE-2026-93270 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn |
| MEDIUM | | 5.5 | | CVE-2026-93272 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 |
| MEDIUM | | 5.5 | | CVE-2026-93276 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator |
| MEDIUM | | 5.5 | | CVE-2026-93282 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix maximum allowed access checks |
| MEDIUM | | 7.1 | | CVE-2026-97422 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: fix SMI event cross-process information leak |
| MEDIUM | | 5.5 | | CVE-2026-97432 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: fix P2P-Device binding handling |
| MEDIUM | | 5.5 | | CVE-2026-97478 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virt: acrn: Fix irqfd use-after-free during eventfd shutdown |
| MEDIUM | | 7.1 | | CVE-2026-97493 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS |
| MEDIUM | | 5.5 | | CVE-2026-97499 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: perf: Retrieve path and source from event data |
| MEDIUM | | 5.5 | | CVE-2026-97513 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Release m2m_ctx after Instance Removed from List |
| MEDIUM | | 5.5 | | CVE-2026-97515 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 |
| MEDIUM | | 5.5 | | CVE-2026-97526 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/pai: Support CPU hotplug for PMU PAI |
| MEDIUM | | 5.5 | | CVE-2026-97538 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (asus_rog_ryujin) Validate HID report lengths |
| MEDIUM | | 5.5 | | CVE-2026-97554 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() |
| MEDIUM | | 7 | | CVE-2026-97561 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid |
| MEDIUM | | 7 | | CVE-2026-97563 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97565 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject short READ responses in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97960 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel: Prevent drain_pebs() reentry |
| MEDIUM | | 5.5 | | CVE-2026-97962 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Move representor vnic reporter to eswitch devlink port |
| MEDIUM | | 5.1 | | CVE-2026-97975 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() |
| MEDIUM | | 4.7 | | CVE-2026-97988 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vhost: invalidate vring access on IOTLB transitions |
| MEDIUM | | 5.5 | | CVE-2026-98019 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: mark a NULL call argument precise |
| MEDIUM | | 5.3 | | CVE-2026-98032 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tracing: Fix subbuf resize races with trace_pipe_raw readers |
| MEDIUM | | 7 | | CVE-2026-98033 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Preserve inner map identity in callback frames |
| MEDIUM | | 7 | | CVE-2026-98034 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark NULL kptr stores precise |
| MEDIUM | | 5.5 | | CVE-2026-98043 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Don't infer non-NULL from a pointer with an unbounded offset |
| MEDIUM | | 7 | | CVE-2026-98047 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check ancestor frames for rbtree callbacks |
| MEDIUM | | 7 | | CVE-2026-98048 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: don't rewrite bpf_fastcall patterns entered by a jump |
| MEDIUM | | 5.5 | | CVE-2026-98049 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: zero extend the result of an arena 32-bit cmpxchg |
| MEDIUM | | 5.5 | | CVE-2026-98053 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Refactor and fix init_config access |
| MEDIUM | | 5.5 | | CVE-2026-98062 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark signal tracepoint siginfo arguments as scalar |
| MEDIUM | | 5.5 | | CVE-2026-98085 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge |
| MEDIUM | | | | CVE-2026-98099 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 5.5 | | CVE-2026-98115 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely drain sessions during logoff |
| MEDIUM | | 5.5 | | CVE-2026-98118 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix readahead synchronisation issues by loading all folios upfront |
| MEDIUM | | 5.5 | | CVE-2026-98124 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/client: invalidate fscache for fallocate range operations |
| MEDIUM | | 5.5 | | CVE-2026-98125 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix stale page cache in insert/collapse range |
| MEDIUM | | 5.5 | | CVE-2026-98131 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix dma mapping leak in stmmac_tso_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-98134 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: check_cond_jmp_op(): properly infer if register is null |
| MEDIUM | | 5.3 | | CVE-2026-98156 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/virtio: use the DMA API for resource backing on Xen |
| MEDIUM | | 5.5 | | CVE-2026-98162 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/server: fix tree connection leak in smb2_tree_connect() |
| MEDIUM | | 5.5 | | CVE-2026-98180 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: RCU-free the scheduler-containing ring and VM objects |
| MEDIUM | | 5.5 | | CVE-2026-98228 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ |
| MEDIUM | | 4.4 | | CVE-2026-98273 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: x86/kprobes: Fix crash when probing CS CALL instructions |
| MEDIUM | | 5.5 | | CVE-2026-98277 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: ring the doorbell if a burst ends in a drop |
| MEDIUM | | 5.5 | | CVE-2026-98279 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: handle lack of space when cleaning up verity items |
| MEDIUM | | 5.3 | | CVE-2026-98284 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netlink: do not free nlk->groups while lockless readers can use it |
| MEDIUM | | 4.1 | | CVE-2026-98286 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown |
| MEDIUM | | 5.5 | | CVE-2026-98288 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix TSO header length truncation |
| MEDIUM | | 5.5 | | CVE-2026-98292 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| MEDIUM | | 5.5 | | CVE-2026-98294 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_qca: Do not write to the serial port after it is closed |
| MEDIUM | | 7 | | CVE-2026-98296 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btintel_pcie: validate TX skb length in send_sync |
| MEDIUM | | 5.5 | | CVE-2026-98313 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/dp: skip PUSH_IDLE when the link was never enabled |
| MEDIUM | | 7 | | CVE-2026-98330 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: get the wiphy out of a dying network namespace |
| MEDIUM | | 5.5 | | CVE-2026-98333 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: reset the LED state when ifup fails |
| MEDIUM | | 7 | | CVE-2026-98341 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: don't free driver-owned scan requests |
| MEDIUM | | 5.5 | | CVE-2026-98353 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables |
| MEDIUM | | 5.5 | | CVE-2026-98355 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rtrs: guard against null kobj name |
| MEDIUM | | 5.5 | | CVE-2026-98376 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Use array_map_meta_equal for percpu array inner map replacement |
| MEDIUM | | 5.5 | | CVE-2026-98408 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: watchdog: rzv2h: Avoid division by zero |
| MEDIUM | | 5.5 | | CVE-2026-98420 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: follow SMB2 session expiration semantics |
| MEDIUM | | | | CVE-2026-98436 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: a ... |
| MEDIUM | | 6.5 | | CVE-2026-98439 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/server: cancel async requests when closing connection |
| MEDIUM | | 4.7 | | CVE-2026-98444 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: drop dquot flush lock when we can't find a buffer to flush |
| MEDIUM | | 6.5 | | CVE-2026-98449 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: delete compound mids on send failure before unlock |
| MEDIUM | | 5.3 | | CVE-2026-98471 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Do cache maintenance on the source VM during intra-host migration |
| MEDIUM | | 5.5 | | CVE-2026-98556 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gve: DQO: reject TSO packets with an out of range MSS |
| MEDIUM | | 4.1 | | CVE-2026-98558 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: flush skb_defer_nodes in dev_cpu_dead() |
| MEDIUM | | 5.9 | | CVE-2026-98570 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: ipv6: keep room for the mac header in dst_dev_overhead() |
| MEDIUM | | 6.7 | | CVE-2026-98589 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject pkt arguments in mutating subprogs |
| MEDIUM | | 4.7 | | CVE-2026-98598 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv6: Prevent rt6_insert_exception() for dying fib6_info |
| MEDIUM | | 6.7 | | CVE-2026-98599 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() |
| MEDIUM | | 4.1 | | CVE-2026-98616 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: reset num_napi when the napi vectors are freed |
| MEDIUM | | 5.5 | | CVE-2026-98652 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Add missing srcu in kvm_s390_set_irq_state() |
| MEDIUM | | 5.5 | | CVE-2026-98674 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iio: adc: adi-axi-adc: Initialize state mutex |
| MEDIUM | | 5.6 | | CVE-2026-98714 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| MEDIUM | | 4.1 | | CVE-2026-98740 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety |
| MEDIUM | | 4.4 | | CVE-2026-98747 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix NULL pointer dereference in serial_core_unregister_port() |
| MEDIUM | | 4.7 | | CVE-2026-98786 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: guard dc_sink dereferences in MST mode validation |
| MEDIUM | | 4.4 | | CVE-2026-98789 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix objects stuck in free_by_rcu_ttrace |
| MEDIUM | | 4.4 | | CVE-2026-98795 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: skip ptp deinit if init was skipped |
| MEDIUM | | 4.4 | | CVE-2026-98799 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Skip detached progs in trampoline images that are still in use |
| MEDIUM | | 4.7 | | CVE-2026-98800 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: kernel: Denial of Service via use-after-free in BPF trampoline |
| MEDIUM | | 6.5 | | CVE-2026-98803 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix rx Scatter-Gather support |
| MEDIUM | | 6.1 | | CVE-2026-98810 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() |
| MEDIUM | | 4.4 | | CVE-2026-98813 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Hold map BTF for the memory allocator destructor record |
| MEDIUM | | 4.4 | | CVE-2026-98814 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix command effects log lifetime for multipath heads |
| MEDIUM | | 4.1 | | CVE-2026-98815 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix cdev lifetime |
| MEDIUM | | 4.1 | | CVE-2026-98816 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix overflow of jump offset in constant blinding |
| MEDIUM | | 5.5 | | CVE-2026-98820 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: set RQF_USE_SCHED when the operation is known |
| MEDIUM | | 5.3 | | CVE-2026-98824 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate TX status rate metadata |
| MEDIUM | | 6.5 | | CVE-2026-98829 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: drop oversized fragments to avoid extra_len overflow |
| MEDIUM | | 4.1 | | CVE-2026-98834 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mtd: core: avoid double-free of OTP NVMEM device |
| MEDIUM | | 6.1 | | CVE-2026-98839 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() |
| MEDIUM | | 4.4 | | CVE-2026-98843 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: zero gaps in read-gaps folio to avoid writing back stale data |
| MEDIUM | | 5.6 | | CVE-2026-98863 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| MEDIUM | | 4.6 | | CVE-2019-15213 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: use-after-free caused by malicious USB device in drivers/media/usb/dvb-usb/dvb-usb-init.c |
| MEDIUM | | 4.1 | | CVE-2019-16089 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Improper return check in nbd_genl_status function in drivers/block/nbd.c |
| MEDIUM | | 4.7 | | CVE-2019-20794 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: task processes not being properly ended could lead to resource exhaustion |
| MEDIUM | | 4.4 | | CVE-2020-14304 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ethtool when reading eeprom of device could lead to memory leak |
| MEDIUM | | 6.7 | | CVE-2020-36694 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: use-after-free in the packet processing context |
| MEDIUM | | 5.5 | | CVE-2023-31082 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sleeping function called from an invalid context in gsmld_write |
| MEDIUM | | 7 | | CVE-2023-3397 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: slab-use-after-free Write in txEnd due to race condition |
| MEDIUM | | 5.5 | | CVE-2023-37454 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: udf: use-after-free write in udf_close_lvid |
| MEDIUM | | 6.7 | | CVE-2023-6238 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvme: memory corruption via unprivileged user passthrough |
| MEDIUM | | 6.5 | | CVE-2023-6240 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation |
| MEDIUM | | 5.5 | | CVE-2024-2193 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | hw: Spectre-SRC that is Speculative Race Conditions (SRCs) for synchronization primitives similar like Spectre V1 with p |
| MEDIUM | | 4.7 | | CVE-2024-24864 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | A race condition was found in the Linux kernel's media/dvb-core in dvb ... |
| MEDIUM | | 5.5 | | CVE-2024-25740 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory leak in ubi driver |
| MEDIUM | | 5.5 | | CVE-2024-56709 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring: check if iowq is killed before queuing |
| MEDIUM | | 5.5 | | CVE-2024-58074 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/i915: Grab intel_display from the encoder to avoid potential oopsies |
| MEDIUM | | 5.5 | | CVE-2025-21752 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents |
| MEDIUM | | 5.5 | | CVE-2025-21949 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Set hugetlb mmap base address aligned with pmd size |
| MEDIUM | | 5.5 | | CVE-2025-22109 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ax25: Remove broken autobind |
| MEDIUM | | 5.5 | | CVE-2025-23132 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: quota: fix to avoid warning in dquot_writeback_dquots() |
| MEDIUM | | 5.5 | | CVE-2025-23135 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Teardown riscv specific bits after kvm_exit |
| MEDIUM | | 5.5 | | CVE-2025-37743 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Avoid memory leak while enabling statistics |
| MEDIUM | | 5.5 | | CVE-2025-37746 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/dwc_pcie: fix duplicate pci_dev devices |
| MEDIUM | | 5.5 | | CVE-2025-37880 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: um: work around sched_yield not yielding in time-travel mode |
| MEDIUM | | 4.7 | | CVE-2025-37906 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: ublk race condition causes kernel crash |
| MEDIUM | | 5.5 | | CVE-2025-38029 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to sleepable page allocation in KASAN |
| MEDIUM | | 5.5 | | CVE-2025-38036 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to null pointer dereference in GT MMIO initialization for VFs |
| MEDIUM | | 5.5 | | CVE-2025-38041 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clk: sunxi-ng: h616: Reparent GPU clock during frequency changes |
| MEDIUM | | 5.5 | | CVE-2025-38042 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn |
| MEDIUM | | 6.7 | | CVE-2025-38064 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio: break and reset virtio devices on device_shutdown() |
| MEDIUM | | 5.5 | | CVE-2025-38132 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: holding cscfg_csdev_lock while removing cscfg from csdev |
| MEDIUM | | 5.5 | | CVE-2025-38140 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Local denial of service in device mapper |
| MEDIUM | | 5.5 | | CVE-2025-38199 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix memory leak due to multiple rx_stats allocation |
| MEDIUM | | 5.5 | | CVE-2025-38207 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm: fix uprobe pte be overwritten when expanding vma |
| MEDIUM | | 5.5 | | CVE-2025-38261 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv: save the SR_SUM status over switches |
| MEDIUM | | 5.5 | | CVE-2025-38284 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: configure manual DAC mode via PCI config API only |
| MEDIUM | | 5.5 | | CVE-2025-38311 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel (iavf): Denial of Service due to a locking issue |
| MEDIUM | | 5.5 | | CVE-2025-38359 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Fix in_atomic() handling in do_secure_storage_access() |
| MEDIUM | | 5.5 | | CVE-2025-38597 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port |
| MEDIUM | | 5.5 | | CVE-2025-38605 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() |
| MEDIUM | | 5.5 | | CVE-2025-39677 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Fix backlog accounting in qdisc_dequeue_internal |
| MEDIUM | | 5.5 | | CVE-2025-39762 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: add null check |
| MEDIUM | | 5.5 | | CVE-2025-39775 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: mremap local denial of service |
| MEDIUM | | 5.5 | | CVE-2025-39789 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: crypto: x86/aegis - Add missing error checks |
| MEDIUM | | 6.1 | | CVE-2025-39822 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/kbuf: fix signedness in this_len calculation |
| MEDIUM | | 5.5 | | CVE-2025-39830 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path |
| MEDIUM | | 5.5 | | CVE-2025-39834 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow |
| MEDIUM | | 6.2 | | CVE-2025-39910 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() |
| MEDIUM | | 7.1 | | CVE-2025-39933 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length |
| MEDIUM | | 2.5 | | CVE-2025-40113 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E |
| MEDIUM | | 6.8 | | CVE-2025-40130 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling |
| MEDIUM | | 6.2 | | CVE-2025-40146 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: fix potential deadlock while nr_requests grown |
| MEDIUM | | 5.2 | | CVE-2025-40217 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pidfs: validate extensible ioctls |
| MEDIUM | | | | CVE-2025-40247 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Fix pgtable prealloc error path |
| MEDIUM | | 5.2 | | CVE-2025-40338 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Do not share the name pointer between components |
| MEDIUM | | 6.1 | | CVE-2025-40355 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sysfs: check visibility before changing group attribute ownership |
| MEDIUM | | 5.5 | | CVE-2025-68209 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mlx5: Fix default values in create CQ |
| MEDIUM | | 5.5 | | CVE-2025-68236 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service during UFS power down |
| MEDIUM | | 5.5 | | CVE-2025-68304 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_core: lookup hci_conn on RX path on protocol side |
| MEDIUM | | | | CVE-2025-68318 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL |
| MEDIUM | | 6.1 | | CVE-2025-68319 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netconsole: Acquire su_mutex before navigating configs hierarchy |
| MEDIUM | | 5.5 | | CVE-2025-68353 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service via NULL pointer dereference in VXLAN module |
| MEDIUM | | 4.5 | | CVE-2025-68360 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks |
| MEDIUM | | 5.5 | | CVE-2025-68368 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service in md driver via uninitialized bioset |
| MEDIUM | | 6.5 | | CVE-2025-68729 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix MSDU buffer types handling in RX error path |
| MEDIUM | | 5.5 | | CVE-2025-68730 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() |
| MEDIUM | | 4.7 | | CVE-2025-68745 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset |
| MEDIUM | | 7.8 | | CVE-2025-71074 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel functionfs: Use-After-Free vulnerability due to open/removal races |
| MEDIUM | | 5.5 | | CVE-2025-71117 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service via deadlock in block layer sysfs store callbacks |
| MEDIUM | | 5.5 | | CVE-2025-71141 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/tilcdc: Fix removal actions in case of failed probe |
| MEDIUM | | 5.5 | | CVE-2025-71188 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: lpc18xx-dmamux: fix device leak on route allocation |
| MEDIUM | | 6.5 | | CVE-2025-71202 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Memory Corruption and Kernel Crashes via IOMMU SVA coherency issue |
| MEDIUM | | 5.5 | | CVE-2025-71227 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: don't WARN for connections on invalid channels |
| MEDIUM | | 5.5 | | CVE-2025-71285 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels |
| MEDIUM | | 5.5 | | CVE-2025-71302 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: fix for dma-fence safe access rules |
| MEDIUM | | 7 | | CVE-2025-71313 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI: endpoint: Add missing NULL check for alloc_workqueue() |
| MEDIUM | | 5.5 | | CVE-2025-71315 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/vkms: Convert to DRM's vblank timer |
| MEDIUM | | 5.5 | | CVE-2026-100074 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| MEDIUM | | 5.5 | | CVE-2026-100076 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths |
| MEDIUM | | 5.5 | | CVE-2026-100077 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Recover HW before retire hung submit |
| MEDIUM | | 5.5 | | CVE-2026-23007 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: block: zero non-PI portion of auto integrity buffer |
| MEDIUM | | 5.5 | | CVE-2026-23017 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: idpf: fix error handling in the init_task on load |
| MEDIUM | | 5.5 | | CVE-2026-23143 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix misalignment bug in struct virtnet_info |
| MEDIUM | | 7.1 | | CVE-2026-23152 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: correctly decode TTLM with default link map |
| MEDIUM | | 5.5 | | CVE-2026-23217 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv: trace: fix snapshot deadlock with sbi ecall |
| MEDIUM | | 5.5 | | CVE-2026-23259 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/rw: free potentially allocated iovec on cache put failure |
| MEDIUM | | 5.5 | | CVE-2026-23265 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer in {read,write}_end_io |
| MEDIUM | | 5.5 | | CVE-2026-23348 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix race of nvdimm_bus object when creating nvdimm objects |
| MEDIUM | | 5.5 | | CVE-2026-23371 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting |
| MEDIUM | | 5.5 | | CVE-2026-23377 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz |
| MEDIUM | | 5.5 | | CVE-2026-23385 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: clone set on flush only |
| MEDIUM | | 5.5 | | CVE-2026-23472 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN |
| MEDIUM | | 5.5 | | CVE-2026-31435 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix read abandonment during retry |
| MEDIUM | | 5.5 | | CVE-2026-31526 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix exception exit lock checking for subprogs |
| MEDIUM | | 5.5 | | CVE-2026-31537 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: server: make use of smbdirect_socket.send_io.bcredits |
| MEDIUM | | 5.5 | | CVE-2026-31562 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register |
| MEDIUM | | 5.5 | | CVE-2026-31579 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit |
| MEDIUM | | 5.5 | | CVE-2026-31591 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish |
| MEDIUM | | 5.5 | | CVE-2026-31592 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock |
| MEDIUM | | 5.5 | | CVE-2026-31630 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rxrpc: proc: size address buffers for %pISpc output |
| MEDIUM | | 7.1 | | CVE-2026-31692 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns |
| MEDIUM | | 5.5 | | CVE-2026-31771 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_event: move wake reason storage into validated event handlers |
| MEDIUM | | 5.5 | | CVE-2026-31777 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: ctxfi: Check the error for index mapping |
| MEDIUM | | 5.5 | | CVE-2026-43009 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix incorrect pruning due to atomic fetch precision tracking |
| MEDIUM | | 5.5 | | CVE-2026-43022 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists |
| MEDIUM | | 5.5 | | CVE-2026-43029 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mptcp: fix soft lockup in mptcp_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-43034 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: set backing store type from query type |
| MEDIUM | | 7.1 | | CVE-2026-43042 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mpls: add seqcount to protect the platform_label{,s} pair |
| MEDIUM | | 5.5 | | CVE-2026-43048 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: HID: core: Mitigate potential OOB by removing bogus memset() |
| MEDIUM | | 5.5 | | CVE-2026-43053 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: close crash window in attr dabtree inactivation |
| MEDIUM | | 5.5 | | CVE-2026-43083 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: ioam6: fix OOB and missing lock |
| MEDIUM | | 5.5 | | CVE-2026-43101 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() |
| MEDIUM | | 5.5 | | CVE-2026-43115 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: srcu: Use irq_work to start GP in tiny SRCU |
| MEDIUM | | 5.5 | | CVE-2026-43118 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix zero size inode with non-zero size after log replay |
| MEDIUM | | 5.5 | | CVE-2026-43127 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs3: fix circular locking dependency in run_unpack_ex |
| MEDIUM | | 5.5 | | CVE-2026-43172 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: fix 22000 series SMEM parsing |
| MEDIUM | | 5.5 | | CVE-2026-43191 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 |
| MEDIUM | | 5.5 | | CVE-2026-43204 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: qcom: q6asm: drop DSP responses for closed data streams |
| MEDIUM | | 5.5 | | CVE-2026-43213 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: validate sequence number of TX release report |
| MEDIUM | | 5.5 | | CVE-2026-43234 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: team: avoid NETDEV_CHANGEMTU event when unregistering slave |
| MEDIUM | | 5.5 | | CVE-2026-43272 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ring-buffer: Fix possible dereference of uninitialized pointer |
| MEDIUM | | 5.5 | | CVE-2026-43294 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels |
| MEDIUM | | 5.5 | | CVE-2026-43298 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Skip vcn poison irq release on VF |
| MEDIUM | | 5.5 | | CVE-2026-43299 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() |
| MEDIUM | | 5.5 | | CVE-2026-43301 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix PM runtime usage count underflow |
| MEDIUM | | 5.5 | | CVE-2026-43308 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() |
| MEDIUM | | 5.5 | | CVE-2026-43309 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md raid: fix hang when stopping arrays with metadata through dm-raid |
| MEDIUM | | 5.5 | | CVE-2026-43310 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC |
| MEDIUM | | 5.5 | | CVE-2026-43311 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soc/tegra: pmc: Fix unsafe generic_handle_irq() call |
| MEDIUM | | 5.5 | | CVE-2026-43325 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: don't send a 6E related command when not supported |
| MEDIUM | | 5.5 | | CVE-2026-43326 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback |
| MEDIUM | | 5.5 | | CVE-2026-43337 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() |
| MEDIUM | | 5.5 | | CVE-2026-43346 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ice: ptp: don't WARN when controlling PF is unavailable |
| MEDIUM | | 5.5 | | CVE-2026-43352 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue |
| MEDIUM | | 5.5 | | CVE-2026-43353 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue |
| MEDIUM | | 7.1 | | CVE-2026-43414 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Completely fix fcport double free |
| MEDIUM | | 5.5 | | CVE-2026-43416 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: powerpc, perf: Check that current->mm is alive before getting user callchain |
| MEDIUM | | 5.5 | | CVE-2026-43443 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: amd: acp-mach-common: Add missing error check for clock acquisition |
| MEDIUM | | 5.5 | | CVE-2026-43463 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() |
| MEDIUM | | 5.5 | | CVE-2026-43464 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ |
| MEDIUM | | 5.5 | | CVE-2026-43465 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ |
| MEDIUM | | 5.5 | | CVE-2026-43485 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nouveau/gsp: drop WARN_ON in ACPI probes |
| MEDIUM | | 6.4 | | CVE-2026-45932 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix tcx/netkit detach permissions when prog fd isn't given |
| MEDIUM | | 7 | | CVE-2026-45934 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation |
| MEDIUM | | 5.5 | | CVE-2026-45940 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix oops when split header is enabled |
| MEDIUM | | 5.5 | | CVE-2026-45961 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gfs2: fix memory leaks in gfs2_fill_super error path |
| MEDIUM | | 5.5 | | CVE-2026-46014 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Add missing save/restore handling of LBR MSRs |
| MEDIUM | | 7 | | CVE-2026-46017 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm: fix deferred split queue races during migration |
| MEDIUM | | 7 | | CVE-2026-46032 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT |
| MEDIUM | | 5.5 | | CVE-2026-46044 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipmi:ssif: Clean up kthread on errors |
| MEDIUM | | 5.5 | | CVE-2026-46059 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN |
| MEDIUM | | 5.5 | | CVE-2026-46066 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix num_ops off-by-one when crypto allocation fails |
| MEDIUM | | 5.5 | | CVE-2026-46071 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 |
| MEDIUM | | 5.5 | | CVE-2026-46096 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() |
| MEDIUM | | 5.5 | | CVE-2026-46147 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() |
| MEDIUM | | 5.5 | | CVE-2026-46148 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: spi: microchip-core-qspi: control built-in cs manually |
| MEDIUM | | 5.5 | | CVE-2026-46153 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: 8021q: delete cleared egress QoS mappings |
| MEDIUM | | 5.5 | | CVE-2026-46171 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv: kvm: fix vector context allocation leak |
| MEDIUM | | 5.5 | | CVE-2026-46228 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: spi: ch341: fix devres lifetime |
| MEDIUM | | 5.5 | | CVE-2026-46245 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dc_link NULL handling in HPD init |
| MEDIUM | | 5.5 | | CVE-2026-46256 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages |
| MEDIUM | | 4.7 | | CVE-2026-46272 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: tmc-etr: Fix race condition between sysfs and perf mode |
| MEDIUM | | 5.5 | | CVE-2026-46302 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: selinux: allow multiple opens of /sys/fs/selinux/policy |
| MEDIUM | | 5.5 | | CVE-2026-46314 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Reject empty multisync extension to prevent infinite loop |
| MEDIUM | | 7 | | CVE-2026-46317 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock |
| MEDIUM | | 7 | | CVE-2026-46324 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: netfilter nf_tables denial of service via race condition in netlink hook unregistration |
| MEDIUM | | 7 | | CVE-2026-46325 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE |
| MEDIUM | | 7 | | CVE-2026-46330 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Revert "net/smc: Introduce TCP ULP support" |
| MEDIUM | | 5.5 | | CVE-2026-52937 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR |
| MEDIUM | | 7 | | CVE-2026-52953 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Fix oops due to out of scope access |
| MEDIUM | | 7 | | CVE-2026-52956 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() |
| MEDIUM | | 5.5 | | CVE-2026-52994 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting |
| MEDIUM | | 7 | | CVE-2026-53009 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ice: fix double-free of tx_buf skb |
| MEDIUM | | 5.5 | | CVE-2026-53017 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix data loss caused by incorrect use of nat_entry flag |
| MEDIUM | | 5.5 | | CVE-2026-53018 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: avoid reading already updated pages during GC |
| MEDIUM | | 5.5 | | CVE-2026-53103 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync |
| MEDIUM | | 5.5 | | CVE-2026-53104 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: Fix memory leak destroying device |
| MEDIUM | | 5.5 | | CVE-2026-53106 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Do not allow deleting local storage in NMI |
| MEDIUM | | 5.5 | | CVE-2026-53107 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: libertas: don't kill URBs in interrupt context |
| MEDIUM | | 5.5 | | CVE-2026-53108 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: powerpc/64s: Fix unmap race with PMD migration entries |
| MEDIUM | | | | CVE-2026-53178 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction |
| MEDIUM | | 7 | | CVE-2026-53224 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate embedded INIT chunk and address list lengths in cookie |
| MEDIUM | | 7 | | CVE-2026-53246 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing |
| MEDIUM | | 5.5 | | CVE-2026-53258 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: fix leak if split 6 GHz scanning fails |
| MEDIUM | | 5.5 | | CVE-2026-53281 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption |
| MEDIUM | | 5.5 | | CVE-2026-53285 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED |
| MEDIUM | | 5.5 | | CVE-2026-53292 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind |
| MEDIUM | | 5.5 | | CVE-2026-53297 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: mana: Guard mana_remove against double invocation |
| MEDIUM | | 5.5 | | CVE-2026-53321 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/napi: cap busy_poll_to 10 msec |
| MEDIUM | | 5.5 | | CVE-2026-53377 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: always recover the gpu |
| MEDIUM | | | | CVE-2026-53401 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: omap2: fix use-after-free in omapfb_mmap |
| MEDIUM | | | | CVE-2026-63805 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: crypto: nx - fix nx_crypto_ctx_exit argument |
| MEDIUM | | | | CVE-2026-63811 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: read COW data with the original inode during atomic write |
| MEDIUM | | | | CVE-2026-63819 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on f2fs_get_node_folio_ra() |
| MEDIUM | | 5.5 | | CVE-2026-63832 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: add wcid publish check in mt76_sta_add |
| MEDIUM | | 5.5 | | CVE-2026-63853 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring |
| MEDIUM | | | | CVE-2026-63857 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-63858 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: add hook transactions for device deletions |
| MEDIUM | | | | CVE-2026-63859 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue() |
| MEDIUM | | 7 | | CVE-2026-63941 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor |
| MEDIUM | | 7 | | CVE-2026-63979 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/handshake: hand off the pinned file reference to accept_doit |
| MEDIUM | | 5.5 | | CVE-2026-63998 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ethtool: module: call ethnl_ops_complete() on module flash errors |
| MEDIUM | | 5.5 | | CVE-2026-63999 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure |
| MEDIUM | | 5.5 | | CVE-2026-64006 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: fix dst corruption in same register operation |
| MEDIUM | | 7 | | CVE-2026-64024 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction |
| MEDIUM | | 5.5 | | CVE-2026-64036 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cgroup/rstat: validate cpu before css_rstat_cpu() access |
| MEDIUM | | 5.5 | | CVE-2026-64038 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Stop work before releasing hwmon device |
| MEDIUM | | 5.5 | | CVE-2026-64060 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix leak of request in netfs_write_begin() error handling |
| MEDIUM | | 7.1 | | CVE-2026-64066 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_read_to_pagecache() to pause on subreq failure |
| MEDIUM | | 5.5 | | CVE-2026-64067 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing barriers when accessing stream->subrequests locklessly |
| MEDIUM | | 7 | | CVE-2026-64068 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing locking around retry adding new subreqs |
| MEDIUM | | 5.5 | | CVE-2026-64076 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: bridge: eb_tables: close module init race |
| MEDIUM | | 5.5 | | CVE-2026-64077 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: ebtables: move to two-stage removal scheme |
| MEDIUM | | 7.1 | | CVE-2026-64078 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: add and use xtables_unregister_table_exit |
| MEDIUM | | 5.5 | | CVE-2026-64079 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: allocate hook ops while under mutex |
| MEDIUM | | 7 | | CVE-2026-64117 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb |
| MEDIUM | | 5.5 | | CVE-2026-64146 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix metabuf leak in inode xattr initialization |
| MEDIUM | | 5.5 | | CVE-2026-64154 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() |
| MEDIUM | | 5.5 | | CVE-2026-64159 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix zeropoint update where i_size > remote_i_size |
| MEDIUM | | 7 | | CVE-2026-64160 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point |
| MEDIUM | | 5.5 | | CVE-2026-64190 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: team: fix NULL pointer dereference in team_xmit during mode change |
| MEDIUM | | 5.5 | | CVE-2026-64212 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it |
| MEDIUM | | 5.5 | | CVE-2026-64213 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Add lock protection to lm90_alert |
| MEDIUM | | 7 | | CVE-2026-64255 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers |
| MEDIUM | | 7 | | CVE-2026-64520 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies |
| MEDIUM | | 7 | | CVE-2026-68086 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/khugepaged: write all dirty file folios when collapsing |
| MEDIUM | | 5.5 | | CVE-2026-68211 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: stm32-dcmipp: Return queued buffers on start_streaming() failure |
| MEDIUM | | 5.5 | | CVE-2026-68233 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/vc4: Shut down BO cache timer before teardown |
| MEDIUM | | 5.5 | | CVE-2026-68242 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/gt: Fix NULL deref on sched_engine alloc failure |
| MEDIUM | | 5.5 | | CVE-2026-68258 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size |
| MEDIUM | | 5.5 | | CVE-2026-68291 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: idpf driver null pointer dereference leads to Denial of Service |
| MEDIUM | | 5.5 | | CVE-2026-68295 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: BPF: Zero-extend signed ALU32 div/mod results |
| MEDIUM | | 5.5 | | CVE-2026-68312 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths |
| MEDIUM | | 7 | | CVE-2026-68323 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tipc: serialize udp bearer replicast list updates |
| MEDIUM | | 5.5 | | CVE-2026-68382 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Hold device ref until queue teardown completes |
| MEDIUM | | 5.5 | | CVE-2026-68383 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Keep scheduler timeline name alive |
| MEDIUM | | 7 | | CVE-2026-68393 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: extend conn_hash lookup critical sections |
| MEDIUM | | 6.4 | | CVE-2026-68399 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix UAF in sock clone early bailouts |
| MEDIUM | | 7 | | CVE-2026-68400 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation |
| MEDIUM | | 7 | | CVE-2026-68401 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() |
| MEDIUM | | 7 | | CVE-2026-68404 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect |
| MEDIUM | | 5.5 | | CVE-2026-68421 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() |
| MEDIUM | | 5.5 | | CVE-2026-68435 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Fix address space mismatch in kexec command line lookup |
| MEDIUM | | 5.5 | | CVE-2026-68441 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains |
| MEDIUM | | 5.5 | | CVE-2026-68447 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size |
| MEDIUM | | 7 | | CVE-2026-68448 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ovl: check access to copy_file_range source with src mounter creds |
| MEDIUM | | 7 | | CVE-2026-68453 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey |
| MEDIUM | | 5.5 | | CVE-2026-68471 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ieee80211: validate MLE common info length |
| MEDIUM | | 5.5 | | CVE-2026-72073 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mmc: vub300: fix use-after-free on probe failure |
| MEDIUM | | 5.5 | | CVE-2026-72162 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec |
| MEDIUM | | 7 | | CVE-2026-72288 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling |
| MEDIUM | | 7 | | CVE-2026-72329 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/liquidio: drop cached VF pci_dev LUT |
| MEDIUM | | 5.5 | | CVE-2026-72337 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: 6lowpan: avoid untracked enable work |
| MEDIUM | | 5.5 | | CVE-2026-72341 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Fix publication race for priv->channel_stats[] |
| MEDIUM | | 5.5 | | CVE-2026-72355 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix barriering when walking subrequest list |
| MEDIUM | | 5.5 | | CVE-2026-72365 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix writethrough to use collection offload |
| MEDIUM | | 5.5 | | CVE-2026-72367 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iomap: guard io_size EOF trim against concurrent truncate underflow |
| MEDIUM | | 5.5 | | CVE-2026-72375 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix reinitialisation of the inode, in particular ->lock_work |
| MEDIUM | | 5.5 | | CVE-2026-72380 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xen/pvcalls: bound backend response req_id before indexing rsp[] |
| MEDIUM | | 5.5 | | CVE-2026-72383 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: fix addr_wq_timer race in sctp_free_addr_wq() |
| MEDIUM | | 5.5 | | CVE-2026-72388 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock |
| MEDIUM | | 5.5 | | CVE-2026-72397 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() |
| MEDIUM | | 7 | | CVE-2026-72398 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: add INIT verification after cookie unpacking |
| MEDIUM | | 5.5 | | CVE-2026-72404 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() |
| MEDIUM | | 5.5 | | CVE-2026-72423 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Guard conntrack opts error writes |
| MEDIUM | | 5.5 | | CVE-2026-72440 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1: fix writes_pending and barrier reference leaks on write failures |
| MEDIUM | | 5.5 | | CVE-2026-72454 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() |
| MEDIUM | | 5.5 | | CVE-2026-72488 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soundwire: fix bug in sdw_add_element_group_count found by syzkaller |
| MEDIUM | | 5.5 | | CVE-2026-72493 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: serialize netif_running() check in enqueue_to_backlog() |
| MEDIUM | | 5.5 | | CVE-2026-72495 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages |
| MEDIUM | | 7 | | CVE-2026-72499 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free CQ toggle page after firmware teardown |
| MEDIUM | | 7 | | CVE-2026-72500 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown |
| MEDIUM | | | | CVE-2026-72501 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: R ... |
| MEDIUM | | 5.5 | | CVE-2026-74257 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sockmap: Fix use-after-free in udp_bpf_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-74264 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: watchdog: fix refcount tracking races |
| MEDIUM | | 5.5 | | CVE-2026-74272 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Resolve region deletion races |
| MEDIUM | | 5.5 | | CVE-2026-74273 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Block region delete during region creation |
| MEDIUM | | 5.5 | | CVE-2026-74314 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Cancel special fields on map value recycle |
| MEDIUM | | 5.5 | | CVE-2026-74317 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ixgbe: do not configure xps for XDP queues |
| MEDIUM | | 5.5 | | CVE-2026-74324 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: validate skb length in testmode query |
| MEDIUM | | 5.5 | | CVE-2026-74337 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks |
| MEDIUM | | 5.5 | | CVE-2026-74342 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: kernfs: link kn to its parent before the LSM init hook |
| MEDIUM | | 5.5 | | CVE-2026-74344 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear rb node linkage when freeing bpf_rb_root |
| MEDIUM | | 5.5 | | CVE-2026-74350 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate fast symlink target during inode read |
| MEDIUM | | 5.5 | | CVE-2026-74354 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Take mmap_lock in zap_pages() |
| MEDIUM | | 5.5 | | CVE-2026-74368 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() |
| MEDIUM | | 6.5 | | CVE-2026-74385 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock |
| MEDIUM | | 5.5 | | CVE-2026-74388 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data |
| MEDIUM | | 7 | | CVE-2026-74405 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: OPP: Fix race between OPP addition and lookup |
| MEDIUM | | 5.5 | | CVE-2026-74407 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath11k: cancel SSR work items during PCI shutdown |
| MEDIUM | | 5.5 | | CVE-2026-74449 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport |
| MEDIUM | | 5.5 | | CVE-2026-74466 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Close speculative mem read possibility |
| MEDIUM | | 7 | | CVE-2026-74506 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix UAF when sending a message |
| MEDIUM | | 7 | | CVE-2026-74513 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister |
| MEDIUM | | 5.5 | | CVE-2026-74527 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-af: Block VFs from clobbering special CGX PKIND state |
| MEDIUM | | 5.5 | | CVE-2026-74529 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback |
| MEDIUM | | 5.5 | | CVE-2026-74530 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback |
| MEDIUM | | 7 | | CVE-2026-74533 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero |
| MEDIUM | | 7 | | CVE-2026-74537 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: hold sk properly in iso_conn_ready |
| MEDIUM | | 5.5 | | CVE-2026-74538 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: lock sk in iso_connect_ind |
| MEDIUM | | 5.5 | | CVE-2026-74542 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix folio_queue ENOMEM in writeback by adding a mempool |
| MEDIUM | | 5.5 | | CVE-2026-74544 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds |
| MEDIUM | | 5.5 | | CVE-2026-74600 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/page_table_check: skip special zero mappings |
| MEDIUM | | 5.5 | | CVE-2026-74605 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: eventfs: Use children field for rcu head and add memory barriers |
| MEDIUM | | 7 | | CVE-2026-74611 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tls: rx: restore msg_iter before TLS 1.3 optimistic retry |
| MEDIUM | | 5.5 | | CVE-2026-74638 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Serialize the scheduler timeout handlers |
| MEDIUM | | 5.5 | | CVE-2026-74687 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: watchdog: at91sam9_wdt: prevent timer rearm during teardown |
| MEDIUM | | 7 | | CVE-2026-74695 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() |
| MEDIUM | | 7 | | CVE-2026-74697 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Disable EOP for TPA on all chips to prevent data corruption |
| MEDIUM | | 5.5 | | CVE-2026-74711 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus) Fix type confusion in notification logic |
| MEDIUM | | 5.5 | | CVE-2026-74713 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vhost_iotlb: bound map allocation in add_range |
| MEDIUM | | 7 | | CVE-2026-74715 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix netns reference imbalance in conntrack kfuncs |
| MEDIUM | | 5.5 | | CVE-2026-74723 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject inline extents without valid headers |
| MEDIUM | | 5.5 | | CVE-2026-74729 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read |
| MEDIUM | | 5.5 | | CVE-2026-74747 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipvs: revalidate ihl to prevent out-of-bounds access |
| MEDIUM | | 5.5 | | CVE-2026-80579 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: clear fb_info->mode before deleting a videomode |
| MEDIUM | | 5.5 | | CVE-2026-80580 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: bound mode sysfs output to the sysfs buffer |
| MEDIUM | | 5.5 | | CVE-2026-80614 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: emac: Fix NULL pointer dereference in emac_probe |
| MEDIUM | | 5.5 | | CVE-2026-80623 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: ete: Always save state on power down |
| MEDIUM | | 5.5 | | CVE-2026-80628 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Serialize readq reset state with q->lock |
| MEDIUM | | 5.5 | | CVE-2026-80631 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject compressed segment that overflows the compressed input |
| MEDIUM | | 5.5 | | CVE-2026-80634 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag |
| MEDIUM | | 5.5 | | CVE-2026-80655 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soc: xilinx: Fix race condition in event registration |
| MEDIUM | | 5.5 | | CVE-2026-80662 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size |
| MEDIUM | | 7 | | CVE-2026-80668 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations |
| MEDIUM | | 5.5 | | CVE-2026-80670 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() |
| MEDIUM | | 5.5 | | CVE-2026-80692 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks |
| MEDIUM | | 7 | | CVE-2026-80693 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: idpf: bound interrupt-vector register fill to the allocated array |
| MEDIUM | | 5.5 | | CVE-2026-80698 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: idxd: fix double free of wq, engine, and group structs |
| MEDIUM | | 5.5 | | CVE-2026-80721 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: ensure no dangling hcon references in iso_conn |
| MEDIUM | | | | CVE-2026-80761 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| MEDIUM | | 5.5 | | CVE-2026-80905 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: tap: fix wrong transport_header when sending VLAN-tagged frame |
| MEDIUM | | 5.5 | | CVE-2026-80920 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring: defer eventfd signaling when queued from a wakeup handler |
| MEDIUM | | 5.5 | | CVE-2026-81010 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/waitid: honor task_work cancellation |
| MEDIUM | | 7 | | CVE-2026-89528 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Reject Read lists that exceed the page budget |
| MEDIUM | | 4.8 | | CVE-2026-89534 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| MEDIUM | | 7 | | CVE-2026-89537 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 |
| MEDIUM | | 7.2 | | CVE-2026-89610 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs: verify run length exceeding volume boundary |
| MEDIUM | | 5.5 | | CVE-2026-89611 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs: validate non-resident attribute offsets |
| MEDIUM | | 7.1 | | CVE-2026-89632 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() |
| MEDIUM | | 7 | | CVE-2026-89637 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 |
| MEDIUM | | 5.5 | | CVE-2026-89639 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC |
| MEDIUM | | 3.3 | | CVE-2026-89642 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cifs: call pagecache_isize_extended() in cifs_setsize() when extending |
| MEDIUM | | 6.2 | | CVE-2026-89648 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ceph: cap delegated inode count in ceph_parse_deleg_inos() |
| MEDIUM | | 7 | | CVE-2026-89654 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix UAF in check_new_map() on session freed during unlock |
| MEDIUM | | 5.3 | | CVE-2026-89682 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net |
| MEDIUM | | 5.3 | | CVE-2026-89705 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths |
| MEDIUM | | 5.9 | | CVE-2026-89709 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: lockd, nfsd: RCU-protect nlmsvc_ops dispatch |
| MEDIUM | | 5.5 | | CVE-2026-89722 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() |
| MEDIUM | | 5.5 | | CVE-2026-89757 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/mglru: fix and remove redundant unevictable folio handling |
| MEDIUM | | 4.7 | | CVE-2026-89810 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix error path at svm_migrate_copy_to_ram |
| MEDIUM | | | | CVE-2026-89826 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| MEDIUM | | | | CVE-2026-89833 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| MEDIUM | | | | CVE-2026-89866 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| MEDIUM | | | | CVE-2026-89906 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| MEDIUM | | 4.7 | | CVE-2026-89913 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables |
| MEDIUM | | 4.7 | | CVE-2026-89920 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Fix memory corruption by not reinjecting CK machine checks |
| MEDIUM | | | | CVE-2026-89935 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 3.6 | | CVE-2026-89987 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/huge_memory: transfer the pmd dirty bit to the folio on zap |
| MEDIUM | | 5.5 | | CVE-2026-90040 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped |
| MEDIUM | | 5.5 | | CVE-2026-90061 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: skip double clone set expressions on element insert |
| MEDIUM | | 5.5 | | CVE-2026-90083 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: act_ife: Only operate on Ethernet frames |
| MEDIUM | | 5.5 | | CVE-2026-90087 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: do not leak an hci_conn when a second LE connect is rejected |
| MEDIUM | | 7 | | CVE-2026-90093 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: access chan->conn safely in get/setsockopt |
| MEDIUM | | 5.5 | | CVE-2026-90098 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: fix sleep in atomic context in MAC table access |
| MEDIUM | | 7 | | CVE-2026-90099 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: account classifier filter allocations to memcg |
| MEDIUM | | 7 | | CVE-2026-90104 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFSv4.1: zero referring call lists before decoding |
| MEDIUM | | 5.5 | | CVE-2026-90105 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vxlan: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90106 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: arp/nd proxy: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90116 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: mtpav: shut down output timer before card teardown |
| MEDIUM | | 5.5 | | CVE-2026-90142 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix resize of the RX ring |
| MEDIUM | | 5.5 | | CVE-2026-90149 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers |
| MEDIUM | | 5.5 | | CVE-2026-90154 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: scope session state changes to bound connections |
| MEDIUM | | 5.5 | | CVE-2026-90155 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: detach blocked lock requests before freeing |
| MEDIUM | | 5.5 | | CVE-2026-90156 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely discard unregistered deferred locks |
| MEDIUM | | 7 | | CVE-2026-90161 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix interlaced ztailpacking pclusters |
| MEDIUM | | 5.5 | | CVE-2026-90162 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: defer publishing granted locks to prevent UAF/double-free race |
| MEDIUM | | 5.5 | | CVE-2026-90167 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: serialize oplock close with pending break ownership |
| MEDIUM | | 5.5 | | CVE-2026-90174 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() |
| MEDIUM | | 5.5 | | CVE-2026-90177 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check pointer type for all atomic RMW paths |
| MEDIUM | | 5.5 | | CVE-2026-90179 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix deadlock in complain-mode change_hat |
| MEDIUM | | 5.5 | | CVE-2026-90204 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate DIO orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90205 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90208 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type |
| MEDIUM | | 5.5 | | CVE-2026-90217 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Compare iterator types during state pruning |
| MEDIUM | | 5.5 | | CVE-2026-90231 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix unconfined user namespace restriction forced stack |
| MEDIUM | | 5.5 | | CVE-2026-90232 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: amt: Don't support cross-netns setup |
| MEDIUM | | 5.1 | | CVE-2026-90234 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFS: Return a delegation the client fails to record |
| MEDIUM | | 7 | | CVE-2026-90237 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nft_ct: move custom expectation support to helper |
| MEDIUM | | 7 | | CVE-2026-90240 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Flush context cache with correct SID when tearing down aliases |
| MEDIUM | | 5.5 | | CVE-2026-90247 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix mmap_lock leak in irq_work path |
| MEDIUM | | 5.9 | | CVE-2026-90256 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind |
| MEDIUM | | 5.5 | | CVE-2026-90259 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() |
| MEDIUM | | 4.7 | | CVE-2026-90260 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: don't clobber the extent buffer when zeroing it out |
| MEDIUM | | 3.3 | | CVE-2026-90263 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: check if root is readonly when setting posix acl |
| MEDIUM | | 5.5 | | CVE-2026-90264 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: always wait for ordered extents to avoid OE races |
| MEDIUM | | 5.5 | | CVE-2026-90265 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: defrag: fix deadlock between defrag and delalloc space reservation |
| MEDIUM | | 5.5 | | CVE-2026-90273 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable |
| MEDIUM | | 5.5 | | CVE-2026-90289 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Resize MST HDCP per-connector arrays to 32 |
| MEDIUM | | 5.5 | | CVE-2026-90300 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear buf on error in __bpf_get_task_stack |
| MEDIUM | | 5.5 | | CVE-2026-90301 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: o2hb: quiesce negotiate handlers and timeout work |
| MEDIUM | | 7 | | CVE-2026-90317 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Invalidate RCU pointers after final spin unlock |
| MEDIUM | | 5.5 | | CVE-2026-90320 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate external xattr entries when reading metadata |
| MEDIUM | | 5.5 | | CVE-2026-90321 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate inline xattrs during inode block validation |
| MEDIUM | | 5.5 | | CVE-2026-90324 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ublk: check import_ubuf() return value |
| MEDIUM | | 4.7 | | CVE-2026-90326 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-cgroup: fix race between policy activation and blkg destruction |
| MEDIUM | | 5.5 | | CVE-2026-90328 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: HID: steam: Reject short reads |
| MEDIUM | | 6.4 | | CVE-2026-90333 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dm-integrity: replace forgeable discard filler with a keyed sector marker |
| MEDIUM | | 4.1 | | CVE-2026-90336 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: clear freed pointers on uart_register_driver() failure |
| MEDIUM | | 5.5 | | CVE-2026-90337 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: do fallible allocations before the console can be registered |
| MEDIUM | | 7 | | CVE-2026-90343 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: stop PMSR before P2P and NAN teardown |
| MEDIUM | | 5.5 | | CVE-2026-90345 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: brcmfmac: fix P2P action frame handling without device vif |
| MEDIUM | | 7 | | CVE-2026-90347 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry |
| MEDIUM | | 5.5 | | CVE-2026-90351 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed |
| MEDIUM | | 4.4 | | CVE-2026-90359 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject >8 byte return values on return-reading trampoline paths |
| MEDIUM | | 5.5 | | CVE-2026-90363 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: don't tear down KMS twice when KMS init fails |
| MEDIUM | | 5.5 | | CVE-2026-90365 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: cancel reset and rc work on device unregister |
| MEDIUM | | 5.5 | | CVE-2026-90367 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER |
| MEDIUM | | 4.8 | | CVE-2026-90379 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash |
| MEDIUM | | 3.3 | | CVE-2026-90401 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md: remove REQ_NOWAIT support from raid1/10/456 |
| MEDIUM | | 5.5 | | CVE-2026-90408 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() |
| MEDIUM | | 5.5 | | CVE-2026-90409 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Add vm_bind region with kbo range overlap check |
| MEDIUM | | 4.7 | | CVE-2026-90417 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() |
| MEDIUM | | 5.5 | | CVE-2026-90421 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI: Fix UAF when probe runs concurrent to dyn ID removal |
| MEDIUM | | 5.5 | | CVE-2026-90422 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path |
| MEDIUM | | 4.7 | | CVE-2026-90427 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() |
| MEDIUM | | 5.5 | | CVE-2026-92480 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Validate string descriptors |
| MEDIUM | | 5.5 | | CVE-2026-92482 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip |
| MEDIUM | | 3.3 | | CVE-2026-92485 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix WARNING in bpf_tracing_link_release |
| MEDIUM | | 5.5 | | CVE-2026-92499 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext4: validate readdir offset before accessing dirent |
| MEDIUM | | 4.7 | | CVE-2026-92500 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext4: use fsdata to track inline data write state and fix race |
| MEDIUM | | 5.5 | | CVE-2026-92503 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() |
| MEDIUM | | 5.5 | | CVE-2026-92518 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv, bpf: Fix kernel stack corruption in tailcall with CFI |
| MEDIUM | | 5.5 | | CVE-2026-92520 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Zero queue and stack outputs on lock failure |
| MEDIUM | | 5.5 | | CVE-2026-93044 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for arena-related insns |
| MEDIUM | | 5.5 | | CVE-2026-93047 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Associate BOs with every job that accesses them |
| MEDIUM | | 5.5 | | CVE-2026-93058 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Only fini scheduler after successful init |
| MEDIUM | | 5.5 | | CVE-2026-93081 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_scmi: Fix SCMI device destroy lifetimes |
| MEDIUM | | 4.7 | | CVE-2026-93099 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Fix UAF from worker threads when domains are removed |
| MEDIUM | | 4.7 | | CVE-2026-93100 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() |
| MEDIUM | | 4.7 | | CVE-2026-93104 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rvt: Return NULL after port allocation failure |
| MEDIUM | | 7 | | CVE-2026-93105 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: esp: do not unref managed frag pages in esp_ssg_unref() |
| MEDIUM | | 5.5 | | CVE-2026-93122 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: usb: gadget: uac: validate rate list length before storing |
| MEDIUM | | 5.5 | | CVE-2026-93135 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject programs with inlined helpers if JIT is not available |
| MEDIUM | | 7 | | CVE-2026-93148 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject MEM_ALLOC BTF accesses past object bounds |
| MEDIUM | | 7 | | CVE-2026-93154 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Add refcounting to user ring MRs |
| MEDIUM | | 5.5 | | CVE-2026-93168 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout |
| MEDIUM | | 5.5 | | CVE-2026-93175 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in CRTC reset function |
| MEDIUM | | 4.7 | | CVE-2026-93176 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in plane reset function |
| MEDIUM | | 5.5 | | CVE-2026-93270 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn |
| MEDIUM | | 5.5 | | CVE-2026-93272 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 |
| MEDIUM | | 5.5 | | CVE-2026-93276 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator |
| MEDIUM | | 5.5 | | CVE-2026-93282 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix maximum allowed access checks |
| MEDIUM | | 7.1 | | CVE-2026-97422 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: fix SMI event cross-process information leak |
| MEDIUM | | 5.5 | | CVE-2026-97432 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: fix P2P-Device binding handling |
| MEDIUM | | 5.5 | | CVE-2026-97478 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virt: acrn: Fix irqfd use-after-free during eventfd shutdown |
| MEDIUM | | 7.1 | | CVE-2026-97493 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS |
| MEDIUM | | 5.5 | | CVE-2026-97499 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: perf: Retrieve path and source from event data |
| MEDIUM | | 5.5 | | CVE-2026-97513 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Release m2m_ctx after Instance Removed from List |
| MEDIUM | | 5.5 | | CVE-2026-97515 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 |
| MEDIUM | | 5.5 | | CVE-2026-97526 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/pai: Support CPU hotplug for PMU PAI |
| MEDIUM | | 5.5 | | CVE-2026-97538 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (asus_rog_ryujin) Validate HID report lengths |
| MEDIUM | | 5.5 | | CVE-2026-97554 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() |
| MEDIUM | | 7 | | CVE-2026-97561 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid |
| MEDIUM | | 7 | | CVE-2026-97563 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97565 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject short READ responses in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97960 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel: Prevent drain_pebs() reentry |
| MEDIUM | | 5.5 | | CVE-2026-97962 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Move representor vnic reporter to eswitch devlink port |
| MEDIUM | | 5.1 | | CVE-2026-97975 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() |
| MEDIUM | | 4.7 | | CVE-2026-97988 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vhost: invalidate vring access on IOTLB transitions |
| MEDIUM | | 5.5 | | CVE-2026-98019 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: mark a NULL call argument precise |
| MEDIUM | | 5.3 | | CVE-2026-98032 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tracing: Fix subbuf resize races with trace_pipe_raw readers |
| MEDIUM | | 7 | | CVE-2026-98033 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Preserve inner map identity in callback frames |
| MEDIUM | | 7 | | CVE-2026-98034 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark NULL kptr stores precise |
| MEDIUM | | 5.5 | | CVE-2026-98043 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Don't infer non-NULL from a pointer with an unbounded offset |
| MEDIUM | | 7 | | CVE-2026-98047 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check ancestor frames for rbtree callbacks |
| MEDIUM | | 7 | | CVE-2026-98048 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: don't rewrite bpf_fastcall patterns entered by a jump |
| MEDIUM | | 5.5 | | CVE-2026-98049 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: zero extend the result of an arena 32-bit cmpxchg |
| MEDIUM | | 5.5 | | CVE-2026-98053 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Refactor and fix init_config access |
| MEDIUM | | 5.5 | | CVE-2026-98062 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark signal tracepoint siginfo arguments as scalar |
| MEDIUM | | 5.5 | | CVE-2026-98085 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge |
| MEDIUM | | | | CVE-2026-98099 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 5.5 | | CVE-2026-98115 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely drain sessions during logoff |
| MEDIUM | | 5.5 | | CVE-2026-98118 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix readahead synchronisation issues by loading all folios upfront |
| MEDIUM | | 5.5 | | CVE-2026-98124 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/client: invalidate fscache for fallocate range operations |
| MEDIUM | | 5.5 | | CVE-2026-98125 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix stale page cache in insert/collapse range |
| MEDIUM | | 5.5 | | CVE-2026-98131 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix dma mapping leak in stmmac_tso_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-98134 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: check_cond_jmp_op(): properly infer if register is null |
| MEDIUM | | 5.3 | | CVE-2026-98156 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/virtio: use the DMA API for resource backing on Xen |
| MEDIUM | | 5.5 | | CVE-2026-98162 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/server: fix tree connection leak in smb2_tree_connect() |
| MEDIUM | | 5.5 | | CVE-2026-98180 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: RCU-free the scheduler-containing ring and VM objects |
| MEDIUM | | 5.5 | | CVE-2026-98228 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ |
| MEDIUM | | 4.4 | | CVE-2026-98273 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: x86/kprobes: Fix crash when probing CS CALL instructions |
| MEDIUM | | 5.5 | | CVE-2026-98277 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: ring the doorbell if a burst ends in a drop |
| MEDIUM | | 5.5 | | CVE-2026-98279 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: handle lack of space when cleaning up verity items |
| MEDIUM | | 5.3 | | CVE-2026-98284 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netlink: do not free nlk->groups while lockless readers can use it |
| MEDIUM | | 4.1 | | CVE-2026-98286 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown |
| MEDIUM | | 5.5 | | CVE-2026-98288 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix TSO header length truncation |
| MEDIUM | | 5.5 | | CVE-2026-98292 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| MEDIUM | | 5.5 | | CVE-2026-98294 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_qca: Do not write to the serial port after it is closed |
| MEDIUM | | 7 | | CVE-2026-98296 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btintel_pcie: validate TX skb length in send_sync |
| MEDIUM | | 5.5 | | CVE-2026-98313 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/dp: skip PUSH_IDLE when the link was never enabled |
| MEDIUM | | 7 | | CVE-2026-98330 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: get the wiphy out of a dying network namespace |
| MEDIUM | | 5.5 | | CVE-2026-98333 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: reset the LED state when ifup fails |
| MEDIUM | | 7 | | CVE-2026-98341 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: don't free driver-owned scan requests |
| MEDIUM | | 5.5 | | CVE-2026-98353 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables |
| MEDIUM | | 5.5 | | CVE-2026-98355 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rtrs: guard against null kobj name |
| MEDIUM | | 5.5 | | CVE-2026-98376 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Use array_map_meta_equal for percpu array inner map replacement |
| MEDIUM | | 5.5 | | CVE-2026-98408 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: watchdog: rzv2h: Avoid division by zero |
| MEDIUM | | 5.5 | | CVE-2026-98420 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: follow SMB2 session expiration semantics |
| MEDIUM | | | | CVE-2026-98436 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: a ... |
| MEDIUM | | 6.5 | | CVE-2026-98439 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/server: cancel async requests when closing connection |
| MEDIUM | | 4.7 | | CVE-2026-98444 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: drop dquot flush lock when we can't find a buffer to flush |
| MEDIUM | | 6.5 | | CVE-2026-98449 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: delete compound mids on send failure before unlock |
| MEDIUM | | 5.3 | | CVE-2026-98471 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Do cache maintenance on the source VM during intra-host migration |
| MEDIUM | | 5.5 | | CVE-2026-98556 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gve: DQO: reject TSO packets with an out of range MSS |
| MEDIUM | | 4.1 | | CVE-2026-98558 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: flush skb_defer_nodes in dev_cpu_dead() |
| MEDIUM | | 5.9 | | CVE-2026-98570 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: ipv6: keep room for the mac header in dst_dev_overhead() |
| MEDIUM | | 6.7 | | CVE-2026-98589 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject pkt arguments in mutating subprogs |
| MEDIUM | | 4.7 | | CVE-2026-98598 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv6: Prevent rt6_insert_exception() for dying fib6_info |
| MEDIUM | | 6.7 | | CVE-2026-98599 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() |
| MEDIUM | | 4.1 | | CVE-2026-98616 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: reset num_napi when the napi vectors are freed |
| MEDIUM | | 5.5 | | CVE-2026-98652 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Add missing srcu in kvm_s390_set_irq_state() |
| MEDIUM | | 5.5 | | CVE-2026-98674 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iio: adc: adi-axi-adc: Initialize state mutex |
| MEDIUM | | 5.6 | | CVE-2026-98714 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| MEDIUM | | 4.1 | | CVE-2026-98740 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety |
| MEDIUM | | 4.4 | | CVE-2026-98747 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix NULL pointer dereference in serial_core_unregister_port() |
| MEDIUM | | 4.7 | | CVE-2026-98786 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: guard dc_sink dereferences in MST mode validation |
| MEDIUM | | 4.4 | | CVE-2026-98789 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix objects stuck in free_by_rcu_ttrace |
| MEDIUM | | 4.4 | | CVE-2026-98795 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: skip ptp deinit if init was skipped |
| MEDIUM | | 4.4 | | CVE-2026-98799 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Skip detached progs in trampoline images that are still in use |
| MEDIUM | | 4.7 | | CVE-2026-98800 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: kernel: Denial of Service via use-after-free in BPF trampoline |
| MEDIUM | | 6.5 | | CVE-2026-98803 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix rx Scatter-Gather support |
| MEDIUM | | 6.1 | | CVE-2026-98810 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() |
| MEDIUM | | 4.4 | | CVE-2026-98813 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Hold map BTF for the memory allocator destructor record |
| MEDIUM | | 4.4 | | CVE-2026-98814 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix command effects log lifetime for multipath heads |
| MEDIUM | | 4.1 | | CVE-2026-98815 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix cdev lifetime |
| MEDIUM | | 4.1 | | CVE-2026-98816 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix overflow of jump offset in constant blinding |
| MEDIUM | | 5.5 | | CVE-2026-98820 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: set RQF_USE_SCHED when the operation is known |
| MEDIUM | | 5.3 | | CVE-2026-98824 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate TX status rate metadata |
| MEDIUM | | 6.5 | | CVE-2026-98829 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: drop oversized fragments to avoid extra_len overflow |
| MEDIUM | | 4.1 | | CVE-2026-98834 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mtd: core: avoid double-free of OTP NVMEM device |
| MEDIUM | | 6.1 | | CVE-2026-98839 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() |
| MEDIUM | | 4.4 | | CVE-2026-98843 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: zero gaps in read-gaps folio to avoid writing back stale data |
| MEDIUM | | 5.6 | | CVE-2026-98863 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| MEDIUM | | 4.6 | | CVE-2019-15213 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: use-after-free caused by malicious USB device in drivers/media/usb/dvb-usb/dvb-usb-init.c |
| MEDIUM | | 4.1 | | CVE-2019-16089 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Improper return check in nbd_genl_status function in drivers/block/nbd.c |
| MEDIUM | | 4.7 | | CVE-2019-20794 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: task processes not being properly ended could lead to resource exhaustion |
| MEDIUM | | 4.4 | | CVE-2020-14304 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ethtool when reading eeprom of device could lead to memory leak |
| MEDIUM | | 6.7 | | CVE-2020-36694 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: use-after-free in the packet processing context |
| MEDIUM | | 5.5 | | CVE-2023-31082 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sleeping function called from an invalid context in gsmld_write |
| MEDIUM | | 7 | | CVE-2023-3397 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: slab-use-after-free Write in txEnd due to race condition |
| MEDIUM | | 5.5 | | CVE-2023-37454 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: udf: use-after-free write in udf_close_lvid |
| MEDIUM | | 6.7 | | CVE-2023-6238 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvme: memory corruption via unprivileged user passthrough |
| MEDIUM | | 6.5 | | CVE-2023-6240 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation |
| MEDIUM | | 5.5 | | CVE-2024-2193 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | hw: Spectre-SRC that is Speculative Race Conditions (SRCs) for synchronization primitives similar like Spectre V1 with p |
| MEDIUM | | 4.7 | | CVE-2024-24864 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | A race condition was found in the Linux kernel's media/dvb-core in dvb ... |
| MEDIUM | | 5.5 | | CVE-2024-25740 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory leak in ubi driver |
| MEDIUM | | 5.5 | | CVE-2024-56709 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring: check if iowq is killed before queuing |
| MEDIUM | | 5.5 | | CVE-2024-58074 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/i915: Grab intel_display from the encoder to avoid potential oopsies |
| MEDIUM | | 5.5 | | CVE-2025-21752 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents |
| MEDIUM | | 5.5 | | CVE-2025-21949 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Set hugetlb mmap base address aligned with pmd size |
| MEDIUM | | 5.5 | | CVE-2025-22109 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ax25: Remove broken autobind |
| MEDIUM | | 5.5 | | CVE-2025-23132 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: quota: fix to avoid warning in dquot_writeback_dquots() |
| MEDIUM | | 5.5 | | CVE-2025-23135 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Teardown riscv specific bits after kvm_exit |
| MEDIUM | | 5.5 | | CVE-2025-37743 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Avoid memory leak while enabling statistics |
| MEDIUM | | 5.5 | | CVE-2025-37746 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/dwc_pcie: fix duplicate pci_dev devices |
| MEDIUM | | 5.5 | | CVE-2025-37880 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: um: work around sched_yield not yielding in time-travel mode |
| MEDIUM | | 4.7 | | CVE-2025-37906 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: ublk race condition causes kernel crash |
| MEDIUM | | 5.5 | | CVE-2025-38029 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to sleepable page allocation in KASAN |
| MEDIUM | | 5.5 | | CVE-2025-38036 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to null pointer dereference in GT MMIO initialization for VFs |
| MEDIUM | | 5.5 | | CVE-2025-38041 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clk: sunxi-ng: h616: Reparent GPU clock during frequency changes |
| MEDIUM | | 5.5 | | CVE-2025-38042 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn |
| MEDIUM | | 6.7 | | CVE-2025-38064 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio: break and reset virtio devices on device_shutdown() |
| MEDIUM | | 5.5 | | CVE-2025-38132 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: holding cscfg_csdev_lock while removing cscfg from csdev |
| MEDIUM | | 5.5 | | CVE-2025-38140 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Local denial of service in device mapper |
| MEDIUM | | 5.5 | | CVE-2025-38199 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix memory leak due to multiple rx_stats allocation |
| MEDIUM | | 5.5 | | CVE-2025-38207 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm: fix uprobe pte be overwritten when expanding vma |
| MEDIUM | | 5.5 | | CVE-2025-38261 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv: save the SR_SUM status over switches |
| MEDIUM | | 5.5 | | CVE-2025-38284 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: configure manual DAC mode via PCI config API only |
| MEDIUM | | 5.5 | | CVE-2025-38311 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel (iavf): Denial of Service due to a locking issue |
| MEDIUM | | 5.5 | | CVE-2025-38359 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Fix in_atomic() handling in do_secure_storage_access() |
| MEDIUM | | 5.5 | | CVE-2025-38597 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port |
| MEDIUM | | 5.5 | | CVE-2025-38605 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() |
| MEDIUM | | 5.5 | | CVE-2025-39677 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Fix backlog accounting in qdisc_dequeue_internal |
| MEDIUM | | 5.5 | | CVE-2025-39762 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: add null check |
| MEDIUM | | 5.5 | | CVE-2025-39775 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: mremap local denial of service |
| MEDIUM | | 5.5 | | CVE-2025-39789 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: crypto: x86/aegis - Add missing error checks |
| MEDIUM | | 6.1 | | CVE-2025-39822 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/kbuf: fix signedness in this_len calculation |
| MEDIUM | | 5.5 | | CVE-2025-39830 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path |
| MEDIUM | | 5.5 | | CVE-2025-39834 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow |
| MEDIUM | | 6.2 | | CVE-2025-39910 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() |
| MEDIUM | | 7.1 | | CVE-2025-39933 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length |
| MEDIUM | | 2.5 | | CVE-2025-40113 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E |
| MEDIUM | | 6.8 | | CVE-2025-40130 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling |
| MEDIUM | | 6.2 | | CVE-2025-40146 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: fix potential deadlock while nr_requests grown |
| MEDIUM | | 5.2 | | CVE-2025-40217 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pidfs: validate extensible ioctls |
| MEDIUM | | | | CVE-2025-40247 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Fix pgtable prealloc error path |
| MEDIUM | | 5.2 | | CVE-2025-40338 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Do not share the name pointer between components |
| MEDIUM | | 6.1 | | CVE-2025-40355 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sysfs: check visibility before changing group attribute ownership |
| MEDIUM | | 5.5 | | CVE-2025-68209 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mlx5: Fix default values in create CQ |
| MEDIUM | | 5.5 | | CVE-2025-68236 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service during UFS power down |
| MEDIUM | | 5.5 | | CVE-2025-68304 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_core: lookup hci_conn on RX path on protocol side |
| MEDIUM | | | | CVE-2025-68318 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL |
| MEDIUM | | 6.1 | | CVE-2025-68319 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netconsole: Acquire su_mutex before navigating configs hierarchy |
| MEDIUM | | 5.5 | | CVE-2025-68353 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service via NULL pointer dereference in VXLAN module |
| MEDIUM | | 4.5 | | CVE-2025-68360 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks |
| MEDIUM | | 5.5 | | CVE-2025-68368 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service in md driver via uninitialized bioset |
| MEDIUM | | 6.5 | | CVE-2025-68729 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix MSDU buffer types handling in RX error path |
| MEDIUM | | 5.5 | | CVE-2025-68730 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() |
| MEDIUM | | 4.7 | | CVE-2025-68745 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset |
| MEDIUM | | 7.8 | | CVE-2025-71074 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel functionfs: Use-After-Free vulnerability due to open/removal races |
| MEDIUM | | 5.5 | | CVE-2025-71117 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service via deadlock in block layer sysfs store callbacks |
| MEDIUM | | 5.5 | | CVE-2025-71141 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/tilcdc: Fix removal actions in case of failed probe |
| MEDIUM | | 5.5 | | CVE-2025-71188 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: lpc18xx-dmamux: fix device leak on route allocation |
| MEDIUM | | 6.5 | | CVE-2025-71202 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Memory Corruption and Kernel Crashes via IOMMU SVA coherency issue |
| MEDIUM | | 5.5 | | CVE-2025-71227 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: don't WARN for connections on invalid channels |
| MEDIUM | | 5.5 | | CVE-2025-71285 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels |
| MEDIUM | | 5.5 | | CVE-2025-71302 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: fix for dma-fence safe access rules |
| MEDIUM | | 7 | | CVE-2025-71313 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI: endpoint: Add missing NULL check for alloc_workqueue() |
| MEDIUM | | 5.5 | | CVE-2025-71315 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/vkms: Convert to DRM's vblank timer |
| MEDIUM | | 5.5 | | CVE-2026-100074 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| MEDIUM | | 5.5 | | CVE-2026-100076 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths |
| MEDIUM | | 5.5 | | CVE-2026-100077 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Recover HW before retire hung submit |
| MEDIUM | | 5.5 | | CVE-2026-23007 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: block: zero non-PI portion of auto integrity buffer |
| MEDIUM | | 5.5 | | CVE-2026-23017 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: idpf: fix error handling in the init_task on load |
| MEDIUM | | 5.5 | | CVE-2026-23143 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix misalignment bug in struct virtnet_info |
| MEDIUM | | 7.1 | | CVE-2026-23152 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: correctly decode TTLM with default link map |
| MEDIUM | | 5.5 | | CVE-2026-23217 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv: trace: fix snapshot deadlock with sbi ecall |
| MEDIUM | | 5.5 | | CVE-2026-23259 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/rw: free potentially allocated iovec on cache put failure |
| MEDIUM | | 5.5 | | CVE-2026-23265 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer in {read,write}_end_io |
| MEDIUM | | 5.5 | | CVE-2026-23348 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix race of nvdimm_bus object when creating nvdimm objects |
| MEDIUM | | 5.5 | | CVE-2026-23371 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting |
| MEDIUM | | 5.5 | | CVE-2026-23377 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz |
| MEDIUM | | 5.5 | | CVE-2026-23385 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: clone set on flush only |
| MEDIUM | | 5.5 | | CVE-2026-23472 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN |
| MEDIUM | | 5.5 | | CVE-2026-31435 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix read abandonment during retry |
| MEDIUM | | 5.5 | | CVE-2026-31526 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix exception exit lock checking for subprogs |
| MEDIUM | | 5.5 | | CVE-2026-31537 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: server: make use of smbdirect_socket.send_io.bcredits |
| MEDIUM | | 5.5 | | CVE-2026-31562 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register |
| MEDIUM | | 5.5 | | CVE-2026-31579 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit |
| MEDIUM | | 5.5 | | CVE-2026-31591 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish |
| MEDIUM | | 5.5 | | CVE-2026-31592 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock |
| MEDIUM | | 5.5 | | CVE-2026-31630 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rxrpc: proc: size address buffers for %pISpc output |
| MEDIUM | | 7.1 | | CVE-2026-31692 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns |
| MEDIUM | | 5.5 | | CVE-2026-31771 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_event: move wake reason storage into validated event handlers |
| MEDIUM | | 5.5 | | CVE-2026-31777 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: ctxfi: Check the error for index mapping |
| MEDIUM | | 5.5 | | CVE-2026-43009 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix incorrect pruning due to atomic fetch precision tracking |
| MEDIUM | | 5.5 | | CVE-2026-43022 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists |
| MEDIUM | | 5.5 | | CVE-2026-43029 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mptcp: fix soft lockup in mptcp_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-43034 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: set backing store type from query type |
| MEDIUM | | 7.1 | | CVE-2026-43042 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mpls: add seqcount to protect the platform_label{,s} pair |
| MEDIUM | | 5.5 | | CVE-2026-43048 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: HID: core: Mitigate potential OOB by removing bogus memset() |
| MEDIUM | | 5.5 | | CVE-2026-43053 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: close crash window in attr dabtree inactivation |
| MEDIUM | | 5.5 | | CVE-2026-43083 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: ioam6: fix OOB and missing lock |
| MEDIUM | | 5.5 | | CVE-2026-43101 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() |
| MEDIUM | | 5.5 | | CVE-2026-43115 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: srcu: Use irq_work to start GP in tiny SRCU |
| MEDIUM | | 5.5 | | CVE-2026-43118 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix zero size inode with non-zero size after log replay |
| MEDIUM | | 5.5 | | CVE-2026-43127 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs3: fix circular locking dependency in run_unpack_ex |
| MEDIUM | | 5.5 | | CVE-2026-43172 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: fix 22000 series SMEM parsing |
| MEDIUM | | 5.5 | | CVE-2026-43191 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 |
| MEDIUM | | 5.5 | | CVE-2026-43204 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: qcom: q6asm: drop DSP responses for closed data streams |
| MEDIUM | | 5.5 | | CVE-2026-43213 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: validate sequence number of TX release report |
| MEDIUM | | 5.5 | | CVE-2026-43234 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: team: avoid NETDEV_CHANGEMTU event when unregistering slave |
| MEDIUM | | 5.5 | | CVE-2026-43272 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ring-buffer: Fix possible dereference of uninitialized pointer |
| MEDIUM | | 5.5 | | CVE-2026-43294 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels |
| MEDIUM | | 5.5 | | CVE-2026-43298 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Skip vcn poison irq release on VF |
| MEDIUM | | 5.5 | | CVE-2026-43299 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() |
| MEDIUM | | 5.5 | | CVE-2026-43301 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix PM runtime usage count underflow |
| MEDIUM | | 5.5 | | CVE-2026-43308 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() |
| MEDIUM | | 5.5 | | CVE-2026-43309 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md raid: fix hang when stopping arrays with metadata through dm-raid |
| MEDIUM | | 5.5 | | CVE-2026-43310 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC |
| MEDIUM | | 5.5 | | CVE-2026-43311 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soc/tegra: pmc: Fix unsafe generic_handle_irq() call |
| MEDIUM | | 5.5 | | CVE-2026-43325 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: don't send a 6E related command when not supported |
| MEDIUM | | 5.5 | | CVE-2026-43326 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback |
| MEDIUM | | 5.5 | | CVE-2026-43337 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() |
| MEDIUM | | 5.5 | | CVE-2026-43346 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ice: ptp: don't WARN when controlling PF is unavailable |
| MEDIUM | | 5.5 | | CVE-2026-43352 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue |
| MEDIUM | | 5.5 | | CVE-2026-43353 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue |
| MEDIUM | | 7.1 | | CVE-2026-43414 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Completely fix fcport double free |
| MEDIUM | | 5.5 | | CVE-2026-43416 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: powerpc, perf: Check that current->mm is alive before getting user callchain |
| MEDIUM | | 5.5 | | CVE-2026-43443 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: amd: acp-mach-common: Add missing error check for clock acquisition |
| MEDIUM | | 5.5 | | CVE-2026-43463 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() |
| MEDIUM | | 5.5 | | CVE-2026-43464 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ |
| MEDIUM | | 5.5 | | CVE-2026-43465 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ |
| MEDIUM | | 5.5 | | CVE-2026-43485 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nouveau/gsp: drop WARN_ON in ACPI probes |
| MEDIUM | | 6.4 | | CVE-2026-45932 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix tcx/netkit detach permissions when prog fd isn't given |
| MEDIUM | | 7 | | CVE-2026-45934 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation |
| MEDIUM | | 5.5 | | CVE-2026-45940 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix oops when split header is enabled |
| MEDIUM | | 5.5 | | CVE-2026-45961 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gfs2: fix memory leaks in gfs2_fill_super error path |
| MEDIUM | | 5.5 | | CVE-2026-46014 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Add missing save/restore handling of LBR MSRs |
| MEDIUM | | 7 | | CVE-2026-46017 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm: fix deferred split queue races during migration |
| MEDIUM | | 7 | | CVE-2026-46032 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT |
| MEDIUM | | 5.5 | | CVE-2026-46044 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipmi:ssif: Clean up kthread on errors |
| MEDIUM | | 5.5 | | CVE-2026-46059 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN |
| MEDIUM | | 5.5 | | CVE-2026-46066 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix num_ops off-by-one when crypto allocation fails |
| MEDIUM | | 5.5 | | CVE-2026-46071 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 |
| MEDIUM | | 5.5 | | CVE-2026-46096 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() |
| MEDIUM | | 5.5 | | CVE-2026-46147 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() |
| MEDIUM | | 5.5 | | CVE-2026-46148 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: spi: microchip-core-qspi: control built-in cs manually |
| MEDIUM | | 5.5 | | CVE-2026-46153 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: 8021q: delete cleared egress QoS mappings |
| MEDIUM | | 5.5 | | CVE-2026-46171 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv: kvm: fix vector context allocation leak |
| MEDIUM | | 5.5 | | CVE-2026-46228 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: spi: ch341: fix devres lifetime |
| MEDIUM | | 5.5 | | CVE-2026-46245 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dc_link NULL handling in HPD init |
| MEDIUM | | 5.5 | | CVE-2026-46256 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages |
| MEDIUM | | 4.7 | | CVE-2026-46272 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: tmc-etr: Fix race condition between sysfs and perf mode |
| MEDIUM | | 5.5 | | CVE-2026-46302 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: selinux: allow multiple opens of /sys/fs/selinux/policy |
| MEDIUM | | 5.5 | | CVE-2026-46314 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Reject empty multisync extension to prevent infinite loop |
| MEDIUM | | 7 | | CVE-2026-46317 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock |
| MEDIUM | | 7 | | CVE-2026-46324 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: netfilter nf_tables denial of service via race condition in netlink hook unregistration |
| MEDIUM | | 7 | | CVE-2026-46325 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE |
| MEDIUM | | 7 | | CVE-2026-46330 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Revert "net/smc: Introduce TCP ULP support" |
| MEDIUM | | 5.5 | | CVE-2026-52937 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR |
| MEDIUM | | 7 | | CVE-2026-52953 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Fix oops due to out of scope access |
| MEDIUM | | 7 | | CVE-2026-52956 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() |
| MEDIUM | | 5.5 | | CVE-2026-52994 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting |
| MEDIUM | | 7 | | CVE-2026-53009 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ice: fix double-free of tx_buf skb |
| MEDIUM | | 5.5 | | CVE-2026-53017 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix data loss caused by incorrect use of nat_entry flag |
| MEDIUM | | 5.5 | | CVE-2026-53018 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: avoid reading already updated pages during GC |
| MEDIUM | | 5.5 | | CVE-2026-53103 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync |
| MEDIUM | | 5.5 | | CVE-2026-53104 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: Fix memory leak destroying device |
| MEDIUM | | 5.5 | | CVE-2026-53106 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Do not allow deleting local storage in NMI |
| MEDIUM | | 5.5 | | CVE-2026-53107 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: libertas: don't kill URBs in interrupt context |
| MEDIUM | | 5.5 | | CVE-2026-53108 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: powerpc/64s: Fix unmap race with PMD migration entries |
| MEDIUM | | | | CVE-2026-53178 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction |
| MEDIUM | | 7 | | CVE-2026-53224 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate embedded INIT chunk and address list lengths in cookie |
| MEDIUM | | 7 | | CVE-2026-53246 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing |
| MEDIUM | | 5.5 | | CVE-2026-53258 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: fix leak if split 6 GHz scanning fails |
| MEDIUM | | 5.5 | | CVE-2026-53281 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption |
| MEDIUM | | 5.5 | | CVE-2026-53285 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED |
| MEDIUM | | 5.5 | | CVE-2026-53292 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind |
| MEDIUM | | 5.5 | | CVE-2026-53297 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: mana: Guard mana_remove against double invocation |
| MEDIUM | | 5.5 | | CVE-2026-53321 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/napi: cap busy_poll_to 10 msec |
| MEDIUM | | 5.5 | | CVE-2026-53377 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: always recover the gpu |
| MEDIUM | | | | CVE-2026-53401 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: omap2: fix use-after-free in omapfb_mmap |
| MEDIUM | | | | CVE-2026-63805 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: crypto: nx - fix nx_crypto_ctx_exit argument |
| MEDIUM | | | | CVE-2026-63811 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: read COW data with the original inode during atomic write |
| MEDIUM | | | | CVE-2026-63819 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on f2fs_get_node_folio_ra() |
| MEDIUM | | 5.5 | | CVE-2026-63832 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: add wcid publish check in mt76_sta_add |
| MEDIUM | | 5.5 | | CVE-2026-63853 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring |
| MEDIUM | | | | CVE-2026-63857 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-63858 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: add hook transactions for device deletions |
| MEDIUM | | | | CVE-2026-63859 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue() |
| MEDIUM | | 7 | | CVE-2026-63941 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor |
| MEDIUM | | 7 | | CVE-2026-63979 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/handshake: hand off the pinned file reference to accept_doit |
| MEDIUM | | 5.5 | | CVE-2026-63998 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ethtool: module: call ethnl_ops_complete() on module flash errors |
| MEDIUM | | 5.5 | | CVE-2026-63999 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure |
| MEDIUM | | 5.5 | | CVE-2026-64006 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: fix dst corruption in same register operation |
| MEDIUM | | 7 | | CVE-2026-64024 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction |
| MEDIUM | | 5.5 | | CVE-2026-64036 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cgroup/rstat: validate cpu before css_rstat_cpu() access |
| MEDIUM | | 5.5 | | CVE-2026-64038 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Stop work before releasing hwmon device |
| MEDIUM | | 5.5 | | CVE-2026-64060 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix leak of request in netfs_write_begin() error handling |
| MEDIUM | | 7.1 | | CVE-2026-64066 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_read_to_pagecache() to pause on subreq failure |
| MEDIUM | | 5.5 | | CVE-2026-64067 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing barriers when accessing stream->subrequests locklessly |
| MEDIUM | | 7 | | CVE-2026-64068 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing locking around retry adding new subreqs |
| MEDIUM | | 5.5 | | CVE-2026-64076 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: bridge: eb_tables: close module init race |
| MEDIUM | | 5.5 | | CVE-2026-64077 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: ebtables: move to two-stage removal scheme |
| MEDIUM | | 7.1 | | CVE-2026-64078 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: add and use xtables_unregister_table_exit |
| MEDIUM | | 5.5 | | CVE-2026-64079 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: allocate hook ops while under mutex |
| MEDIUM | | 7 | | CVE-2026-64117 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb |
| MEDIUM | | 5.5 | | CVE-2026-64146 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix metabuf leak in inode xattr initialization |
| MEDIUM | | 5.5 | | CVE-2026-64154 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() |
| MEDIUM | | 5.5 | | CVE-2026-64159 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix zeropoint update where i_size > remote_i_size |
| MEDIUM | | 7 | | CVE-2026-64160 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point |
| MEDIUM | | 5.5 | | CVE-2026-64190 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: team: fix NULL pointer dereference in team_xmit during mode change |
| MEDIUM | | 5.5 | | CVE-2026-64212 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it |
| MEDIUM | | 5.5 | | CVE-2026-64213 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Add lock protection to lm90_alert |
| MEDIUM | | 7 | | CVE-2026-64255 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers |
| MEDIUM | | 7 | | CVE-2026-64520 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies |
| MEDIUM | | 7 | | CVE-2026-68086 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/khugepaged: write all dirty file folios when collapsing |
| MEDIUM | | 5.5 | | CVE-2026-68211 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: stm32-dcmipp: Return queued buffers on start_streaming() failure |
| MEDIUM | | 5.5 | | CVE-2026-68233 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/vc4: Shut down BO cache timer before teardown |
| MEDIUM | | 5.5 | | CVE-2026-68242 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/gt: Fix NULL deref on sched_engine alloc failure |
| MEDIUM | | 5.5 | | CVE-2026-68258 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size |
| MEDIUM | | 5.5 | | CVE-2026-68291 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: idpf driver null pointer dereference leads to Denial of Service |
| MEDIUM | | 5.5 | | CVE-2026-68295 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: BPF: Zero-extend signed ALU32 div/mod results |
| MEDIUM | | 5.5 | | CVE-2026-68312 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths |
| MEDIUM | | 7 | | CVE-2026-68323 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tipc: serialize udp bearer replicast list updates |
| MEDIUM | | 5.5 | | CVE-2026-68382 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Hold device ref until queue teardown completes |
| MEDIUM | | 5.5 | | CVE-2026-68383 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Keep scheduler timeline name alive |
| MEDIUM | | 7 | | CVE-2026-68393 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: extend conn_hash lookup critical sections |
| MEDIUM | | 6.4 | | CVE-2026-68399 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix UAF in sock clone early bailouts |
| MEDIUM | | 7 | | CVE-2026-68400 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation |
| MEDIUM | | 7 | | CVE-2026-68401 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() |
| MEDIUM | | 7 | | CVE-2026-68404 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect |
| MEDIUM | | 5.5 | | CVE-2026-68421 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() |
| MEDIUM | | 5.5 | | CVE-2026-68435 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Fix address space mismatch in kexec command line lookup |
| MEDIUM | | 5.5 | | CVE-2026-68441 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains |
| MEDIUM | | 5.5 | | CVE-2026-68447 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size |
| MEDIUM | | 7 | | CVE-2026-68448 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ovl: check access to copy_file_range source with src mounter creds |
| MEDIUM | | 7 | | CVE-2026-68453 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey |
| MEDIUM | | 5.5 | | CVE-2026-68471 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ieee80211: validate MLE common info length |
| MEDIUM | | 5.5 | | CVE-2026-72073 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mmc: vub300: fix use-after-free on probe failure |
| MEDIUM | | 5.5 | | CVE-2026-72162 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec |
| MEDIUM | | 7 | | CVE-2026-72288 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling |
| MEDIUM | | 7 | | CVE-2026-72329 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/liquidio: drop cached VF pci_dev LUT |
| MEDIUM | | 5.5 | | CVE-2026-72337 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: 6lowpan: avoid untracked enable work |
| MEDIUM | | 5.5 | | CVE-2026-72341 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Fix publication race for priv->channel_stats[] |
| MEDIUM | | 5.5 | | CVE-2026-72355 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix barriering when walking subrequest list |
| MEDIUM | | 5.5 | | CVE-2026-72365 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix writethrough to use collection offload |
| MEDIUM | | 5.5 | | CVE-2026-72367 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iomap: guard io_size EOF trim against concurrent truncate underflow |
| MEDIUM | | 5.5 | | CVE-2026-72375 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix reinitialisation of the inode, in particular ->lock_work |
| MEDIUM | | 5.5 | | CVE-2026-72380 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xen/pvcalls: bound backend response req_id before indexing rsp[] |
| MEDIUM | | 5.5 | | CVE-2026-72383 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: fix addr_wq_timer race in sctp_free_addr_wq() |
| MEDIUM | | 5.5 | | CVE-2026-72388 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock |
| MEDIUM | | 5.5 | | CVE-2026-72397 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() |
| MEDIUM | | 7 | | CVE-2026-72398 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: add INIT verification after cookie unpacking |
| MEDIUM | | 5.5 | | CVE-2026-72404 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() |
| MEDIUM | | 5.5 | | CVE-2026-72423 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Guard conntrack opts error writes |
| MEDIUM | | 5.5 | | CVE-2026-72440 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1: fix writes_pending and barrier reference leaks on write failures |
| MEDIUM | | 5.5 | | CVE-2026-72454 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() |
| MEDIUM | | 5.5 | | CVE-2026-72488 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soundwire: fix bug in sdw_add_element_group_count found by syzkaller |
| MEDIUM | | 5.5 | | CVE-2026-72493 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: serialize netif_running() check in enqueue_to_backlog() |
| MEDIUM | | 5.5 | | CVE-2026-72495 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages |
| MEDIUM | | 7 | | CVE-2026-72499 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free CQ toggle page after firmware teardown |
| MEDIUM | | 7 | | CVE-2026-72500 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown |
| MEDIUM | | | | CVE-2026-72501 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: R ... |
| MEDIUM | | 5.5 | | CVE-2026-74257 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sockmap: Fix use-after-free in udp_bpf_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-74264 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: watchdog: fix refcount tracking races |
| MEDIUM | | 5.5 | | CVE-2026-74272 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Resolve region deletion races |
| MEDIUM | | 5.5 | | CVE-2026-74273 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Block region delete during region creation |
| MEDIUM | | 5.5 | | CVE-2026-74314 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Cancel special fields on map value recycle |
| MEDIUM | | 5.5 | | CVE-2026-74317 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ixgbe: do not configure xps for XDP queues |
| MEDIUM | | 5.5 | | CVE-2026-74324 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: validate skb length in testmode query |
| MEDIUM | | 5.5 | | CVE-2026-74337 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks |
| MEDIUM | | 5.5 | | CVE-2026-74342 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: kernfs: link kn to its parent before the LSM init hook |
| MEDIUM | | 5.5 | | CVE-2026-74344 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear rb node linkage when freeing bpf_rb_root |
| MEDIUM | | 5.5 | | CVE-2026-74350 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate fast symlink target during inode read |
| MEDIUM | | 5.5 | | CVE-2026-74354 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Take mmap_lock in zap_pages() |
| MEDIUM | | 5.5 | | CVE-2026-74368 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() |
| MEDIUM | | 6.5 | | CVE-2026-74385 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock |
| MEDIUM | | 5.5 | | CVE-2026-74388 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data |
| MEDIUM | | 7 | | CVE-2026-74405 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: OPP: Fix race between OPP addition and lookup |
| MEDIUM | | 5.5 | | CVE-2026-74407 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath11k: cancel SSR work items during PCI shutdown |
| MEDIUM | | 5.5 | | CVE-2026-74449 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport |
| MEDIUM | | 5.5 | | CVE-2026-74466 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Close speculative mem read possibility |
| MEDIUM | | 7 | | CVE-2026-74506 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix UAF when sending a message |
| MEDIUM | | 7 | | CVE-2026-74513 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister |
| MEDIUM | | 5.5 | | CVE-2026-74527 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-af: Block VFs from clobbering special CGX PKIND state |
| MEDIUM | | 5.5 | | CVE-2026-74529 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback |
| MEDIUM | | 5.5 | | CVE-2026-74530 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback |
| MEDIUM | | 7 | | CVE-2026-74533 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero |
| MEDIUM | | 7 | | CVE-2026-74537 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: hold sk properly in iso_conn_ready |
| MEDIUM | | 5.5 | | CVE-2026-74538 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: lock sk in iso_connect_ind |
| MEDIUM | | 5.5 | | CVE-2026-74542 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix folio_queue ENOMEM in writeback by adding a mempool |
| MEDIUM | | 5.5 | | CVE-2026-74544 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds |
| MEDIUM | | 5.5 | | CVE-2026-74600 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/page_table_check: skip special zero mappings |
| MEDIUM | | 5.5 | | CVE-2026-74605 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: eventfs: Use children field for rcu head and add memory barriers |
| MEDIUM | | 7 | | CVE-2026-74611 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tls: rx: restore msg_iter before TLS 1.3 optimistic retry |
| MEDIUM | | 5.5 | | CVE-2026-74638 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Serialize the scheduler timeout handlers |
| MEDIUM | | 5.5 | | CVE-2026-74687 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: watchdog: at91sam9_wdt: prevent timer rearm during teardown |
| MEDIUM | | 7 | | CVE-2026-74695 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() |
| MEDIUM | | 7 | | CVE-2026-74697 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Disable EOP for TPA on all chips to prevent data corruption |
| MEDIUM | | 5.5 | | CVE-2026-74711 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus) Fix type confusion in notification logic |
| MEDIUM | | 5.5 | | CVE-2026-74713 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vhost_iotlb: bound map allocation in add_range |
| MEDIUM | | 7 | | CVE-2026-74715 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix netns reference imbalance in conntrack kfuncs |
| MEDIUM | | 5.5 | | CVE-2026-74723 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject inline extents without valid headers |
| MEDIUM | | 5.5 | | CVE-2026-74729 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read |
| MEDIUM | | 5.5 | | CVE-2026-74747 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipvs: revalidate ihl to prevent out-of-bounds access |
| MEDIUM | | 5.5 | | CVE-2026-80579 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: clear fb_info->mode before deleting a videomode |
| MEDIUM | | 5.5 | | CVE-2026-80580 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: bound mode sysfs output to the sysfs buffer |
| MEDIUM | | 5.5 | | CVE-2026-80614 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: emac: Fix NULL pointer dereference in emac_probe |
| MEDIUM | | 5.5 | | CVE-2026-80623 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: ete: Always save state on power down |
| MEDIUM | | 5.5 | | CVE-2026-80628 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Serialize readq reset state with q->lock |
| MEDIUM | | 5.5 | | CVE-2026-80631 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject compressed segment that overflows the compressed input |
| MEDIUM | | 5.5 | | CVE-2026-80634 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag |
| MEDIUM | | 5.5 | | CVE-2026-80655 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soc: xilinx: Fix race condition in event registration |
| MEDIUM | | 5.5 | | CVE-2026-80662 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size |
| MEDIUM | | 7 | | CVE-2026-80668 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations |
| MEDIUM | | 5.5 | | CVE-2026-80670 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() |
| MEDIUM | | 5.5 | | CVE-2026-80692 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks |
| MEDIUM | | 7 | | CVE-2026-80693 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: idpf: bound interrupt-vector register fill to the allocated array |
| MEDIUM | | 5.5 | | CVE-2026-80698 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: idxd: fix double free of wq, engine, and group structs |
| MEDIUM | | 5.5 | | CVE-2026-80721 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: ensure no dangling hcon references in iso_conn |
| MEDIUM | | | | CVE-2026-80761 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| MEDIUM | | 5.5 | | CVE-2026-80905 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: tap: fix wrong transport_header when sending VLAN-tagged frame |
| MEDIUM | | 5.5 | | CVE-2026-80920 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring: defer eventfd signaling when queued from a wakeup handler |
| MEDIUM | | 5.5 | | CVE-2026-81010 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/waitid: honor task_work cancellation |
| MEDIUM | | 7 | | CVE-2026-89528 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Reject Read lists that exceed the page budget |
| MEDIUM | | 4.8 | | CVE-2026-89534 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| MEDIUM | | 7 | | CVE-2026-89537 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 |
| MEDIUM | | 7.2 | | CVE-2026-89610 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs: verify run length exceeding volume boundary |
| MEDIUM | | 5.5 | | CVE-2026-89611 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs: validate non-resident attribute offsets |
| MEDIUM | | 7.1 | | CVE-2026-89632 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() |
| MEDIUM | | 7 | | CVE-2026-89637 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 |
| MEDIUM | | 5.5 | | CVE-2026-89639 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC |
| MEDIUM | | 3.3 | | CVE-2026-89642 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cifs: call pagecache_isize_extended() in cifs_setsize() when extending |
| MEDIUM | | 6.2 | | CVE-2026-89648 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ceph: cap delegated inode count in ceph_parse_deleg_inos() |
| MEDIUM | | 7 | | CVE-2026-89654 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix UAF in check_new_map() on session freed during unlock |
| MEDIUM | | 5.3 | | CVE-2026-89682 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net |
| MEDIUM | | 5.3 | | CVE-2026-89705 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths |
| MEDIUM | | 5.9 | | CVE-2026-89709 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: lockd, nfsd: RCU-protect nlmsvc_ops dispatch |
| MEDIUM | | 5.5 | | CVE-2026-89722 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() |
| MEDIUM | | 5.5 | | CVE-2026-89757 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/mglru: fix and remove redundant unevictable folio handling |
| MEDIUM | | 4.7 | | CVE-2026-89810 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix error path at svm_migrate_copy_to_ram |
| MEDIUM | | | | CVE-2026-89826 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| MEDIUM | | | | CVE-2026-89833 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| MEDIUM | | | | CVE-2026-89866 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| MEDIUM | | | | CVE-2026-89906 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| MEDIUM | | 4.7 | | CVE-2026-89913 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables |
| MEDIUM | | 4.7 | | CVE-2026-89920 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Fix memory corruption by not reinjecting CK machine checks |
| MEDIUM | | | | CVE-2026-89935 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 3.6 | | CVE-2026-89987 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/huge_memory: transfer the pmd dirty bit to the folio on zap |
| MEDIUM | | 5.5 | | CVE-2026-90040 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped |
| MEDIUM | | 5.5 | | CVE-2026-90061 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: skip double clone set expressions on element insert |
| MEDIUM | | 5.5 | | CVE-2026-90083 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: act_ife: Only operate on Ethernet frames |
| MEDIUM | | 5.5 | | CVE-2026-90087 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: do not leak an hci_conn when a second LE connect is rejected |
| MEDIUM | | 7 | | CVE-2026-90093 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: access chan->conn safely in get/setsockopt |
| MEDIUM | | 5.5 | | CVE-2026-90098 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: fix sleep in atomic context in MAC table access |
| MEDIUM | | 7 | | CVE-2026-90099 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: account classifier filter allocations to memcg |
| MEDIUM | | 7 | | CVE-2026-90104 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFSv4.1: zero referring call lists before decoding |
| MEDIUM | | 5.5 | | CVE-2026-90105 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vxlan: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90106 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: arp/nd proxy: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90116 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: mtpav: shut down output timer before card teardown |
| MEDIUM | | 5.5 | | CVE-2026-90142 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix resize of the RX ring |
| MEDIUM | | 5.5 | | CVE-2026-90149 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers |
| MEDIUM | | 5.5 | | CVE-2026-90154 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: scope session state changes to bound connections |
| MEDIUM | | 5.5 | | CVE-2026-90155 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: detach blocked lock requests before freeing |
| MEDIUM | | 5.5 | | CVE-2026-90156 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely discard unregistered deferred locks |
| MEDIUM | | 7 | | CVE-2026-90161 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix interlaced ztailpacking pclusters |
| MEDIUM | | 5.5 | | CVE-2026-90162 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: defer publishing granted locks to prevent UAF/double-free race |
| MEDIUM | | 5.5 | | CVE-2026-90167 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: serialize oplock close with pending break ownership |
| MEDIUM | | 5.5 | | CVE-2026-90174 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() |
| MEDIUM | | 5.5 | | CVE-2026-90177 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check pointer type for all atomic RMW paths |
| MEDIUM | | 5.5 | | CVE-2026-90179 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix deadlock in complain-mode change_hat |
| MEDIUM | | 5.5 | | CVE-2026-90204 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate DIO orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90205 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90208 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type |
| MEDIUM | | 5.5 | | CVE-2026-90217 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Compare iterator types during state pruning |
| MEDIUM | | 5.5 | | CVE-2026-90231 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix unconfined user namespace restriction forced stack |
| MEDIUM | | 5.5 | | CVE-2026-90232 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: amt: Don't support cross-netns setup |
| MEDIUM | | 5.1 | | CVE-2026-90234 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFS: Return a delegation the client fails to record |
| MEDIUM | | 7 | | CVE-2026-90237 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nft_ct: move custom expectation support to helper |
| MEDIUM | | 7 | | CVE-2026-90240 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Flush context cache with correct SID when tearing down aliases |
| MEDIUM | | 5.5 | | CVE-2026-90247 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix mmap_lock leak in irq_work path |
| MEDIUM | | 5.9 | | CVE-2026-90256 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind |
| MEDIUM | | 5.5 | | CVE-2026-90259 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() |
| MEDIUM | | 4.7 | | CVE-2026-90260 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: don't clobber the extent buffer when zeroing it out |
| MEDIUM | | 3.3 | | CVE-2026-90263 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: check if root is readonly when setting posix acl |
| MEDIUM | | 5.5 | | CVE-2026-90264 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: always wait for ordered extents to avoid OE races |
| MEDIUM | | 5.5 | | CVE-2026-90265 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: defrag: fix deadlock between defrag and delalloc space reservation |
| MEDIUM | | 5.5 | | CVE-2026-90273 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable |
| MEDIUM | | 5.5 | | CVE-2026-90289 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Resize MST HDCP per-connector arrays to 32 |
| MEDIUM | | 5.5 | | CVE-2026-90300 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear buf on error in __bpf_get_task_stack |
| MEDIUM | | 5.5 | | CVE-2026-90301 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: o2hb: quiesce negotiate handlers and timeout work |
| MEDIUM | | 7 | | CVE-2026-90317 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Invalidate RCU pointers after final spin unlock |
| MEDIUM | | 5.5 | | CVE-2026-90320 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate external xattr entries when reading metadata |
| MEDIUM | | 5.5 | | CVE-2026-90321 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate inline xattrs during inode block validation |
| MEDIUM | | 5.5 | | CVE-2026-90324 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ublk: check import_ubuf() return value |
| MEDIUM | | 4.7 | | CVE-2026-90326 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-cgroup: fix race between policy activation and blkg destruction |
| MEDIUM | | 5.5 | | CVE-2026-90328 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: HID: steam: Reject short reads |
| MEDIUM | | 6.4 | | CVE-2026-90333 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dm-integrity: replace forgeable discard filler with a keyed sector marker |
| MEDIUM | | 4.1 | | CVE-2026-90336 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: clear freed pointers on uart_register_driver() failure |
| MEDIUM | | 5.5 | | CVE-2026-90337 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: do fallible allocations before the console can be registered |
| MEDIUM | | 7 | | CVE-2026-90343 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: stop PMSR before P2P and NAN teardown |
| MEDIUM | | 5.5 | | CVE-2026-90345 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: brcmfmac: fix P2P action frame handling without device vif |
| MEDIUM | | 7 | | CVE-2026-90347 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry |
| MEDIUM | | 5.5 | | CVE-2026-90351 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed |
| MEDIUM | | 4.4 | | CVE-2026-90359 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject >8 byte return values on return-reading trampoline paths |
| MEDIUM | | 5.5 | | CVE-2026-90363 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: don't tear down KMS twice when KMS init fails |
| MEDIUM | | 5.5 | | CVE-2026-90365 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: cancel reset and rc work on device unregister |
| MEDIUM | | 5.5 | | CVE-2026-90367 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER |
| MEDIUM | | 4.8 | | CVE-2026-90379 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash |
| MEDIUM | | 3.3 | | CVE-2026-90401 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md: remove REQ_NOWAIT support from raid1/10/456 |
| MEDIUM | | 5.5 | | CVE-2026-90408 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() |
| MEDIUM | | 5.5 | | CVE-2026-90409 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Add vm_bind region with kbo range overlap check |
| MEDIUM | | 4.7 | | CVE-2026-90417 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() |
| MEDIUM | | 5.5 | | CVE-2026-90421 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI: Fix UAF when probe runs concurrent to dyn ID removal |
| MEDIUM | | 5.5 | | CVE-2026-90422 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path |
| MEDIUM | | 4.7 | | CVE-2026-90427 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() |
| MEDIUM | | 5.5 | | CVE-2026-92480 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Validate string descriptors |
| MEDIUM | | 5.5 | | CVE-2026-92482 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip |
| MEDIUM | | 3.3 | | CVE-2026-92485 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix WARNING in bpf_tracing_link_release |
| MEDIUM | | 5.5 | | CVE-2026-92499 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext4: validate readdir offset before accessing dirent |
| MEDIUM | | 4.7 | | CVE-2026-92500 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext4: use fsdata to track inline data write state and fix race |
| MEDIUM | | 5.5 | | CVE-2026-92503 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() |
| MEDIUM | | 5.5 | | CVE-2026-92518 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv, bpf: Fix kernel stack corruption in tailcall with CFI |
| MEDIUM | | 5.5 | | CVE-2026-92520 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Zero queue and stack outputs on lock failure |
| MEDIUM | | 5.5 | | CVE-2026-93044 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for arena-related insns |
| MEDIUM | | 5.5 | | CVE-2026-93047 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Associate BOs with every job that accesses them |
| MEDIUM | | 5.5 | | CVE-2026-93058 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Only fini scheduler after successful init |
| MEDIUM | | 5.5 | | CVE-2026-93081 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_scmi: Fix SCMI device destroy lifetimes |
| MEDIUM | | 4.7 | | CVE-2026-93099 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Fix UAF from worker threads when domains are removed |
| MEDIUM | | 4.7 | | CVE-2026-93100 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() |
| MEDIUM | | 4.7 | | CVE-2026-93104 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rvt: Return NULL after port allocation failure |
| MEDIUM | | 7 | | CVE-2026-93105 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: esp: do not unref managed frag pages in esp_ssg_unref() |
| MEDIUM | | 5.5 | | CVE-2026-93122 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: usb: gadget: uac: validate rate list length before storing |
| MEDIUM | | 5.5 | | CVE-2026-93135 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject programs with inlined helpers if JIT is not available |
| MEDIUM | | 7 | | CVE-2026-93148 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject MEM_ALLOC BTF accesses past object bounds |
| MEDIUM | | 7 | | CVE-2026-93154 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Add refcounting to user ring MRs |
| MEDIUM | | 5.5 | | CVE-2026-93168 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout |
| MEDIUM | | 5.5 | | CVE-2026-93175 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in CRTC reset function |
| MEDIUM | | 4.7 | | CVE-2026-93176 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in plane reset function |
| MEDIUM | | 5.5 | | CVE-2026-93270 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn |
| MEDIUM | | 5.5 | | CVE-2026-93272 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 |
| MEDIUM | | 5.5 | | CVE-2026-93276 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator |
| MEDIUM | | 5.5 | | CVE-2026-93282 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix maximum allowed access checks |
| MEDIUM | | 7.1 | | CVE-2026-97422 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: fix SMI event cross-process information leak |
| MEDIUM | | 5.5 | | CVE-2026-97432 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: fix P2P-Device binding handling |
| MEDIUM | | 5.5 | | CVE-2026-97478 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virt: acrn: Fix irqfd use-after-free during eventfd shutdown |
| MEDIUM | | 7.1 | | CVE-2026-97493 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS |
| MEDIUM | | 5.5 | | CVE-2026-97499 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: perf: Retrieve path and source from event data |
| MEDIUM | | 5.5 | | CVE-2026-97513 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Release m2m_ctx after Instance Removed from List |
| MEDIUM | | 5.5 | | CVE-2026-97515 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 |
| MEDIUM | | 5.5 | | CVE-2026-97526 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/pai: Support CPU hotplug for PMU PAI |
| MEDIUM | | 5.5 | | CVE-2026-97538 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (asus_rog_ryujin) Validate HID report lengths |
| MEDIUM | | 5.5 | | CVE-2026-97554 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() |
| MEDIUM | | 7 | | CVE-2026-97561 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid |
| MEDIUM | | 7 | | CVE-2026-97563 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97565 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject short READ responses in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97960 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel: Prevent drain_pebs() reentry |
| MEDIUM | | 5.5 | | CVE-2026-97962 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Move representor vnic reporter to eswitch devlink port |
| MEDIUM | | 5.1 | | CVE-2026-97975 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() |
| MEDIUM | | 4.7 | | CVE-2026-97988 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vhost: invalidate vring access on IOTLB transitions |
| MEDIUM | | 5.5 | | CVE-2026-98019 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: mark a NULL call argument precise |
| MEDIUM | | 5.3 | | CVE-2026-98032 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tracing: Fix subbuf resize races with trace_pipe_raw readers |
| MEDIUM | | 7 | | CVE-2026-98033 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Preserve inner map identity in callback frames |
| MEDIUM | | 7 | | CVE-2026-98034 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark NULL kptr stores precise |
| MEDIUM | | 5.5 | | CVE-2026-98043 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Don't infer non-NULL from a pointer with an unbounded offset |
| MEDIUM | | 7 | | CVE-2026-98047 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check ancestor frames for rbtree callbacks |
| MEDIUM | | 7 | | CVE-2026-98048 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: don't rewrite bpf_fastcall patterns entered by a jump |
| MEDIUM | | 5.5 | | CVE-2026-98049 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: zero extend the result of an arena 32-bit cmpxchg |
| MEDIUM | | 5.5 | | CVE-2026-98053 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Refactor and fix init_config access |
| MEDIUM | | 5.5 | | CVE-2026-98062 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark signal tracepoint siginfo arguments as scalar |
| MEDIUM | | 5.5 | | CVE-2026-98085 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge |
| MEDIUM | | | | CVE-2026-98099 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 5.5 | | CVE-2026-98115 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely drain sessions during logoff |
| MEDIUM | | 5.5 | | CVE-2026-98118 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix readahead synchronisation issues by loading all folios upfront |
| MEDIUM | | 5.5 | | CVE-2026-98124 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/client: invalidate fscache for fallocate range operations |
| MEDIUM | | 5.5 | | CVE-2026-98125 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix stale page cache in insert/collapse range |
| MEDIUM | | 5.5 | | CVE-2026-98131 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix dma mapping leak in stmmac_tso_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-98134 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: check_cond_jmp_op(): properly infer if register is null |
| MEDIUM | | 5.3 | | CVE-2026-98156 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/virtio: use the DMA API for resource backing on Xen |
| MEDIUM | | 5.5 | | CVE-2026-98162 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/server: fix tree connection leak in smb2_tree_connect() |
| MEDIUM | | 5.5 | | CVE-2026-98180 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: RCU-free the scheduler-containing ring and VM objects |
| MEDIUM | | 5.5 | | CVE-2026-98228 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ |
| MEDIUM | | 4.4 | | CVE-2026-98273 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: x86/kprobes: Fix crash when probing CS CALL instructions |
| MEDIUM | | 5.5 | | CVE-2026-98277 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: ring the doorbell if a burst ends in a drop |
| MEDIUM | | 5.5 | | CVE-2026-98279 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: handle lack of space when cleaning up verity items |
| MEDIUM | | 5.3 | | CVE-2026-98284 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netlink: do not free nlk->groups while lockless readers can use it |
| MEDIUM | | 4.1 | | CVE-2026-98286 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown |
| MEDIUM | | 5.5 | | CVE-2026-98288 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix TSO header length truncation |
| MEDIUM | | 5.5 | | CVE-2026-98292 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| MEDIUM | | 5.5 | | CVE-2026-98294 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_qca: Do not write to the serial port after it is closed |
| MEDIUM | | 7 | | CVE-2026-98296 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btintel_pcie: validate TX skb length in send_sync |
| MEDIUM | | 5.5 | | CVE-2026-98313 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/dp: skip PUSH_IDLE when the link was never enabled |
| MEDIUM | | 7 | | CVE-2026-98330 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: get the wiphy out of a dying network namespace |
| MEDIUM | | 5.5 | | CVE-2026-98333 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: reset the LED state when ifup fails |
| MEDIUM | | 7 | | CVE-2026-98341 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: don't free driver-owned scan requests |
| MEDIUM | | 5.5 | | CVE-2026-98353 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables |
| MEDIUM | | 5.5 | | CVE-2026-98355 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rtrs: guard against null kobj name |
| MEDIUM | | 5.5 | | CVE-2026-98376 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Use array_map_meta_equal for percpu array inner map replacement |
| MEDIUM | | 5.5 | | CVE-2026-98408 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: watchdog: rzv2h: Avoid division by zero |
| MEDIUM | | 5.5 | | CVE-2026-98420 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: follow SMB2 session expiration semantics |
| MEDIUM | | | | CVE-2026-98436 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: a ... |
| MEDIUM | | 6.5 | | CVE-2026-98439 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/server: cancel async requests when closing connection |
| MEDIUM | | 4.7 | | CVE-2026-98444 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: drop dquot flush lock when we can't find a buffer to flush |
| MEDIUM | | 6.5 | | CVE-2026-98449 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: delete compound mids on send failure before unlock |
| MEDIUM | | 5.3 | | CVE-2026-98471 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Do cache maintenance on the source VM during intra-host migration |
| MEDIUM | | 5.5 | | CVE-2026-98556 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gve: DQO: reject TSO packets with an out of range MSS |
| MEDIUM | | 4.1 | | CVE-2026-98558 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: flush skb_defer_nodes in dev_cpu_dead() |
| MEDIUM | | 5.9 | | CVE-2026-98570 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: ipv6: keep room for the mac header in dst_dev_overhead() |
| MEDIUM | | 6.7 | | CVE-2026-98589 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject pkt arguments in mutating subprogs |
| MEDIUM | | 4.7 | | CVE-2026-98598 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv6: Prevent rt6_insert_exception() for dying fib6_info |
| MEDIUM | | 6.7 | | CVE-2026-98599 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() |
| MEDIUM | | 4.1 | | CVE-2026-98616 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: reset num_napi when the napi vectors are freed |
| MEDIUM | | 5.5 | | CVE-2026-98652 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Add missing srcu in kvm_s390_set_irq_state() |
| MEDIUM | | 5.5 | | CVE-2026-98674 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iio: adc: adi-axi-adc: Initialize state mutex |
| MEDIUM | | 5.6 | | CVE-2026-98714 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| MEDIUM | | 4.1 | | CVE-2026-98740 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety |
| MEDIUM | | 4.4 | | CVE-2026-98747 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix NULL pointer dereference in serial_core_unregister_port() |
| MEDIUM | | 4.7 | | CVE-2026-98786 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: guard dc_sink dereferences in MST mode validation |
| MEDIUM | | 4.4 | | CVE-2026-98789 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix objects stuck in free_by_rcu_ttrace |
| MEDIUM | | 4.4 | | CVE-2026-98795 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: skip ptp deinit if init was skipped |
| MEDIUM | | 4.4 | | CVE-2026-98799 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Skip detached progs in trampoline images that are still in use |
| MEDIUM | | 4.7 | | CVE-2026-98800 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: kernel: Denial of Service via use-after-free in BPF trampoline |
| MEDIUM | | 6.5 | | CVE-2026-98803 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix rx Scatter-Gather support |
| MEDIUM | | 6.1 | | CVE-2026-98810 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() |
| MEDIUM | | 4.4 | | CVE-2026-98813 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Hold map BTF for the memory allocator destructor record |
| MEDIUM | | 4.4 | | CVE-2026-98814 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix command effects log lifetime for multipath heads |
| MEDIUM | | 4.1 | | CVE-2026-98815 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix cdev lifetime |
| MEDIUM | | 4.1 | | CVE-2026-98816 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix overflow of jump offset in constant blinding |
| MEDIUM | | 5.5 | | CVE-2026-98820 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: set RQF_USE_SCHED when the operation is known |
| MEDIUM | | 5.3 | | CVE-2026-98824 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate TX status rate metadata |
| MEDIUM | | 6.5 | | CVE-2026-98829 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: drop oversized fragments to avoid extra_len overflow |
| MEDIUM | | 4.1 | | CVE-2026-98834 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mtd: core: avoid double-free of OTP NVMEM device |
| MEDIUM | | 6.1 | | CVE-2026-98839 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() |
| MEDIUM | | 4.4 | | CVE-2026-98843 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: zero gaps in read-gaps folio to avoid writing back stale data |
| MEDIUM | | 5.6 | | CVE-2026-98863 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| MEDIUM | | 4.6 | | CVE-2019-15213 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: use-after-free caused by malicious USB device in drivers/media/usb/dvb-usb/dvb-usb-init.c |
| MEDIUM | | 4.1 | | CVE-2019-16089 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Improper return check in nbd_genl_status function in drivers/block/nbd.c |
| MEDIUM | | 4.7 | | CVE-2019-20794 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: task processes not being properly ended could lead to resource exhaustion |
| MEDIUM | | 4.4 | | CVE-2020-14304 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ethtool when reading eeprom of device could lead to memory leak |
| MEDIUM | | 6.7 | | CVE-2020-36694 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: use-after-free in the packet processing context |
| MEDIUM | | 5.5 | | CVE-2023-31082 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sleeping function called from an invalid context in gsmld_write |
| MEDIUM | | 7 | | CVE-2023-3397 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: slab-use-after-free Write in txEnd due to race condition |
| MEDIUM | | 5.5 | | CVE-2023-37454 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: udf: use-after-free write in udf_close_lvid |
| MEDIUM | | 6.7 | | CVE-2023-6238 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvme: memory corruption via unprivileged user passthrough |
| MEDIUM | | 6.5 | | CVE-2023-6240 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation |
| MEDIUM | | 5.5 | | CVE-2024-2193 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | hw: Spectre-SRC that is Speculative Race Conditions (SRCs) for synchronization primitives similar like Spectre V1 with p |
| MEDIUM | | 4.7 | | CVE-2024-24864 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | A race condition was found in the Linux kernel's media/dvb-core in dvb ... |
| MEDIUM | | 5.5 | | CVE-2024-25740 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory leak in ubi driver |
| MEDIUM | | 5.5 | | CVE-2024-56709 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring: check if iowq is killed before queuing |
| MEDIUM | | 5.5 | | CVE-2024-58074 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/i915: Grab intel_display from the encoder to avoid potential oopsies |
| MEDIUM | | 5.5 | | CVE-2025-21752 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents |
| MEDIUM | | 5.5 | | CVE-2025-21949 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Set hugetlb mmap base address aligned with pmd size |
| MEDIUM | | 5.5 | | CVE-2025-22109 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ax25: Remove broken autobind |
| MEDIUM | | 5.5 | | CVE-2025-23132 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: quota: fix to avoid warning in dquot_writeback_dquots() |
| MEDIUM | | 5.5 | | CVE-2025-23135 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Teardown riscv specific bits after kvm_exit |
| MEDIUM | | 5.5 | | CVE-2025-37743 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Avoid memory leak while enabling statistics |
| MEDIUM | | 5.5 | | CVE-2025-37746 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/dwc_pcie: fix duplicate pci_dev devices |
| MEDIUM | | 5.5 | | CVE-2025-37880 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: um: work around sched_yield not yielding in time-travel mode |
| MEDIUM | | 4.7 | | CVE-2025-37906 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: ublk race condition causes kernel crash |
| MEDIUM | | 5.5 | | CVE-2025-38029 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to sleepable page allocation in KASAN |
| MEDIUM | | 5.5 | | CVE-2025-38036 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to null pointer dereference in GT MMIO initialization for VFs |
| MEDIUM | | 5.5 | | CVE-2025-38041 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clk: sunxi-ng: h616: Reparent GPU clock during frequency changes |
| MEDIUM | | 5.5 | | CVE-2025-38042 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn |
| MEDIUM | | 6.7 | | CVE-2025-38064 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio: break and reset virtio devices on device_shutdown() |
| MEDIUM | | 5.5 | | CVE-2025-38132 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: holding cscfg_csdev_lock while removing cscfg from csdev |
| MEDIUM | | 5.5 | | CVE-2025-38140 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Local denial of service in device mapper |
| MEDIUM | | 5.5 | | CVE-2025-38199 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix memory leak due to multiple rx_stats allocation |
| MEDIUM | | 5.5 | | CVE-2025-38207 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm: fix uprobe pte be overwritten when expanding vma |
| MEDIUM | | 5.5 | | CVE-2025-38261 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv: save the SR_SUM status over switches |
| MEDIUM | | 5.5 | | CVE-2025-38284 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: configure manual DAC mode via PCI config API only |
| MEDIUM | | 5.5 | | CVE-2025-38311 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel (iavf): Denial of Service due to a locking issue |
| MEDIUM | | 5.5 | | CVE-2025-38359 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Fix in_atomic() handling in do_secure_storage_access() |
| MEDIUM | | 5.5 | | CVE-2025-38597 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port |
| MEDIUM | | 5.5 | | CVE-2025-38605 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() |
| MEDIUM | | 5.5 | | CVE-2025-39677 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Fix backlog accounting in qdisc_dequeue_internal |
| MEDIUM | | 5.5 | | CVE-2025-39762 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: add null check |
| MEDIUM | | 5.5 | | CVE-2025-39775 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: mremap local denial of service |
| MEDIUM | | 5.5 | | CVE-2025-39789 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: crypto: x86/aegis - Add missing error checks |
| MEDIUM | | 6.1 | | CVE-2025-39822 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/kbuf: fix signedness in this_len calculation |
| MEDIUM | | 5.5 | | CVE-2025-39830 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path |
| MEDIUM | | 5.5 | | CVE-2025-39834 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow |
| MEDIUM | | 6.2 | | CVE-2025-39910 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() |
| MEDIUM | | 7.1 | | CVE-2025-39933 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length |
| MEDIUM | | 2.5 | | CVE-2025-40113 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E |
| MEDIUM | | 6.8 | | CVE-2025-40130 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling |
| MEDIUM | | 6.2 | | CVE-2025-40146 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: fix potential deadlock while nr_requests grown |
| MEDIUM | | 5.2 | | CVE-2025-40217 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pidfs: validate extensible ioctls |
| MEDIUM | | | | CVE-2025-40247 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Fix pgtable prealloc error path |
| MEDIUM | | 5.2 | | CVE-2025-40338 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Do not share the name pointer between components |
| MEDIUM | | 6.1 | | CVE-2025-40355 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sysfs: check visibility before changing group attribute ownership |
| MEDIUM | | 5.5 | | CVE-2025-68209 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mlx5: Fix default values in create CQ |
| MEDIUM | | 5.5 | | CVE-2025-68236 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service during UFS power down |
| MEDIUM | | 5.5 | | CVE-2025-68304 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_core: lookup hci_conn on RX path on protocol side |
| MEDIUM | | | | CVE-2025-68318 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL |
| MEDIUM | | 6.1 | | CVE-2025-68319 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netconsole: Acquire su_mutex before navigating configs hierarchy |
| MEDIUM | | 5.5 | | CVE-2025-68353 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service via NULL pointer dereference in VXLAN module |
| MEDIUM | | 4.5 | | CVE-2025-68360 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks |
| MEDIUM | | 5.5 | | CVE-2025-68368 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service in md driver via uninitialized bioset |
| MEDIUM | | 6.5 | | CVE-2025-68729 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix MSDU buffer types handling in RX error path |
| MEDIUM | | 5.5 | | CVE-2025-68730 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() |
| MEDIUM | | 4.7 | | CVE-2025-68745 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset |
| MEDIUM | | 7.8 | | CVE-2025-71074 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel functionfs: Use-After-Free vulnerability due to open/removal races |
| MEDIUM | | 5.5 | | CVE-2025-71117 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service via deadlock in block layer sysfs store callbacks |
| MEDIUM | | 5.5 | | CVE-2025-71141 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/tilcdc: Fix removal actions in case of failed probe |
| MEDIUM | | 5.5 | | CVE-2025-71188 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: lpc18xx-dmamux: fix device leak on route allocation |
| MEDIUM | | 6.5 | | CVE-2025-71202 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Memory Corruption and Kernel Crashes via IOMMU SVA coherency issue |
| MEDIUM | | 5.5 | | CVE-2025-71227 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: don't WARN for connections on invalid channels |
| MEDIUM | | 5.5 | | CVE-2025-71285 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels |
| MEDIUM | | 5.5 | | CVE-2025-71302 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: fix for dma-fence safe access rules |
| MEDIUM | | 7 | | CVE-2025-71313 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI: endpoint: Add missing NULL check for alloc_workqueue() |
| MEDIUM | | 5.5 | | CVE-2025-71315 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/vkms: Convert to DRM's vblank timer |
| MEDIUM | | 5.5 | | CVE-2026-100074 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| MEDIUM | | 5.5 | | CVE-2026-100076 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths |
| MEDIUM | | 5.5 | | CVE-2026-100077 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Recover HW before retire hung submit |
| MEDIUM | | 5.5 | | CVE-2026-23007 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: block: zero non-PI portion of auto integrity buffer |
| MEDIUM | | 5.5 | | CVE-2026-23017 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: idpf: fix error handling in the init_task on load |
| MEDIUM | | 5.5 | | CVE-2026-23143 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix misalignment bug in struct virtnet_info |
| MEDIUM | | 7.1 | | CVE-2026-23152 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: correctly decode TTLM with default link map |
| MEDIUM | | 5.5 | | CVE-2026-23217 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv: trace: fix snapshot deadlock with sbi ecall |
| MEDIUM | | 5.5 | | CVE-2026-23259 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/rw: free potentially allocated iovec on cache put failure |
| MEDIUM | | 5.5 | | CVE-2026-23265 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer in {read,write}_end_io |
| MEDIUM | | 5.5 | | CVE-2026-23348 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix race of nvdimm_bus object when creating nvdimm objects |
| MEDIUM | | 5.5 | | CVE-2026-23371 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting |
| MEDIUM | | 5.5 | | CVE-2026-23377 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz |
| MEDIUM | | 5.5 | | CVE-2026-23385 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: clone set on flush only |
| MEDIUM | | 5.5 | | CVE-2026-23472 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN |
| MEDIUM | | 5.5 | | CVE-2026-31435 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix read abandonment during retry |
| MEDIUM | | 5.5 | | CVE-2026-31526 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix exception exit lock checking for subprogs |
| MEDIUM | | 5.5 | | CVE-2026-31537 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: server: make use of smbdirect_socket.send_io.bcredits |
| MEDIUM | | 5.5 | | CVE-2026-31562 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register |
| MEDIUM | | 5.5 | | CVE-2026-31579 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit |
| MEDIUM | | 5.5 | | CVE-2026-31591 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish |
| MEDIUM | | 5.5 | | CVE-2026-31592 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock |
| MEDIUM | | 5.5 | | CVE-2026-31630 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rxrpc: proc: size address buffers for %pISpc output |
| MEDIUM | | 7.1 | | CVE-2026-31692 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns |
| MEDIUM | | 5.5 | | CVE-2026-31771 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_event: move wake reason storage into validated event handlers |
| MEDIUM | | 5.5 | | CVE-2026-31777 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: ctxfi: Check the error for index mapping |
| MEDIUM | | 5.5 | | CVE-2026-43009 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix incorrect pruning due to atomic fetch precision tracking |
| MEDIUM | | 5.5 | | CVE-2026-43022 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists |
| MEDIUM | | 5.5 | | CVE-2026-43029 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mptcp: fix soft lockup in mptcp_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-43034 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: set backing store type from query type |
| MEDIUM | | 7.1 | | CVE-2026-43042 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mpls: add seqcount to protect the platform_label{,s} pair |
| MEDIUM | | 5.5 | | CVE-2026-43048 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: HID: core: Mitigate potential OOB by removing bogus memset() |
| MEDIUM | | 5.5 | | CVE-2026-43053 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: close crash window in attr dabtree inactivation |
| MEDIUM | | 5.5 | | CVE-2026-43083 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: ioam6: fix OOB and missing lock |
| MEDIUM | | 5.5 | | CVE-2026-43101 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() |
| MEDIUM | | 5.5 | | CVE-2026-43115 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: srcu: Use irq_work to start GP in tiny SRCU |
| MEDIUM | | 5.5 | | CVE-2026-43118 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix zero size inode with non-zero size after log replay |
| MEDIUM | | 5.5 | | CVE-2026-43127 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs3: fix circular locking dependency in run_unpack_ex |
| MEDIUM | | 5.5 | | CVE-2026-43172 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: fix 22000 series SMEM parsing |
| MEDIUM | | 5.5 | | CVE-2026-43191 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 |
| MEDIUM | | 5.5 | | CVE-2026-43204 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: qcom: q6asm: drop DSP responses for closed data streams |
| MEDIUM | | 5.5 | | CVE-2026-43213 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: validate sequence number of TX release report |
| MEDIUM | | 5.5 | | CVE-2026-43234 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: team: avoid NETDEV_CHANGEMTU event when unregistering slave |
| MEDIUM | | 5.5 | | CVE-2026-43272 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ring-buffer: Fix possible dereference of uninitialized pointer |
| MEDIUM | | 5.5 | | CVE-2026-43294 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels |
| MEDIUM | | 5.5 | | CVE-2026-43298 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Skip vcn poison irq release on VF |
| MEDIUM | | 5.5 | | CVE-2026-43299 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() |
| MEDIUM | | 5.5 | | CVE-2026-43301 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix PM runtime usage count underflow |
| MEDIUM | | 5.5 | | CVE-2026-43308 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() |
| MEDIUM | | 5.5 | | CVE-2026-43309 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md raid: fix hang when stopping arrays with metadata through dm-raid |
| MEDIUM | | 5.5 | | CVE-2026-43310 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC |
| MEDIUM | | 5.5 | | CVE-2026-43311 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soc/tegra: pmc: Fix unsafe generic_handle_irq() call |
| MEDIUM | | 5.5 | | CVE-2026-43325 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: don't send a 6E related command when not supported |
| MEDIUM | | 5.5 | | CVE-2026-43326 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback |
| MEDIUM | | 5.5 | | CVE-2026-43337 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() |
| MEDIUM | | 5.5 | | CVE-2026-43346 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ice: ptp: don't WARN when controlling PF is unavailable |
| MEDIUM | | 5.5 | | CVE-2026-43352 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue |
| MEDIUM | | 5.5 | | CVE-2026-43353 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue |
| MEDIUM | | 7.1 | | CVE-2026-43414 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Completely fix fcport double free |
| MEDIUM | | 5.5 | | CVE-2026-43416 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: powerpc, perf: Check that current->mm is alive before getting user callchain |
| MEDIUM | | 5.5 | | CVE-2026-43443 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: amd: acp-mach-common: Add missing error check for clock acquisition |
| MEDIUM | | 5.5 | | CVE-2026-43463 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() |
| MEDIUM | | 5.5 | | CVE-2026-43464 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ |
| MEDIUM | | 5.5 | | CVE-2026-43465 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ |
| MEDIUM | | 5.5 | | CVE-2026-43485 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nouveau/gsp: drop WARN_ON in ACPI probes |
| MEDIUM | | 6.4 | | CVE-2026-45932 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix tcx/netkit detach permissions when prog fd isn't given |
| MEDIUM | | 7 | | CVE-2026-45934 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation |
| MEDIUM | | 5.5 | | CVE-2026-45940 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix oops when split header is enabled |
| MEDIUM | | 5.5 | | CVE-2026-45961 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gfs2: fix memory leaks in gfs2_fill_super error path |
| MEDIUM | | 5.5 | | CVE-2026-46014 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Add missing save/restore handling of LBR MSRs |
| MEDIUM | | 7 | | CVE-2026-46017 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm: fix deferred split queue races during migration |
| MEDIUM | | 7 | | CVE-2026-46032 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT |
| MEDIUM | | 5.5 | | CVE-2026-46044 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipmi:ssif: Clean up kthread on errors |
| MEDIUM | | 5.5 | | CVE-2026-46059 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN |
| MEDIUM | | 5.5 | | CVE-2026-46066 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix num_ops off-by-one when crypto allocation fails |
| MEDIUM | | 5.5 | | CVE-2026-46071 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 |
| MEDIUM | | 5.5 | | CVE-2026-46096 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() |
| MEDIUM | | 5.5 | | CVE-2026-46147 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() |
| MEDIUM | | 5.5 | | CVE-2026-46148 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: spi: microchip-core-qspi: control built-in cs manually |
| MEDIUM | | 5.5 | | CVE-2026-46153 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: 8021q: delete cleared egress QoS mappings |
| MEDIUM | | 5.5 | | CVE-2026-46171 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv: kvm: fix vector context allocation leak |
| MEDIUM | | 5.5 | | CVE-2026-46228 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: spi: ch341: fix devres lifetime |
| MEDIUM | | 5.5 | | CVE-2026-46245 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dc_link NULL handling in HPD init |
| MEDIUM | | 5.5 | | CVE-2026-46256 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages |
| MEDIUM | | 4.7 | | CVE-2026-46272 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: tmc-etr: Fix race condition between sysfs and perf mode |
| MEDIUM | | 5.5 | | CVE-2026-46302 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: selinux: allow multiple opens of /sys/fs/selinux/policy |
| MEDIUM | | 5.5 | | CVE-2026-46314 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Reject empty multisync extension to prevent infinite loop |
| MEDIUM | | 7 | | CVE-2026-46317 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock |
| MEDIUM | | 7 | | CVE-2026-46324 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: netfilter nf_tables denial of service via race condition in netlink hook unregistration |
| MEDIUM | | 7 | | CVE-2026-46325 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE |
| MEDIUM | | 7 | | CVE-2026-46330 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Revert "net/smc: Introduce TCP ULP support" |
| MEDIUM | | 5.5 | | CVE-2026-52937 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR |
| MEDIUM | | 7 | | CVE-2026-52953 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Fix oops due to out of scope access |
| MEDIUM | | 7 | | CVE-2026-52956 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() |
| MEDIUM | | 5.5 | | CVE-2026-52994 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting |
| MEDIUM | | 7 | | CVE-2026-53009 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ice: fix double-free of tx_buf skb |
| MEDIUM | | 5.5 | | CVE-2026-53017 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix data loss caused by incorrect use of nat_entry flag |
| MEDIUM | | 5.5 | | CVE-2026-53018 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: avoid reading already updated pages during GC |
| MEDIUM | | 5.5 | | CVE-2026-53103 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync |
| MEDIUM | | 5.5 | | CVE-2026-53104 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: Fix memory leak destroying device |
| MEDIUM | | 5.5 | | CVE-2026-53106 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Do not allow deleting local storage in NMI |
| MEDIUM | | 5.5 | | CVE-2026-53107 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: libertas: don't kill URBs in interrupt context |
| MEDIUM | | 5.5 | | CVE-2026-53108 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: powerpc/64s: Fix unmap race with PMD migration entries |
| MEDIUM | | | | CVE-2026-53178 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction |
| MEDIUM | | 7 | | CVE-2026-53224 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate embedded INIT chunk and address list lengths in cookie |
| MEDIUM | | 7 | | CVE-2026-53246 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing |
| MEDIUM | | 5.5 | | CVE-2026-53258 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: fix leak if split 6 GHz scanning fails |
| MEDIUM | | 5.5 | | CVE-2026-53281 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption |
| MEDIUM | | 5.5 | | CVE-2026-53285 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED |
| MEDIUM | | 5.5 | | CVE-2026-53292 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind |
| MEDIUM | | 5.5 | | CVE-2026-53297 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: mana: Guard mana_remove against double invocation |
| MEDIUM | | 5.5 | | CVE-2026-53321 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/napi: cap busy_poll_to 10 msec |
| MEDIUM | | 5.5 | | CVE-2026-53377 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: always recover the gpu |
| MEDIUM | | | | CVE-2026-53401 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: omap2: fix use-after-free in omapfb_mmap |
| MEDIUM | | | | CVE-2026-63805 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: crypto: nx - fix nx_crypto_ctx_exit argument |
| MEDIUM | | | | CVE-2026-63811 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: read COW data with the original inode during atomic write |
| MEDIUM | | | | CVE-2026-63819 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on f2fs_get_node_folio_ra() |
| MEDIUM | | 5.5 | | CVE-2026-63832 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: add wcid publish check in mt76_sta_add |
| MEDIUM | | 5.5 | | CVE-2026-63853 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring |
| MEDIUM | | | | CVE-2026-63857 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-63858 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: add hook transactions for device deletions |
| MEDIUM | | | | CVE-2026-63859 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue() |
| MEDIUM | | 7 | | CVE-2026-63941 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor |
| MEDIUM | | 7 | | CVE-2026-63979 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/handshake: hand off the pinned file reference to accept_doit |
| MEDIUM | | 5.5 | | CVE-2026-63998 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ethtool: module: call ethnl_ops_complete() on module flash errors |
| MEDIUM | | 5.5 | | CVE-2026-63999 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure |
| MEDIUM | | 5.5 | | CVE-2026-64006 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: fix dst corruption in same register operation |
| MEDIUM | | 7 | | CVE-2026-64024 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction |
| MEDIUM | | 5.5 | | CVE-2026-64036 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cgroup/rstat: validate cpu before css_rstat_cpu() access |
| MEDIUM | | 5.5 | | CVE-2026-64038 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Stop work before releasing hwmon device |
| MEDIUM | | 5.5 | | CVE-2026-64060 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix leak of request in netfs_write_begin() error handling |
| MEDIUM | | 7.1 | | CVE-2026-64066 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_read_to_pagecache() to pause on subreq failure |
| MEDIUM | | 5.5 | | CVE-2026-64067 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing barriers when accessing stream->subrequests locklessly |
| MEDIUM | | 7 | | CVE-2026-64068 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing locking around retry adding new subreqs |
| MEDIUM | | 5.5 | | CVE-2026-64076 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: bridge: eb_tables: close module init race |
| MEDIUM | | 5.5 | | CVE-2026-64077 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: ebtables: move to two-stage removal scheme |
| MEDIUM | | 7.1 | | CVE-2026-64078 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: add and use xtables_unregister_table_exit |
| MEDIUM | | 5.5 | | CVE-2026-64079 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: allocate hook ops while under mutex |
| MEDIUM | | 7 | | CVE-2026-64117 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb |
| MEDIUM | | 5.5 | | CVE-2026-64146 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix metabuf leak in inode xattr initialization |
| MEDIUM | | 5.5 | | CVE-2026-64154 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() |
| MEDIUM | | 5.5 | | CVE-2026-64159 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix zeropoint update where i_size > remote_i_size |
| MEDIUM | | 7 | | CVE-2026-64160 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point |
| MEDIUM | | 5.5 | | CVE-2026-64190 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: team: fix NULL pointer dereference in team_xmit during mode change |
| MEDIUM | | 5.5 | | CVE-2026-64212 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it |
| MEDIUM | | 5.5 | | CVE-2026-64213 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Add lock protection to lm90_alert |
| MEDIUM | | 7 | | CVE-2026-64255 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers |
| MEDIUM | | 7 | | CVE-2026-64520 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies |
| MEDIUM | | 7 | | CVE-2026-68086 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/khugepaged: write all dirty file folios when collapsing |
| MEDIUM | | 5.5 | | CVE-2026-68211 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: stm32-dcmipp: Return queued buffers on start_streaming() failure |
| MEDIUM | | 5.5 | | CVE-2026-68233 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/vc4: Shut down BO cache timer before teardown |
| MEDIUM | | 5.5 | | CVE-2026-68242 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/gt: Fix NULL deref on sched_engine alloc failure |
| MEDIUM | | 5.5 | | CVE-2026-68258 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size |
| MEDIUM | | 5.5 | | CVE-2026-68291 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: idpf driver null pointer dereference leads to Denial of Service |
| MEDIUM | | 5.5 | | CVE-2026-68295 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: BPF: Zero-extend signed ALU32 div/mod results |
| MEDIUM | | 5.5 | | CVE-2026-68312 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths |
| MEDIUM | | 7 | | CVE-2026-68323 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tipc: serialize udp bearer replicast list updates |
| MEDIUM | | 5.5 | | CVE-2026-68382 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Hold device ref until queue teardown completes |
| MEDIUM | | 5.5 | | CVE-2026-68383 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Keep scheduler timeline name alive |
| MEDIUM | | 7 | | CVE-2026-68393 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: extend conn_hash lookup critical sections |
| MEDIUM | | 6.4 | | CVE-2026-68399 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix UAF in sock clone early bailouts |
| MEDIUM | | 7 | | CVE-2026-68400 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation |
| MEDIUM | | 7 | | CVE-2026-68401 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() |
| MEDIUM | | 7 | | CVE-2026-68404 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect |
| MEDIUM | | 5.5 | | CVE-2026-68421 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() |
| MEDIUM | | 5.5 | | CVE-2026-68435 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Fix address space mismatch in kexec command line lookup |
| MEDIUM | | 5.5 | | CVE-2026-68441 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains |
| MEDIUM | | 5.5 | | CVE-2026-68447 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size |
| MEDIUM | | 7 | | CVE-2026-68448 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ovl: check access to copy_file_range source with src mounter creds |
| MEDIUM | | 7 | | CVE-2026-68453 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey |
| MEDIUM | | 5.5 | | CVE-2026-68471 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ieee80211: validate MLE common info length |
| MEDIUM | | 5.5 | | CVE-2026-72073 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mmc: vub300: fix use-after-free on probe failure |
| MEDIUM | | 5.5 | | CVE-2026-72162 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec |
| MEDIUM | | 7 | | CVE-2026-72288 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling |
| MEDIUM | | 7 | | CVE-2026-72329 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/liquidio: drop cached VF pci_dev LUT |
| MEDIUM | | 5.5 | | CVE-2026-72337 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: 6lowpan: avoid untracked enable work |
| MEDIUM | | 5.5 | | CVE-2026-72341 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Fix publication race for priv->channel_stats[] |
| MEDIUM | | 5.5 | | CVE-2026-72355 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix barriering when walking subrequest list |
| MEDIUM | | 5.5 | | CVE-2026-72365 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix writethrough to use collection offload |
| MEDIUM | | 5.5 | | CVE-2026-72367 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iomap: guard io_size EOF trim against concurrent truncate underflow |
| MEDIUM | | 5.5 | | CVE-2026-72375 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix reinitialisation of the inode, in particular ->lock_work |
| MEDIUM | | 5.5 | | CVE-2026-72380 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xen/pvcalls: bound backend response req_id before indexing rsp[] |
| MEDIUM | | 5.5 | | CVE-2026-72383 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: fix addr_wq_timer race in sctp_free_addr_wq() |
| MEDIUM | | 5.5 | | CVE-2026-72388 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock |
| MEDIUM | | 5.5 | | CVE-2026-72397 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() |
| MEDIUM | | 7 | | CVE-2026-72398 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: add INIT verification after cookie unpacking |
| MEDIUM | | 5.5 | | CVE-2026-72404 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() |
| MEDIUM | | 5.5 | | CVE-2026-72423 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Guard conntrack opts error writes |
| MEDIUM | | 5.5 | | CVE-2026-72440 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1: fix writes_pending and barrier reference leaks on write failures |
| MEDIUM | | 5.5 | | CVE-2026-72454 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() |
| MEDIUM | | 5.5 | | CVE-2026-72488 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soundwire: fix bug in sdw_add_element_group_count found by syzkaller |
| MEDIUM | | 5.5 | | CVE-2026-72493 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: serialize netif_running() check in enqueue_to_backlog() |
| MEDIUM | | 5.5 | | CVE-2026-72495 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages |
| MEDIUM | | 7 | | CVE-2026-72499 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free CQ toggle page after firmware teardown |
| MEDIUM | | 7 | | CVE-2026-72500 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown |
| MEDIUM | | | | CVE-2026-72501 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: R ... |
| MEDIUM | | 5.5 | | CVE-2026-74257 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sockmap: Fix use-after-free in udp_bpf_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-74264 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: watchdog: fix refcount tracking races |
| MEDIUM | | 5.5 | | CVE-2026-74272 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Resolve region deletion races |
| MEDIUM | | 5.5 | | CVE-2026-74273 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Block region delete during region creation |
| MEDIUM | | 5.5 | | CVE-2026-74314 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Cancel special fields on map value recycle |
| MEDIUM | | 5.5 | | CVE-2026-74317 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ixgbe: do not configure xps for XDP queues |
| MEDIUM | | 5.5 | | CVE-2026-74324 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: validate skb length in testmode query |
| MEDIUM | | 5.5 | | CVE-2026-74337 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks |
| MEDIUM | | 5.5 | | CVE-2026-74342 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: kernfs: link kn to its parent before the LSM init hook |
| MEDIUM | | 5.5 | | CVE-2026-74344 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear rb node linkage when freeing bpf_rb_root |
| MEDIUM | | 5.5 | | CVE-2026-74350 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate fast symlink target during inode read |
| MEDIUM | | 5.5 | | CVE-2026-74354 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Take mmap_lock in zap_pages() |
| MEDIUM | | 5.5 | | CVE-2026-74368 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() |
| MEDIUM | | 6.5 | | CVE-2026-74385 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock |
| MEDIUM | | 5.5 | | CVE-2026-74388 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data |
| MEDIUM | | 7 | | CVE-2026-74405 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: OPP: Fix race between OPP addition and lookup |
| MEDIUM | | 5.5 | | CVE-2026-74407 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath11k: cancel SSR work items during PCI shutdown |
| MEDIUM | | 5.5 | | CVE-2026-74449 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport |
| MEDIUM | | 5.5 | | CVE-2026-74466 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Close speculative mem read possibility |
| MEDIUM | | 7 | | CVE-2026-74506 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix UAF when sending a message |
| MEDIUM | | 7 | | CVE-2026-74513 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister |
| MEDIUM | | 5.5 | | CVE-2026-74527 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-af: Block VFs from clobbering special CGX PKIND state |
| MEDIUM | | 5.5 | | CVE-2026-74529 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback |
| MEDIUM | | 5.5 | | CVE-2026-74530 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback |
| MEDIUM | | 7 | | CVE-2026-74533 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero |
| MEDIUM | | 7 | | CVE-2026-74537 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: hold sk properly in iso_conn_ready |
| MEDIUM | | 5.5 | | CVE-2026-74538 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: lock sk in iso_connect_ind |
| MEDIUM | | 5.5 | | CVE-2026-74542 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix folio_queue ENOMEM in writeback by adding a mempool |
| MEDIUM | | 5.5 | | CVE-2026-74544 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds |
| MEDIUM | | 5.5 | | CVE-2026-74600 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/page_table_check: skip special zero mappings |
| MEDIUM | | 5.5 | | CVE-2026-74605 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: eventfs: Use children field for rcu head and add memory barriers |
| MEDIUM | | 7 | | CVE-2026-74611 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tls: rx: restore msg_iter before TLS 1.3 optimistic retry |
| MEDIUM | | 5.5 | | CVE-2026-74638 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Serialize the scheduler timeout handlers |
| MEDIUM | | 5.5 | | CVE-2026-74687 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: watchdog: at91sam9_wdt: prevent timer rearm during teardown |
| MEDIUM | | 7 | | CVE-2026-74695 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() |
| MEDIUM | | 7 | | CVE-2026-74697 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Disable EOP for TPA on all chips to prevent data corruption |
| MEDIUM | | 5.5 | | CVE-2026-74711 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus) Fix type confusion in notification logic |
| MEDIUM | | 5.5 | | CVE-2026-74713 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vhost_iotlb: bound map allocation in add_range |
| MEDIUM | | 7 | | CVE-2026-74715 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix netns reference imbalance in conntrack kfuncs |
| MEDIUM | | 5.5 | | CVE-2026-74723 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject inline extents without valid headers |
| MEDIUM | | 5.5 | | CVE-2026-74729 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read |
| MEDIUM | | 5.5 | | CVE-2026-74747 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipvs: revalidate ihl to prevent out-of-bounds access |
| MEDIUM | | 5.5 | | CVE-2026-80579 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: clear fb_info->mode before deleting a videomode |
| MEDIUM | | 5.5 | | CVE-2026-80580 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: bound mode sysfs output to the sysfs buffer |
| MEDIUM | | 5.5 | | CVE-2026-80614 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: emac: Fix NULL pointer dereference in emac_probe |
| MEDIUM | | 5.5 | | CVE-2026-80623 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: ete: Always save state on power down |
| MEDIUM | | 5.5 | | CVE-2026-80628 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Serialize readq reset state with q->lock |
| MEDIUM | | 5.5 | | CVE-2026-80631 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject compressed segment that overflows the compressed input |
| MEDIUM | | 5.5 | | CVE-2026-80634 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag |
| MEDIUM | | 5.5 | | CVE-2026-80655 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soc: xilinx: Fix race condition in event registration |
| MEDIUM | | 5.5 | | CVE-2026-80662 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size |
| MEDIUM | | 7 | | CVE-2026-80668 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations |
| MEDIUM | | 5.5 | | CVE-2026-80670 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() |
| MEDIUM | | 5.5 | | CVE-2026-80692 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks |
| MEDIUM | | 7 | | CVE-2026-80693 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: idpf: bound interrupt-vector register fill to the allocated array |
| MEDIUM | | 5.5 | | CVE-2026-80698 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: idxd: fix double free of wq, engine, and group structs |
| MEDIUM | | 5.5 | | CVE-2026-80721 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: ensure no dangling hcon references in iso_conn |
| MEDIUM | | | | CVE-2026-80761 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| MEDIUM | | 5.5 | | CVE-2026-80905 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: tap: fix wrong transport_header when sending VLAN-tagged frame |
| MEDIUM | | 5.5 | | CVE-2026-80920 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring: defer eventfd signaling when queued from a wakeup handler |
| MEDIUM | | 5.5 | | CVE-2026-81010 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/waitid: honor task_work cancellation |
| MEDIUM | | 7 | | CVE-2026-89528 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Reject Read lists that exceed the page budget |
| MEDIUM | | 4.8 | | CVE-2026-89534 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| MEDIUM | | 7 | | CVE-2026-89537 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 |
| MEDIUM | | 7.2 | | CVE-2026-89610 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs: verify run length exceeding volume boundary |
| MEDIUM | | 5.5 | | CVE-2026-89611 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs: validate non-resident attribute offsets |
| MEDIUM | | 7.1 | | CVE-2026-89632 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() |
| MEDIUM | | 7 | | CVE-2026-89637 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 |
| MEDIUM | | 5.5 | | CVE-2026-89639 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC |
| MEDIUM | | 3.3 | | CVE-2026-89642 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cifs: call pagecache_isize_extended() in cifs_setsize() when extending |
| MEDIUM | | 6.2 | | CVE-2026-89648 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ceph: cap delegated inode count in ceph_parse_deleg_inos() |
| MEDIUM | | 7 | | CVE-2026-89654 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix UAF in check_new_map() on session freed during unlock |
| MEDIUM | | 5.3 | | CVE-2026-89682 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net |
| MEDIUM | | 5.3 | | CVE-2026-89705 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths |
| MEDIUM | | 5.9 | | CVE-2026-89709 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: lockd, nfsd: RCU-protect nlmsvc_ops dispatch |
| MEDIUM | | 5.5 | | CVE-2026-89722 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() |
| MEDIUM | | 5.5 | | CVE-2026-89757 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/mglru: fix and remove redundant unevictable folio handling |
| MEDIUM | | 4.7 | | CVE-2026-89810 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix error path at svm_migrate_copy_to_ram |
| MEDIUM | | | | CVE-2026-89826 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| MEDIUM | | | | CVE-2026-89833 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| MEDIUM | | | | CVE-2026-89866 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| MEDIUM | | | | CVE-2026-89906 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| MEDIUM | | 4.7 | | CVE-2026-89913 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables |
| MEDIUM | | 4.7 | | CVE-2026-89920 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Fix memory corruption by not reinjecting CK machine checks |
| MEDIUM | | | | CVE-2026-89935 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 3.6 | | CVE-2026-89987 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/huge_memory: transfer the pmd dirty bit to the folio on zap |
| MEDIUM | | 5.5 | | CVE-2026-90040 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped |
| MEDIUM | | 5.5 | | CVE-2026-90061 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: skip double clone set expressions on element insert |
| MEDIUM | | 5.5 | | CVE-2026-90083 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: act_ife: Only operate on Ethernet frames |
| MEDIUM | | 5.5 | | CVE-2026-90087 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: do not leak an hci_conn when a second LE connect is rejected |
| MEDIUM | | 7 | | CVE-2026-90093 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: access chan->conn safely in get/setsockopt |
| MEDIUM | | 5.5 | | CVE-2026-90098 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: fix sleep in atomic context in MAC table access |
| MEDIUM | | 7 | | CVE-2026-90099 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: account classifier filter allocations to memcg |
| MEDIUM | | 7 | | CVE-2026-90104 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFSv4.1: zero referring call lists before decoding |
| MEDIUM | | 5.5 | | CVE-2026-90105 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vxlan: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90106 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: arp/nd proxy: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90116 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: mtpav: shut down output timer before card teardown |
| MEDIUM | | 5.5 | | CVE-2026-90142 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix resize of the RX ring |
| MEDIUM | | 5.5 | | CVE-2026-90149 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers |
| MEDIUM | | 5.5 | | CVE-2026-90154 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: scope session state changes to bound connections |
| MEDIUM | | 5.5 | | CVE-2026-90155 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: detach blocked lock requests before freeing |
| MEDIUM | | 5.5 | | CVE-2026-90156 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely discard unregistered deferred locks |
| MEDIUM | | 7 | | CVE-2026-90161 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix interlaced ztailpacking pclusters |
| MEDIUM | | 5.5 | | CVE-2026-90162 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: defer publishing granted locks to prevent UAF/double-free race |
| MEDIUM | | 5.5 | | CVE-2026-90167 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: serialize oplock close with pending break ownership |
| MEDIUM | | 5.5 | | CVE-2026-90174 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() |
| MEDIUM | | 5.5 | | CVE-2026-90177 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check pointer type for all atomic RMW paths |
| MEDIUM | | 5.5 | | CVE-2026-90179 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix deadlock in complain-mode change_hat |
| MEDIUM | | 5.5 | | CVE-2026-90204 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate DIO orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90205 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90208 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type |
| MEDIUM | | 5.5 | | CVE-2026-90217 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Compare iterator types during state pruning |
| MEDIUM | | 5.5 | | CVE-2026-90231 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix unconfined user namespace restriction forced stack |
| MEDIUM | | 5.5 | | CVE-2026-90232 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: amt: Don't support cross-netns setup |
| MEDIUM | | 5.1 | | CVE-2026-90234 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFS: Return a delegation the client fails to record |
| MEDIUM | | 7 | | CVE-2026-90237 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nft_ct: move custom expectation support to helper |
| MEDIUM | | 7 | | CVE-2026-90240 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Flush context cache with correct SID when tearing down aliases |
| MEDIUM | | 5.5 | | CVE-2026-90247 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix mmap_lock leak in irq_work path |
| MEDIUM | | 5.9 | | CVE-2026-90256 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind |
| MEDIUM | | 5.5 | | CVE-2026-90259 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() |
| MEDIUM | | 4.7 | | CVE-2026-90260 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: don't clobber the extent buffer when zeroing it out |
| MEDIUM | | 3.3 | | CVE-2026-90263 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: check if root is readonly when setting posix acl |
| MEDIUM | | 5.5 | | CVE-2026-90264 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: always wait for ordered extents to avoid OE races |
| MEDIUM | | 5.5 | | CVE-2026-90265 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: defrag: fix deadlock between defrag and delalloc space reservation |
| MEDIUM | | 5.5 | | CVE-2026-90273 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable |
| MEDIUM | | 5.5 | | CVE-2026-90289 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Resize MST HDCP per-connector arrays to 32 |
| MEDIUM | | 5.5 | | CVE-2026-90300 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear buf on error in __bpf_get_task_stack |
| MEDIUM | | 5.5 | | CVE-2026-90301 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: o2hb: quiesce negotiate handlers and timeout work |
| MEDIUM | | 7 | | CVE-2026-90317 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Invalidate RCU pointers after final spin unlock |
| MEDIUM | | 5.5 | | CVE-2026-90320 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate external xattr entries when reading metadata |
| MEDIUM | | 5.5 | | CVE-2026-90321 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate inline xattrs during inode block validation |
| MEDIUM | | 5.5 | | CVE-2026-90324 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ublk: check import_ubuf() return value |
| MEDIUM | | 4.7 | | CVE-2026-90326 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-cgroup: fix race between policy activation and blkg destruction |
| MEDIUM | | 5.5 | | CVE-2026-90328 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: HID: steam: Reject short reads |
| MEDIUM | | 6.4 | | CVE-2026-90333 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dm-integrity: replace forgeable discard filler with a keyed sector marker |
| MEDIUM | | 4.1 | | CVE-2026-90336 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: clear freed pointers on uart_register_driver() failure |
| MEDIUM | | 5.5 | | CVE-2026-90337 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: do fallible allocations before the console can be registered |
| MEDIUM | | 7 | | CVE-2026-90343 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: stop PMSR before P2P and NAN teardown |
| MEDIUM | | 5.5 | | CVE-2026-90345 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: brcmfmac: fix P2P action frame handling without device vif |
| MEDIUM | | 7 | | CVE-2026-90347 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry |
| MEDIUM | | 5.5 | | CVE-2026-90351 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed |
| MEDIUM | | 4.4 | | CVE-2026-90359 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject >8 byte return values on return-reading trampoline paths |
| MEDIUM | | 5.5 | | CVE-2026-90363 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: don't tear down KMS twice when KMS init fails |
| MEDIUM | | 5.5 | | CVE-2026-90365 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: cancel reset and rc work on device unregister |
| MEDIUM | | 5.5 | | CVE-2026-90367 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER |
| MEDIUM | | 4.8 | | CVE-2026-90379 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash |
| MEDIUM | | 3.3 | | CVE-2026-90401 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md: remove REQ_NOWAIT support from raid1/10/456 |
| MEDIUM | | 5.5 | | CVE-2026-90408 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() |
| MEDIUM | | 5.5 | | CVE-2026-90409 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Add vm_bind region with kbo range overlap check |
| MEDIUM | | 4.7 | | CVE-2026-90417 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() |
| MEDIUM | | 5.5 | | CVE-2026-90421 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI: Fix UAF when probe runs concurrent to dyn ID removal |
| MEDIUM | | 5.5 | | CVE-2026-90422 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path |
| MEDIUM | | 4.7 | | CVE-2026-90427 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() |
| MEDIUM | | 5.5 | | CVE-2026-92480 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Validate string descriptors |
| MEDIUM | | 5.5 | | CVE-2026-92482 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip |
| MEDIUM | | 3.3 | | CVE-2026-92485 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix WARNING in bpf_tracing_link_release |
| MEDIUM | | 5.5 | | CVE-2026-92499 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext4: validate readdir offset before accessing dirent |
| MEDIUM | | 4.7 | | CVE-2026-92500 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext4: use fsdata to track inline data write state and fix race |
| MEDIUM | | 5.5 | | CVE-2026-92503 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() |
| MEDIUM | | 5.5 | | CVE-2026-92518 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv, bpf: Fix kernel stack corruption in tailcall with CFI |
| MEDIUM | | 5.5 | | CVE-2026-92520 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Zero queue and stack outputs on lock failure |
| MEDIUM | | 5.5 | | CVE-2026-93044 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for arena-related insns |
| MEDIUM | | 5.5 | | CVE-2026-93047 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Associate BOs with every job that accesses them |
| MEDIUM | | 5.5 | | CVE-2026-93058 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Only fini scheduler after successful init |
| MEDIUM | | 5.5 | | CVE-2026-93081 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_scmi: Fix SCMI device destroy lifetimes |
| MEDIUM | | 4.7 | | CVE-2026-93099 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Fix UAF from worker threads when domains are removed |
| MEDIUM | | 4.7 | | CVE-2026-93100 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() |
| MEDIUM | | 4.7 | | CVE-2026-93104 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rvt: Return NULL after port allocation failure |
| MEDIUM | | 7 | | CVE-2026-93105 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: esp: do not unref managed frag pages in esp_ssg_unref() |
| MEDIUM | | 5.5 | | CVE-2026-93122 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: usb: gadget: uac: validate rate list length before storing |
| MEDIUM | | 5.5 | | CVE-2026-93135 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject programs with inlined helpers if JIT is not available |
| MEDIUM | | 7 | | CVE-2026-93148 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject MEM_ALLOC BTF accesses past object bounds |
| MEDIUM | | 7 | | CVE-2026-93154 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Add refcounting to user ring MRs |
| MEDIUM | | 5.5 | | CVE-2026-93168 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout |
| MEDIUM | | 5.5 | | CVE-2026-93175 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in CRTC reset function |
| MEDIUM | | 4.7 | | CVE-2026-93176 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in plane reset function |
| MEDIUM | | 5.5 | | CVE-2026-93270 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn |
| MEDIUM | | 5.5 | | CVE-2026-93272 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 |
| MEDIUM | | 5.5 | | CVE-2026-93276 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator |
| MEDIUM | | 5.5 | | CVE-2026-93282 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix maximum allowed access checks |
| MEDIUM | | 7.1 | | CVE-2026-97422 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: fix SMI event cross-process information leak |
| MEDIUM | | 5.5 | | CVE-2026-97432 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: fix P2P-Device binding handling |
| MEDIUM | | 5.5 | | CVE-2026-97478 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virt: acrn: Fix irqfd use-after-free during eventfd shutdown |
| MEDIUM | | 7.1 | | CVE-2026-97493 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS |
| MEDIUM | | 5.5 | | CVE-2026-97499 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: perf: Retrieve path and source from event data |
| MEDIUM | | 5.5 | | CVE-2026-97513 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Release m2m_ctx after Instance Removed from List |
| MEDIUM | | 5.5 | | CVE-2026-97515 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 |
| MEDIUM | | 5.5 | | CVE-2026-97526 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/pai: Support CPU hotplug for PMU PAI |
| MEDIUM | | 5.5 | | CVE-2026-97538 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (asus_rog_ryujin) Validate HID report lengths |
| MEDIUM | | 5.5 | | CVE-2026-97554 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() |
| MEDIUM | | 7 | | CVE-2026-97561 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid |
| MEDIUM | | 7 | | CVE-2026-97563 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97565 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject short READ responses in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97960 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel: Prevent drain_pebs() reentry |
| MEDIUM | | 5.5 | | CVE-2026-97962 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Move representor vnic reporter to eswitch devlink port |
| MEDIUM | | 5.1 | | CVE-2026-97975 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() |
| MEDIUM | | 4.7 | | CVE-2026-97988 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vhost: invalidate vring access on IOTLB transitions |
| MEDIUM | | 5.5 | | CVE-2026-98019 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: mark a NULL call argument precise |
| MEDIUM | | 5.3 | | CVE-2026-98032 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tracing: Fix subbuf resize races with trace_pipe_raw readers |
| MEDIUM | | 7 | | CVE-2026-98033 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Preserve inner map identity in callback frames |
| MEDIUM | | 7 | | CVE-2026-98034 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark NULL kptr stores precise |
| MEDIUM | | 5.5 | | CVE-2026-98043 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Don't infer non-NULL from a pointer with an unbounded offset |
| MEDIUM | | 7 | | CVE-2026-98047 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check ancestor frames for rbtree callbacks |
| MEDIUM | | 7 | | CVE-2026-98048 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: don't rewrite bpf_fastcall patterns entered by a jump |
| MEDIUM | | 5.5 | | CVE-2026-98049 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: zero extend the result of an arena 32-bit cmpxchg |
| MEDIUM | | 5.5 | | CVE-2026-98053 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Refactor and fix init_config access |
| MEDIUM | | 5.5 | | CVE-2026-98062 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark signal tracepoint siginfo arguments as scalar |
| MEDIUM | | 5.5 | | CVE-2026-98085 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge |
| MEDIUM | | | | CVE-2026-98099 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 5.5 | | CVE-2026-98115 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely drain sessions during logoff |
| MEDIUM | | 5.5 | | CVE-2026-98118 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix readahead synchronisation issues by loading all folios upfront |
| MEDIUM | | 5.5 | | CVE-2026-98124 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/client: invalidate fscache for fallocate range operations |
| MEDIUM | | 5.5 | | CVE-2026-98125 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix stale page cache in insert/collapse range |
| MEDIUM | | 5.5 | | CVE-2026-98131 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix dma mapping leak in stmmac_tso_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-98134 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: check_cond_jmp_op(): properly infer if register is null |
| MEDIUM | | 5.3 | | CVE-2026-98156 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/virtio: use the DMA API for resource backing on Xen |
| MEDIUM | | 5.5 | | CVE-2026-98162 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/server: fix tree connection leak in smb2_tree_connect() |
| MEDIUM | | 5.5 | | CVE-2026-98180 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: RCU-free the scheduler-containing ring and VM objects |
| MEDIUM | | 5.5 | | CVE-2026-98228 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ |
| MEDIUM | | 4.4 | | CVE-2026-98273 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: x86/kprobes: Fix crash when probing CS CALL instructions |
| MEDIUM | | 5.5 | | CVE-2026-98277 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: ring the doorbell if a burst ends in a drop |
| MEDIUM | | 5.5 | | CVE-2026-98279 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: handle lack of space when cleaning up verity items |
| MEDIUM | | 5.3 | | CVE-2026-98284 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netlink: do not free nlk->groups while lockless readers can use it |
| MEDIUM | | 4.1 | | CVE-2026-98286 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown |
| MEDIUM | | 5.5 | | CVE-2026-98288 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix TSO header length truncation |
| MEDIUM | | 5.5 | | CVE-2026-98292 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| MEDIUM | | 5.5 | | CVE-2026-98294 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_qca: Do not write to the serial port after it is closed |
| MEDIUM | | 7 | | CVE-2026-98296 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btintel_pcie: validate TX skb length in send_sync |
| MEDIUM | | 5.5 | | CVE-2026-98313 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/dp: skip PUSH_IDLE when the link was never enabled |
| MEDIUM | | 7 | | CVE-2026-98330 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: get the wiphy out of a dying network namespace |
| MEDIUM | | 5.5 | | CVE-2026-98333 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: reset the LED state when ifup fails |
| MEDIUM | | 7 | | CVE-2026-98341 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: don't free driver-owned scan requests |
| MEDIUM | | 5.5 | | CVE-2026-98353 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables |
| MEDIUM | | 5.5 | | CVE-2026-98355 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rtrs: guard against null kobj name |
| MEDIUM | | 5.5 | | CVE-2026-98376 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Use array_map_meta_equal for percpu array inner map replacement |
| MEDIUM | | 5.5 | | CVE-2026-98408 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: watchdog: rzv2h: Avoid division by zero |
| MEDIUM | | 5.5 | | CVE-2026-98420 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: follow SMB2 session expiration semantics |
| MEDIUM | | | | CVE-2026-98436 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: a ... |
| MEDIUM | | 6.5 | | CVE-2026-98439 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/server: cancel async requests when closing connection |
| MEDIUM | | 4.7 | | CVE-2026-98444 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: drop dquot flush lock when we can't find a buffer to flush |
| MEDIUM | | 6.5 | | CVE-2026-98449 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: delete compound mids on send failure before unlock |
| MEDIUM | | 5.3 | | CVE-2026-98471 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Do cache maintenance on the source VM during intra-host migration |
| MEDIUM | | 5.5 | | CVE-2026-98556 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gve: DQO: reject TSO packets with an out of range MSS |
| MEDIUM | | 4.1 | | CVE-2026-98558 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: flush skb_defer_nodes in dev_cpu_dead() |
| MEDIUM | | 5.9 | | CVE-2026-98570 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: ipv6: keep room for the mac header in dst_dev_overhead() |
| MEDIUM | | 6.7 | | CVE-2026-98589 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject pkt arguments in mutating subprogs |
| MEDIUM | | 4.7 | | CVE-2026-98598 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv6: Prevent rt6_insert_exception() for dying fib6_info |
| MEDIUM | | 6.7 | | CVE-2026-98599 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() |
| MEDIUM | | 4.1 | | CVE-2026-98616 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: reset num_napi when the napi vectors are freed |
| MEDIUM | | 5.5 | | CVE-2026-98652 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Add missing srcu in kvm_s390_set_irq_state() |
| MEDIUM | | 5.5 | | CVE-2026-98674 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iio: adc: adi-axi-adc: Initialize state mutex |
| MEDIUM | | 5.6 | | CVE-2026-98714 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| MEDIUM | | 4.1 | | CVE-2026-98740 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety |
| MEDIUM | | 4.4 | | CVE-2026-98747 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix NULL pointer dereference in serial_core_unregister_port() |
| MEDIUM | | 4.7 | | CVE-2026-98786 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: guard dc_sink dereferences in MST mode validation |
| MEDIUM | | 4.4 | | CVE-2026-98789 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix objects stuck in free_by_rcu_ttrace |
| MEDIUM | | 4.4 | | CVE-2026-98795 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: skip ptp deinit if init was skipped |
| MEDIUM | | 4.4 | | CVE-2026-98799 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Skip detached progs in trampoline images that are still in use |
| MEDIUM | | 4.7 | | CVE-2026-98800 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: kernel: Denial of Service via use-after-free in BPF trampoline |
| MEDIUM | | 6.5 | | CVE-2026-98803 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix rx Scatter-Gather support |
| MEDIUM | | 6.1 | | CVE-2026-98810 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() |
| MEDIUM | | 4.4 | | CVE-2026-98813 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Hold map BTF for the memory allocator destructor record |
| MEDIUM | | 4.4 | | CVE-2026-98814 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix command effects log lifetime for multipath heads |
| MEDIUM | | 4.1 | | CVE-2026-98815 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix cdev lifetime |
| MEDIUM | | 4.1 | | CVE-2026-98816 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix overflow of jump offset in constant blinding |
| MEDIUM | | 5.5 | | CVE-2026-98820 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: set RQF_USE_SCHED when the operation is known |
| MEDIUM | | 5.3 | | CVE-2026-98824 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate TX status rate metadata |
| MEDIUM | | 6.5 | | CVE-2026-98829 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: drop oversized fragments to avoid extra_len overflow |
| MEDIUM | | 4.1 | | CVE-2026-98834 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mtd: core: avoid double-free of OTP NVMEM device |
| MEDIUM | | 6.1 | | CVE-2026-98839 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() |
| MEDIUM | | 4.4 | | CVE-2026-98843 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: zero gaps in read-gaps folio to avoid writing back stale data |
| MEDIUM | | 5.6 | | CVE-2026-98863 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| MEDIUM | | 4.6 | | CVE-2019-15213 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: use-after-free caused by malicious USB device in drivers/media/usb/dvb-usb/dvb-usb-init.c |
| MEDIUM | | 4.1 | | CVE-2019-16089 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Improper return check in nbd_genl_status function in drivers/block/nbd.c |
| MEDIUM | | 4.7 | | CVE-2019-20794 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: task processes not being properly ended could lead to resource exhaustion |
| MEDIUM | | 4.4 | | CVE-2020-14304 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ethtool when reading eeprom of device could lead to memory leak |
| MEDIUM | | 6.7 | | CVE-2020-36694 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfilter: use-after-free in the packet processing context |
| MEDIUM | | 5.5 | | CVE-2023-31082 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: sleeping function called from an invalid context in gsmld_write |
| MEDIUM | | 7 | | CVE-2023-3397 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: slab-use-after-free Write in txEnd due to race condition |
| MEDIUM | | 5.5 | | CVE-2023-37454 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: udf: use-after-free write in udf_close_lvid |
| MEDIUM | | 6.7 | | CVE-2023-6238 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: nvme: memory corruption via unprivileged user passthrough |
| MEDIUM | | 6.5 | | CVE-2023-6240 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation |
| MEDIUM | | 5.5 | | CVE-2024-2193 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | hw: Spectre-SRC that is Speculative Race Conditions (SRCs) for synchronization primitives similar like Spectre V1 with p |
| MEDIUM | | 4.7 | | CVE-2024-24864 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | A race condition was found in the Linux kernel's media/dvb-core in dvb ... |
| MEDIUM | | 5.5 | | CVE-2024-25740 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: memory leak in ubi driver |
| MEDIUM | | 5.5 | | CVE-2024-56709 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: io_uring: check if iowq is killed before queuing |
| MEDIUM | | 5.5 | | CVE-2024-58074 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/i915: Grab intel_display from the encoder to avoid potential oopsies |
| MEDIUM | | 5.5 | | CVE-2025-21752 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents |
| MEDIUM | | 5.5 | | CVE-2025-21949 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Set hugetlb mmap base address aligned with pmd size |
| MEDIUM | | 5.5 | | CVE-2025-22109 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ax25: Remove broken autobind |
| MEDIUM | | 5.5 | | CVE-2025-23132 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: f2fs: quota: fix to avoid warning in dquot_writeback_dquots() |
| MEDIUM | | 5.5 | | CVE-2025-23135 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Teardown riscv specific bits after kvm_exit |
| MEDIUM | | 5.5 | | CVE-2025-37743 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Avoid memory leak while enabling statistics |
| MEDIUM | | 5.5 | | CVE-2025-37746 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: perf/dwc_pcie: fix duplicate pci_dev devices |
| MEDIUM | | 5.5 | | CVE-2025-37880 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: um: work around sched_yield not yielding in time-travel mode |
| MEDIUM | | 4.7 | | CVE-2025-37906 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: ublk race condition causes kernel crash |
| MEDIUM | | 5.5 | | CVE-2025-38029 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to sleepable page allocation in KASAN |
| MEDIUM | | 5.5 | | CVE-2025-38036 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to null pointer dereference in GT MMIO initialization for VFs |
| MEDIUM | | 5.5 | | CVE-2025-38041 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: clk: sunxi-ng: h616: Reparent GPU clock during frequency changes |
| MEDIUM | | 5.5 | | CVE-2025-38042 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn |
| MEDIUM | | 6.7 | | CVE-2025-38064 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: virtio: break and reset virtio devices on device_shutdown() |
| MEDIUM | | 5.5 | | CVE-2025-38132 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: coresight: holding cscfg_csdev_lock while removing cscfg from csdev |
| MEDIUM | | 5.5 | | CVE-2025-38140 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Local denial of service in device mapper |
| MEDIUM | | 5.5 | | CVE-2025-38199 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix memory leak due to multiple rx_stats allocation |
| MEDIUM | | 5.5 | | CVE-2025-38207 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: mm: fix uprobe pte be overwritten when expanding vma |
| MEDIUM | | 5.5 | | CVE-2025-38261 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: riscv: save the SR_SUM status over switches |
| MEDIUM | | 5.5 | | CVE-2025-38284 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: configure manual DAC mode via PCI config API only |
| MEDIUM | | 5.5 | | CVE-2025-38311 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Linux kernel (iavf): Denial of Service due to a locking issue |
| MEDIUM | | 5.5 | | CVE-2025-38359 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Fix in_atomic() handling in do_secure_storage_access() |
| MEDIUM | | 5.5 | | CVE-2025-38597 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port |
| MEDIUM | | 5.5 | | CVE-2025-38605 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() |
| MEDIUM | | 5.5 | | CVE-2025-39677 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net/sched: Fix backlog accounting in qdisc_dequeue_internal |
| MEDIUM | | 5.5 | | CVE-2025-39762 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: add null check |
| MEDIUM | | 5.5 | | CVE-2025-39775 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: mremap local denial of service |
| MEDIUM | | 5.5 | | CVE-2025-39789 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: crypto: x86/aegis - Add missing error checks |
| MEDIUM | | 6.1 | | CVE-2025-39822 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: io_uring/kbuf: fix signedness in this_len calculation |
| MEDIUM | | 5.5 | | CVE-2025-39830 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path |
| MEDIUM | | 5.5 | | CVE-2025-39834 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow |
| MEDIUM | | 6.2 | | CVE-2025-39910 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() |
| MEDIUM | | 7.1 | | CVE-2025-39933 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length |
| MEDIUM | | 2.5 | | CVE-2025-40113 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E |
| MEDIUM | | 6.8 | | CVE-2025-40130 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling |
| MEDIUM | | 6.2 | | CVE-2025-40146 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: blk-mq: fix potential deadlock while nr_requests grown |
| MEDIUM | | 5.2 | | CVE-2025-40217 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: pidfs: validate extensible ioctls |
| MEDIUM | | | | CVE-2025-40247 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Fix pgtable prealloc error path |
| MEDIUM | | 5.2 | | CVE-2025-40338 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Do not share the name pointer between components |
| MEDIUM | | 6.1 | | CVE-2025-40355 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: sysfs: check visibility before changing group attribute ownership |
| MEDIUM | | 5.5 | | CVE-2025-68209 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: mlx5: Fix default values in create CQ |
| MEDIUM | | 5.5 | | CVE-2025-68236 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service during UFS power down |
| MEDIUM | | 5.5 | | CVE-2025-68304 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_core: lookup hci_conn on RX path on protocol side |
| MEDIUM | | | | CVE-2025-68318 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL |
| MEDIUM | | 6.1 | | CVE-2025-68319 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netconsole: Acquire su_mutex before navigating configs hierarchy |
| MEDIUM | | 5.5 | | CVE-2025-68353 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service via NULL pointer dereference in VXLAN module |
| MEDIUM | | 4.5 | | CVE-2025-68360 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks |
| MEDIUM | | 5.5 | | CVE-2025-68368 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service in md driver via uninitialized bioset |
| MEDIUM | | 6.5 | | CVE-2025-68729 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix MSDU buffer types handling in RX error path |
| MEDIUM | | 5.5 | | CVE-2025-68730 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() |
| MEDIUM | | 4.7 | | CVE-2025-68745 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset |
| MEDIUM | | 7.8 | | CVE-2025-71074 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Linux kernel functionfs: Use-After-Free vulnerability due to open/removal races |
| MEDIUM | | 5.5 | | CVE-2025-71117 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service via deadlock in block layer sysfs store callbacks |
| MEDIUM | | 5.5 | | CVE-2025-71141 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/tilcdc: Fix removal actions in case of failed probe |
| MEDIUM | | 5.5 | | CVE-2025-71188 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: dmaengine: lpc18xx-dmamux: fix device leak on route allocation |
| MEDIUM | | 6.5 | | CVE-2025-71202 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Memory Corruption and Kernel Crashes via IOMMU SVA coherency issue |
| MEDIUM | | 5.5 | | CVE-2025-71227 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: don't WARN for connections on invalid channels |
| MEDIUM | | 5.5 | | CVE-2025-71285 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels |
| MEDIUM | | 5.5 | | CVE-2025-71302 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: fix for dma-fence safe access rules |
| MEDIUM | | 7 | | CVE-2025-71313 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: PCI: endpoint: Add missing NULL check for alloc_workqueue() |
| MEDIUM | | 5.5 | | CVE-2025-71315 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/vkms: Convert to DRM's vblank timer |
| MEDIUM | | 5.5 | | CVE-2026-100074 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| MEDIUM | | 5.5 | | CVE-2026-100076 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths |
| MEDIUM | | 5.5 | | CVE-2026-100077 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Recover HW before retire hung submit |
| MEDIUM | | 5.5 | | CVE-2026-23007 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: block: zero non-PI portion of auto integrity buffer |
| MEDIUM | | 5.5 | | CVE-2026-23017 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: idpf: fix error handling in the init_task on load |
| MEDIUM | | 5.5 | | CVE-2026-23143 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix misalignment bug in struct virtnet_info |
| MEDIUM | | 7.1 | | CVE-2026-23152 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: correctly decode TTLM with default link map |
| MEDIUM | | 5.5 | | CVE-2026-23217 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: riscv: trace: fix snapshot deadlock with sbi ecall |
| MEDIUM | | 5.5 | | CVE-2026-23259 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: io_uring/rw: free potentially allocated iovec on cache put failure |
| MEDIUM | | 5.5 | | CVE-2026-23265 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer in {read,write}_end_io |
| MEDIUM | | 5.5 | | CVE-2026-23348 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix race of nvdimm_bus object when creating nvdimm objects |
| MEDIUM | | 5.5 | | CVE-2026-23371 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting |
| MEDIUM | | 5.5 | | CVE-2026-23377 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz |
| MEDIUM | | 5.5 | | CVE-2026-23385 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: clone set on flush only |
| MEDIUM | | 5.5 | | CVE-2026-23472 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN |
| MEDIUM | | 5.5 | | CVE-2026-31435 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix read abandonment during retry |
| MEDIUM | | 5.5 | | CVE-2026-31526 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix exception exit lock checking for subprogs |
| MEDIUM | | 5.5 | | CVE-2026-31537 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: smb: server: make use of smbdirect_socket.send_io.bcredits |
| MEDIUM | | 5.5 | | CVE-2026-31562 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register |
| MEDIUM | | 5.5 | | CVE-2026-31579 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit |
| MEDIUM | | 5.5 | | CVE-2026-31591 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish |
| MEDIUM | | 5.5 | | CVE-2026-31592 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock |
| MEDIUM | | 5.5 | | CVE-2026-31630 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: rxrpc: proc: size address buffers for %pISpc output |
| MEDIUM | | 7.1 | | CVE-2026-31692 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns |
| MEDIUM | | 5.5 | | CVE-2026-31771 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_event: move wake reason storage into validated event handlers |
| MEDIUM | | 5.5 | | CVE-2026-31777 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ALSA: ctxfi: Check the error for index mapping |
| MEDIUM | | 5.5 | | CVE-2026-43009 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix incorrect pruning due to atomic fetch precision tracking |
| MEDIUM | | 5.5 | | CVE-2026-43022 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists |
| MEDIUM | | 5.5 | | CVE-2026-43029 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: mptcp: fix soft lockup in mptcp_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-43034 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: set backing store type from query type |
| MEDIUM | | 7.1 | | CVE-2026-43042 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: mpls: add seqcount to protect the platform_label{,s} pair |
| MEDIUM | | 5.5 | | CVE-2026-43048 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: HID: core: Mitigate potential OOB by removing bogus memset() |
| MEDIUM | | 5.5 | | CVE-2026-43053 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: xfs: close crash window in attr dabtree inactivation |
| MEDIUM | | 5.5 | | CVE-2026-43083 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: ioam6: fix OOB and missing lock |
| MEDIUM | | 5.5 | | CVE-2026-43101 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() |
| MEDIUM | | 5.5 | | CVE-2026-43115 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: srcu: Use irq_work to start GP in tiny SRCU |
| MEDIUM | | 5.5 | | CVE-2026-43118 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix zero size inode with non-zero size after log replay |
| MEDIUM | | 5.5 | | CVE-2026-43127 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ntfs3: fix circular locking dependency in run_unpack_ex |
| MEDIUM | | 5.5 | | CVE-2026-43172 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: fix 22000 series SMEM parsing |
| MEDIUM | | 5.5 | | CVE-2026-43191 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 |
| MEDIUM | | 5.5 | | CVE-2026-43204 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ASoC: qcom: q6asm: drop DSP responses for closed data streams |
| MEDIUM | | 5.5 | | CVE-2026-43213 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: validate sequence number of TX release report |
| MEDIUM | | 5.5 | | CVE-2026-43234 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: team: avoid NETDEV_CHANGEMTU event when unregistering slave |
| MEDIUM | | 5.5 | | CVE-2026-43272 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ring-buffer: Fix possible dereference of uninitialized pointer |
| MEDIUM | | 5.5 | | CVE-2026-43294 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels |
| MEDIUM | | 5.5 | | CVE-2026-43298 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Skip vcn poison irq release on VF |
| MEDIUM | | 5.5 | | CVE-2026-43299 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() |
| MEDIUM | | 5.5 | | CVE-2026-43301 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix PM runtime usage count underflow |
| MEDIUM | | 5.5 | | CVE-2026-43308 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() |
| MEDIUM | | 5.5 | | CVE-2026-43309 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: md raid: fix hang when stopping arrays with metadata through dm-raid |
| MEDIUM | | 5.5 | | CVE-2026-43310 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC |
| MEDIUM | | 5.5 | | CVE-2026-43311 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: soc/tegra: pmc: Fix unsafe generic_handle_irq() call |
| MEDIUM | | 5.5 | | CVE-2026-43325 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: don't send a 6E related command when not supported |
| MEDIUM | | 5.5 | | CVE-2026-43326 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback |
| MEDIUM | | 5.5 | | CVE-2026-43337 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() |
| MEDIUM | | 5.5 | | CVE-2026-43346 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ice: ptp: don't WARN when controlling PF is unavailable |
| MEDIUM | | 5.5 | | CVE-2026-43352 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue |
| MEDIUM | | 5.5 | | CVE-2026-43353 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue |
| MEDIUM | | 7.1 | | CVE-2026-43414 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Completely fix fcport double free |
| MEDIUM | | 5.5 | | CVE-2026-43416 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: powerpc, perf: Check that current->mm is alive before getting user callchain |
| MEDIUM | | 5.5 | | CVE-2026-43443 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ASoC: amd: acp-mach-common: Add missing error check for clock acquisition |
| MEDIUM | | 5.5 | | CVE-2026-43463 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() |
| MEDIUM | | 5.5 | | CVE-2026-43464 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ |
| MEDIUM | | 5.5 | | CVE-2026-43465 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ |
| MEDIUM | | 5.5 | | CVE-2026-43485 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: nouveau/gsp: drop WARN_ON in ACPI probes |
| MEDIUM | | 6.4 | | CVE-2026-45932 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix tcx/netkit detach permissions when prog fd isn't given |
| MEDIUM | | 7 | | CVE-2026-45934 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation |
| MEDIUM | | 5.5 | | CVE-2026-45940 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix oops when split header is enabled |
| MEDIUM | | 5.5 | | CVE-2026-45961 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: gfs2: fix memory leaks in gfs2_fill_super error path |
| MEDIUM | | 5.5 | | CVE-2026-46014 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Add missing save/restore handling of LBR MSRs |
| MEDIUM | | 7 | | CVE-2026-46017 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: mm: fix deferred split queue races during migration |
| MEDIUM | | 7 | | CVE-2026-46032 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT |
| MEDIUM | | 5.5 | | CVE-2026-46044 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ipmi:ssif: Clean up kthread on errors |
| MEDIUM | | 5.5 | | CVE-2026-46059 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN |
| MEDIUM | | 5.5 | | CVE-2026-46066 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ceph: fix num_ops off-by-one when crypto allocation fails |
| MEDIUM | | 5.5 | | CVE-2026-46071 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 |
| MEDIUM | | 5.5 | | CVE-2026-46096 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() |
| MEDIUM | | 5.5 | | CVE-2026-46147 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() |
| MEDIUM | | 5.5 | | CVE-2026-46148 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: spi: microchip-core-qspi: control built-in cs manually |
| MEDIUM | | 5.5 | | CVE-2026-46153 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: 8021q: delete cleared egress QoS mappings |
| MEDIUM | | 5.5 | | CVE-2026-46171 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: riscv: kvm: fix vector context allocation leak |
| MEDIUM | | 5.5 | | CVE-2026-46228 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: spi: ch341: fix devres lifetime |
| MEDIUM | | 5.5 | | CVE-2026-46245 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dc_link NULL handling in HPD init |
| MEDIUM | | 5.5 | | CVE-2026-46256 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages |
| MEDIUM | | 4.7 | | CVE-2026-46272 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: coresight: tmc-etr: Fix race condition between sysfs and perf mode |
| MEDIUM | | 5.5 | | CVE-2026-46302 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: selinux: allow multiple opens of /sys/fs/selinux/policy |
| MEDIUM | | 5.5 | | CVE-2026-46314 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Reject empty multisync extension to prevent infinite loop |
| MEDIUM | | 7 | | CVE-2026-46317 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock |
| MEDIUM | | 7 | | CVE-2026-46324 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: netfilter nf_tables denial of service via race condition in netlink hook unregistration |
| MEDIUM | | 7 | | CVE-2026-46325 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE |
| MEDIUM | | 7 | | CVE-2026-46330 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Revert "net/smc: Introduce TCP ULP support" |
| MEDIUM | | 5.5 | | CVE-2026-52937 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR |
| MEDIUM | | 7 | | CVE-2026-52953 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Fix oops due to out of scope access |
| MEDIUM | | 7 | | CVE-2026-52956 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() |
| MEDIUM | | 5.5 | | CVE-2026-52994 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting |
| MEDIUM | | 7 | | CVE-2026-53009 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ice: fix double-free of tx_buf skb |
| MEDIUM | | 5.5 | | CVE-2026-53017 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix data loss caused by incorrect use of nat_entry flag |
| MEDIUM | | 5.5 | | CVE-2026-53018 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: f2fs: avoid reading already updated pages during GC |
| MEDIUM | | 5.5 | | CVE-2026-53103 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync |
| MEDIUM | | 5.5 | | CVE-2026-53104 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: Fix memory leak destroying device |
| MEDIUM | | 5.5 | | CVE-2026-53106 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Do not allow deleting local storage in NMI |
| MEDIUM | | 5.5 | | CVE-2026-53107 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: libertas: don't kill URBs in interrupt context |
| MEDIUM | | 5.5 | | CVE-2026-53108 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: powerpc/64s: Fix unmap race with PMD migration entries |
| MEDIUM | | | | CVE-2026-53178 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction |
| MEDIUM | | 7 | | CVE-2026-53224 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: sctp: validate embedded INIT chunk and address list lengths in cookie |
| MEDIUM | | 7 | | CVE-2026-53246 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing |
| MEDIUM | | 5.5 | | CVE-2026-53258 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: fix leak if split 6 GHz scanning fails |
| MEDIUM | | 5.5 | | CVE-2026-53281 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption |
| MEDIUM | | 5.5 | | CVE-2026-53285 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED |
| MEDIUM | | 5.5 | | CVE-2026-53292 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind |
| MEDIUM | | 5.5 | | CVE-2026-53297 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: mana: Guard mana_remove against double invocation |
| MEDIUM | | 5.5 | | CVE-2026-53321 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: io_uring/napi: cap busy_poll_to 10 msec |
| MEDIUM | | 5.5 | | CVE-2026-53377 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/msm: always recover the gpu |
| MEDIUM | | | | CVE-2026-53401 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: fbdev: omap2: fix use-after-free in omapfb_mmap |
| MEDIUM | | | | CVE-2026-63805 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: crypto: nx - fix nx_crypto_ctx_exit argument |
| MEDIUM | | | | CVE-2026-63811 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: f2fs: read COW data with the original inode during atomic write |
| MEDIUM | | | | CVE-2026-63819 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on f2fs_get_node_folio_ra() |
| MEDIUM | | 5.5 | | CVE-2026-63832 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: add wcid publish check in mt76_sta_add |
| MEDIUM | | 5.5 | | CVE-2026-63853 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring |
| MEDIUM | | | | CVE-2026-63857 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-63858 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: add hook transactions for device deletions |
| MEDIUM | | | | CVE-2026-63859 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue() |
| MEDIUM | | 7 | | CVE-2026-63941 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor |
| MEDIUM | | 7 | | CVE-2026-63979 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net/handshake: hand off the pinned file reference to accept_doit |
| MEDIUM | | 5.5 | | CVE-2026-63998 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ethtool: module: call ethnl_ops_complete() on module flash errors |
| MEDIUM | | 5.5 | | CVE-2026-63999 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure |
| MEDIUM | | 5.5 | | CVE-2026-64006 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: fix dst corruption in same register operation |
| MEDIUM | | 7 | | CVE-2026-64024 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction |
| MEDIUM | | 5.5 | | CVE-2026-64036 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: cgroup/rstat: validate cpu before css_rstat_cpu() access |
| MEDIUM | | 5.5 | | CVE-2026-64038 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Stop work before releasing hwmon device |
| MEDIUM | | 5.5 | | CVE-2026-64060 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix leak of request in netfs_write_begin() error handling |
| MEDIUM | | 7.1 | | CVE-2026-64066 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_read_to_pagecache() to pause on subreq failure |
| MEDIUM | | 5.5 | | CVE-2026-64067 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing barriers when accessing stream->subrequests locklessly |
| MEDIUM | | 7 | | CVE-2026-64068 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing locking around retry adding new subreqs |
| MEDIUM | | 5.5 | | CVE-2026-64076 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfilter: bridge: eb_tables: close module init race |
| MEDIUM | | 5.5 | | CVE-2026-64077 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfilter: ebtables: move to two-stage removal scheme |
| MEDIUM | | 7.1 | | CVE-2026-64078 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: add and use xtables_unregister_table_exit |
| MEDIUM | | 5.5 | | CVE-2026-64079 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: allocate hook ops while under mutex |
| MEDIUM | | 7 | | CVE-2026-64117 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb |
| MEDIUM | | 5.5 | | CVE-2026-64146 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: erofs: fix metabuf leak in inode xattr initialization |
| MEDIUM | | 5.5 | | CVE-2026-64154 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() |
| MEDIUM | | 5.5 | | CVE-2026-64159 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix zeropoint update where i_size > remote_i_size |
| MEDIUM | | 7 | | CVE-2026-64160 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point |
| MEDIUM | | 5.5 | | CVE-2026-64190 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: team: fix NULL pointer dereference in team_xmit during mode change |
| MEDIUM | | 5.5 | | CVE-2026-64212 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it |
| MEDIUM | | 5.5 | | CVE-2026-64213 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Add lock protection to lm90_alert |
| MEDIUM | | 7 | | CVE-2026-64255 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers |
| MEDIUM | | 7 | | CVE-2026-64520 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies |
| MEDIUM | | 7 | | CVE-2026-68086 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: mm/khugepaged: write all dirty file folios when collapsing |
| MEDIUM | | 5.5 | | CVE-2026-68211 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: media: stm32-dcmipp: Return queued buffers on start_streaming() failure |
| MEDIUM | | 5.5 | | CVE-2026-68233 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/vc4: Shut down BO cache timer before teardown |
| MEDIUM | | 5.5 | | CVE-2026-68242 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/i915/gt: Fix NULL deref on sched_engine alloc failure |
| MEDIUM | | 5.5 | | CVE-2026-68258 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size |
| MEDIUM | | 5.5 | | CVE-2026-68291 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: idpf driver null pointer dereference leads to Denial of Service |
| MEDIUM | | 5.5 | | CVE-2026-68295 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: LoongArch: BPF: Zero-extend signed ALU32 div/mod results |
| MEDIUM | | 5.5 | | CVE-2026-68312 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths |
| MEDIUM | | 7 | | CVE-2026-68323 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: tipc: serialize udp bearer replicast list updates |
| MEDIUM | | 5.5 | | CVE-2026-68382 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Hold device ref until queue teardown completes |
| MEDIUM | | 5.5 | | CVE-2026-68383 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Keep scheduler timeline name alive |
| MEDIUM | | 7 | | CVE-2026-68393 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: extend conn_hash lookup critical sections |
| MEDIUM | | 6.4 | | CVE-2026-68399 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix UAF in sock clone early bailouts |
| MEDIUM | | 7 | | CVE-2026-68400 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation |
| MEDIUM | | 7 | | CVE-2026-68401 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() |
| MEDIUM | | 7 | | CVE-2026-68404 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect |
| MEDIUM | | 5.5 | | CVE-2026-68421 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() |
| MEDIUM | | 5.5 | | CVE-2026-68435 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Fix address space mismatch in kexec command line lookup |
| MEDIUM | | 5.5 | | CVE-2026-68441 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains |
| MEDIUM | | 5.5 | | CVE-2026-68447 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size |
| MEDIUM | | 7 | | CVE-2026-68448 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ovl: check access to copy_file_range source with src mounter creds |
| MEDIUM | | 7 | | CVE-2026-68453 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey |
| MEDIUM | | 5.5 | | CVE-2026-68471 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: ieee80211: validate MLE common info length |
| MEDIUM | | 5.5 | | CVE-2026-72073 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: mmc: vub300: fix use-after-free on probe failure |
| MEDIUM | | 5.5 | | CVE-2026-72162 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec |
| MEDIUM | | 7 | | CVE-2026-72288 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling |
| MEDIUM | | 7 | | CVE-2026-72329 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net/liquidio: drop cached VF pci_dev LUT |
| MEDIUM | | 5.5 | | CVE-2026-72337 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: 6lowpan: avoid untracked enable work |
| MEDIUM | | 5.5 | | CVE-2026-72341 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Fix publication race for priv->channel_stats[] |
| MEDIUM | | 5.5 | | CVE-2026-72355 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix barriering when walking subrequest list |
| MEDIUM | | 5.5 | | CVE-2026-72365 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix writethrough to use collection offload |
| MEDIUM | | 5.5 | | CVE-2026-72367 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: iomap: guard io_size EOF trim against concurrent truncate underflow |
| MEDIUM | | 5.5 | | CVE-2026-72375 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: afs: Fix reinitialisation of the inode, in particular ->lock_work |
| MEDIUM | | 5.5 | | CVE-2026-72380 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: xen/pvcalls: bound backend response req_id before indexing rsp[] |
| MEDIUM | | 5.5 | | CVE-2026-72383 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: sctp: fix addr_wq_timer race in sctp_free_addr_wq() |
| MEDIUM | | 5.5 | | CVE-2026-72388 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock |
| MEDIUM | | 5.5 | | CVE-2026-72397 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() |
| MEDIUM | | 7 | | CVE-2026-72398 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: sctp: add INIT verification after cookie unpacking |
| MEDIUM | | 5.5 | | CVE-2026-72404 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() |
| MEDIUM | | 5.5 | | CVE-2026-72423 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Guard conntrack opts error writes |
| MEDIUM | | 5.5 | | CVE-2026-72440 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: md/raid1: fix writes_pending and barrier reference leaks on write failures |
| MEDIUM | | 5.5 | | CVE-2026-72454 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() |
| MEDIUM | | 5.5 | | CVE-2026-72488 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: soundwire: fix bug in sdw_add_element_group_count found by syzkaller |
| MEDIUM | | 5.5 | | CVE-2026-72493 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: serialize netif_running() check in enqueue_to_backlog() |
| MEDIUM | | 5.5 | | CVE-2026-72495 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages |
| MEDIUM | | 7 | | CVE-2026-72499 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free CQ toggle page after firmware teardown |
| MEDIUM | | 7 | | CVE-2026-72500 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown |
| MEDIUM | | | | CVE-2026-72501 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: R ... |
| MEDIUM | | 5.5 | | CVE-2026-74257 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: sockmap: Fix use-after-free in udp_bpf_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-74264 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: watchdog: fix refcount tracking races |
| MEDIUM | | 5.5 | | CVE-2026-74272 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Resolve region deletion races |
| MEDIUM | | 5.5 | | CVE-2026-74273 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Block region delete during region creation |
| MEDIUM | | 5.5 | | CVE-2026-74314 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Cancel special fields on map value recycle |
| MEDIUM | | 5.5 | | CVE-2026-74317 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ixgbe: do not configure xps for XDP queues |
| MEDIUM | | 5.5 | | CVE-2026-74324 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: validate skb length in testmode query |
| MEDIUM | | 5.5 | | CVE-2026-74337 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks |
| MEDIUM | | 5.5 | | CVE-2026-74342 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: kernfs: link kn to its parent before the LSM init hook |
| MEDIUM | | 5.5 | | CVE-2026-74344 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear rb node linkage when freeing bpf_rb_root |
| MEDIUM | | 5.5 | | CVE-2026-74350 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate fast symlink target during inode read |
| MEDIUM | | 5.5 | | CVE-2026-74354 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Take mmap_lock in zap_pages() |
| MEDIUM | | 5.5 | | CVE-2026-74368 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() |
| MEDIUM | | 6.5 | | CVE-2026-74385 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock |
| MEDIUM | | 5.5 | | CVE-2026-74388 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data |
| MEDIUM | | 7 | | CVE-2026-74405 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: OPP: Fix race between OPP addition and lookup |
| MEDIUM | | 5.5 | | CVE-2026-74407 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: ath11k: cancel SSR work items during PCI shutdown |
| MEDIUM | | 5.5 | | CVE-2026-74449 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport |
| MEDIUM | | 5.5 | | CVE-2026-74466 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Close speculative mem read possibility |
| MEDIUM | | 7 | | CVE-2026-74506 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: afs: Fix UAF when sending a message |
| MEDIUM | | 7 | | CVE-2026-74513 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister |
| MEDIUM | | 5.5 | | CVE-2026-74527 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: octeontx2-af: Block VFs from clobbering special CGX PKIND state |
| MEDIUM | | 5.5 | | CVE-2026-74529 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback |
| MEDIUM | | 5.5 | | CVE-2026-74530 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback |
| MEDIUM | | 7 | | CVE-2026-74533 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero |
| MEDIUM | | 7 | | CVE-2026-74537 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: hold sk properly in iso_conn_ready |
| MEDIUM | | 5.5 | | CVE-2026-74538 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: lock sk in iso_connect_ind |
| MEDIUM | | 5.5 | | CVE-2026-74542 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix folio_queue ENOMEM in writeback by adding a mempool |
| MEDIUM | | 5.5 | | CVE-2026-74544 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds |
| MEDIUM | | 5.5 | | CVE-2026-74600 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: mm/page_table_check: skip special zero mappings |
| MEDIUM | | 5.5 | | CVE-2026-74605 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: eventfs: Use children field for rcu head and add memory barriers |
| MEDIUM | | 7 | | CVE-2026-74611 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: tls: rx: restore msg_iter before TLS 1.3 optimistic retry |
| MEDIUM | | 5.5 | | CVE-2026-74638 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Serialize the scheduler timeout handlers |
| MEDIUM | | 5.5 | | CVE-2026-74687 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: watchdog: at91sam9_wdt: prevent timer rearm during teardown |
| MEDIUM | | 7 | | CVE-2026-74695 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() |
| MEDIUM | | 7 | | CVE-2026-74697 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Disable EOP for TPA on all chips to prevent data corruption |
| MEDIUM | | 5.5 | | CVE-2026-74711 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus) Fix type confusion in notification logic |
| MEDIUM | | 5.5 | | CVE-2026-74713 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: vhost_iotlb: bound map allocation in add_range |
| MEDIUM | | 7 | | CVE-2026-74715 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix netns reference imbalance in conntrack kfuncs |
| MEDIUM | | 5.5 | | CVE-2026-74723 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject inline extents without valid headers |
| MEDIUM | | 5.5 | | CVE-2026-74729 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read |
| MEDIUM | | 5.5 | | CVE-2026-74747 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ipvs: revalidate ihl to prevent out-of-bounds access |
| MEDIUM | | 5.5 | | CVE-2026-80579 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: fbdev: clear fb_info->mode before deleting a videomode |
| MEDIUM | | 5.5 | | CVE-2026-80580 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: fbdev: bound mode sysfs output to the sysfs buffer |
| MEDIUM | | 5.5 | | CVE-2026-80614 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: emac: Fix NULL pointer dereference in emac_probe |
| MEDIUM | | 5.5 | | CVE-2026-80623 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: coresight: ete: Always save state on power down |
| MEDIUM | | 5.5 | | CVE-2026-80628 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Serialize readq reset state with q->lock |
| MEDIUM | | 5.5 | | CVE-2026-80631 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject compressed segment that overflows the compressed input |
| MEDIUM | | 5.5 | | CVE-2026-80634 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag |
| MEDIUM | | 5.5 | | CVE-2026-80655 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: soc: xilinx: Fix race condition in event registration |
| MEDIUM | | 5.5 | | CVE-2026-80662 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size |
| MEDIUM | | 7 | | CVE-2026-80668 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations |
| MEDIUM | | 5.5 | | CVE-2026-80670 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() |
| MEDIUM | | 5.5 | | CVE-2026-80692 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks |
| MEDIUM | | 7 | | CVE-2026-80693 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: idpf: bound interrupt-vector register fill to the allocated array |
| MEDIUM | | 5.5 | | CVE-2026-80698 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: dmaengine: idxd: fix double free of wq, engine, and group structs |
| MEDIUM | | 5.5 | | CVE-2026-80721 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: ensure no dangling hcon references in iso_conn |
| MEDIUM | | | | CVE-2026-80761 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| MEDIUM | | 5.5 | | CVE-2026-80905 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: tap: fix wrong transport_header when sending VLAN-tagged frame |
| MEDIUM | | 5.5 | | CVE-2026-80920 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: io_uring: defer eventfd signaling when queued from a wakeup handler |
| MEDIUM | | 5.5 | | CVE-2026-81010 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: io_uring/waitid: honor task_work cancellation |
| MEDIUM | | 7 | | CVE-2026-89528 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Reject Read lists that exceed the page budget |
| MEDIUM | | 4.8 | | CVE-2026-89534 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| MEDIUM | | 7 | | CVE-2026-89537 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 |
| MEDIUM | | 7.2 | | CVE-2026-89610 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ntfs: verify run length exceeding volume boundary |
| MEDIUM | | 5.5 | | CVE-2026-89611 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ntfs: validate non-resident attribute offsets |
| MEDIUM | | 7.1 | | CVE-2026-89632 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() |
| MEDIUM | | 7 | | CVE-2026-89637 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 |
| MEDIUM | | 5.5 | | CVE-2026-89639 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC |
| MEDIUM | | 3.3 | | CVE-2026-89642 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: cifs: call pagecache_isize_extended() in cifs_setsize() when extending |
| MEDIUM | | 6.2 | | CVE-2026-89648 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ceph: cap delegated inode count in ceph_parse_deleg_inos() |
| MEDIUM | | 7 | | CVE-2026-89654 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ceph: fix UAF in check_new_map() on session freed during unlock |
| MEDIUM | | 5.3 | | CVE-2026-89682 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net |
| MEDIUM | | 5.3 | | CVE-2026-89705 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths |
| MEDIUM | | 5.9 | | CVE-2026-89709 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: lockd, nfsd: RCU-protect nlmsvc_ops dispatch |
| MEDIUM | | 5.5 | | CVE-2026-89722 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() |
| MEDIUM | | 5.5 | | CVE-2026-89757 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: mm/mglru: fix and remove redundant unevictable folio handling |
| MEDIUM | | 4.7 | | CVE-2026-89810 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix error path at svm_migrate_copy_to_ram |
| MEDIUM | | | | CVE-2026-89826 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| MEDIUM | | | | CVE-2026-89833 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| MEDIUM | | | | CVE-2026-89866 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| MEDIUM | | | | CVE-2026-89906 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| MEDIUM | | 4.7 | | CVE-2026-89913 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables |
| MEDIUM | | 4.7 | | CVE-2026-89920 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Fix memory corruption by not reinjecting CK machine checks |
| MEDIUM | | | | CVE-2026-89935 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 3.6 | | CVE-2026-89987 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: mm/huge_memory: transfer the pmd dirty bit to the folio on zap |
| MEDIUM | | 5.5 | | CVE-2026-90040 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped |
| MEDIUM | | 5.5 | | CVE-2026-90061 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: skip double clone set expressions on element insert |
| MEDIUM | | 5.5 | | CVE-2026-90083 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net/sched: act_ife: Only operate on Ethernet frames |
| MEDIUM | | 5.5 | | CVE-2026-90087 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: do not leak an hci_conn when a second LE connect is rejected |
| MEDIUM | | 7 | | CVE-2026-90093 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: access chan->conn safely in get/setsockopt |
| MEDIUM | | 5.5 | | CVE-2026-90098 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: fix sleep in atomic context in MAC table access |
| MEDIUM | | 7 | | CVE-2026-90099 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net/sched: account classifier filter allocations to memcg |
| MEDIUM | | 7 | | CVE-2026-90104 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: NFSv4.1: zero referring call lists before decoding |
| MEDIUM | | 5.5 | | CVE-2026-90105 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: vxlan: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90106 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: bridge: arp/nd proxy: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90116 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ALSA: mtpav: shut down output timer before card teardown |
| MEDIUM | | 5.5 | | CVE-2026-90142 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix resize of the RX ring |
| MEDIUM | | 5.5 | | CVE-2026-90149 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers |
| MEDIUM | | 5.5 | | CVE-2026-90154 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ksmbd: scope session state changes to bound connections |
| MEDIUM | | 5.5 | | CVE-2026-90155 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ksmbd: detach blocked lock requests before freeing |
| MEDIUM | | 5.5 | | CVE-2026-90156 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely discard unregistered deferred locks |
| MEDIUM | | 7 | | CVE-2026-90161 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: erofs: fix interlaced ztailpacking pclusters |
| MEDIUM | | 5.5 | | CVE-2026-90162 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ksmbd: defer publishing granted locks to prevent UAF/double-free race |
| MEDIUM | | 5.5 | | CVE-2026-90167 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ksmbd: serialize oplock close with pending break ownership |
| MEDIUM | | 5.5 | | CVE-2026-90174 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() |
| MEDIUM | | 5.5 | | CVE-2026-90177 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Check pointer type for all atomic RMW paths |
| MEDIUM | | 5.5 | | CVE-2026-90179 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix deadlock in complain-mode change_hat |
| MEDIUM | | 5.5 | | CVE-2026-90204 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate DIO orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90205 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90208 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type |
| MEDIUM | | 5.5 | | CVE-2026-90217 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Compare iterator types during state pruning |
| MEDIUM | | 5.5 | | CVE-2026-90231 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix unconfined user namespace restriction forced stack |
| MEDIUM | | 5.5 | | CVE-2026-90232 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: amt: Don't support cross-netns setup |
| MEDIUM | | 5.1 | | CVE-2026-90234 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: NFS: Return a delegation the client fails to record |
| MEDIUM | | 7 | | CVE-2026-90237 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfilter: nft_ct: move custom expectation support to helper |
| MEDIUM | | 7 | | CVE-2026-90240 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Flush context cache with correct SID when tearing down aliases |
| MEDIUM | | 5.5 | | CVE-2026-90247 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix mmap_lock leak in irq_work path |
| MEDIUM | | 5.9 | | CVE-2026-90256 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind |
| MEDIUM | | 5.5 | | CVE-2026-90259 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() |
| MEDIUM | | 4.7 | | CVE-2026-90260 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: don't clobber the extent buffer when zeroing it out |
| MEDIUM | | 3.3 | | CVE-2026-90263 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: btrfs: check if root is readonly when setting posix acl |
| MEDIUM | | 5.5 | | CVE-2026-90264 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: btrfs: always wait for ordered extents to avoid OE races |
| MEDIUM | | 5.5 | | CVE-2026-90265 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: btrfs: defrag: fix deadlock between defrag and delalloc space reservation |
| MEDIUM | | 5.5 | | CVE-2026-90273 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable |
| MEDIUM | | 5.5 | | CVE-2026-90289 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Resize MST HDCP per-connector arrays to 32 |
| MEDIUM | | 5.5 | | CVE-2026-90300 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear buf on error in __bpf_get_task_stack |
| MEDIUM | | 5.5 | | CVE-2026-90301 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ocfs2: o2hb: quiesce negotiate handlers and timeout work |
| MEDIUM | | 7 | | CVE-2026-90317 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Invalidate RCU pointers after final spin unlock |
| MEDIUM | | 5.5 | | CVE-2026-90320 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate external xattr entries when reading metadata |
| MEDIUM | | 5.5 | | CVE-2026-90321 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate inline xattrs during inode block validation |
| MEDIUM | | 5.5 | | CVE-2026-90324 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ublk: check import_ubuf() return value |
| MEDIUM | | 4.7 | | CVE-2026-90326 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: blk-cgroup: fix race between policy activation and blkg destruction |
| MEDIUM | | 5.5 | | CVE-2026-90328 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: HID: steam: Reject short reads |
| MEDIUM | | 6.4 | | CVE-2026-90333 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: dm-integrity: replace forgeable discard filler with a keyed sector marker |
| MEDIUM | | 4.1 | | CVE-2026-90336 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: serial: core: clear freed pointers on uart_register_driver() failure |
| MEDIUM | | 5.5 | | CVE-2026-90337 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: serial: core: do fallible allocations before the console can be registered |
| MEDIUM | | 7 | | CVE-2026-90343 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: stop PMSR before P2P and NAN teardown |
| MEDIUM | | 5.5 | | CVE-2026-90345 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: brcmfmac: fix P2P action frame handling without device vif |
| MEDIUM | | 7 | | CVE-2026-90347 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry |
| MEDIUM | | 5.5 | | CVE-2026-90351 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed |
| MEDIUM | | 4.4 | | CVE-2026-90359 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject >8 byte return values on return-reading trampoline paths |
| MEDIUM | | 5.5 | | CVE-2026-90363 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/msm: don't tear down KMS twice when KMS init fails |
| MEDIUM | | 5.5 | | CVE-2026-90365 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: cancel reset and rc work on device unregister |
| MEDIUM | | 5.5 | | CVE-2026-90367 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER |
| MEDIUM | | 4.8 | | CVE-2026-90379 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash |
| MEDIUM | | 3.3 | | CVE-2026-90401 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: md: remove REQ_NOWAIT support from raid1/10/456 |
| MEDIUM | | 5.5 | | CVE-2026-90408 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() |
| MEDIUM | | 5.5 | | CVE-2026-90409 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Add vm_bind region with kbo range overlap check |
| MEDIUM | | 4.7 | | CVE-2026-90417 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() |
| MEDIUM | | 5.5 | | CVE-2026-90421 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: PCI: Fix UAF when probe runs concurrent to dyn ID removal |
| MEDIUM | | 5.5 | | CVE-2026-90422 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path |
| MEDIUM | | 4.7 | | CVE-2026-90427 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() |
| MEDIUM | | 5.5 | | CVE-2026-92480 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Validate string descriptors |
| MEDIUM | | 5.5 | | CVE-2026-92482 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip |
| MEDIUM | | 3.3 | | CVE-2026-92485 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix WARNING in bpf_tracing_link_release |
| MEDIUM | | 5.5 | | CVE-2026-92499 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ext4: validate readdir offset before accessing dirent |
| MEDIUM | | 4.7 | | CVE-2026-92500 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ext4: use fsdata to track inline data write state and fix race |
| MEDIUM | | 5.5 | | CVE-2026-92503 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() |
| MEDIUM | | 5.5 | | CVE-2026-92518 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: riscv, bpf: Fix kernel stack corruption in tailcall with CFI |
| MEDIUM | | 5.5 | | CVE-2026-92520 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Zero queue and stack outputs on lock failure |
| MEDIUM | | 5.5 | | CVE-2026-93044 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for arena-related insns |
| MEDIUM | | 5.5 | | CVE-2026-93047 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Associate BOs with every job that accesses them |
| MEDIUM | | 5.5 | | CVE-2026-93058 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Only fini scheduler after successful init |
| MEDIUM | | 5.5 | | CVE-2026-93081 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_scmi: Fix SCMI device destroy lifetimes |
| MEDIUM | | 4.7 | | CVE-2026-93099 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Fix UAF from worker threads when domains are removed |
| MEDIUM | | 4.7 | | CVE-2026-93100 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() |
| MEDIUM | | 4.7 | | CVE-2026-93104 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: RDMA/rvt: Return NULL after port allocation failure |
| MEDIUM | | 7 | | CVE-2026-93105 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: esp: do not unref managed frag pages in esp_ssg_unref() |
| MEDIUM | | 5.5 | | CVE-2026-93122 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: usb: gadget: uac: validate rate list length before storing |
| MEDIUM | | 5.5 | | CVE-2026-93135 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject programs with inlined helpers if JIT is not available |
| MEDIUM | | 7 | | CVE-2026-93148 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject MEM_ALLOC BTF accesses past object bounds |
| MEDIUM | | 7 | | CVE-2026-93154 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Add refcounting to user ring MRs |
| MEDIUM | | 5.5 | | CVE-2026-93168 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout |
| MEDIUM | | 5.5 | | CVE-2026-93175 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in CRTC reset function |
| MEDIUM | | 4.7 | | CVE-2026-93176 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in plane reset function |
| MEDIUM | | 5.5 | | CVE-2026-93270 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn |
| MEDIUM | | 5.5 | | CVE-2026-93272 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 |
| MEDIUM | | 5.5 | | CVE-2026-93276 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator |
| MEDIUM | | 5.5 | | CVE-2026-93282 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix maximum allowed access checks |
| MEDIUM | | 7.1 | | CVE-2026-97422 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: fix SMI event cross-process information leak |
| MEDIUM | | 5.5 | | CVE-2026-97432 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: fix P2P-Device binding handling |
| MEDIUM | | 5.5 | | CVE-2026-97478 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: virt: acrn: Fix irqfd use-after-free during eventfd shutdown |
| MEDIUM | | 7.1 | | CVE-2026-97493 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS |
| MEDIUM | | 5.5 | | CVE-2026-97499 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: coresight: perf: Retrieve path and source from event data |
| MEDIUM | | 5.5 | | CVE-2026-97513 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Release m2m_ctx after Instance Removed from List |
| MEDIUM | | 5.5 | | CVE-2026-97515 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 |
| MEDIUM | | 5.5 | | CVE-2026-97526 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: s390/pai: Support CPU hotplug for PMU PAI |
| MEDIUM | | 5.5 | | CVE-2026-97538 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: hwmon: (asus_rog_ryujin) Validate HID report lengths |
| MEDIUM | | 5.5 | | CVE-2026-97554 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() |
| MEDIUM | | 7 | | CVE-2026-97561 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid |
| MEDIUM | | 7 | | CVE-2026-97563 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97565 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject short READ responses in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97960 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel: Prevent drain_pebs() reentry |
| MEDIUM | | 5.5 | | CVE-2026-97962 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Move representor vnic reporter to eswitch devlink port |
| MEDIUM | | 5.1 | | CVE-2026-97975 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() |
| MEDIUM | | 4.7 | | CVE-2026-97988 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: vhost: invalidate vring access on IOTLB transitions |
| MEDIUM | | 5.5 | | CVE-2026-98019 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: mark a NULL call argument precise |
| MEDIUM | | 5.3 | | CVE-2026-98032 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: tracing: Fix subbuf resize races with trace_pipe_raw readers |
| MEDIUM | | 7 | | CVE-2026-98033 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Preserve inner map identity in callback frames |
| MEDIUM | | 7 | | CVE-2026-98034 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark NULL kptr stores precise |
| MEDIUM | | 5.5 | | CVE-2026-98043 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Don't infer non-NULL from a pointer with an unbounded offset |
| MEDIUM | | 7 | | CVE-2026-98047 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Check ancestor frames for rbtree callbacks |
| MEDIUM | | 7 | | CVE-2026-98048 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: don't rewrite bpf_fastcall patterns entered by a jump |
| MEDIUM | | 5.5 | | CVE-2026-98049 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: zero extend the result of an arena 32-bit cmpxchg |
| MEDIUM | | 5.5 | | CVE-2026-98053 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Refactor and fix init_config access |
| MEDIUM | | 5.5 | | CVE-2026-98062 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark signal tracepoint siginfo arguments as scalar |
| MEDIUM | | 5.5 | | CVE-2026-98085 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge |
| MEDIUM | | | | CVE-2026-98099 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 5.5 | | CVE-2026-98115 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely drain sessions during logoff |
| MEDIUM | | 5.5 | | CVE-2026-98118 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix readahead synchronisation issues by loading all folios upfront |
| MEDIUM | | 5.5 | | CVE-2026-98124 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: smb/client: invalidate fscache for fallocate range operations |
| MEDIUM | | 5.5 | | CVE-2026-98125 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix stale page cache in insert/collapse range |
| MEDIUM | | 5.5 | | CVE-2026-98131 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix dma mapping leak in stmmac_tso_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-98134 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: check_cond_jmp_op(): properly infer if register is null |
| MEDIUM | | 5.3 | | CVE-2026-98156 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/virtio: use the DMA API for resource backing on Xen |
| MEDIUM | | 5.5 | | CVE-2026-98162 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: smb/server: fix tree connection leak in smb2_tree_connect() |
| MEDIUM | | 5.5 | | CVE-2026-98180 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/msm: RCU-free the scheduler-containing ring and VM objects |
| MEDIUM | | 5.5 | | CVE-2026-98228 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ |
| MEDIUM | | 4.4 | | CVE-2026-98273 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: x86/kprobes: Fix crash when probing CS CALL instructions |
| MEDIUM | | 5.5 | | CVE-2026-98277 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: ring the doorbell if a burst ends in a drop |
| MEDIUM | | 5.5 | | CVE-2026-98279 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: btrfs: handle lack of space when cleaning up verity items |
| MEDIUM | | 5.3 | | CVE-2026-98284 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netlink: do not free nlk->groups while lockless readers can use it |
| MEDIUM | | 4.1 | | CVE-2026-98286 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown |
| MEDIUM | | 5.5 | | CVE-2026-98288 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix TSO header length truncation |
| MEDIUM | | 5.5 | | CVE-2026-98292 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| MEDIUM | | 5.5 | | CVE-2026-98294 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_qca: Do not write to the serial port after it is closed |
| MEDIUM | | 7 | | CVE-2026-98296 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btintel_pcie: validate TX skb length in send_sync |
| MEDIUM | | 5.5 | | CVE-2026-98313 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/msm/dp: skip PUSH_IDLE when the link was never enabled |
| MEDIUM | | 7 | | CVE-2026-98330 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: get the wiphy out of a dying network namespace |
| MEDIUM | | 5.5 | | CVE-2026-98333 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: reset the LED state when ifup fails |
| MEDIUM | | 7 | | CVE-2026-98341 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: don't free driver-owned scan requests |
| MEDIUM | | 5.5 | | CVE-2026-98353 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables |
| MEDIUM | | 5.5 | | CVE-2026-98355 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: RDMA/rtrs: guard against null kobj name |
| MEDIUM | | 5.5 | | CVE-2026-98376 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Use array_map_meta_equal for percpu array inner map replacement |
| MEDIUM | | 5.5 | | CVE-2026-98408 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: watchdog: rzv2h: Avoid division by zero |
| MEDIUM | | 5.5 | | CVE-2026-98420 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ksmbd: follow SMB2 session expiration semantics |
| MEDIUM | | | | CVE-2026-98436 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: a ... |
| MEDIUM | | 6.5 | | CVE-2026-98439 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: smb/server: cancel async requests when closing connection |
| MEDIUM | | 4.7 | | CVE-2026-98444 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: xfs: drop dquot flush lock when we can't find a buffer to flush |
| MEDIUM | | 6.5 | | CVE-2026-98449 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: smb: client: delete compound mids on send failure before unlock |
| MEDIUM | | 5.3 | | CVE-2026-98471 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Do cache maintenance on the source VM during intra-host migration |
| MEDIUM | | 5.5 | | CVE-2026-98556 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: gve: DQO: reject TSO packets with an out of range MSS |
| MEDIUM | | 4.1 | | CVE-2026-98558 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: flush skb_defer_nodes in dev_cpu_dead() |
| MEDIUM | | 5.9 | | CVE-2026-98570 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: ipv6: keep room for the mac header in dst_dev_overhead() |
| MEDIUM | | 6.7 | | CVE-2026-98589 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject pkt arguments in mutating subprogs |
| MEDIUM | | 4.7 | | CVE-2026-98598 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ipv6: Prevent rt6_insert_exception() for dying fib6_info |
| MEDIUM | | 6.7 | | CVE-2026-98599 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() |
| MEDIUM | | 4.1 | | CVE-2026-98616 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: reset num_napi when the napi vectors are freed |
| MEDIUM | | 5.5 | | CVE-2026-98652 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Add missing srcu in kvm_s390_set_irq_state() |
| MEDIUM | | 5.5 | | CVE-2026-98674 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: iio: adc: adi-axi-adc: Initialize state mutex |
| MEDIUM | | 5.6 | | CVE-2026-98714 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| MEDIUM | | 4.1 | | CVE-2026-98740 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety |
| MEDIUM | | 4.4 | | CVE-2026-98747 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix NULL pointer dereference in serial_core_unregister_port() |
| MEDIUM | | 4.7 | | CVE-2026-98786 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: guard dc_sink dereferences in MST mode validation |
| MEDIUM | | 4.4 | | CVE-2026-98789 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix objects stuck in free_by_rcu_ttrace |
| MEDIUM | | 4.4 | | CVE-2026-98795 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: skip ptp deinit if init was skipped |
| MEDIUM | | 4.4 | | CVE-2026-98799 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Skip detached progs in trampoline images that are still in use |
| MEDIUM | | 4.7 | | CVE-2026-98800 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: kernel: Denial of Service via use-after-free in BPF trampoline |
| MEDIUM | | 6.5 | | CVE-2026-98803 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix rx Scatter-Gather support |
| MEDIUM | | 6.1 | | CVE-2026-98810 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() |
| MEDIUM | | 4.4 | | CVE-2026-98813 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Hold map BTF for the memory allocator destructor record |
| MEDIUM | | 4.4 | | CVE-2026-98814 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: nvme: fix command effects log lifetime for multipath heads |
| MEDIUM | | 4.1 | | CVE-2026-98815 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: nvme: fix cdev lifetime |
| MEDIUM | | 4.1 | | CVE-2026-98816 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix overflow of jump offset in constant blinding |
| MEDIUM | | 5.5 | | CVE-2026-98820 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: blk-mq: set RQF_USE_SCHED when the operation is known |
| MEDIUM | | 5.3 | | CVE-2026-98824 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate TX status rate metadata |
| MEDIUM | | 6.5 | | CVE-2026-98829 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: drop oversized fragments to avoid extra_len overflow |
| MEDIUM | | 4.1 | | CVE-2026-98834 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: mtd: core: avoid double-free of OTP NVMEM device |
| MEDIUM | | 6.1 | | CVE-2026-98839 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() |
| MEDIUM | | 4.4 | | CVE-2026-98843 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfs: zero gaps in read-gaps folio to avoid writing back stale data |
| MEDIUM | | 5.6 | | CVE-2026-98863 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| MEDIUM | | 4.6 | | CVE-2019-15213 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: use-after-free caused by malicious USB device in drivers/media/usb/dvb-usb/dvb-usb-init.c |
| MEDIUM | | 4.1 | | CVE-2019-16089 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Improper return check in nbd_genl_status function in drivers/block/nbd.c |
| MEDIUM | | 4.7 | | CVE-2019-20794 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: task processes not being properly ended could lead to resource exhaustion |
| MEDIUM | | 4.4 | | CVE-2020-14304 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ethtool when reading eeprom of device could lead to memory leak |
| MEDIUM | | 6.7 | | CVE-2020-36694 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: use-after-free in the packet processing context |
| MEDIUM | | 5.5 | | CVE-2023-31082 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sleeping function called from an invalid context in gsmld_write |
| MEDIUM | | 7 | | CVE-2023-3397 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: slab-use-after-free Write in txEnd due to race condition |
| MEDIUM | | 5.5 | | CVE-2023-37454 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: udf: use-after-free write in udf_close_lvid |
| MEDIUM | | 6.7 | | CVE-2023-6238 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvme: memory corruption via unprivileged user passthrough |
| MEDIUM | | 6.5 | | CVE-2023-6240 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation |
| MEDIUM | | 5.5 | | CVE-2024-2193 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | hw: Spectre-SRC that is Speculative Race Conditions (SRCs) for synchronization primitives similar like Spectre V1 with p |
| MEDIUM | | 4.7 | | CVE-2024-24864 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | A race condition was found in the Linux kernel's media/dvb-core in dvb ... |
| MEDIUM | | 5.5 | | CVE-2024-25740 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory leak in ubi driver |
| MEDIUM | | 5.5 | | CVE-2024-56709 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring: check if iowq is killed before queuing |
| MEDIUM | | 5.5 | | CVE-2024-58074 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/i915: Grab intel_display from the encoder to avoid potential oopsies |
| MEDIUM | | 5.5 | | CVE-2025-21752 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents |
| MEDIUM | | 5.5 | | CVE-2025-21949 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Set hugetlb mmap base address aligned with pmd size |
| MEDIUM | | 5.5 | | CVE-2025-22109 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ax25: Remove broken autobind |
| MEDIUM | | 5.5 | | CVE-2025-23132 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: quota: fix to avoid warning in dquot_writeback_dquots() |
| MEDIUM | | 5.5 | | CVE-2025-23135 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Teardown riscv specific bits after kvm_exit |
| MEDIUM | | 5.5 | | CVE-2025-37743 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Avoid memory leak while enabling statistics |
| MEDIUM | | 5.5 | | CVE-2025-37746 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/dwc_pcie: fix duplicate pci_dev devices |
| MEDIUM | | 5.5 | | CVE-2025-37880 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: um: work around sched_yield not yielding in time-travel mode |
| MEDIUM | | 4.7 | | CVE-2025-37906 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: ublk race condition causes kernel crash |
| MEDIUM | | 5.5 | | CVE-2025-38029 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to sleepable page allocation in KASAN |
| MEDIUM | | 5.5 | | CVE-2025-38036 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to null pointer dereference in GT MMIO initialization for VFs |
| MEDIUM | | 5.5 | | CVE-2025-38041 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clk: sunxi-ng: h616: Reparent GPU clock during frequency changes |
| MEDIUM | | 5.5 | | CVE-2025-38042 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn |
| MEDIUM | | 6.7 | | CVE-2025-38064 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio: break and reset virtio devices on device_shutdown() |
| MEDIUM | | 5.5 | | CVE-2025-38132 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: holding cscfg_csdev_lock while removing cscfg from csdev |
| MEDIUM | | 5.5 | | CVE-2025-38140 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Local denial of service in device mapper |
| MEDIUM | | 5.5 | | CVE-2025-38199 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix memory leak due to multiple rx_stats allocation |
| MEDIUM | | 5.5 | | CVE-2025-38207 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm: fix uprobe pte be overwritten when expanding vma |
| MEDIUM | | 5.5 | | CVE-2025-38261 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv: save the SR_SUM status over switches |
| MEDIUM | | 5.5 | | CVE-2025-38284 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: configure manual DAC mode via PCI config API only |
| MEDIUM | | 5.5 | | CVE-2025-38311 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel (iavf): Denial of Service due to a locking issue |
| MEDIUM | | 5.5 | | CVE-2025-38359 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Fix in_atomic() handling in do_secure_storage_access() |
| MEDIUM | | 5.5 | | CVE-2025-38597 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port |
| MEDIUM | | 5.5 | | CVE-2025-38605 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() |
| MEDIUM | | 5.5 | | CVE-2025-39677 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Fix backlog accounting in qdisc_dequeue_internal |
| MEDIUM | | 5.5 | | CVE-2025-39762 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: add null check |
| MEDIUM | | 5.5 | | CVE-2025-39775 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: mremap local denial of service |
| MEDIUM | | 5.5 | | CVE-2025-39789 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: crypto: x86/aegis - Add missing error checks |
| MEDIUM | | 6.1 | | CVE-2025-39822 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/kbuf: fix signedness in this_len calculation |
| MEDIUM | | 5.5 | | CVE-2025-39830 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path |
| MEDIUM | | 5.5 | | CVE-2025-39834 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow |
| MEDIUM | | 6.2 | | CVE-2025-39910 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() |
| MEDIUM | | 7.1 | | CVE-2025-39933 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length |
| MEDIUM | | 2.5 | | CVE-2025-40113 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E |
| MEDIUM | | 6.8 | | CVE-2025-40130 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling |
| MEDIUM | | 6.2 | | CVE-2025-40146 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: fix potential deadlock while nr_requests grown |
| MEDIUM | | 5.2 | | CVE-2025-40217 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pidfs: validate extensible ioctls |
| MEDIUM | | | | CVE-2025-40247 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Fix pgtable prealloc error path |
| MEDIUM | | 5.2 | | CVE-2025-40338 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Do not share the name pointer between components |
| MEDIUM | | 6.1 | | CVE-2025-40355 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sysfs: check visibility before changing group attribute ownership |
| MEDIUM | | 5.5 | | CVE-2025-68209 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mlx5: Fix default values in create CQ |
| MEDIUM | | 5.5 | | CVE-2025-68236 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service during UFS power down |
| MEDIUM | | 5.5 | | CVE-2025-68304 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_core: lookup hci_conn on RX path on protocol side |
| MEDIUM | | | | CVE-2025-68318 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL |
| MEDIUM | | 6.1 | | CVE-2025-68319 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netconsole: Acquire su_mutex before navigating configs hierarchy |
| MEDIUM | | 5.5 | | CVE-2025-68353 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service via NULL pointer dereference in VXLAN module |
| MEDIUM | | 4.5 | | CVE-2025-68360 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks |
| MEDIUM | | 5.5 | | CVE-2025-68368 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service in md driver via uninitialized bioset |
| MEDIUM | | 6.5 | | CVE-2025-68729 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix MSDU buffer types handling in RX error path |
| MEDIUM | | 5.5 | | CVE-2025-68730 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() |
| MEDIUM | | 4.7 | | CVE-2025-68745 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset |
| MEDIUM | | 7.8 | | CVE-2025-71074 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel functionfs: Use-After-Free vulnerability due to open/removal races |
| MEDIUM | | 5.5 | | CVE-2025-71117 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service via deadlock in block layer sysfs store callbacks |
| MEDIUM | | 5.5 | | CVE-2025-71141 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/tilcdc: Fix removal actions in case of failed probe |
| MEDIUM | | 5.5 | | CVE-2025-71188 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: lpc18xx-dmamux: fix device leak on route allocation |
| MEDIUM | | 6.5 | | CVE-2025-71202 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Memory Corruption and Kernel Crashes via IOMMU SVA coherency issue |
| MEDIUM | | 5.5 | | CVE-2025-71227 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: don't WARN for connections on invalid channels |
| MEDIUM | | 5.5 | | CVE-2025-71285 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels |
| MEDIUM | | 5.5 | | CVE-2025-71302 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: fix for dma-fence safe access rules |
| MEDIUM | | 7 | | CVE-2025-71313 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI: endpoint: Add missing NULL check for alloc_workqueue() |
| MEDIUM | | 5.5 | | CVE-2025-71315 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/vkms: Convert to DRM's vblank timer |
| MEDIUM | | 5.5 | | CVE-2026-100074 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| MEDIUM | | 5.5 | | CVE-2026-100076 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths |
| MEDIUM | | 5.5 | | CVE-2026-100077 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Recover HW before retire hung submit |
| MEDIUM | | 5.5 | | CVE-2026-23007 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: block: zero non-PI portion of auto integrity buffer |
| MEDIUM | | 5.5 | | CVE-2026-23017 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: idpf: fix error handling in the init_task on load |
| MEDIUM | | 5.5 | | CVE-2026-23143 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix misalignment bug in struct virtnet_info |
| MEDIUM | | 7.1 | | CVE-2026-23152 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: correctly decode TTLM with default link map |
| MEDIUM | | 5.5 | | CVE-2026-23217 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv: trace: fix snapshot deadlock with sbi ecall |
| MEDIUM | | 5.5 | | CVE-2026-23259 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/rw: free potentially allocated iovec on cache put failure |
| MEDIUM | | 5.5 | | CVE-2026-23265 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer in {read,write}_end_io |
| MEDIUM | | 5.5 | | CVE-2026-23348 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix race of nvdimm_bus object when creating nvdimm objects |
| MEDIUM | | 5.5 | | CVE-2026-23371 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting |
| MEDIUM | | 5.5 | | CVE-2026-23377 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz |
| MEDIUM | | 5.5 | | CVE-2026-23385 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: clone set on flush only |
| MEDIUM | | 5.5 | | CVE-2026-23472 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN |
| MEDIUM | | 5.5 | | CVE-2026-31435 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix read abandonment during retry |
| MEDIUM | | 5.5 | | CVE-2026-31526 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix exception exit lock checking for subprogs |
| MEDIUM | | 5.5 | | CVE-2026-31537 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: server: make use of smbdirect_socket.send_io.bcredits |
| MEDIUM | | 5.5 | | CVE-2026-31562 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register |
| MEDIUM | | 5.5 | | CVE-2026-31579 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit |
| MEDIUM | | 5.5 | | CVE-2026-31591 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish |
| MEDIUM | | 5.5 | | CVE-2026-31592 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock |
| MEDIUM | | 5.5 | | CVE-2026-31630 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rxrpc: proc: size address buffers for %pISpc output |
| MEDIUM | | 7.1 | | CVE-2026-31692 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns |
| MEDIUM | | 5.5 | | CVE-2026-31771 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_event: move wake reason storage into validated event handlers |
| MEDIUM | | 5.5 | | CVE-2026-31777 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: ctxfi: Check the error for index mapping |
| MEDIUM | | 5.5 | | CVE-2026-43009 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix incorrect pruning due to atomic fetch precision tracking |
| MEDIUM | | 5.5 | | CVE-2026-43022 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists |
| MEDIUM | | 5.5 | | CVE-2026-43029 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mptcp: fix soft lockup in mptcp_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-43034 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: set backing store type from query type |
| MEDIUM | | 7.1 | | CVE-2026-43042 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mpls: add seqcount to protect the platform_label{,s} pair |
| MEDIUM | | 5.5 | | CVE-2026-43048 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: HID: core: Mitigate potential OOB by removing bogus memset() |
| MEDIUM | | 5.5 | | CVE-2026-43053 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: close crash window in attr dabtree inactivation |
| MEDIUM | | 5.5 | | CVE-2026-43083 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: ioam6: fix OOB and missing lock |
| MEDIUM | | 5.5 | | CVE-2026-43101 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() |
| MEDIUM | | 5.5 | | CVE-2026-43115 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: srcu: Use irq_work to start GP in tiny SRCU |
| MEDIUM | | 5.5 | | CVE-2026-43118 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix zero size inode with non-zero size after log replay |
| MEDIUM | | 5.5 | | CVE-2026-43127 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs3: fix circular locking dependency in run_unpack_ex |
| MEDIUM | | 5.5 | | CVE-2026-43172 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: fix 22000 series SMEM parsing |
| MEDIUM | | 5.5 | | CVE-2026-43191 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 |
| MEDIUM | | 5.5 | | CVE-2026-43204 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: qcom: q6asm: drop DSP responses for closed data streams |
| MEDIUM | | 5.5 | | CVE-2026-43213 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: validate sequence number of TX release report |
| MEDIUM | | 5.5 | | CVE-2026-43234 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: team: avoid NETDEV_CHANGEMTU event when unregistering slave |
| MEDIUM | | 5.5 | | CVE-2026-43272 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ring-buffer: Fix possible dereference of uninitialized pointer |
| MEDIUM | | 5.5 | | CVE-2026-43294 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels |
| MEDIUM | | 5.5 | | CVE-2026-43298 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Skip vcn poison irq release on VF |
| MEDIUM | | 5.5 | | CVE-2026-43299 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() |
| MEDIUM | | 5.5 | | CVE-2026-43301 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix PM runtime usage count underflow |
| MEDIUM | | 5.5 | | CVE-2026-43308 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() |
| MEDIUM | | 5.5 | | CVE-2026-43309 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md raid: fix hang when stopping arrays with metadata through dm-raid |
| MEDIUM | | 5.5 | | CVE-2026-43310 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC |
| MEDIUM | | 5.5 | | CVE-2026-43311 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soc/tegra: pmc: Fix unsafe generic_handle_irq() call |
| MEDIUM | | 5.5 | | CVE-2026-43325 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: don't send a 6E related command when not supported |
| MEDIUM | | 5.5 | | CVE-2026-43326 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback |
| MEDIUM | | 5.5 | | CVE-2026-43337 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() |
| MEDIUM | | 5.5 | | CVE-2026-43346 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ice: ptp: don't WARN when controlling PF is unavailable |
| MEDIUM | | 5.5 | | CVE-2026-43352 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue |
| MEDIUM | | 5.5 | | CVE-2026-43353 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue |
| MEDIUM | | 7.1 | | CVE-2026-43414 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Completely fix fcport double free |
| MEDIUM | | 5.5 | | CVE-2026-43416 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: powerpc, perf: Check that current->mm is alive before getting user callchain |
| MEDIUM | | 5.5 | | CVE-2026-43443 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: amd: acp-mach-common: Add missing error check for clock acquisition |
| MEDIUM | | 5.5 | | CVE-2026-43463 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() |
| MEDIUM | | 5.5 | | CVE-2026-43464 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ |
| MEDIUM | | 5.5 | | CVE-2026-43465 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ |
| MEDIUM | | 5.5 | | CVE-2026-43485 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nouveau/gsp: drop WARN_ON in ACPI probes |
| MEDIUM | | 6.4 | | CVE-2026-45932 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix tcx/netkit detach permissions when prog fd isn't given |
| MEDIUM | | 7 | | CVE-2026-45934 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation |
| MEDIUM | | 5.5 | | CVE-2026-45940 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix oops when split header is enabled |
| MEDIUM | | 5.5 | | CVE-2026-45961 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gfs2: fix memory leaks in gfs2_fill_super error path |
| MEDIUM | | 5.5 | | CVE-2026-46014 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Add missing save/restore handling of LBR MSRs |
| MEDIUM | | 7 | | CVE-2026-46017 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm: fix deferred split queue races during migration |
| MEDIUM | | 7 | | CVE-2026-46032 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT |
| MEDIUM | | 5.5 | | CVE-2026-46044 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipmi:ssif: Clean up kthread on errors |
| MEDIUM | | 5.5 | | CVE-2026-46059 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN |
| MEDIUM | | 5.5 | | CVE-2026-46066 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix num_ops off-by-one when crypto allocation fails |
| MEDIUM | | 5.5 | | CVE-2026-46071 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 |
| MEDIUM | | 5.5 | | CVE-2026-46096 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() |
| MEDIUM | | 5.5 | | CVE-2026-46147 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() |
| MEDIUM | | 5.5 | | CVE-2026-46148 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: spi: microchip-core-qspi: control built-in cs manually |
| MEDIUM | | 5.5 | | CVE-2026-46153 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: 8021q: delete cleared egress QoS mappings |
| MEDIUM | | 5.5 | | CVE-2026-46171 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv: kvm: fix vector context allocation leak |
| MEDIUM | | 5.5 | | CVE-2026-46228 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: spi: ch341: fix devres lifetime |
| MEDIUM | | 5.5 | | CVE-2026-46245 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dc_link NULL handling in HPD init |
| MEDIUM | | 5.5 | | CVE-2026-46256 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages |
| MEDIUM | | 4.7 | | CVE-2026-46272 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: tmc-etr: Fix race condition between sysfs and perf mode |
| MEDIUM | | 5.5 | | CVE-2026-46302 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: selinux: allow multiple opens of /sys/fs/selinux/policy |
| MEDIUM | | 5.5 | | CVE-2026-46314 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Reject empty multisync extension to prevent infinite loop |
| MEDIUM | | 7 | | CVE-2026-46317 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock |
| MEDIUM | | 7 | | CVE-2026-46324 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: netfilter nf_tables denial of service via race condition in netlink hook unregistration |
| MEDIUM | | 7 | | CVE-2026-46325 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE |
| MEDIUM | | 7 | | CVE-2026-46330 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Revert "net/smc: Introduce TCP ULP support" |
| MEDIUM | | 5.5 | | CVE-2026-52937 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR |
| MEDIUM | | 7 | | CVE-2026-52953 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Fix oops due to out of scope access |
| MEDIUM | | 7 | | CVE-2026-52956 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() |
| MEDIUM | | 5.5 | | CVE-2026-52994 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting |
| MEDIUM | | 7 | | CVE-2026-53009 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ice: fix double-free of tx_buf skb |
| MEDIUM | | 5.5 | | CVE-2026-53017 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix data loss caused by incorrect use of nat_entry flag |
| MEDIUM | | 5.5 | | CVE-2026-53018 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: avoid reading already updated pages during GC |
| MEDIUM | | 5.5 | | CVE-2026-53103 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync |
| MEDIUM | | 5.5 | | CVE-2026-53104 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: Fix memory leak destroying device |
| MEDIUM | | 5.5 | | CVE-2026-53106 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Do not allow deleting local storage in NMI |
| MEDIUM | | 5.5 | | CVE-2026-53107 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: libertas: don't kill URBs in interrupt context |
| MEDIUM | | 5.5 | | CVE-2026-53108 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: powerpc/64s: Fix unmap race with PMD migration entries |
| MEDIUM | | | | CVE-2026-53178 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction |
| MEDIUM | | 7 | | CVE-2026-53224 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate embedded INIT chunk and address list lengths in cookie |
| MEDIUM | | 7 | | CVE-2026-53246 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing |
| MEDIUM | | 5.5 | | CVE-2026-53258 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: fix leak if split 6 GHz scanning fails |
| MEDIUM | | 5.5 | | CVE-2026-53281 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption |
| MEDIUM | | 5.5 | | CVE-2026-53285 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED |
| MEDIUM | | 5.5 | | CVE-2026-53292 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind |
| MEDIUM | | 5.5 | | CVE-2026-53297 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: mana: Guard mana_remove against double invocation |
| MEDIUM | | 5.5 | | CVE-2026-53321 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/napi: cap busy_poll_to 10 msec |
| MEDIUM | | 5.5 | | CVE-2026-53377 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: always recover the gpu |
| MEDIUM | | | | CVE-2026-53401 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: omap2: fix use-after-free in omapfb_mmap |
| MEDIUM | | | | CVE-2026-63805 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: crypto: nx - fix nx_crypto_ctx_exit argument |
| MEDIUM | | | | CVE-2026-63811 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: read COW data with the original inode during atomic write |
| MEDIUM | | | | CVE-2026-63819 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on f2fs_get_node_folio_ra() |
| MEDIUM | | 5.5 | | CVE-2026-63832 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: add wcid publish check in mt76_sta_add |
| MEDIUM | | 5.5 | | CVE-2026-63853 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring |
| MEDIUM | | | | CVE-2026-63857 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-63858 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: add hook transactions for device deletions |
| MEDIUM | | | | CVE-2026-63859 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue() |
| MEDIUM | | 7 | | CVE-2026-63941 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor |
| MEDIUM | | 7 | | CVE-2026-63979 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/handshake: hand off the pinned file reference to accept_doit |
| MEDIUM | | 5.5 | | CVE-2026-63998 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ethtool: module: call ethnl_ops_complete() on module flash errors |
| MEDIUM | | 5.5 | | CVE-2026-63999 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure |
| MEDIUM | | 5.5 | | CVE-2026-64006 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: fix dst corruption in same register operation |
| MEDIUM | | 7 | | CVE-2026-64024 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction |
| MEDIUM | | 5.5 | | CVE-2026-64036 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cgroup/rstat: validate cpu before css_rstat_cpu() access |
| MEDIUM | | 5.5 | | CVE-2026-64038 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Stop work before releasing hwmon device |
| MEDIUM | | 5.5 | | CVE-2026-64060 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix leak of request in netfs_write_begin() error handling |
| MEDIUM | | 7.1 | | CVE-2026-64066 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_read_to_pagecache() to pause on subreq failure |
| MEDIUM | | 5.5 | | CVE-2026-64067 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing barriers when accessing stream->subrequests locklessly |
| MEDIUM | | 7 | | CVE-2026-64068 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing locking around retry adding new subreqs |
| MEDIUM | | 5.5 | | CVE-2026-64076 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: bridge: eb_tables: close module init race |
| MEDIUM | | 5.5 | | CVE-2026-64077 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: ebtables: move to two-stage removal scheme |
| MEDIUM | | 7.1 | | CVE-2026-64078 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: add and use xtables_unregister_table_exit |
| MEDIUM | | 5.5 | | CVE-2026-64079 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: allocate hook ops while under mutex |
| MEDIUM | | 7 | | CVE-2026-64117 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb |
| MEDIUM | | 5.5 | | CVE-2026-64146 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix metabuf leak in inode xattr initialization |
| MEDIUM | | 5.5 | | CVE-2026-64154 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() |
| MEDIUM | | 5.5 | | CVE-2026-64159 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix zeropoint update where i_size > remote_i_size |
| MEDIUM | | 7 | | CVE-2026-64160 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point |
| MEDIUM | | 5.5 | | CVE-2026-64190 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: team: fix NULL pointer dereference in team_xmit during mode change |
| MEDIUM | | 5.5 | | CVE-2026-64212 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it |
| MEDIUM | | 5.5 | | CVE-2026-64213 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Add lock protection to lm90_alert |
| MEDIUM | | 7 | | CVE-2026-64255 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers |
| MEDIUM | | 7 | | CVE-2026-64520 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies |
| MEDIUM | | 7 | | CVE-2026-68086 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/khugepaged: write all dirty file folios when collapsing |
| MEDIUM | | 5.5 | | CVE-2026-68211 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: stm32-dcmipp: Return queued buffers on start_streaming() failure |
| MEDIUM | | 5.5 | | CVE-2026-68233 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/vc4: Shut down BO cache timer before teardown |
| MEDIUM | | 5.5 | | CVE-2026-68242 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/gt: Fix NULL deref on sched_engine alloc failure |
| MEDIUM | | 5.5 | | CVE-2026-68258 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size |
| MEDIUM | | 5.5 | | CVE-2026-68291 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: idpf driver null pointer dereference leads to Denial of Service |
| MEDIUM | | 5.5 | | CVE-2026-68295 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: BPF: Zero-extend signed ALU32 div/mod results |
| MEDIUM | | 5.5 | | CVE-2026-68312 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths |
| MEDIUM | | 7 | | CVE-2026-68323 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tipc: serialize udp bearer replicast list updates |
| MEDIUM | | 5.5 | | CVE-2026-68382 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Hold device ref until queue teardown completes |
| MEDIUM | | 5.5 | | CVE-2026-68383 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Keep scheduler timeline name alive |
| MEDIUM | | 7 | | CVE-2026-68393 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: extend conn_hash lookup critical sections |
| MEDIUM | | 6.4 | | CVE-2026-68399 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix UAF in sock clone early bailouts |
| MEDIUM | | 7 | | CVE-2026-68400 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation |
| MEDIUM | | 7 | | CVE-2026-68401 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() |
| MEDIUM | | 7 | | CVE-2026-68404 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect |
| MEDIUM | | 5.5 | | CVE-2026-68421 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() |
| MEDIUM | | 5.5 | | CVE-2026-68435 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Fix address space mismatch in kexec command line lookup |
| MEDIUM | | 5.5 | | CVE-2026-68441 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains |
| MEDIUM | | 5.5 | | CVE-2026-68447 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size |
| MEDIUM | | 7 | | CVE-2026-68448 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ovl: check access to copy_file_range source with src mounter creds |
| MEDIUM | | 7 | | CVE-2026-68453 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey |
| MEDIUM | | 5.5 | | CVE-2026-68471 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ieee80211: validate MLE common info length |
| MEDIUM | | 5.5 | | CVE-2026-72073 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mmc: vub300: fix use-after-free on probe failure |
| MEDIUM | | 5.5 | | CVE-2026-72162 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec |
| MEDIUM | | 7 | | CVE-2026-72288 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling |
| MEDIUM | | 7 | | CVE-2026-72329 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/liquidio: drop cached VF pci_dev LUT |
| MEDIUM | | 5.5 | | CVE-2026-72337 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: 6lowpan: avoid untracked enable work |
| MEDIUM | | 5.5 | | CVE-2026-72341 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Fix publication race for priv->channel_stats[] |
| MEDIUM | | 5.5 | | CVE-2026-72355 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix barriering when walking subrequest list |
| MEDIUM | | 5.5 | | CVE-2026-72365 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix writethrough to use collection offload |
| MEDIUM | | 5.5 | | CVE-2026-72367 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iomap: guard io_size EOF trim against concurrent truncate underflow |
| MEDIUM | | 5.5 | | CVE-2026-72375 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix reinitialisation of the inode, in particular ->lock_work |
| MEDIUM | | 5.5 | | CVE-2026-72380 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xen/pvcalls: bound backend response req_id before indexing rsp[] |
| MEDIUM | | 5.5 | | CVE-2026-72383 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: fix addr_wq_timer race in sctp_free_addr_wq() |
| MEDIUM | | 5.5 | | CVE-2026-72388 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock |
| MEDIUM | | 5.5 | | CVE-2026-72397 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() |
| MEDIUM | | 7 | | CVE-2026-72398 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: add INIT verification after cookie unpacking |
| MEDIUM | | 5.5 | | CVE-2026-72404 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() |
| MEDIUM | | 5.5 | | CVE-2026-72423 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Guard conntrack opts error writes |
| MEDIUM | | 5.5 | | CVE-2026-72440 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1: fix writes_pending and barrier reference leaks on write failures |
| MEDIUM | | 5.5 | | CVE-2026-72454 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() |
| MEDIUM | | 5.5 | | CVE-2026-72488 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soundwire: fix bug in sdw_add_element_group_count found by syzkaller |
| MEDIUM | | 5.5 | | CVE-2026-72493 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: serialize netif_running() check in enqueue_to_backlog() |
| MEDIUM | | 5.5 | | CVE-2026-72495 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages |
| MEDIUM | | 7 | | CVE-2026-72499 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free CQ toggle page after firmware teardown |
| MEDIUM | | 7 | | CVE-2026-72500 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown |
| MEDIUM | | | | CVE-2026-72501 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: R ... |
| MEDIUM | | 5.5 | | CVE-2026-74257 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sockmap: Fix use-after-free in udp_bpf_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-74264 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: watchdog: fix refcount tracking races |
| MEDIUM | | 5.5 | | CVE-2026-74272 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Resolve region deletion races |
| MEDIUM | | 5.5 | | CVE-2026-74273 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Block region delete during region creation |
| MEDIUM | | 5.5 | | CVE-2026-74314 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Cancel special fields on map value recycle |
| MEDIUM | | 5.5 | | CVE-2026-74317 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ixgbe: do not configure xps for XDP queues |
| MEDIUM | | 5.5 | | CVE-2026-74324 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: validate skb length in testmode query |
| MEDIUM | | 5.5 | | CVE-2026-74337 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks |
| MEDIUM | | 5.5 | | CVE-2026-74342 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: kernfs: link kn to its parent before the LSM init hook |
| MEDIUM | | 5.5 | | CVE-2026-74344 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear rb node linkage when freeing bpf_rb_root |
| MEDIUM | | 5.5 | | CVE-2026-74350 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate fast symlink target during inode read |
| MEDIUM | | 5.5 | | CVE-2026-74354 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Take mmap_lock in zap_pages() |
| MEDIUM | | 5.5 | | CVE-2026-74368 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() |
| MEDIUM | | 6.5 | | CVE-2026-74385 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock |
| MEDIUM | | 5.5 | | CVE-2026-74388 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data |
| MEDIUM | | 7 | | CVE-2026-74405 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: OPP: Fix race between OPP addition and lookup |
| MEDIUM | | 5.5 | | CVE-2026-74407 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath11k: cancel SSR work items during PCI shutdown |
| MEDIUM | | 5.5 | | CVE-2026-74449 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport |
| MEDIUM | | 5.5 | | CVE-2026-74466 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Close speculative mem read possibility |
| MEDIUM | | 7 | | CVE-2026-74506 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix UAF when sending a message |
| MEDIUM | | 7 | | CVE-2026-74513 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister |
| MEDIUM | | 5.5 | | CVE-2026-74527 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-af: Block VFs from clobbering special CGX PKIND state |
| MEDIUM | | 5.5 | | CVE-2026-74529 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback |
| MEDIUM | | 5.5 | | CVE-2026-74530 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback |
| MEDIUM | | 7 | | CVE-2026-74533 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero |
| MEDIUM | | 7 | | CVE-2026-74537 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: hold sk properly in iso_conn_ready |
| MEDIUM | | 5.5 | | CVE-2026-74538 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: lock sk in iso_connect_ind |
| MEDIUM | | 5.5 | | CVE-2026-74542 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix folio_queue ENOMEM in writeback by adding a mempool |
| MEDIUM | | 5.5 | | CVE-2026-74544 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds |
| MEDIUM | | 5.5 | | CVE-2026-74600 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/page_table_check: skip special zero mappings |
| MEDIUM | | 5.5 | | CVE-2026-74605 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: eventfs: Use children field for rcu head and add memory barriers |
| MEDIUM | | 7 | | CVE-2026-74611 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tls: rx: restore msg_iter before TLS 1.3 optimistic retry |
| MEDIUM | | 5.5 | | CVE-2026-74638 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Serialize the scheduler timeout handlers |
| MEDIUM | | 5.5 | | CVE-2026-74687 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: watchdog: at91sam9_wdt: prevent timer rearm during teardown |
| MEDIUM | | 7 | | CVE-2026-74695 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() |
| MEDIUM | | 7 | | CVE-2026-74697 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Disable EOP for TPA on all chips to prevent data corruption |
| MEDIUM | | 5.5 | | CVE-2026-74711 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus) Fix type confusion in notification logic |
| MEDIUM | | 5.5 | | CVE-2026-74713 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vhost_iotlb: bound map allocation in add_range |
| MEDIUM | | 7 | | CVE-2026-74715 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix netns reference imbalance in conntrack kfuncs |
| MEDIUM | | 5.5 | | CVE-2026-74723 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject inline extents without valid headers |
| MEDIUM | | 5.5 | | CVE-2026-74729 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read |
| MEDIUM | | 5.5 | | CVE-2026-74747 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipvs: revalidate ihl to prevent out-of-bounds access |
| MEDIUM | | 5.5 | | CVE-2026-80579 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: clear fb_info->mode before deleting a videomode |
| MEDIUM | | 5.5 | | CVE-2026-80580 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: bound mode sysfs output to the sysfs buffer |
| MEDIUM | | 5.5 | | CVE-2026-80614 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: emac: Fix NULL pointer dereference in emac_probe |
| MEDIUM | | 5.5 | | CVE-2026-80623 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: ete: Always save state on power down |
| MEDIUM | | 5.5 | | CVE-2026-80628 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Serialize readq reset state with q->lock |
| MEDIUM | | 5.5 | | CVE-2026-80631 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject compressed segment that overflows the compressed input |
| MEDIUM | | 5.5 | | CVE-2026-80634 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag |
| MEDIUM | | 5.5 | | CVE-2026-80655 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soc: xilinx: Fix race condition in event registration |
| MEDIUM | | 5.5 | | CVE-2026-80662 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size |
| MEDIUM | | 7 | | CVE-2026-80668 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations |
| MEDIUM | | 5.5 | | CVE-2026-80670 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() |
| MEDIUM | | 5.5 | | CVE-2026-80692 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks |
| MEDIUM | | 7 | | CVE-2026-80693 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: idpf: bound interrupt-vector register fill to the allocated array |
| MEDIUM | | 5.5 | | CVE-2026-80698 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: idxd: fix double free of wq, engine, and group structs |
| MEDIUM | | 5.5 | | CVE-2026-80721 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: ensure no dangling hcon references in iso_conn |
| MEDIUM | | | | CVE-2026-80761 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| MEDIUM | | 5.5 | | CVE-2026-80905 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: tap: fix wrong transport_header when sending VLAN-tagged frame |
| MEDIUM | | 5.5 | | CVE-2026-80920 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring: defer eventfd signaling when queued from a wakeup handler |
| MEDIUM | | 5.5 | | CVE-2026-81010 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/waitid: honor task_work cancellation |
| MEDIUM | | 7 | | CVE-2026-89528 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Reject Read lists that exceed the page budget |
| MEDIUM | | 4.8 | | CVE-2026-89534 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| MEDIUM | | 7 | | CVE-2026-89537 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 |
| MEDIUM | | 7.2 | | CVE-2026-89610 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs: verify run length exceeding volume boundary |
| MEDIUM | | 5.5 | | CVE-2026-89611 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs: validate non-resident attribute offsets |
| MEDIUM | | 7.1 | | CVE-2026-89632 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() |
| MEDIUM | | 7 | | CVE-2026-89637 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 |
| MEDIUM | | 5.5 | | CVE-2026-89639 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC |
| MEDIUM | | 3.3 | | CVE-2026-89642 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cifs: call pagecache_isize_extended() in cifs_setsize() when extending |
| MEDIUM | | 6.2 | | CVE-2026-89648 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ceph: cap delegated inode count in ceph_parse_deleg_inos() |
| MEDIUM | | 7 | | CVE-2026-89654 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix UAF in check_new_map() on session freed during unlock |
| MEDIUM | | 5.3 | | CVE-2026-89682 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net |
| MEDIUM | | 5.3 | | CVE-2026-89705 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths |
| MEDIUM | | 5.9 | | CVE-2026-89709 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: lockd, nfsd: RCU-protect nlmsvc_ops dispatch |
| MEDIUM | | 5.5 | | CVE-2026-89722 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() |
| MEDIUM | | 5.5 | | CVE-2026-89757 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/mglru: fix and remove redundant unevictable folio handling |
| MEDIUM | | 4.7 | | CVE-2026-89810 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix error path at svm_migrate_copy_to_ram |
| MEDIUM | | | | CVE-2026-89826 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| MEDIUM | | | | CVE-2026-89833 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| MEDIUM | | | | CVE-2026-89866 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| MEDIUM | | | | CVE-2026-89906 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| MEDIUM | | 4.7 | | CVE-2026-89913 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables |
| MEDIUM | | 4.7 | | CVE-2026-89920 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Fix memory corruption by not reinjecting CK machine checks |
| MEDIUM | | | | CVE-2026-89935 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 3.6 | | CVE-2026-89987 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/huge_memory: transfer the pmd dirty bit to the folio on zap |
| MEDIUM | | 5.5 | | CVE-2026-90040 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped |
| MEDIUM | | 5.5 | | CVE-2026-90061 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: skip double clone set expressions on element insert |
| MEDIUM | | 5.5 | | CVE-2026-90083 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: act_ife: Only operate on Ethernet frames |
| MEDIUM | | 5.5 | | CVE-2026-90087 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: do not leak an hci_conn when a second LE connect is rejected |
| MEDIUM | | 7 | | CVE-2026-90093 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: access chan->conn safely in get/setsockopt |
| MEDIUM | | 5.5 | | CVE-2026-90098 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: fix sleep in atomic context in MAC table access |
| MEDIUM | | 7 | | CVE-2026-90099 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: account classifier filter allocations to memcg |
| MEDIUM | | 7 | | CVE-2026-90104 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFSv4.1: zero referring call lists before decoding |
| MEDIUM | | 5.5 | | CVE-2026-90105 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vxlan: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90106 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: arp/nd proxy: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90116 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: mtpav: shut down output timer before card teardown |
| MEDIUM | | 5.5 | | CVE-2026-90142 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix resize of the RX ring |
| MEDIUM | | 5.5 | | CVE-2026-90149 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers |
| MEDIUM | | 5.5 | | CVE-2026-90154 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: scope session state changes to bound connections |
| MEDIUM | | 5.5 | | CVE-2026-90155 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: detach blocked lock requests before freeing |
| MEDIUM | | 5.5 | | CVE-2026-90156 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely discard unregistered deferred locks |
| MEDIUM | | 7 | | CVE-2026-90161 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix interlaced ztailpacking pclusters |
| MEDIUM | | 5.5 | | CVE-2026-90162 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: defer publishing granted locks to prevent UAF/double-free race |
| MEDIUM | | 5.5 | | CVE-2026-90167 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: serialize oplock close with pending break ownership |
| MEDIUM | | 5.5 | | CVE-2026-90174 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() |
| MEDIUM | | 5.5 | | CVE-2026-90177 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check pointer type for all atomic RMW paths |
| MEDIUM | | 5.5 | | CVE-2026-90179 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix deadlock in complain-mode change_hat |
| MEDIUM | | 5.5 | | CVE-2026-90204 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate DIO orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90205 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90208 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type |
| MEDIUM | | 5.5 | | CVE-2026-90217 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Compare iterator types during state pruning |
| MEDIUM | | 5.5 | | CVE-2026-90231 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix unconfined user namespace restriction forced stack |
| MEDIUM | | 5.5 | | CVE-2026-90232 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: amt: Don't support cross-netns setup |
| MEDIUM | | 5.1 | | CVE-2026-90234 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFS: Return a delegation the client fails to record |
| MEDIUM | | 7 | | CVE-2026-90237 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nft_ct: move custom expectation support to helper |
| MEDIUM | | 7 | | CVE-2026-90240 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Flush context cache with correct SID when tearing down aliases |
| MEDIUM | | 5.5 | | CVE-2026-90247 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix mmap_lock leak in irq_work path |
| MEDIUM | | 5.9 | | CVE-2026-90256 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind |
| MEDIUM | | 5.5 | | CVE-2026-90259 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() |
| MEDIUM | | 4.7 | | CVE-2026-90260 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: don't clobber the extent buffer when zeroing it out |
| MEDIUM | | 3.3 | | CVE-2026-90263 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: check if root is readonly when setting posix acl |
| MEDIUM | | 5.5 | | CVE-2026-90264 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: always wait for ordered extents to avoid OE races |
| MEDIUM | | 5.5 | | CVE-2026-90265 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: defrag: fix deadlock between defrag and delalloc space reservation |
| MEDIUM | | 5.5 | | CVE-2026-90273 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable |
| MEDIUM | | 5.5 | | CVE-2026-90289 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Resize MST HDCP per-connector arrays to 32 |
| MEDIUM | | 5.5 | | CVE-2026-90300 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear buf on error in __bpf_get_task_stack |
| MEDIUM | | 5.5 | | CVE-2026-90301 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: o2hb: quiesce negotiate handlers and timeout work |
| MEDIUM | | 7 | | CVE-2026-90317 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Invalidate RCU pointers after final spin unlock |
| MEDIUM | | 5.5 | | CVE-2026-90320 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate external xattr entries when reading metadata |
| MEDIUM | | 5.5 | | CVE-2026-90321 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate inline xattrs during inode block validation |
| MEDIUM | | 5.5 | | CVE-2026-90324 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ublk: check import_ubuf() return value |
| MEDIUM | | 4.7 | | CVE-2026-90326 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-cgroup: fix race between policy activation and blkg destruction |
| MEDIUM | | 5.5 | | CVE-2026-90328 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: HID: steam: Reject short reads |
| MEDIUM | | 6.4 | | CVE-2026-90333 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dm-integrity: replace forgeable discard filler with a keyed sector marker |
| MEDIUM | | 4.1 | | CVE-2026-90336 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: clear freed pointers on uart_register_driver() failure |
| MEDIUM | | 5.5 | | CVE-2026-90337 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: do fallible allocations before the console can be registered |
| MEDIUM | | 7 | | CVE-2026-90343 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: stop PMSR before P2P and NAN teardown |
| MEDIUM | | 5.5 | | CVE-2026-90345 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: brcmfmac: fix P2P action frame handling without device vif |
| MEDIUM | | 7 | | CVE-2026-90347 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry |
| MEDIUM | | 5.5 | | CVE-2026-90351 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed |
| MEDIUM | | 4.4 | | CVE-2026-90359 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject >8 byte return values on return-reading trampoline paths |
| MEDIUM | | 5.5 | | CVE-2026-90363 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: don't tear down KMS twice when KMS init fails |
| MEDIUM | | 5.5 | | CVE-2026-90365 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: cancel reset and rc work on device unregister |
| MEDIUM | | 5.5 | | CVE-2026-90367 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER |
| MEDIUM | | 4.8 | | CVE-2026-90379 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash |
| MEDIUM | | 3.3 | | CVE-2026-90401 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md: remove REQ_NOWAIT support from raid1/10/456 |
| MEDIUM | | 5.5 | | CVE-2026-90408 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() |
| MEDIUM | | 5.5 | | CVE-2026-90409 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Add vm_bind region with kbo range overlap check |
| MEDIUM | | 4.7 | | CVE-2026-90417 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() |
| MEDIUM | | 5.5 | | CVE-2026-90421 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI: Fix UAF when probe runs concurrent to dyn ID removal |
| MEDIUM | | 5.5 | | CVE-2026-90422 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path |
| MEDIUM | | 4.7 | | CVE-2026-90427 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() |
| MEDIUM | | 5.5 | | CVE-2026-92480 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Validate string descriptors |
| MEDIUM | | 5.5 | | CVE-2026-92482 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip |
| MEDIUM | | 3.3 | | CVE-2026-92485 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix WARNING in bpf_tracing_link_release |
| MEDIUM | | 5.5 | | CVE-2026-92499 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext4: validate readdir offset before accessing dirent |
| MEDIUM | | 4.7 | | CVE-2026-92500 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext4: use fsdata to track inline data write state and fix race |
| MEDIUM | | 5.5 | | CVE-2026-92503 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() |
| MEDIUM | | 5.5 | | CVE-2026-92518 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv, bpf: Fix kernel stack corruption in tailcall with CFI |
| MEDIUM | | 5.5 | | CVE-2026-92520 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Zero queue and stack outputs on lock failure |
| MEDIUM | | 5.5 | | CVE-2026-93044 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for arena-related insns |
| MEDIUM | | 5.5 | | CVE-2026-93047 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Associate BOs with every job that accesses them |
| MEDIUM | | 5.5 | | CVE-2026-93058 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Only fini scheduler after successful init |
| MEDIUM | | 5.5 | | CVE-2026-93081 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_scmi: Fix SCMI device destroy lifetimes |
| MEDIUM | | 4.7 | | CVE-2026-93099 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Fix UAF from worker threads when domains are removed |
| MEDIUM | | 4.7 | | CVE-2026-93100 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() |
| MEDIUM | | 4.7 | | CVE-2026-93104 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rvt: Return NULL after port allocation failure |
| MEDIUM | | 7 | | CVE-2026-93105 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: esp: do not unref managed frag pages in esp_ssg_unref() |
| MEDIUM | | 5.5 | | CVE-2026-93122 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: usb: gadget: uac: validate rate list length before storing |
| MEDIUM | | 5.5 | | CVE-2026-93135 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject programs with inlined helpers if JIT is not available |
| MEDIUM | | 7 | | CVE-2026-93148 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject MEM_ALLOC BTF accesses past object bounds |
| MEDIUM | | 7 | | CVE-2026-93154 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Add refcounting to user ring MRs |
| MEDIUM | | 5.5 | | CVE-2026-93168 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout |
| MEDIUM | | 5.5 | | CVE-2026-93175 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in CRTC reset function |
| MEDIUM | | 4.7 | | CVE-2026-93176 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in plane reset function |
| MEDIUM | | 5.5 | | CVE-2026-93270 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn |
| MEDIUM | | 5.5 | | CVE-2026-93272 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 |
| MEDIUM | | 5.5 | | CVE-2026-93276 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator |
| MEDIUM | | 5.5 | | CVE-2026-93282 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix maximum allowed access checks |
| MEDIUM | | 7.1 | | CVE-2026-97422 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: fix SMI event cross-process information leak |
| MEDIUM | | 5.5 | | CVE-2026-97432 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: fix P2P-Device binding handling |
| MEDIUM | | 5.5 | | CVE-2026-97478 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virt: acrn: Fix irqfd use-after-free during eventfd shutdown |
| MEDIUM | | 7.1 | | CVE-2026-97493 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS |
| MEDIUM | | 5.5 | | CVE-2026-97499 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: perf: Retrieve path and source from event data |
| MEDIUM | | 5.5 | | CVE-2026-97513 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Release m2m_ctx after Instance Removed from List |
| MEDIUM | | 5.5 | | CVE-2026-97515 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 |
| MEDIUM | | 5.5 | | CVE-2026-97526 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/pai: Support CPU hotplug for PMU PAI |
| MEDIUM | | 5.5 | | CVE-2026-97538 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (asus_rog_ryujin) Validate HID report lengths |
| MEDIUM | | 5.5 | | CVE-2026-97554 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() |
| MEDIUM | | 7 | | CVE-2026-97561 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid |
| MEDIUM | | 7 | | CVE-2026-97563 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97565 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject short READ responses in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97960 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel: Prevent drain_pebs() reentry |
| MEDIUM | | 5.5 | | CVE-2026-97962 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Move representor vnic reporter to eswitch devlink port |
| MEDIUM | | 5.1 | | CVE-2026-97975 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() |
| MEDIUM | | 4.7 | | CVE-2026-97988 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vhost: invalidate vring access on IOTLB transitions |
| MEDIUM | | 5.5 | | CVE-2026-98019 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: mark a NULL call argument precise |
| MEDIUM | | 5.3 | | CVE-2026-98032 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tracing: Fix subbuf resize races with trace_pipe_raw readers |
| MEDIUM | | 7 | | CVE-2026-98033 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Preserve inner map identity in callback frames |
| MEDIUM | | 7 | | CVE-2026-98034 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark NULL kptr stores precise |
| MEDIUM | | 5.5 | | CVE-2026-98043 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Don't infer non-NULL from a pointer with an unbounded offset |
| MEDIUM | | 7 | | CVE-2026-98047 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check ancestor frames for rbtree callbacks |
| MEDIUM | | 7 | | CVE-2026-98048 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: don't rewrite bpf_fastcall patterns entered by a jump |
| MEDIUM | | 5.5 | | CVE-2026-98049 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: zero extend the result of an arena 32-bit cmpxchg |
| MEDIUM | | 5.5 | | CVE-2026-98053 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Refactor and fix init_config access |
| MEDIUM | | 5.5 | | CVE-2026-98062 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark signal tracepoint siginfo arguments as scalar |
| MEDIUM | | 5.5 | | CVE-2026-98085 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge |
| MEDIUM | | | | CVE-2026-98099 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 5.5 | | CVE-2026-98115 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely drain sessions during logoff |
| MEDIUM | | 5.5 | | CVE-2026-98118 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix readahead synchronisation issues by loading all folios upfront |
| MEDIUM | | 5.5 | | CVE-2026-98124 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/client: invalidate fscache for fallocate range operations |
| MEDIUM | | 5.5 | | CVE-2026-98125 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix stale page cache in insert/collapse range |
| MEDIUM | | 5.5 | | CVE-2026-98131 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix dma mapping leak in stmmac_tso_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-98134 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: check_cond_jmp_op(): properly infer if register is null |
| MEDIUM | | 5.3 | | CVE-2026-98156 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/virtio: use the DMA API for resource backing on Xen |
| MEDIUM | | 5.5 | | CVE-2026-98162 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/server: fix tree connection leak in smb2_tree_connect() |
| MEDIUM | | 5.5 | | CVE-2026-98180 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: RCU-free the scheduler-containing ring and VM objects |
| MEDIUM | | 5.5 | | CVE-2026-98228 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ |
| MEDIUM | | 4.4 | | CVE-2026-98273 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: x86/kprobes: Fix crash when probing CS CALL instructions |
| MEDIUM | | 5.5 | | CVE-2026-98277 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: ring the doorbell if a burst ends in a drop |
| MEDIUM | | 5.5 | | CVE-2026-98279 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: handle lack of space when cleaning up verity items |
| MEDIUM | | 5.3 | | CVE-2026-98284 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netlink: do not free nlk->groups while lockless readers can use it |
| MEDIUM | | 4.1 | | CVE-2026-98286 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown |
| MEDIUM | | 5.5 | | CVE-2026-98288 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix TSO header length truncation |
| MEDIUM | | 5.5 | | CVE-2026-98292 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| MEDIUM | | 5.5 | | CVE-2026-98294 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_qca: Do not write to the serial port after it is closed |
| MEDIUM | | 7 | | CVE-2026-98296 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btintel_pcie: validate TX skb length in send_sync |
| MEDIUM | | 5.5 | | CVE-2026-98313 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/dp: skip PUSH_IDLE when the link was never enabled |
| MEDIUM | | 7 | | CVE-2026-98330 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: get the wiphy out of a dying network namespace |
| MEDIUM | | 5.5 | | CVE-2026-98333 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: reset the LED state when ifup fails |
| MEDIUM | | 7 | | CVE-2026-98341 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: don't free driver-owned scan requests |
| MEDIUM | | 5.5 | | CVE-2026-98353 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables |
| MEDIUM | | 5.5 | | CVE-2026-98355 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rtrs: guard against null kobj name |
| MEDIUM | | 5.5 | | CVE-2026-98376 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Use array_map_meta_equal for percpu array inner map replacement |
| MEDIUM | | 5.5 | | CVE-2026-98408 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: watchdog: rzv2h: Avoid division by zero |
| MEDIUM | | 5.5 | | CVE-2026-98420 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: follow SMB2 session expiration semantics |
| MEDIUM | | | | CVE-2026-98436 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: a ... |
| MEDIUM | | 6.5 | | CVE-2026-98439 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/server: cancel async requests when closing connection |
| MEDIUM | | 4.7 | | CVE-2026-98444 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: drop dquot flush lock when we can't find a buffer to flush |
| MEDIUM | | 6.5 | | CVE-2026-98449 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: delete compound mids on send failure before unlock |
| MEDIUM | | 5.3 | | CVE-2026-98471 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Do cache maintenance on the source VM during intra-host migration |
| MEDIUM | | 5.5 | | CVE-2026-98556 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gve: DQO: reject TSO packets with an out of range MSS |
| MEDIUM | | 4.1 | | CVE-2026-98558 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: flush skb_defer_nodes in dev_cpu_dead() |
| MEDIUM | | 5.9 | | CVE-2026-98570 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: ipv6: keep room for the mac header in dst_dev_overhead() |
| MEDIUM | | 6.7 | | CVE-2026-98589 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject pkt arguments in mutating subprogs |
| MEDIUM | | 4.7 | | CVE-2026-98598 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv6: Prevent rt6_insert_exception() for dying fib6_info |
| MEDIUM | | 6.7 | | CVE-2026-98599 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() |
| MEDIUM | | 4.1 | | CVE-2026-98616 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: reset num_napi when the napi vectors are freed |
| MEDIUM | | 5.5 | | CVE-2026-98652 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Add missing srcu in kvm_s390_set_irq_state() |
| MEDIUM | | 5.5 | | CVE-2026-98674 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iio: adc: adi-axi-adc: Initialize state mutex |
| MEDIUM | | 5.6 | | CVE-2026-98714 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| MEDIUM | | 4.1 | | CVE-2026-98740 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety |
| MEDIUM | | 4.4 | | CVE-2026-98747 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix NULL pointer dereference in serial_core_unregister_port() |
| MEDIUM | | 4.7 | | CVE-2026-98786 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: guard dc_sink dereferences in MST mode validation |
| MEDIUM | | 4.4 | | CVE-2026-98789 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix objects stuck in free_by_rcu_ttrace |
| MEDIUM | | 4.4 | | CVE-2026-98795 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: skip ptp deinit if init was skipped |
| MEDIUM | | 4.4 | | CVE-2026-98799 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Skip detached progs in trampoline images that are still in use |
| MEDIUM | | 4.7 | | CVE-2026-98800 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: kernel: Denial of Service via use-after-free in BPF trampoline |
| MEDIUM | | 6.5 | | CVE-2026-98803 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix rx Scatter-Gather support |
| MEDIUM | | 6.1 | | CVE-2026-98810 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() |
| MEDIUM | | 4.4 | | CVE-2026-98813 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Hold map BTF for the memory allocator destructor record |
| MEDIUM | | 4.4 | | CVE-2026-98814 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix command effects log lifetime for multipath heads |
| MEDIUM | | 4.1 | | CVE-2026-98815 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix cdev lifetime |
| MEDIUM | | 4.1 | | CVE-2026-98816 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix overflow of jump offset in constant blinding |
| MEDIUM | | 5.5 | | CVE-2026-98820 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: set RQF_USE_SCHED when the operation is known |
| MEDIUM | | 5.3 | | CVE-2026-98824 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate TX status rate metadata |
| MEDIUM | | 6.5 | | CVE-2026-98829 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: drop oversized fragments to avoid extra_len overflow |
| MEDIUM | | 4.1 | | CVE-2026-98834 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mtd: core: avoid double-free of OTP NVMEM device |
| MEDIUM | | 6.1 | | CVE-2026-98839 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() |
| MEDIUM | | 4.4 | | CVE-2026-98843 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: zero gaps in read-gaps folio to avoid writing back stale data |
| MEDIUM | | 5.6 | | CVE-2026-98863 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| MEDIUM | | 4.6 | | CVE-2019-15213 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: use-after-free caused by malicious USB device in drivers/media/usb/dvb-usb/dvb-usb-init.c |
| MEDIUM | | 4.1 | | CVE-2019-16089 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Improper return check in nbd_genl_status function in drivers/block/nbd.c |
| MEDIUM | | 4.7 | | CVE-2019-20794 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: task processes not being properly ended could lead to resource exhaustion |
| MEDIUM | | 4.4 | | CVE-2020-14304 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ethtool when reading eeprom of device could lead to memory leak |
| MEDIUM | | 6.7 | | CVE-2020-36694 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: use-after-free in the packet processing context |
| MEDIUM | | 5.5 | | CVE-2023-31082 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sleeping function called from an invalid context in gsmld_write |
| MEDIUM | | 7 | | CVE-2023-3397 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: slab-use-after-free Write in txEnd due to race condition |
| MEDIUM | | 5.5 | | CVE-2023-37454 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: udf: use-after-free write in udf_close_lvid |
| MEDIUM | | 6.7 | | CVE-2023-6238 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvme: memory corruption via unprivileged user passthrough |
| MEDIUM | | 6.5 | | CVE-2023-6240 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation |
| MEDIUM | | 5.5 | | CVE-2024-2193 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | hw: Spectre-SRC that is Speculative Race Conditions (SRCs) for synchronization primitives similar like Spectre V1 with p |
| MEDIUM | | 4.7 | | CVE-2024-24864 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | A race condition was found in the Linux kernel's media/dvb-core in dvb ... |
| MEDIUM | | 5.5 | | CVE-2024-25740 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory leak in ubi driver |
| MEDIUM | | 5.5 | | CVE-2024-56709 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring: check if iowq is killed before queuing |
| MEDIUM | | 5.5 | | CVE-2024-58074 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/i915: Grab intel_display from the encoder to avoid potential oopsies |
| MEDIUM | | 5.5 | | CVE-2025-21752 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents |
| MEDIUM | | 5.5 | | CVE-2025-21949 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Set hugetlb mmap base address aligned with pmd size |
| MEDIUM | | 5.5 | | CVE-2025-22109 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ax25: Remove broken autobind |
| MEDIUM | | 5.5 | | CVE-2025-23132 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: quota: fix to avoid warning in dquot_writeback_dquots() |
| MEDIUM | | 5.5 | | CVE-2025-23135 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Teardown riscv specific bits after kvm_exit |
| MEDIUM | | 5.5 | | CVE-2025-37743 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Avoid memory leak while enabling statistics |
| MEDIUM | | 5.5 | | CVE-2025-37746 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/dwc_pcie: fix duplicate pci_dev devices |
| MEDIUM | | 5.5 | | CVE-2025-37880 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: um: work around sched_yield not yielding in time-travel mode |
| MEDIUM | | 4.7 | | CVE-2025-37906 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: ublk race condition causes kernel crash |
| MEDIUM | | 5.5 | | CVE-2025-38029 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to sleepable page allocation in KASAN |
| MEDIUM | | 5.5 | | CVE-2025-38036 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to null pointer dereference in GT MMIO initialization for VFs |
| MEDIUM | | 5.5 | | CVE-2025-38041 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clk: sunxi-ng: h616: Reparent GPU clock during frequency changes |
| MEDIUM | | 5.5 | | CVE-2025-38042 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn |
| MEDIUM | | 6.7 | | CVE-2025-38064 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio: break and reset virtio devices on device_shutdown() |
| MEDIUM | | 5.5 | | CVE-2025-38132 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: holding cscfg_csdev_lock while removing cscfg from csdev |
| MEDIUM | | 5.5 | | CVE-2025-38140 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Local denial of service in device mapper |
| MEDIUM | | 5.5 | | CVE-2025-38199 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix memory leak due to multiple rx_stats allocation |
| MEDIUM | | 5.5 | | CVE-2025-38207 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm: fix uprobe pte be overwritten when expanding vma |
| MEDIUM | | 5.5 | | CVE-2025-38261 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv: save the SR_SUM status over switches |
| MEDIUM | | 5.5 | | CVE-2025-38284 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: configure manual DAC mode via PCI config API only |
| MEDIUM | | 5.5 | | CVE-2025-38311 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel (iavf): Denial of Service due to a locking issue |
| MEDIUM | | 5.5 | | CVE-2025-38359 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Fix in_atomic() handling in do_secure_storage_access() |
| MEDIUM | | 5.5 | | CVE-2025-38597 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port |
| MEDIUM | | 5.5 | | CVE-2025-38605 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() |
| MEDIUM | | 5.5 | | CVE-2025-39677 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Fix backlog accounting in qdisc_dequeue_internal |
| MEDIUM | | 5.5 | | CVE-2025-39762 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: add null check |
| MEDIUM | | 5.5 | | CVE-2025-39775 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: mremap local denial of service |
| MEDIUM | | 5.5 | | CVE-2025-39789 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: crypto: x86/aegis - Add missing error checks |
| MEDIUM | | 6.1 | | CVE-2025-39822 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/kbuf: fix signedness in this_len calculation |
| MEDIUM | | 5.5 | | CVE-2025-39830 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path |
| MEDIUM | | 5.5 | | CVE-2025-39834 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow |
| MEDIUM | | 6.2 | | CVE-2025-39910 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() |
| MEDIUM | | 7.1 | | CVE-2025-39933 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length |
| MEDIUM | | 2.5 | | CVE-2025-40113 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E |
| MEDIUM | | 6.8 | | CVE-2025-40130 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling |
| MEDIUM | | 6.2 | | CVE-2025-40146 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: fix potential deadlock while nr_requests grown |
| MEDIUM | | 5.2 | | CVE-2025-40217 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pidfs: validate extensible ioctls |
| MEDIUM | | | | CVE-2025-40247 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Fix pgtable prealloc error path |
| MEDIUM | | 5.2 | | CVE-2025-40338 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Do not share the name pointer between components |
| MEDIUM | | 6.1 | | CVE-2025-40355 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sysfs: check visibility before changing group attribute ownership |
| MEDIUM | | 5.5 | | CVE-2025-68209 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mlx5: Fix default values in create CQ |
| MEDIUM | | 5.5 | | CVE-2025-68236 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service during UFS power down |
| MEDIUM | | 5.5 | | CVE-2025-68304 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_core: lookup hci_conn on RX path on protocol side |
| MEDIUM | | | | CVE-2025-68318 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL |
| MEDIUM | | 6.1 | | CVE-2025-68319 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netconsole: Acquire su_mutex before navigating configs hierarchy |
| MEDIUM | | 5.5 | | CVE-2025-68353 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service via NULL pointer dereference in VXLAN module |
| MEDIUM | | 4.5 | | CVE-2025-68360 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks |
| MEDIUM | | 5.5 | | CVE-2025-68368 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service in md driver via uninitialized bioset |
| MEDIUM | | 6.5 | | CVE-2025-68729 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix MSDU buffer types handling in RX error path |
| MEDIUM | | 5.5 | | CVE-2025-68730 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() |
| MEDIUM | | 4.7 | | CVE-2025-68745 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset |
| MEDIUM | | 7.8 | | CVE-2025-71074 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel functionfs: Use-After-Free vulnerability due to open/removal races |
| MEDIUM | | 5.5 | | CVE-2025-71117 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service via deadlock in block layer sysfs store callbacks |
| MEDIUM | | 5.5 | | CVE-2025-71141 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/tilcdc: Fix removal actions in case of failed probe |
| MEDIUM | | 5.5 | | CVE-2025-71188 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: lpc18xx-dmamux: fix device leak on route allocation |
| MEDIUM | | 6.5 | | CVE-2025-71202 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Memory Corruption and Kernel Crashes via IOMMU SVA coherency issue |
| MEDIUM | | 5.5 | | CVE-2025-71227 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: don't WARN for connections on invalid channels |
| MEDIUM | | 5.5 | | CVE-2025-71285 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels |
| MEDIUM | | 5.5 | | CVE-2025-71302 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: fix for dma-fence safe access rules |
| MEDIUM | | 7 | | CVE-2025-71313 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI: endpoint: Add missing NULL check for alloc_workqueue() |
| MEDIUM | | 5.5 | | CVE-2025-71315 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/vkms: Convert to DRM's vblank timer |
| MEDIUM | | 5.5 | | CVE-2026-100074 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| MEDIUM | | 5.5 | | CVE-2026-100076 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths |
| MEDIUM | | 5.5 | | CVE-2026-100077 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Recover HW before retire hung submit |
| MEDIUM | | 5.5 | | CVE-2026-23007 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: block: zero non-PI portion of auto integrity buffer |
| MEDIUM | | 5.5 | | CVE-2026-23017 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: idpf: fix error handling in the init_task on load |
| MEDIUM | | 5.5 | | CVE-2026-23143 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix misalignment bug in struct virtnet_info |
| MEDIUM | | 7.1 | | CVE-2026-23152 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: correctly decode TTLM with default link map |
| MEDIUM | | 5.5 | | CVE-2026-23217 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv: trace: fix snapshot deadlock with sbi ecall |
| MEDIUM | | 5.5 | | CVE-2026-23259 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/rw: free potentially allocated iovec on cache put failure |
| MEDIUM | | 5.5 | | CVE-2026-23265 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer in {read,write}_end_io |
| MEDIUM | | 5.5 | | CVE-2026-23348 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix race of nvdimm_bus object when creating nvdimm objects |
| MEDIUM | | 5.5 | | CVE-2026-23371 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting |
| MEDIUM | | 5.5 | | CVE-2026-23377 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz |
| MEDIUM | | 5.5 | | CVE-2026-23385 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: clone set on flush only |
| MEDIUM | | 5.5 | | CVE-2026-23472 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN |
| MEDIUM | | 5.5 | | CVE-2026-31435 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix read abandonment during retry |
| MEDIUM | | 5.5 | | CVE-2026-31526 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix exception exit lock checking for subprogs |
| MEDIUM | | 5.5 | | CVE-2026-31537 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: server: make use of smbdirect_socket.send_io.bcredits |
| MEDIUM | | 5.5 | | CVE-2026-31562 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register |
| MEDIUM | | 5.5 | | CVE-2026-31579 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit |
| MEDIUM | | 5.5 | | CVE-2026-31591 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish |
| MEDIUM | | 5.5 | | CVE-2026-31592 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock |
| MEDIUM | | 5.5 | | CVE-2026-31630 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rxrpc: proc: size address buffers for %pISpc output |
| MEDIUM | | 7.1 | | CVE-2026-31692 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns |
| MEDIUM | | 5.5 | | CVE-2026-31771 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_event: move wake reason storage into validated event handlers |
| MEDIUM | | 5.5 | | CVE-2026-31777 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: ctxfi: Check the error for index mapping |
| MEDIUM | | 5.5 | | CVE-2026-43009 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix incorrect pruning due to atomic fetch precision tracking |
| MEDIUM | | 5.5 | | CVE-2026-43022 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists |
| MEDIUM | | 5.5 | | CVE-2026-43029 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mptcp: fix soft lockup in mptcp_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-43034 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: set backing store type from query type |
| MEDIUM | | 7.1 | | CVE-2026-43042 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mpls: add seqcount to protect the platform_label{,s} pair |
| MEDIUM | | 5.5 | | CVE-2026-43048 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: HID: core: Mitigate potential OOB by removing bogus memset() |
| MEDIUM | | 5.5 | | CVE-2026-43053 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: close crash window in attr dabtree inactivation |
| MEDIUM | | 5.5 | | CVE-2026-43083 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: ioam6: fix OOB and missing lock |
| MEDIUM | | 5.5 | | CVE-2026-43101 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() |
| MEDIUM | | 5.5 | | CVE-2026-43115 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: srcu: Use irq_work to start GP in tiny SRCU |
| MEDIUM | | 5.5 | | CVE-2026-43118 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix zero size inode with non-zero size after log replay |
| MEDIUM | | 5.5 | | CVE-2026-43127 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs3: fix circular locking dependency in run_unpack_ex |
| MEDIUM | | 5.5 | | CVE-2026-43172 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: fix 22000 series SMEM parsing |
| MEDIUM | | 5.5 | | CVE-2026-43191 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 |
| MEDIUM | | 5.5 | | CVE-2026-43204 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: qcom: q6asm: drop DSP responses for closed data streams |
| MEDIUM | | 5.5 | | CVE-2026-43213 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: validate sequence number of TX release report |
| MEDIUM | | 5.5 | | CVE-2026-43234 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: team: avoid NETDEV_CHANGEMTU event when unregistering slave |
| MEDIUM | | 5.5 | | CVE-2026-43272 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ring-buffer: Fix possible dereference of uninitialized pointer |
| MEDIUM | | 5.5 | | CVE-2026-43294 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels |
| MEDIUM | | 5.5 | | CVE-2026-43298 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Skip vcn poison irq release on VF |
| MEDIUM | | 5.5 | | CVE-2026-43299 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() |
| MEDIUM | | 5.5 | | CVE-2026-43301 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix PM runtime usage count underflow |
| MEDIUM | | 5.5 | | CVE-2026-43308 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() |
| MEDIUM | | 5.5 | | CVE-2026-43309 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md raid: fix hang when stopping arrays with metadata through dm-raid |
| MEDIUM | | 5.5 | | CVE-2026-43310 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC |
| MEDIUM | | 5.5 | | CVE-2026-43311 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soc/tegra: pmc: Fix unsafe generic_handle_irq() call |
| MEDIUM | | 5.5 | | CVE-2026-43325 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: don't send a 6E related command when not supported |
| MEDIUM | | 5.5 | | CVE-2026-43326 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback |
| MEDIUM | | 5.5 | | CVE-2026-43337 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() |
| MEDIUM | | 5.5 | | CVE-2026-43346 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ice: ptp: don't WARN when controlling PF is unavailable |
| MEDIUM | | 5.5 | | CVE-2026-43352 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue |
| MEDIUM | | 5.5 | | CVE-2026-43353 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue |
| MEDIUM | | 7.1 | | CVE-2026-43414 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Completely fix fcport double free |
| MEDIUM | | 5.5 | | CVE-2026-43416 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: powerpc, perf: Check that current->mm is alive before getting user callchain |
| MEDIUM | | 5.5 | | CVE-2026-43443 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: amd: acp-mach-common: Add missing error check for clock acquisition |
| MEDIUM | | 5.5 | | CVE-2026-43463 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() |
| MEDIUM | | 5.5 | | CVE-2026-43464 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ |
| MEDIUM | | 5.5 | | CVE-2026-43465 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ |
| MEDIUM | | 5.5 | | CVE-2026-43485 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nouveau/gsp: drop WARN_ON in ACPI probes |
| MEDIUM | | 6.4 | | CVE-2026-45932 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix tcx/netkit detach permissions when prog fd isn't given |
| MEDIUM | | 7 | | CVE-2026-45934 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation |
| MEDIUM | | 5.5 | | CVE-2026-45940 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix oops when split header is enabled |
| MEDIUM | | 5.5 | | CVE-2026-45961 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gfs2: fix memory leaks in gfs2_fill_super error path |
| MEDIUM | | 5.5 | | CVE-2026-46014 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Add missing save/restore handling of LBR MSRs |
| MEDIUM | | 7 | | CVE-2026-46017 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm: fix deferred split queue races during migration |
| MEDIUM | | 7 | | CVE-2026-46032 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT |
| MEDIUM | | 5.5 | | CVE-2026-46044 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipmi:ssif: Clean up kthread on errors |
| MEDIUM | | 5.5 | | CVE-2026-46059 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN |
| MEDIUM | | 5.5 | | CVE-2026-46066 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix num_ops off-by-one when crypto allocation fails |
| MEDIUM | | 5.5 | | CVE-2026-46071 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 |
| MEDIUM | | 5.5 | | CVE-2026-46096 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() |
| MEDIUM | | 5.5 | | CVE-2026-46147 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() |
| MEDIUM | | 5.5 | | CVE-2026-46148 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: spi: microchip-core-qspi: control built-in cs manually |
| MEDIUM | | 5.5 | | CVE-2026-46153 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: 8021q: delete cleared egress QoS mappings |
| MEDIUM | | 5.5 | | CVE-2026-46171 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv: kvm: fix vector context allocation leak |
| MEDIUM | | 5.5 | | CVE-2026-46228 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: spi: ch341: fix devres lifetime |
| MEDIUM | | 5.5 | | CVE-2026-46245 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dc_link NULL handling in HPD init |
| MEDIUM | | 5.5 | | CVE-2026-46256 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages |
| MEDIUM | | 4.7 | | CVE-2026-46272 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: tmc-etr: Fix race condition between sysfs and perf mode |
| MEDIUM | | 5.5 | | CVE-2026-46302 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: selinux: allow multiple opens of /sys/fs/selinux/policy |
| MEDIUM | | 5.5 | | CVE-2026-46314 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Reject empty multisync extension to prevent infinite loop |
| MEDIUM | | 7 | | CVE-2026-46317 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock |
| MEDIUM | | 7 | | CVE-2026-46324 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: netfilter nf_tables denial of service via race condition in netlink hook unregistration |
| MEDIUM | | 7 | | CVE-2026-46325 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE |
| MEDIUM | | 7 | | CVE-2026-46330 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Revert "net/smc: Introduce TCP ULP support" |
| MEDIUM | | 5.5 | | CVE-2026-52937 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR |
| MEDIUM | | 7 | | CVE-2026-52953 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Fix oops due to out of scope access |
| MEDIUM | | 7 | | CVE-2026-52956 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() |
| MEDIUM | | 5.5 | | CVE-2026-52994 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting |
| MEDIUM | | 7 | | CVE-2026-53009 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ice: fix double-free of tx_buf skb |
| MEDIUM | | 5.5 | | CVE-2026-53017 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix data loss caused by incorrect use of nat_entry flag |
| MEDIUM | | 5.5 | | CVE-2026-53018 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: avoid reading already updated pages during GC |
| MEDIUM | | 5.5 | | CVE-2026-53103 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync |
| MEDIUM | | 5.5 | | CVE-2026-53104 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: Fix memory leak destroying device |
| MEDIUM | | 5.5 | | CVE-2026-53106 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Do not allow deleting local storage in NMI |
| MEDIUM | | 5.5 | | CVE-2026-53107 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: libertas: don't kill URBs in interrupt context |
| MEDIUM | | 5.5 | | CVE-2026-53108 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: powerpc/64s: Fix unmap race with PMD migration entries |
| MEDIUM | | | | CVE-2026-53178 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction |
| MEDIUM | | 7 | | CVE-2026-53224 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate embedded INIT chunk and address list lengths in cookie |
| MEDIUM | | 7 | | CVE-2026-53246 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing |
| MEDIUM | | 5.5 | | CVE-2026-53258 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: fix leak if split 6 GHz scanning fails |
| MEDIUM | | 5.5 | | CVE-2026-53281 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption |
| MEDIUM | | 5.5 | | CVE-2026-53285 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED |
| MEDIUM | | 5.5 | | CVE-2026-53292 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind |
| MEDIUM | | 5.5 | | CVE-2026-53297 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: mana: Guard mana_remove against double invocation |
| MEDIUM | | 5.5 | | CVE-2026-53321 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/napi: cap busy_poll_to 10 msec |
| MEDIUM | | 5.5 | | CVE-2026-53377 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: always recover the gpu |
| MEDIUM | | | | CVE-2026-53401 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: omap2: fix use-after-free in omapfb_mmap |
| MEDIUM | | | | CVE-2026-63805 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: crypto: nx - fix nx_crypto_ctx_exit argument |
| MEDIUM | | | | CVE-2026-63811 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: read COW data with the original inode during atomic write |
| MEDIUM | | | | CVE-2026-63819 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on f2fs_get_node_folio_ra() |
| MEDIUM | | 5.5 | | CVE-2026-63832 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: add wcid publish check in mt76_sta_add |
| MEDIUM | | 5.5 | | CVE-2026-63853 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring |
| MEDIUM | | | | CVE-2026-63857 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-63858 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: add hook transactions for device deletions |
| MEDIUM | | | | CVE-2026-63859 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue() |
| MEDIUM | | 7 | | CVE-2026-63941 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor |
| MEDIUM | | 7 | | CVE-2026-63979 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/handshake: hand off the pinned file reference to accept_doit |
| MEDIUM | | 5.5 | | CVE-2026-63998 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ethtool: module: call ethnl_ops_complete() on module flash errors |
| MEDIUM | | 5.5 | | CVE-2026-63999 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure |
| MEDIUM | | 5.5 | | CVE-2026-64006 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: fix dst corruption in same register operation |
| MEDIUM | | 7 | | CVE-2026-64024 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction |
| MEDIUM | | 5.5 | | CVE-2026-64036 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cgroup/rstat: validate cpu before css_rstat_cpu() access |
| MEDIUM | | 5.5 | | CVE-2026-64038 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Stop work before releasing hwmon device |
| MEDIUM | | 5.5 | | CVE-2026-64060 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix leak of request in netfs_write_begin() error handling |
| MEDIUM | | 7.1 | | CVE-2026-64066 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_read_to_pagecache() to pause on subreq failure |
| MEDIUM | | 5.5 | | CVE-2026-64067 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing barriers when accessing stream->subrequests locklessly |
| MEDIUM | | 7 | | CVE-2026-64068 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing locking around retry adding new subreqs |
| MEDIUM | | 5.5 | | CVE-2026-64076 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: bridge: eb_tables: close module init race |
| MEDIUM | | 5.5 | | CVE-2026-64077 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: ebtables: move to two-stage removal scheme |
| MEDIUM | | 7.1 | | CVE-2026-64078 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: add and use xtables_unregister_table_exit |
| MEDIUM | | 5.5 | | CVE-2026-64079 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: allocate hook ops while under mutex |
| MEDIUM | | 7 | | CVE-2026-64117 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb |
| MEDIUM | | 5.5 | | CVE-2026-64146 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix metabuf leak in inode xattr initialization |
| MEDIUM | | 5.5 | | CVE-2026-64154 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() |
| MEDIUM | | 5.5 | | CVE-2026-64159 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix zeropoint update where i_size > remote_i_size |
| MEDIUM | | 7 | | CVE-2026-64160 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point |
| MEDIUM | | 5.5 | | CVE-2026-64190 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: team: fix NULL pointer dereference in team_xmit during mode change |
| MEDIUM | | 5.5 | | CVE-2026-64212 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it |
| MEDIUM | | 5.5 | | CVE-2026-64213 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Add lock protection to lm90_alert |
| MEDIUM | | 7 | | CVE-2026-64255 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers |
| MEDIUM | | 7 | | CVE-2026-64520 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies |
| MEDIUM | | 7 | | CVE-2026-68086 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/khugepaged: write all dirty file folios when collapsing |
| MEDIUM | | 5.5 | | CVE-2026-68211 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: stm32-dcmipp: Return queued buffers on start_streaming() failure |
| MEDIUM | | 5.5 | | CVE-2026-68233 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/vc4: Shut down BO cache timer before teardown |
| MEDIUM | | 5.5 | | CVE-2026-68242 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/gt: Fix NULL deref on sched_engine alloc failure |
| MEDIUM | | 5.5 | | CVE-2026-68258 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size |
| MEDIUM | | 5.5 | | CVE-2026-68291 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: idpf driver null pointer dereference leads to Denial of Service |
| MEDIUM | | 5.5 | | CVE-2026-68295 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: BPF: Zero-extend signed ALU32 div/mod results |
| MEDIUM | | 5.5 | | CVE-2026-68312 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths |
| MEDIUM | | 7 | | CVE-2026-68323 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tipc: serialize udp bearer replicast list updates |
| MEDIUM | | 5.5 | | CVE-2026-68382 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Hold device ref until queue teardown completes |
| MEDIUM | | 5.5 | | CVE-2026-68383 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Keep scheduler timeline name alive |
| MEDIUM | | 7 | | CVE-2026-68393 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: extend conn_hash lookup critical sections |
| MEDIUM | | 6.4 | | CVE-2026-68399 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix UAF in sock clone early bailouts |
| MEDIUM | | 7 | | CVE-2026-68400 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation |
| MEDIUM | | 7 | | CVE-2026-68401 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() |
| MEDIUM | | 7 | | CVE-2026-68404 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect |
| MEDIUM | | 5.5 | | CVE-2026-68421 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() |
| MEDIUM | | 5.5 | | CVE-2026-68435 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Fix address space mismatch in kexec command line lookup |
| MEDIUM | | 5.5 | | CVE-2026-68441 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains |
| MEDIUM | | 5.5 | | CVE-2026-68447 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size |
| MEDIUM | | 7 | | CVE-2026-68448 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ovl: check access to copy_file_range source with src mounter creds |
| MEDIUM | | 7 | | CVE-2026-68453 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey |
| MEDIUM | | 5.5 | | CVE-2026-68471 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ieee80211: validate MLE common info length |
| MEDIUM | | 5.5 | | CVE-2026-72073 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mmc: vub300: fix use-after-free on probe failure |
| MEDIUM | | 5.5 | | CVE-2026-72162 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec |
| MEDIUM | | 7 | | CVE-2026-72288 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling |
| MEDIUM | | 7 | | CVE-2026-72329 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/liquidio: drop cached VF pci_dev LUT |
| MEDIUM | | 5.5 | | CVE-2026-72337 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: 6lowpan: avoid untracked enable work |
| MEDIUM | | 5.5 | | CVE-2026-72341 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Fix publication race for priv->channel_stats[] |
| MEDIUM | | 5.5 | | CVE-2026-72355 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix barriering when walking subrequest list |
| MEDIUM | | 5.5 | | CVE-2026-72365 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix writethrough to use collection offload |
| MEDIUM | | 5.5 | | CVE-2026-72367 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iomap: guard io_size EOF trim against concurrent truncate underflow |
| MEDIUM | | 5.5 | | CVE-2026-72375 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix reinitialisation of the inode, in particular ->lock_work |
| MEDIUM | | 5.5 | | CVE-2026-72380 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xen/pvcalls: bound backend response req_id before indexing rsp[] |
| MEDIUM | | 5.5 | | CVE-2026-72383 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: fix addr_wq_timer race in sctp_free_addr_wq() |
| MEDIUM | | 5.5 | | CVE-2026-72388 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock |
| MEDIUM | | 5.5 | | CVE-2026-72397 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() |
| MEDIUM | | 7 | | CVE-2026-72398 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: add INIT verification after cookie unpacking |
| MEDIUM | | 5.5 | | CVE-2026-72404 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() |
| MEDIUM | | 5.5 | | CVE-2026-72423 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Guard conntrack opts error writes |
| MEDIUM | | 5.5 | | CVE-2026-72440 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1: fix writes_pending and barrier reference leaks on write failures |
| MEDIUM | | 5.5 | | CVE-2026-72454 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() |
| MEDIUM | | 5.5 | | CVE-2026-72488 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soundwire: fix bug in sdw_add_element_group_count found by syzkaller |
| MEDIUM | | 5.5 | | CVE-2026-72493 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: serialize netif_running() check in enqueue_to_backlog() |
| MEDIUM | | 5.5 | | CVE-2026-72495 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages |
| MEDIUM | | 7 | | CVE-2026-72499 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free CQ toggle page after firmware teardown |
| MEDIUM | | 7 | | CVE-2026-72500 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown |
| MEDIUM | | | | CVE-2026-72501 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: R ... |
| MEDIUM | | 5.5 | | CVE-2026-74257 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sockmap: Fix use-after-free in udp_bpf_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-74264 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: watchdog: fix refcount tracking races |
| MEDIUM | | 5.5 | | CVE-2026-74272 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Resolve region deletion races |
| MEDIUM | | 5.5 | | CVE-2026-74273 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Block region delete during region creation |
| MEDIUM | | 5.5 | | CVE-2026-74314 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Cancel special fields on map value recycle |
| MEDIUM | | 5.5 | | CVE-2026-74317 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ixgbe: do not configure xps for XDP queues |
| MEDIUM | | 5.5 | | CVE-2026-74324 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: validate skb length in testmode query |
| MEDIUM | | 5.5 | | CVE-2026-74337 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks |
| MEDIUM | | 5.5 | | CVE-2026-74342 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: kernfs: link kn to its parent before the LSM init hook |
| MEDIUM | | 5.5 | | CVE-2026-74344 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear rb node linkage when freeing bpf_rb_root |
| MEDIUM | | 5.5 | | CVE-2026-74350 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate fast symlink target during inode read |
| MEDIUM | | 5.5 | | CVE-2026-74354 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Take mmap_lock in zap_pages() |
| MEDIUM | | 5.5 | | CVE-2026-74368 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() |
| MEDIUM | | 6.5 | | CVE-2026-74385 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock |
| MEDIUM | | 5.5 | | CVE-2026-74388 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data |
| MEDIUM | | 7 | | CVE-2026-74405 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: OPP: Fix race between OPP addition and lookup |
| MEDIUM | | 5.5 | | CVE-2026-74407 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath11k: cancel SSR work items during PCI shutdown |
| MEDIUM | | 5.5 | | CVE-2026-74449 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport |
| MEDIUM | | 5.5 | | CVE-2026-74466 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Close speculative mem read possibility |
| MEDIUM | | 7 | | CVE-2026-74506 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix UAF when sending a message |
| MEDIUM | | 7 | | CVE-2026-74513 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister |
| MEDIUM | | 5.5 | | CVE-2026-74527 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-af: Block VFs from clobbering special CGX PKIND state |
| MEDIUM | | 5.5 | | CVE-2026-74529 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback |
| MEDIUM | | 5.5 | | CVE-2026-74530 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback |
| MEDIUM | | 7 | | CVE-2026-74533 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero |
| MEDIUM | | 7 | | CVE-2026-74537 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: hold sk properly in iso_conn_ready |
| MEDIUM | | 5.5 | | CVE-2026-74538 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: lock sk in iso_connect_ind |
| MEDIUM | | 5.5 | | CVE-2026-74542 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix folio_queue ENOMEM in writeback by adding a mempool |
| MEDIUM | | 5.5 | | CVE-2026-74544 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds |
| MEDIUM | | 5.5 | | CVE-2026-74600 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/page_table_check: skip special zero mappings |
| MEDIUM | | 5.5 | | CVE-2026-74605 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: eventfs: Use children field for rcu head and add memory barriers |
| MEDIUM | | 7 | | CVE-2026-74611 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tls: rx: restore msg_iter before TLS 1.3 optimistic retry |
| MEDIUM | | 5.5 | | CVE-2026-74638 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Serialize the scheduler timeout handlers |
| MEDIUM | | 5.5 | | CVE-2026-74687 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: watchdog: at91sam9_wdt: prevent timer rearm during teardown |
| MEDIUM | | 7 | | CVE-2026-74695 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() |
| MEDIUM | | 7 | | CVE-2026-74697 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Disable EOP for TPA on all chips to prevent data corruption |
| MEDIUM | | 5.5 | | CVE-2026-74711 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus) Fix type confusion in notification logic |
| MEDIUM | | 5.5 | | CVE-2026-74713 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vhost_iotlb: bound map allocation in add_range |
| MEDIUM | | 7 | | CVE-2026-74715 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix netns reference imbalance in conntrack kfuncs |
| MEDIUM | | 5.5 | | CVE-2026-74723 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject inline extents without valid headers |
| MEDIUM | | 5.5 | | CVE-2026-74729 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read |
| MEDIUM | | 5.5 | | CVE-2026-74747 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipvs: revalidate ihl to prevent out-of-bounds access |
| MEDIUM | | 5.5 | | CVE-2026-80579 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: clear fb_info->mode before deleting a videomode |
| MEDIUM | | 5.5 | | CVE-2026-80580 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: bound mode sysfs output to the sysfs buffer |
| MEDIUM | | 5.5 | | CVE-2026-80614 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: emac: Fix NULL pointer dereference in emac_probe |
| MEDIUM | | 5.5 | | CVE-2026-80623 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: ete: Always save state on power down |
| MEDIUM | | 5.5 | | CVE-2026-80628 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Serialize readq reset state with q->lock |
| MEDIUM | | 5.5 | | CVE-2026-80631 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject compressed segment that overflows the compressed input |
| MEDIUM | | 5.5 | | CVE-2026-80634 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag |
| MEDIUM | | 5.5 | | CVE-2026-80655 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soc: xilinx: Fix race condition in event registration |
| MEDIUM | | 5.5 | | CVE-2026-80662 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size |
| MEDIUM | | 7 | | CVE-2026-80668 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations |
| MEDIUM | | 5.5 | | CVE-2026-80670 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() |
| MEDIUM | | 5.5 | | CVE-2026-80692 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks |
| MEDIUM | | 7 | | CVE-2026-80693 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: idpf: bound interrupt-vector register fill to the allocated array |
| MEDIUM | | 5.5 | | CVE-2026-80698 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: idxd: fix double free of wq, engine, and group structs |
| MEDIUM | | 5.5 | | CVE-2026-80721 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: ensure no dangling hcon references in iso_conn |
| MEDIUM | | | | CVE-2026-80761 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| MEDIUM | | 5.5 | | CVE-2026-80905 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: tap: fix wrong transport_header when sending VLAN-tagged frame |
| MEDIUM | | 5.5 | | CVE-2026-80920 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring: defer eventfd signaling when queued from a wakeup handler |
| MEDIUM | | 5.5 | | CVE-2026-81010 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/waitid: honor task_work cancellation |
| MEDIUM | | 7 | | CVE-2026-89528 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Reject Read lists that exceed the page budget |
| MEDIUM | | 4.8 | | CVE-2026-89534 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| MEDIUM | | 7 | | CVE-2026-89537 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 |
| MEDIUM | | 7.2 | | CVE-2026-89610 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs: verify run length exceeding volume boundary |
| MEDIUM | | 5.5 | | CVE-2026-89611 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs: validate non-resident attribute offsets |
| MEDIUM | | 7.1 | | CVE-2026-89632 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() |
| MEDIUM | | 7 | | CVE-2026-89637 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 |
| MEDIUM | | 5.5 | | CVE-2026-89639 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC |
| MEDIUM | | 3.3 | | CVE-2026-89642 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cifs: call pagecache_isize_extended() in cifs_setsize() when extending |
| MEDIUM | | 6.2 | | CVE-2026-89648 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ceph: cap delegated inode count in ceph_parse_deleg_inos() |
| MEDIUM | | 7 | | CVE-2026-89654 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix UAF in check_new_map() on session freed during unlock |
| MEDIUM | | 5.3 | | CVE-2026-89682 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net |
| MEDIUM | | 5.3 | | CVE-2026-89705 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths |
| MEDIUM | | 5.9 | | CVE-2026-89709 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: lockd, nfsd: RCU-protect nlmsvc_ops dispatch |
| MEDIUM | | 5.5 | | CVE-2026-89722 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() |
| MEDIUM | | 5.5 | | CVE-2026-89757 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/mglru: fix and remove redundant unevictable folio handling |
| MEDIUM | | 4.7 | | CVE-2026-89810 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix error path at svm_migrate_copy_to_ram |
| MEDIUM | | | | CVE-2026-89826 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| MEDIUM | | | | CVE-2026-89833 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| MEDIUM | | | | CVE-2026-89866 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| MEDIUM | | | | CVE-2026-89906 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| MEDIUM | | 4.7 | | CVE-2026-89913 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables |
| MEDIUM | | 4.7 | | CVE-2026-89920 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Fix memory corruption by not reinjecting CK machine checks |
| MEDIUM | | | | CVE-2026-89935 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 3.6 | | CVE-2026-89987 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/huge_memory: transfer the pmd dirty bit to the folio on zap |
| MEDIUM | | 5.5 | | CVE-2026-90040 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped |
| MEDIUM | | 5.5 | | CVE-2026-90061 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: skip double clone set expressions on element insert |
| MEDIUM | | 5.5 | | CVE-2026-90083 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: act_ife: Only operate on Ethernet frames |
| MEDIUM | | 5.5 | | CVE-2026-90087 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: do not leak an hci_conn when a second LE connect is rejected |
| MEDIUM | | 7 | | CVE-2026-90093 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: access chan->conn safely in get/setsockopt |
| MEDIUM | | 5.5 | | CVE-2026-90098 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: fix sleep in atomic context in MAC table access |
| MEDIUM | | 7 | | CVE-2026-90099 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: account classifier filter allocations to memcg |
| MEDIUM | | 7 | | CVE-2026-90104 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFSv4.1: zero referring call lists before decoding |
| MEDIUM | | 5.5 | | CVE-2026-90105 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vxlan: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90106 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: arp/nd proxy: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90116 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: mtpav: shut down output timer before card teardown |
| MEDIUM | | 5.5 | | CVE-2026-90142 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix resize of the RX ring |
| MEDIUM | | 5.5 | | CVE-2026-90149 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers |
| MEDIUM | | 5.5 | | CVE-2026-90154 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: scope session state changes to bound connections |
| MEDIUM | | 5.5 | | CVE-2026-90155 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: detach blocked lock requests before freeing |
| MEDIUM | | 5.5 | | CVE-2026-90156 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely discard unregistered deferred locks |
| MEDIUM | | 7 | | CVE-2026-90161 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix interlaced ztailpacking pclusters |
| MEDIUM | | 5.5 | | CVE-2026-90162 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: defer publishing granted locks to prevent UAF/double-free race |
| MEDIUM | | 5.5 | | CVE-2026-90167 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: serialize oplock close with pending break ownership |
| MEDIUM | | 5.5 | | CVE-2026-90174 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() |
| MEDIUM | | 5.5 | | CVE-2026-90177 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check pointer type for all atomic RMW paths |
| MEDIUM | | 5.5 | | CVE-2026-90179 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix deadlock in complain-mode change_hat |
| MEDIUM | | 5.5 | | CVE-2026-90204 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate DIO orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90205 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90208 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type |
| MEDIUM | | 5.5 | | CVE-2026-90217 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Compare iterator types during state pruning |
| MEDIUM | | 5.5 | | CVE-2026-90231 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix unconfined user namespace restriction forced stack |
| MEDIUM | | 5.5 | | CVE-2026-90232 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: amt: Don't support cross-netns setup |
| MEDIUM | | 5.1 | | CVE-2026-90234 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFS: Return a delegation the client fails to record |
| MEDIUM | | 7 | | CVE-2026-90237 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nft_ct: move custom expectation support to helper |
| MEDIUM | | 7 | | CVE-2026-90240 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Flush context cache with correct SID when tearing down aliases |
| MEDIUM | | 5.5 | | CVE-2026-90247 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix mmap_lock leak in irq_work path |
| MEDIUM | | 5.9 | | CVE-2026-90256 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind |
| MEDIUM | | 5.5 | | CVE-2026-90259 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() |
| MEDIUM | | 4.7 | | CVE-2026-90260 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: don't clobber the extent buffer when zeroing it out |
| MEDIUM | | 3.3 | | CVE-2026-90263 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: check if root is readonly when setting posix acl |
| MEDIUM | | 5.5 | | CVE-2026-90264 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: always wait for ordered extents to avoid OE races |
| MEDIUM | | 5.5 | | CVE-2026-90265 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: defrag: fix deadlock between defrag and delalloc space reservation |
| MEDIUM | | 5.5 | | CVE-2026-90273 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable |
| MEDIUM | | 5.5 | | CVE-2026-90289 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Resize MST HDCP per-connector arrays to 32 |
| MEDIUM | | 5.5 | | CVE-2026-90300 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear buf on error in __bpf_get_task_stack |
| MEDIUM | | 5.5 | | CVE-2026-90301 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: o2hb: quiesce negotiate handlers and timeout work |
| MEDIUM | | 7 | | CVE-2026-90317 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Invalidate RCU pointers after final spin unlock |
| MEDIUM | | 5.5 | | CVE-2026-90320 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate external xattr entries when reading metadata |
| MEDIUM | | 5.5 | | CVE-2026-90321 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate inline xattrs during inode block validation |
| MEDIUM | | 5.5 | | CVE-2026-90324 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ublk: check import_ubuf() return value |
| MEDIUM | | 4.7 | | CVE-2026-90326 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-cgroup: fix race between policy activation and blkg destruction |
| MEDIUM | | 5.5 | | CVE-2026-90328 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: HID: steam: Reject short reads |
| MEDIUM | | 6.4 | | CVE-2026-90333 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dm-integrity: replace forgeable discard filler with a keyed sector marker |
| MEDIUM | | 4.1 | | CVE-2026-90336 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: clear freed pointers on uart_register_driver() failure |
| MEDIUM | | 5.5 | | CVE-2026-90337 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: do fallible allocations before the console can be registered |
| MEDIUM | | 7 | | CVE-2026-90343 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: stop PMSR before P2P and NAN teardown |
| MEDIUM | | 5.5 | | CVE-2026-90345 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: brcmfmac: fix P2P action frame handling without device vif |
| MEDIUM | | 7 | | CVE-2026-90347 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry |
| MEDIUM | | 5.5 | | CVE-2026-90351 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed |
| MEDIUM | | 4.4 | | CVE-2026-90359 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject >8 byte return values on return-reading trampoline paths |
| MEDIUM | | 5.5 | | CVE-2026-90363 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: don't tear down KMS twice when KMS init fails |
| MEDIUM | | 5.5 | | CVE-2026-90365 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: cancel reset and rc work on device unregister |
| MEDIUM | | 5.5 | | CVE-2026-90367 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER |
| MEDIUM | | 4.8 | | CVE-2026-90379 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash |
| MEDIUM | | 3.3 | | CVE-2026-90401 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md: remove REQ_NOWAIT support from raid1/10/456 |
| MEDIUM | | 5.5 | | CVE-2026-90408 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() |
| MEDIUM | | 5.5 | | CVE-2026-90409 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Add vm_bind region with kbo range overlap check |
| MEDIUM | | 4.7 | | CVE-2026-90417 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() |
| MEDIUM | | 5.5 | | CVE-2026-90421 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI: Fix UAF when probe runs concurrent to dyn ID removal |
| MEDIUM | | 5.5 | | CVE-2026-90422 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path |
| MEDIUM | | 4.7 | | CVE-2026-90427 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() |
| MEDIUM | | 5.5 | | CVE-2026-92480 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Validate string descriptors |
| MEDIUM | | 5.5 | | CVE-2026-92482 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip |
| MEDIUM | | 3.3 | | CVE-2026-92485 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix WARNING in bpf_tracing_link_release |
| MEDIUM | | 5.5 | | CVE-2026-92499 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext4: validate readdir offset before accessing dirent |
| MEDIUM | | 4.7 | | CVE-2026-92500 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext4: use fsdata to track inline data write state and fix race |
| MEDIUM | | 5.5 | | CVE-2026-92503 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() |
| MEDIUM | | 5.5 | | CVE-2026-92518 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv, bpf: Fix kernel stack corruption in tailcall with CFI |
| MEDIUM | | 5.5 | | CVE-2026-92520 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Zero queue and stack outputs on lock failure |
| MEDIUM | | 5.5 | | CVE-2026-93044 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for arena-related insns |
| MEDIUM | | 5.5 | | CVE-2026-93047 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Associate BOs with every job that accesses them |
| MEDIUM | | 5.5 | | CVE-2026-93058 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Only fini scheduler after successful init |
| MEDIUM | | 5.5 | | CVE-2026-93081 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_scmi: Fix SCMI device destroy lifetimes |
| MEDIUM | | 4.7 | | CVE-2026-93099 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Fix UAF from worker threads when domains are removed |
| MEDIUM | | 4.7 | | CVE-2026-93100 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() |
| MEDIUM | | 4.7 | | CVE-2026-93104 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rvt: Return NULL after port allocation failure |
| MEDIUM | | 7 | | CVE-2026-93105 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: esp: do not unref managed frag pages in esp_ssg_unref() |
| MEDIUM | | 5.5 | | CVE-2026-93122 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: usb: gadget: uac: validate rate list length before storing |
| MEDIUM | | 5.5 | | CVE-2026-93135 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject programs with inlined helpers if JIT is not available |
| MEDIUM | | 7 | | CVE-2026-93148 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject MEM_ALLOC BTF accesses past object bounds |
| MEDIUM | | 7 | | CVE-2026-93154 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Add refcounting to user ring MRs |
| MEDIUM | | 5.5 | | CVE-2026-93168 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout |
| MEDIUM | | 5.5 | | CVE-2026-93175 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in CRTC reset function |
| MEDIUM | | 4.7 | | CVE-2026-93176 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in plane reset function |
| MEDIUM | | 5.5 | | CVE-2026-93270 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn |
| MEDIUM | | 5.5 | | CVE-2026-93272 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 |
| MEDIUM | | 5.5 | | CVE-2026-93276 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator |
| MEDIUM | | 5.5 | | CVE-2026-93282 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix maximum allowed access checks |
| MEDIUM | | 7.1 | | CVE-2026-97422 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: fix SMI event cross-process information leak |
| MEDIUM | | 5.5 | | CVE-2026-97432 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: fix P2P-Device binding handling |
| MEDIUM | | 5.5 | | CVE-2026-97478 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virt: acrn: Fix irqfd use-after-free during eventfd shutdown |
| MEDIUM | | 7.1 | | CVE-2026-97493 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS |
| MEDIUM | | 5.5 | | CVE-2026-97499 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: perf: Retrieve path and source from event data |
| MEDIUM | | 5.5 | | CVE-2026-97513 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Release m2m_ctx after Instance Removed from List |
| MEDIUM | | 5.5 | | CVE-2026-97515 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 |
| MEDIUM | | 5.5 | | CVE-2026-97526 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/pai: Support CPU hotplug for PMU PAI |
| MEDIUM | | 5.5 | | CVE-2026-97538 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (asus_rog_ryujin) Validate HID report lengths |
| MEDIUM | | 5.5 | | CVE-2026-97554 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() |
| MEDIUM | | 7 | | CVE-2026-97561 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid |
| MEDIUM | | 7 | | CVE-2026-97563 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97565 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject short READ responses in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97960 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel: Prevent drain_pebs() reentry |
| MEDIUM | | 5.5 | | CVE-2026-97962 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Move representor vnic reporter to eswitch devlink port |
| MEDIUM | | 5.1 | | CVE-2026-97975 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() |
| MEDIUM | | 4.7 | | CVE-2026-97988 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vhost: invalidate vring access on IOTLB transitions |
| MEDIUM | | 5.5 | | CVE-2026-98019 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: mark a NULL call argument precise |
| MEDIUM | | 5.3 | | CVE-2026-98032 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tracing: Fix subbuf resize races with trace_pipe_raw readers |
| MEDIUM | | 7 | | CVE-2026-98033 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Preserve inner map identity in callback frames |
| MEDIUM | | 7 | | CVE-2026-98034 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark NULL kptr stores precise |
| MEDIUM | | 5.5 | | CVE-2026-98043 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Don't infer non-NULL from a pointer with an unbounded offset |
| MEDIUM | | 7 | | CVE-2026-98047 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check ancestor frames for rbtree callbacks |
| MEDIUM | | 7 | | CVE-2026-98048 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: don't rewrite bpf_fastcall patterns entered by a jump |
| MEDIUM | | 5.5 | | CVE-2026-98049 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: zero extend the result of an arena 32-bit cmpxchg |
| MEDIUM | | 5.5 | | CVE-2026-98053 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Refactor and fix init_config access |
| MEDIUM | | 5.5 | | CVE-2026-98062 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark signal tracepoint siginfo arguments as scalar |
| MEDIUM | | 5.5 | | CVE-2026-98085 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge |
| MEDIUM | | | | CVE-2026-98099 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 5.5 | | CVE-2026-98115 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely drain sessions during logoff |
| MEDIUM | | 5.5 | | CVE-2026-98118 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix readahead synchronisation issues by loading all folios upfront |
| MEDIUM | | 5.5 | | CVE-2026-98124 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/client: invalidate fscache for fallocate range operations |
| MEDIUM | | 5.5 | | CVE-2026-98125 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix stale page cache in insert/collapse range |
| MEDIUM | | 5.5 | | CVE-2026-98131 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix dma mapping leak in stmmac_tso_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-98134 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: check_cond_jmp_op(): properly infer if register is null |
| MEDIUM | | 5.3 | | CVE-2026-98156 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/virtio: use the DMA API for resource backing on Xen |
| MEDIUM | | 5.5 | | CVE-2026-98162 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/server: fix tree connection leak in smb2_tree_connect() |
| MEDIUM | | 5.5 | | CVE-2026-98180 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: RCU-free the scheduler-containing ring and VM objects |
| MEDIUM | | 5.5 | | CVE-2026-98228 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ |
| MEDIUM | | 4.4 | | CVE-2026-98273 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: x86/kprobes: Fix crash when probing CS CALL instructions |
| MEDIUM | | 5.5 | | CVE-2026-98277 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: ring the doorbell if a burst ends in a drop |
| MEDIUM | | 5.5 | | CVE-2026-98279 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: handle lack of space when cleaning up verity items |
| MEDIUM | | 5.3 | | CVE-2026-98284 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netlink: do not free nlk->groups while lockless readers can use it |
| MEDIUM | | 4.1 | | CVE-2026-98286 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown |
| MEDIUM | | 5.5 | | CVE-2026-98288 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix TSO header length truncation |
| MEDIUM | | 5.5 | | CVE-2026-98292 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| MEDIUM | | 5.5 | | CVE-2026-98294 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_qca: Do not write to the serial port after it is closed |
| MEDIUM | | 7 | | CVE-2026-98296 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btintel_pcie: validate TX skb length in send_sync |
| MEDIUM | | 5.5 | | CVE-2026-98313 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/dp: skip PUSH_IDLE when the link was never enabled |
| MEDIUM | | 7 | | CVE-2026-98330 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: get the wiphy out of a dying network namespace |
| MEDIUM | | 5.5 | | CVE-2026-98333 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: reset the LED state when ifup fails |
| MEDIUM | | 7 | | CVE-2026-98341 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: don't free driver-owned scan requests |
| MEDIUM | | 5.5 | | CVE-2026-98353 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables |
| MEDIUM | | 5.5 | | CVE-2026-98355 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rtrs: guard against null kobj name |
| MEDIUM | | 5.5 | | CVE-2026-98376 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Use array_map_meta_equal for percpu array inner map replacement |
| MEDIUM | | 5.5 | | CVE-2026-98408 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: watchdog: rzv2h: Avoid division by zero |
| MEDIUM | | 5.5 | | CVE-2026-98420 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: follow SMB2 session expiration semantics |
| MEDIUM | | | | CVE-2026-98436 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: a ... |
| MEDIUM | | 6.5 | | CVE-2026-98439 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/server: cancel async requests when closing connection |
| MEDIUM | | 4.7 | | CVE-2026-98444 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: drop dquot flush lock when we can't find a buffer to flush |
| MEDIUM | | 6.5 | | CVE-2026-98449 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: delete compound mids on send failure before unlock |
| MEDIUM | | 5.3 | | CVE-2026-98471 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Do cache maintenance on the source VM during intra-host migration |
| MEDIUM | | 5.5 | | CVE-2026-98556 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gve: DQO: reject TSO packets with an out of range MSS |
| MEDIUM | | 4.1 | | CVE-2026-98558 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: flush skb_defer_nodes in dev_cpu_dead() |
| MEDIUM | | 5.9 | | CVE-2026-98570 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: ipv6: keep room for the mac header in dst_dev_overhead() |
| MEDIUM | | 6.7 | | CVE-2026-98589 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject pkt arguments in mutating subprogs |
| MEDIUM | | 4.7 | | CVE-2026-98598 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv6: Prevent rt6_insert_exception() for dying fib6_info |
| MEDIUM | | 6.7 | | CVE-2026-98599 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() |
| MEDIUM | | 4.1 | | CVE-2026-98616 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: reset num_napi when the napi vectors are freed |
| MEDIUM | | 5.5 | | CVE-2026-98652 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Add missing srcu in kvm_s390_set_irq_state() |
| MEDIUM | | 5.5 | | CVE-2026-98674 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iio: adc: adi-axi-adc: Initialize state mutex |
| MEDIUM | | 5.6 | | CVE-2026-98714 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| MEDIUM | | 4.1 | | CVE-2026-98740 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety |
| MEDIUM | | 4.4 | | CVE-2026-98747 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix NULL pointer dereference in serial_core_unregister_port() |
| MEDIUM | | 4.7 | | CVE-2026-98786 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: guard dc_sink dereferences in MST mode validation |
| MEDIUM | | 4.4 | | CVE-2026-98789 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix objects stuck in free_by_rcu_ttrace |
| MEDIUM | | 4.4 | | CVE-2026-98795 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: skip ptp deinit if init was skipped |
| MEDIUM | | 4.4 | | CVE-2026-98799 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Skip detached progs in trampoline images that are still in use |
| MEDIUM | | 4.7 | | CVE-2026-98800 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: kernel: Denial of Service via use-after-free in BPF trampoline |
| MEDIUM | | 6.5 | | CVE-2026-98803 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix rx Scatter-Gather support |
| MEDIUM | | 6.1 | | CVE-2026-98810 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() |
| MEDIUM | | 4.4 | | CVE-2026-98813 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Hold map BTF for the memory allocator destructor record |
| MEDIUM | | 4.4 | | CVE-2026-98814 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix command effects log lifetime for multipath heads |
| MEDIUM | | 4.1 | | CVE-2026-98815 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix cdev lifetime |
| MEDIUM | | 4.1 | | CVE-2026-98816 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix overflow of jump offset in constant blinding |
| MEDIUM | | 5.5 | | CVE-2026-98820 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: set RQF_USE_SCHED when the operation is known |
| MEDIUM | | 5.3 | | CVE-2026-98824 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate TX status rate metadata |
| MEDIUM | | 6.5 | | CVE-2026-98829 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: drop oversized fragments to avoid extra_len overflow |
| MEDIUM | | 4.1 | | CVE-2026-98834 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mtd: core: avoid double-free of OTP NVMEM device |
| MEDIUM | | 6.1 | | CVE-2026-98839 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() |
| MEDIUM | | 4.4 | | CVE-2026-98843 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: zero gaps in read-gaps folio to avoid writing back stale data |
| MEDIUM | | 5.6 | | CVE-2026-98863 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| MEDIUM | | 4.6 | | CVE-2019-15213 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: use-after-free caused by malicious USB device in drivers/media/usb/dvb-usb/dvb-usb-init.c |
| MEDIUM | | 4.1 | | CVE-2019-16089 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Improper return check in nbd_genl_status function in drivers/block/nbd.c |
| MEDIUM | | 4.7 | | CVE-2019-20794 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: task processes not being properly ended could lead to resource exhaustion |
| MEDIUM | | 4.4 | | CVE-2020-14304 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ethtool when reading eeprom of device could lead to memory leak |
| MEDIUM | | 6.7 | | CVE-2020-36694 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: use-after-free in the packet processing context |
| MEDIUM | | 5.5 | | CVE-2023-31082 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sleeping function called from an invalid context in gsmld_write |
| MEDIUM | | 7 | | CVE-2023-3397 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: slab-use-after-free Write in txEnd due to race condition |
| MEDIUM | | 5.5 | | CVE-2023-37454 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: udf: use-after-free write in udf_close_lvid |
| MEDIUM | | 6.7 | | CVE-2023-6238 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvme: memory corruption via unprivileged user passthrough |
| MEDIUM | | 6.5 | | CVE-2023-6240 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation |
| MEDIUM | | 5.5 | | CVE-2024-2193 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | hw: Spectre-SRC that is Speculative Race Conditions (SRCs) for synchronization primitives similar like Spectre V1 with p |
| MEDIUM | | 4.7 | | CVE-2024-24864 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | A race condition was found in the Linux kernel's media/dvb-core in dvb ... |
| MEDIUM | | 5.5 | | CVE-2024-25740 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory leak in ubi driver |
| MEDIUM | | 5.5 | | CVE-2024-56709 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring: check if iowq is killed before queuing |
| MEDIUM | | 5.5 | | CVE-2024-58074 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/i915: Grab intel_display from the encoder to avoid potential oopsies |
| MEDIUM | | 5.5 | | CVE-2025-21752 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents |
| MEDIUM | | 5.5 | | CVE-2025-21949 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Set hugetlb mmap base address aligned with pmd size |
| MEDIUM | | 5.5 | | CVE-2025-22109 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ax25: Remove broken autobind |
| MEDIUM | | 5.5 | | CVE-2025-23132 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: quota: fix to avoid warning in dquot_writeback_dquots() |
| MEDIUM | | 5.5 | | CVE-2025-23135 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Teardown riscv specific bits after kvm_exit |
| MEDIUM | | 5.5 | | CVE-2025-37743 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Avoid memory leak while enabling statistics |
| MEDIUM | | 5.5 | | CVE-2025-37746 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/dwc_pcie: fix duplicate pci_dev devices |
| MEDIUM | | 5.5 | | CVE-2025-37880 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: um: work around sched_yield not yielding in time-travel mode |
| MEDIUM | | 4.7 | | CVE-2025-37906 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: ublk race condition causes kernel crash |
| MEDIUM | | 5.5 | | CVE-2025-38029 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to sleepable page allocation in KASAN |
| MEDIUM | | 5.5 | | CVE-2025-38036 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to null pointer dereference in GT MMIO initialization for VFs |
| MEDIUM | | 5.5 | | CVE-2025-38041 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clk: sunxi-ng: h616: Reparent GPU clock during frequency changes |
| MEDIUM | | 5.5 | | CVE-2025-38042 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn |
| MEDIUM | | 6.7 | | CVE-2025-38064 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio: break and reset virtio devices on device_shutdown() |
| MEDIUM | | 5.5 | | CVE-2025-38132 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: holding cscfg_csdev_lock while removing cscfg from csdev |
| MEDIUM | | 5.5 | | CVE-2025-38140 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Local denial of service in device mapper |
| MEDIUM | | 5.5 | | CVE-2025-38199 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix memory leak due to multiple rx_stats allocation |
| MEDIUM | | 5.5 | | CVE-2025-38207 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm: fix uprobe pte be overwritten when expanding vma |
| MEDIUM | | 5.5 | | CVE-2025-38261 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv: save the SR_SUM status over switches |
| MEDIUM | | 5.5 | | CVE-2025-38284 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: configure manual DAC mode via PCI config API only |
| MEDIUM | | 5.5 | | CVE-2025-38311 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel (iavf): Denial of Service due to a locking issue |
| MEDIUM | | 5.5 | | CVE-2025-38359 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Fix in_atomic() handling in do_secure_storage_access() |
| MEDIUM | | 5.5 | | CVE-2025-38597 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port |
| MEDIUM | | 5.5 | | CVE-2025-38605 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() |
| MEDIUM | | 5.5 | | CVE-2025-39677 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Fix backlog accounting in qdisc_dequeue_internal |
| MEDIUM | | 5.5 | | CVE-2025-39762 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: add null check |
| MEDIUM | | 5.5 | | CVE-2025-39775 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: mremap local denial of service |
| MEDIUM | | 5.5 | | CVE-2025-39789 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: crypto: x86/aegis - Add missing error checks |
| MEDIUM | | 6.1 | | CVE-2025-39822 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/kbuf: fix signedness in this_len calculation |
| MEDIUM | | 5.5 | | CVE-2025-39830 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path |
| MEDIUM | | 5.5 | | CVE-2025-39834 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow |
| MEDIUM | | 6.2 | | CVE-2025-39910 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() |
| MEDIUM | | 7.1 | | CVE-2025-39933 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length |
| MEDIUM | | 2.5 | | CVE-2025-40113 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E |
| MEDIUM | | 6.8 | | CVE-2025-40130 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling |
| MEDIUM | | 6.2 | | CVE-2025-40146 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: fix potential deadlock while nr_requests grown |
| MEDIUM | | 5.2 | | CVE-2025-40217 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pidfs: validate extensible ioctls |
| MEDIUM | | | | CVE-2025-40247 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Fix pgtable prealloc error path |
| MEDIUM | | 5.2 | | CVE-2025-40338 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Do not share the name pointer between components |
| MEDIUM | | 6.1 | | CVE-2025-40355 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sysfs: check visibility before changing group attribute ownership |
| MEDIUM | | 5.5 | | CVE-2025-68209 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mlx5: Fix default values in create CQ |
| MEDIUM | | 5.5 | | CVE-2025-68236 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service during UFS power down |
| MEDIUM | | 5.5 | | CVE-2025-68304 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_core: lookup hci_conn on RX path on protocol side |
| MEDIUM | | | | CVE-2025-68318 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL |
| MEDIUM | | 6.1 | | CVE-2025-68319 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netconsole: Acquire su_mutex before navigating configs hierarchy |
| MEDIUM | | 5.5 | | CVE-2025-68353 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service via NULL pointer dereference in VXLAN module |
| MEDIUM | | 4.5 | | CVE-2025-68360 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks |
| MEDIUM | | 5.5 | | CVE-2025-68368 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service in md driver via uninitialized bioset |
| MEDIUM | | 6.5 | | CVE-2025-68729 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix MSDU buffer types handling in RX error path |
| MEDIUM | | 5.5 | | CVE-2025-68730 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() |
| MEDIUM | | 4.7 | | CVE-2025-68745 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset |
| MEDIUM | | 7.8 | | CVE-2025-71074 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel functionfs: Use-After-Free vulnerability due to open/removal races |
| MEDIUM | | 5.5 | | CVE-2025-71117 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service via deadlock in block layer sysfs store callbacks |
| MEDIUM | | 5.5 | | CVE-2025-71141 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/tilcdc: Fix removal actions in case of failed probe |
| MEDIUM | | 5.5 | | CVE-2025-71188 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: lpc18xx-dmamux: fix device leak on route allocation |
| MEDIUM | | 6.5 | | CVE-2025-71202 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Memory Corruption and Kernel Crashes via IOMMU SVA coherency issue |
| MEDIUM | | 5.5 | | CVE-2025-71227 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: don't WARN for connections on invalid channels |
| MEDIUM | | 5.5 | | CVE-2025-71285 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels |
| MEDIUM | | 5.5 | | CVE-2025-71302 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: fix for dma-fence safe access rules |
| MEDIUM | | 7 | | CVE-2025-71313 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI: endpoint: Add missing NULL check for alloc_workqueue() |
| MEDIUM | | 5.5 | | CVE-2025-71315 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/vkms: Convert to DRM's vblank timer |
| MEDIUM | | 5.5 | | CVE-2026-100074 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| MEDIUM | | 5.5 | | CVE-2026-100076 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths |
| MEDIUM | | 5.5 | | CVE-2026-100077 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Recover HW before retire hung submit |
| MEDIUM | | 5.5 | | CVE-2026-23007 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: block: zero non-PI portion of auto integrity buffer |
| MEDIUM | | 5.5 | | CVE-2026-23017 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: idpf: fix error handling in the init_task on load |
| MEDIUM | | 5.5 | | CVE-2026-23143 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix misalignment bug in struct virtnet_info |
| MEDIUM | | 7.1 | | CVE-2026-23152 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: correctly decode TTLM with default link map |
| MEDIUM | | 5.5 | | CVE-2026-23217 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv: trace: fix snapshot deadlock with sbi ecall |
| MEDIUM | | 5.5 | | CVE-2026-23259 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/rw: free potentially allocated iovec on cache put failure |
| MEDIUM | | 5.5 | | CVE-2026-23265 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer in {read,write}_end_io |
| MEDIUM | | 5.5 | | CVE-2026-23348 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix race of nvdimm_bus object when creating nvdimm objects |
| MEDIUM | | 5.5 | | CVE-2026-23371 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting |
| MEDIUM | | 5.5 | | CVE-2026-23377 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz |
| MEDIUM | | 5.5 | | CVE-2026-23385 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: clone set on flush only |
| MEDIUM | | 5.5 | | CVE-2026-23472 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN |
| MEDIUM | | 5.5 | | CVE-2026-31435 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix read abandonment during retry |
| MEDIUM | | 5.5 | | CVE-2026-31526 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix exception exit lock checking for subprogs |
| MEDIUM | | 5.5 | | CVE-2026-31537 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: server: make use of smbdirect_socket.send_io.bcredits |
| MEDIUM | | 5.5 | | CVE-2026-31562 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register |
| MEDIUM | | 5.5 | | CVE-2026-31579 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit |
| MEDIUM | | 5.5 | | CVE-2026-31591 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish |
| MEDIUM | | 5.5 | | CVE-2026-31592 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock |
| MEDIUM | | 5.5 | | CVE-2026-31630 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rxrpc: proc: size address buffers for %pISpc output |
| MEDIUM | | 7.1 | | CVE-2026-31692 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns |
| MEDIUM | | 5.5 | | CVE-2026-31771 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_event: move wake reason storage into validated event handlers |
| MEDIUM | | 5.5 | | CVE-2026-31777 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: ctxfi: Check the error for index mapping |
| MEDIUM | | 5.5 | | CVE-2026-43009 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix incorrect pruning due to atomic fetch precision tracking |
| MEDIUM | | 5.5 | | CVE-2026-43022 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists |
| MEDIUM | | 5.5 | | CVE-2026-43029 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mptcp: fix soft lockup in mptcp_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-43034 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: set backing store type from query type |
| MEDIUM | | 7.1 | | CVE-2026-43042 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mpls: add seqcount to protect the platform_label{,s} pair |
| MEDIUM | | 5.5 | | CVE-2026-43048 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: HID: core: Mitigate potential OOB by removing bogus memset() |
| MEDIUM | | 5.5 | | CVE-2026-43053 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: close crash window in attr dabtree inactivation |
| MEDIUM | | 5.5 | | CVE-2026-43083 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: ioam6: fix OOB and missing lock |
| MEDIUM | | 5.5 | | CVE-2026-43101 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() |
| MEDIUM | | 5.5 | | CVE-2026-43115 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: srcu: Use irq_work to start GP in tiny SRCU |
| MEDIUM | | 5.5 | | CVE-2026-43118 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix zero size inode with non-zero size after log replay |
| MEDIUM | | 5.5 | | CVE-2026-43127 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs3: fix circular locking dependency in run_unpack_ex |
| MEDIUM | | 5.5 | | CVE-2026-43172 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: fix 22000 series SMEM parsing |
| MEDIUM | | 5.5 | | CVE-2026-43191 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 |
| MEDIUM | | 5.5 | | CVE-2026-43204 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: qcom: q6asm: drop DSP responses for closed data streams |
| MEDIUM | | 5.5 | | CVE-2026-43213 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: validate sequence number of TX release report |
| MEDIUM | | 5.5 | | CVE-2026-43234 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: team: avoid NETDEV_CHANGEMTU event when unregistering slave |
| MEDIUM | | 5.5 | | CVE-2026-43272 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ring-buffer: Fix possible dereference of uninitialized pointer |
| MEDIUM | | 5.5 | | CVE-2026-43294 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels |
| MEDIUM | | 5.5 | | CVE-2026-43298 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Skip vcn poison irq release on VF |
| MEDIUM | | 5.5 | | CVE-2026-43299 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() |
| MEDIUM | | 5.5 | | CVE-2026-43301 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix PM runtime usage count underflow |
| MEDIUM | | 5.5 | | CVE-2026-43308 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() |
| MEDIUM | | 5.5 | | CVE-2026-43309 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md raid: fix hang when stopping arrays with metadata through dm-raid |
| MEDIUM | | 5.5 | | CVE-2026-43310 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC |
| MEDIUM | | 5.5 | | CVE-2026-43311 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soc/tegra: pmc: Fix unsafe generic_handle_irq() call |
| MEDIUM | | 5.5 | | CVE-2026-43325 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: don't send a 6E related command when not supported |
| MEDIUM | | 5.5 | | CVE-2026-43326 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback |
| MEDIUM | | 5.5 | | CVE-2026-43337 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() |
| MEDIUM | | 5.5 | | CVE-2026-43346 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ice: ptp: don't WARN when controlling PF is unavailable |
| MEDIUM | | 5.5 | | CVE-2026-43352 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue |
| MEDIUM | | 5.5 | | CVE-2026-43353 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue |
| MEDIUM | | 7.1 | | CVE-2026-43414 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Completely fix fcport double free |
| MEDIUM | | 5.5 | | CVE-2026-43416 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: powerpc, perf: Check that current->mm is alive before getting user callchain |
| MEDIUM | | 5.5 | | CVE-2026-43443 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: amd: acp-mach-common: Add missing error check for clock acquisition |
| MEDIUM | | 5.5 | | CVE-2026-43463 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() |
| MEDIUM | | 5.5 | | CVE-2026-43464 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ |
| MEDIUM | | 5.5 | | CVE-2026-43465 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ |
| MEDIUM | | 5.5 | | CVE-2026-43485 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nouveau/gsp: drop WARN_ON in ACPI probes |
| MEDIUM | | 6.4 | | CVE-2026-45932 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix tcx/netkit detach permissions when prog fd isn't given |
| MEDIUM | | 7 | | CVE-2026-45934 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation |
| MEDIUM | | 5.5 | | CVE-2026-45940 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix oops when split header is enabled |
| MEDIUM | | 5.5 | | CVE-2026-45961 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gfs2: fix memory leaks in gfs2_fill_super error path |
| MEDIUM | | 5.5 | | CVE-2026-46014 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Add missing save/restore handling of LBR MSRs |
| MEDIUM | | 7 | | CVE-2026-46017 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm: fix deferred split queue races during migration |
| MEDIUM | | 7 | | CVE-2026-46032 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT |
| MEDIUM | | 5.5 | | CVE-2026-46044 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipmi:ssif: Clean up kthread on errors |
| MEDIUM | | 5.5 | | CVE-2026-46059 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN |
| MEDIUM | | 5.5 | | CVE-2026-46066 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix num_ops off-by-one when crypto allocation fails |
| MEDIUM | | 5.5 | | CVE-2026-46071 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 |
| MEDIUM | | 5.5 | | CVE-2026-46096 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() |
| MEDIUM | | 5.5 | | CVE-2026-46147 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() |
| MEDIUM | | 5.5 | | CVE-2026-46148 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: spi: microchip-core-qspi: control built-in cs manually |
| MEDIUM | | 5.5 | | CVE-2026-46153 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: 8021q: delete cleared egress QoS mappings |
| MEDIUM | | 5.5 | | CVE-2026-46171 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv: kvm: fix vector context allocation leak |
| MEDIUM | | 5.5 | | CVE-2026-46228 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: spi: ch341: fix devres lifetime |
| MEDIUM | | 5.5 | | CVE-2026-46245 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dc_link NULL handling in HPD init |
| MEDIUM | | 5.5 | | CVE-2026-46256 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages |
| MEDIUM | | 4.7 | | CVE-2026-46272 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: tmc-etr: Fix race condition between sysfs and perf mode |
| MEDIUM | | 5.5 | | CVE-2026-46302 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: selinux: allow multiple opens of /sys/fs/selinux/policy |
| MEDIUM | | 5.5 | | CVE-2026-46314 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Reject empty multisync extension to prevent infinite loop |
| MEDIUM | | 7 | | CVE-2026-46317 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock |
| MEDIUM | | 7 | | CVE-2026-46324 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: netfilter nf_tables denial of service via race condition in netlink hook unregistration |
| MEDIUM | | 7 | | CVE-2026-46325 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE |
| MEDIUM | | 7 | | CVE-2026-46330 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Revert "net/smc: Introduce TCP ULP support" |
| MEDIUM | | 5.5 | | CVE-2026-52937 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR |
| MEDIUM | | 7 | | CVE-2026-52953 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Fix oops due to out of scope access |
| MEDIUM | | 7 | | CVE-2026-52956 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() |
| MEDIUM | | 5.5 | | CVE-2026-52994 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting |
| MEDIUM | | 7 | | CVE-2026-53009 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ice: fix double-free of tx_buf skb |
| MEDIUM | | 5.5 | | CVE-2026-53017 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix data loss caused by incorrect use of nat_entry flag |
| MEDIUM | | 5.5 | | CVE-2026-53018 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: avoid reading already updated pages during GC |
| MEDIUM | | 5.5 | | CVE-2026-53103 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync |
| MEDIUM | | 5.5 | | CVE-2026-53104 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: Fix memory leak destroying device |
| MEDIUM | | 5.5 | | CVE-2026-53106 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Do not allow deleting local storage in NMI |
| MEDIUM | | 5.5 | | CVE-2026-53107 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: libertas: don't kill URBs in interrupt context |
| MEDIUM | | 5.5 | | CVE-2026-53108 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: powerpc/64s: Fix unmap race with PMD migration entries |
| MEDIUM | | | | CVE-2026-53178 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction |
| MEDIUM | | 7 | | CVE-2026-53224 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate embedded INIT chunk and address list lengths in cookie |
| MEDIUM | | 7 | | CVE-2026-53246 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing |
| MEDIUM | | 5.5 | | CVE-2026-53258 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: fix leak if split 6 GHz scanning fails |
| MEDIUM | | 5.5 | | CVE-2026-53281 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption |
| MEDIUM | | 5.5 | | CVE-2026-53285 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED |
| MEDIUM | | 5.5 | | CVE-2026-53292 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind |
| MEDIUM | | 5.5 | | CVE-2026-53297 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: mana: Guard mana_remove against double invocation |
| MEDIUM | | 5.5 | | CVE-2026-53321 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/napi: cap busy_poll_to 10 msec |
| MEDIUM | | 5.5 | | CVE-2026-53377 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: always recover the gpu |
| MEDIUM | | | | CVE-2026-53401 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: omap2: fix use-after-free in omapfb_mmap |
| MEDIUM | | | | CVE-2026-63805 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: crypto: nx - fix nx_crypto_ctx_exit argument |
| MEDIUM | | | | CVE-2026-63811 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: read COW data with the original inode during atomic write |
| MEDIUM | | | | CVE-2026-63819 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on f2fs_get_node_folio_ra() |
| MEDIUM | | 5.5 | | CVE-2026-63832 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: add wcid publish check in mt76_sta_add |
| MEDIUM | | 5.5 | | CVE-2026-63853 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring |
| MEDIUM | | | | CVE-2026-63857 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-63858 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: add hook transactions for device deletions |
| MEDIUM | | | | CVE-2026-63859 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue() |
| MEDIUM | | 7 | | CVE-2026-63941 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor |
| MEDIUM | | 7 | | CVE-2026-63979 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/handshake: hand off the pinned file reference to accept_doit |
| MEDIUM | | 5.5 | | CVE-2026-63998 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ethtool: module: call ethnl_ops_complete() on module flash errors |
| MEDIUM | | 5.5 | | CVE-2026-63999 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure |
| MEDIUM | | 5.5 | | CVE-2026-64006 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: fix dst corruption in same register operation |
| MEDIUM | | 7 | | CVE-2026-64024 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction |
| MEDIUM | | 5.5 | | CVE-2026-64036 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cgroup/rstat: validate cpu before css_rstat_cpu() access |
| MEDIUM | | 5.5 | | CVE-2026-64038 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Stop work before releasing hwmon device |
| MEDIUM | | 5.5 | | CVE-2026-64060 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix leak of request in netfs_write_begin() error handling |
| MEDIUM | | 7.1 | | CVE-2026-64066 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_read_to_pagecache() to pause on subreq failure |
| MEDIUM | | 5.5 | | CVE-2026-64067 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing barriers when accessing stream->subrequests locklessly |
| MEDIUM | | 7 | | CVE-2026-64068 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing locking around retry adding new subreqs |
| MEDIUM | | 5.5 | | CVE-2026-64076 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: bridge: eb_tables: close module init race |
| MEDIUM | | 5.5 | | CVE-2026-64077 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: ebtables: move to two-stage removal scheme |
| MEDIUM | | 7.1 | | CVE-2026-64078 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: add and use xtables_unregister_table_exit |
| MEDIUM | | 5.5 | | CVE-2026-64079 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: allocate hook ops while under mutex |
| MEDIUM | | 7 | | CVE-2026-64117 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb |
| MEDIUM | | 5.5 | | CVE-2026-64146 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix metabuf leak in inode xattr initialization |
| MEDIUM | | 5.5 | | CVE-2026-64154 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() |
| MEDIUM | | 5.5 | | CVE-2026-64159 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix zeropoint update where i_size > remote_i_size |
| MEDIUM | | 7 | | CVE-2026-64160 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point |
| MEDIUM | | 5.5 | | CVE-2026-64190 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: team: fix NULL pointer dereference in team_xmit during mode change |
| MEDIUM | | 5.5 | | CVE-2026-64212 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it |
| MEDIUM | | 5.5 | | CVE-2026-64213 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Add lock protection to lm90_alert |
| MEDIUM | | 7 | | CVE-2026-64255 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers |
| MEDIUM | | 7 | | CVE-2026-64520 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies |
| MEDIUM | | 7 | | CVE-2026-68086 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/khugepaged: write all dirty file folios when collapsing |
| MEDIUM | | 5.5 | | CVE-2026-68211 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: stm32-dcmipp: Return queued buffers on start_streaming() failure |
| MEDIUM | | 5.5 | | CVE-2026-68233 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/vc4: Shut down BO cache timer before teardown |
| MEDIUM | | 5.5 | | CVE-2026-68242 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/gt: Fix NULL deref on sched_engine alloc failure |
| MEDIUM | | 5.5 | | CVE-2026-68258 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size |
| MEDIUM | | 5.5 | | CVE-2026-68291 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: idpf driver null pointer dereference leads to Denial of Service |
| MEDIUM | | 5.5 | | CVE-2026-68295 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: BPF: Zero-extend signed ALU32 div/mod results |
| MEDIUM | | 5.5 | | CVE-2026-68312 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths |
| MEDIUM | | 7 | | CVE-2026-68323 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tipc: serialize udp bearer replicast list updates |
| MEDIUM | | 5.5 | | CVE-2026-68382 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Hold device ref until queue teardown completes |
| MEDIUM | | 5.5 | | CVE-2026-68383 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Keep scheduler timeline name alive |
| MEDIUM | | 7 | | CVE-2026-68393 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: extend conn_hash lookup critical sections |
| MEDIUM | | 6.4 | | CVE-2026-68399 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix UAF in sock clone early bailouts |
| MEDIUM | | 7 | | CVE-2026-68400 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation |
| MEDIUM | | 7 | | CVE-2026-68401 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() |
| MEDIUM | | 7 | | CVE-2026-68404 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect |
| MEDIUM | | 5.5 | | CVE-2026-68421 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() |
| MEDIUM | | 5.5 | | CVE-2026-68435 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Fix address space mismatch in kexec command line lookup |
| MEDIUM | | 5.5 | | CVE-2026-68441 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains |
| MEDIUM | | 5.5 | | CVE-2026-68447 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size |
| MEDIUM | | 7 | | CVE-2026-68448 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ovl: check access to copy_file_range source with src mounter creds |
| MEDIUM | | 7 | | CVE-2026-68453 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey |
| MEDIUM | | 5.5 | | CVE-2026-68471 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ieee80211: validate MLE common info length |
| MEDIUM | | 5.5 | | CVE-2026-72073 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mmc: vub300: fix use-after-free on probe failure |
| MEDIUM | | 5.5 | | CVE-2026-72162 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec |
| MEDIUM | | 7 | | CVE-2026-72288 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling |
| MEDIUM | | 7 | | CVE-2026-72329 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/liquidio: drop cached VF pci_dev LUT |
| MEDIUM | | 5.5 | | CVE-2026-72337 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: 6lowpan: avoid untracked enable work |
| MEDIUM | | 5.5 | | CVE-2026-72341 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Fix publication race for priv->channel_stats[] |
| MEDIUM | | 5.5 | | CVE-2026-72355 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix barriering when walking subrequest list |
| MEDIUM | | 5.5 | | CVE-2026-72365 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix writethrough to use collection offload |
| MEDIUM | | 5.5 | | CVE-2026-72367 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iomap: guard io_size EOF trim against concurrent truncate underflow |
| MEDIUM | | 5.5 | | CVE-2026-72375 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix reinitialisation of the inode, in particular ->lock_work |
| MEDIUM | | 5.5 | | CVE-2026-72380 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xen/pvcalls: bound backend response req_id before indexing rsp[] |
| MEDIUM | | 5.5 | | CVE-2026-72383 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: fix addr_wq_timer race in sctp_free_addr_wq() |
| MEDIUM | | 5.5 | | CVE-2026-72388 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock |
| MEDIUM | | 5.5 | | CVE-2026-72397 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() |
| MEDIUM | | 7 | | CVE-2026-72398 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: add INIT verification after cookie unpacking |
| MEDIUM | | 5.5 | | CVE-2026-72404 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() |
| MEDIUM | | 5.5 | | CVE-2026-72423 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Guard conntrack opts error writes |
| MEDIUM | | 5.5 | | CVE-2026-72440 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1: fix writes_pending and barrier reference leaks on write failures |
| MEDIUM | | 5.5 | | CVE-2026-72454 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() |
| MEDIUM | | 5.5 | | CVE-2026-72488 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soundwire: fix bug in sdw_add_element_group_count found by syzkaller |
| MEDIUM | | 5.5 | | CVE-2026-72493 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: serialize netif_running() check in enqueue_to_backlog() |
| MEDIUM | | 5.5 | | CVE-2026-72495 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages |
| MEDIUM | | 7 | | CVE-2026-72499 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free CQ toggle page after firmware teardown |
| MEDIUM | | 7 | | CVE-2026-72500 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown |
| MEDIUM | | | | CVE-2026-72501 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: R ... |
| MEDIUM | | 5.5 | | CVE-2026-74257 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sockmap: Fix use-after-free in udp_bpf_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-74264 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: watchdog: fix refcount tracking races |
| MEDIUM | | 5.5 | | CVE-2026-74272 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Resolve region deletion races |
| MEDIUM | | 5.5 | | CVE-2026-74273 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Block region delete during region creation |
| MEDIUM | | 5.5 | | CVE-2026-74314 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Cancel special fields on map value recycle |
| MEDIUM | | 5.5 | | CVE-2026-74317 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ixgbe: do not configure xps for XDP queues |
| MEDIUM | | 5.5 | | CVE-2026-74324 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: validate skb length in testmode query |
| MEDIUM | | 5.5 | | CVE-2026-74337 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks |
| MEDIUM | | 5.5 | | CVE-2026-74342 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: kernfs: link kn to its parent before the LSM init hook |
| MEDIUM | | 5.5 | | CVE-2026-74344 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear rb node linkage when freeing bpf_rb_root |
| MEDIUM | | 5.5 | | CVE-2026-74350 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate fast symlink target during inode read |
| MEDIUM | | 5.5 | | CVE-2026-74354 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Take mmap_lock in zap_pages() |
| MEDIUM | | 5.5 | | CVE-2026-74368 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() |
| MEDIUM | | 6.5 | | CVE-2026-74385 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock |
| MEDIUM | | 5.5 | | CVE-2026-74388 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data |
| MEDIUM | | 7 | | CVE-2026-74405 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: OPP: Fix race between OPP addition and lookup |
| MEDIUM | | 5.5 | | CVE-2026-74407 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath11k: cancel SSR work items during PCI shutdown |
| MEDIUM | | 5.5 | | CVE-2026-74449 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport |
| MEDIUM | | 5.5 | | CVE-2026-74466 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Close speculative mem read possibility |
| MEDIUM | | 7 | | CVE-2026-74506 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix UAF when sending a message |
| MEDIUM | | 7 | | CVE-2026-74513 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister |
| MEDIUM | | 5.5 | | CVE-2026-74527 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-af: Block VFs from clobbering special CGX PKIND state |
| MEDIUM | | 5.5 | | CVE-2026-74529 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback |
| MEDIUM | | 5.5 | | CVE-2026-74530 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback |
| MEDIUM | | 7 | | CVE-2026-74533 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero |
| MEDIUM | | 7 | | CVE-2026-74537 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: hold sk properly in iso_conn_ready |
| MEDIUM | | 5.5 | | CVE-2026-74538 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: lock sk in iso_connect_ind |
| MEDIUM | | 5.5 | | CVE-2026-74542 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix folio_queue ENOMEM in writeback by adding a mempool |
| MEDIUM | | 5.5 | | CVE-2026-74544 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds |
| MEDIUM | | 5.5 | | CVE-2026-74600 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/page_table_check: skip special zero mappings |
| MEDIUM | | 5.5 | | CVE-2026-74605 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: eventfs: Use children field for rcu head and add memory barriers |
| MEDIUM | | 7 | | CVE-2026-74611 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tls: rx: restore msg_iter before TLS 1.3 optimistic retry |
| MEDIUM | | 5.5 | | CVE-2026-74638 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Serialize the scheduler timeout handlers |
| MEDIUM | | 5.5 | | CVE-2026-74687 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: watchdog: at91sam9_wdt: prevent timer rearm during teardown |
| MEDIUM | | 7 | | CVE-2026-74695 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() |
| MEDIUM | | 7 | | CVE-2026-74697 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Disable EOP for TPA on all chips to prevent data corruption |
| MEDIUM | | 5.5 | | CVE-2026-74711 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus) Fix type confusion in notification logic |
| MEDIUM | | 5.5 | | CVE-2026-74713 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vhost_iotlb: bound map allocation in add_range |
| MEDIUM | | 7 | | CVE-2026-74715 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix netns reference imbalance in conntrack kfuncs |
| MEDIUM | | 5.5 | | CVE-2026-74723 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject inline extents without valid headers |
| MEDIUM | | 5.5 | | CVE-2026-74729 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read |
| MEDIUM | | 5.5 | | CVE-2026-74747 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipvs: revalidate ihl to prevent out-of-bounds access |
| MEDIUM | | 5.5 | | CVE-2026-80579 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: clear fb_info->mode before deleting a videomode |
| MEDIUM | | 5.5 | | CVE-2026-80580 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: bound mode sysfs output to the sysfs buffer |
| MEDIUM | | 5.5 | | CVE-2026-80614 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: emac: Fix NULL pointer dereference in emac_probe |
| MEDIUM | | 5.5 | | CVE-2026-80623 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: ete: Always save state on power down |
| MEDIUM | | 5.5 | | CVE-2026-80628 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Serialize readq reset state with q->lock |
| MEDIUM | | 5.5 | | CVE-2026-80631 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject compressed segment that overflows the compressed input |
| MEDIUM | | 5.5 | | CVE-2026-80634 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag |
| MEDIUM | | 5.5 | | CVE-2026-80655 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soc: xilinx: Fix race condition in event registration |
| MEDIUM | | 5.5 | | CVE-2026-80662 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size |
| MEDIUM | | 7 | | CVE-2026-80668 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations |
| MEDIUM | | 5.5 | | CVE-2026-80670 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() |
| MEDIUM | | 5.5 | | CVE-2026-80692 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks |
| MEDIUM | | 7 | | CVE-2026-80693 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: idpf: bound interrupt-vector register fill to the allocated array |
| MEDIUM | | 5.5 | | CVE-2026-80698 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: idxd: fix double free of wq, engine, and group structs |
| MEDIUM | | 5.5 | | CVE-2026-80721 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: ensure no dangling hcon references in iso_conn |
| MEDIUM | | | | CVE-2026-80761 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| MEDIUM | | 5.5 | | CVE-2026-80905 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: tap: fix wrong transport_header when sending VLAN-tagged frame |
| MEDIUM | | 5.5 | | CVE-2026-80920 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring: defer eventfd signaling when queued from a wakeup handler |
| MEDIUM | | 5.5 | | CVE-2026-81010 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/waitid: honor task_work cancellation |
| MEDIUM | | 7 | | CVE-2026-89528 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Reject Read lists that exceed the page budget |
| MEDIUM | | 4.8 | | CVE-2026-89534 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| MEDIUM | | 7 | | CVE-2026-89537 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 |
| MEDIUM | | 7.2 | | CVE-2026-89610 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs: verify run length exceeding volume boundary |
| MEDIUM | | 5.5 | | CVE-2026-89611 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs: validate non-resident attribute offsets |
| MEDIUM | | 7.1 | | CVE-2026-89632 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() |
| MEDIUM | | 7 | | CVE-2026-89637 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 |
| MEDIUM | | 5.5 | | CVE-2026-89639 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC |
| MEDIUM | | 3.3 | | CVE-2026-89642 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cifs: call pagecache_isize_extended() in cifs_setsize() when extending |
| MEDIUM | | 6.2 | | CVE-2026-89648 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ceph: cap delegated inode count in ceph_parse_deleg_inos() |
| MEDIUM | | 7 | | CVE-2026-89654 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix UAF in check_new_map() on session freed during unlock |
| MEDIUM | | 5.3 | | CVE-2026-89682 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net |
| MEDIUM | | 5.3 | | CVE-2026-89705 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths |
| MEDIUM | | 5.9 | | CVE-2026-89709 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: lockd, nfsd: RCU-protect nlmsvc_ops dispatch |
| MEDIUM | | 5.5 | | CVE-2026-89722 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() |
| MEDIUM | | 5.5 | | CVE-2026-89757 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/mglru: fix and remove redundant unevictable folio handling |
| MEDIUM | | 4.7 | | CVE-2026-89810 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix error path at svm_migrate_copy_to_ram |
| MEDIUM | | | | CVE-2026-89826 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| MEDIUM | | | | CVE-2026-89833 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| MEDIUM | | | | CVE-2026-89866 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| MEDIUM | | | | CVE-2026-89906 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| MEDIUM | | 4.7 | | CVE-2026-89913 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables |
| MEDIUM | | 4.7 | | CVE-2026-89920 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Fix memory corruption by not reinjecting CK machine checks |
| MEDIUM | | | | CVE-2026-89935 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 3.6 | | CVE-2026-89987 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/huge_memory: transfer the pmd dirty bit to the folio on zap |
| MEDIUM | | 5.5 | | CVE-2026-90040 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped |
| MEDIUM | | 5.5 | | CVE-2026-90061 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: skip double clone set expressions on element insert |
| MEDIUM | | 5.5 | | CVE-2026-90083 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: act_ife: Only operate on Ethernet frames |
| MEDIUM | | 5.5 | | CVE-2026-90087 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: do not leak an hci_conn when a second LE connect is rejected |
| MEDIUM | | 7 | | CVE-2026-90093 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: access chan->conn safely in get/setsockopt |
| MEDIUM | | 5.5 | | CVE-2026-90098 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: fix sleep in atomic context in MAC table access |
| MEDIUM | | 7 | | CVE-2026-90099 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: account classifier filter allocations to memcg |
| MEDIUM | | 7 | | CVE-2026-90104 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFSv4.1: zero referring call lists before decoding |
| MEDIUM | | 5.5 | | CVE-2026-90105 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vxlan: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90106 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: arp/nd proxy: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90116 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: mtpav: shut down output timer before card teardown |
| MEDIUM | | 5.5 | | CVE-2026-90142 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix resize of the RX ring |
| MEDIUM | | 5.5 | | CVE-2026-90149 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers |
| MEDIUM | | 5.5 | | CVE-2026-90154 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: scope session state changes to bound connections |
| MEDIUM | | 5.5 | | CVE-2026-90155 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: detach blocked lock requests before freeing |
| MEDIUM | | 5.5 | | CVE-2026-90156 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely discard unregistered deferred locks |
| MEDIUM | | 7 | | CVE-2026-90161 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix interlaced ztailpacking pclusters |
| MEDIUM | | 5.5 | | CVE-2026-90162 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: defer publishing granted locks to prevent UAF/double-free race |
| MEDIUM | | 5.5 | | CVE-2026-90167 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: serialize oplock close with pending break ownership |
| MEDIUM | | 5.5 | | CVE-2026-90174 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() |
| MEDIUM | | 5.5 | | CVE-2026-90177 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check pointer type for all atomic RMW paths |
| MEDIUM | | 5.5 | | CVE-2026-90179 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix deadlock in complain-mode change_hat |
| MEDIUM | | 5.5 | | CVE-2026-90204 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate DIO orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90205 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90208 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type |
| MEDIUM | | 5.5 | | CVE-2026-90217 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Compare iterator types during state pruning |
| MEDIUM | | 5.5 | | CVE-2026-90231 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix unconfined user namespace restriction forced stack |
| MEDIUM | | 5.5 | | CVE-2026-90232 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: amt: Don't support cross-netns setup |
| MEDIUM | | 5.1 | | CVE-2026-90234 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFS: Return a delegation the client fails to record |
| MEDIUM | | 7 | | CVE-2026-90237 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nft_ct: move custom expectation support to helper |
| MEDIUM | | 7 | | CVE-2026-90240 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Flush context cache with correct SID when tearing down aliases |
| MEDIUM | | 5.5 | | CVE-2026-90247 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix mmap_lock leak in irq_work path |
| MEDIUM | | 5.9 | | CVE-2026-90256 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind |
| MEDIUM | | 5.5 | | CVE-2026-90259 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() |
| MEDIUM | | 4.7 | | CVE-2026-90260 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: don't clobber the extent buffer when zeroing it out |
| MEDIUM | | 3.3 | | CVE-2026-90263 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: check if root is readonly when setting posix acl |
| MEDIUM | | 5.5 | | CVE-2026-90264 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: always wait for ordered extents to avoid OE races |
| MEDIUM | | 5.5 | | CVE-2026-90265 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: defrag: fix deadlock between defrag and delalloc space reservation |
| MEDIUM | | 5.5 | | CVE-2026-90273 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable |
| MEDIUM | | 5.5 | | CVE-2026-90289 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Resize MST HDCP per-connector arrays to 32 |
| MEDIUM | | 5.5 | | CVE-2026-90300 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear buf on error in __bpf_get_task_stack |
| MEDIUM | | 5.5 | | CVE-2026-90301 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: o2hb: quiesce negotiate handlers and timeout work |
| MEDIUM | | 7 | | CVE-2026-90317 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Invalidate RCU pointers after final spin unlock |
| MEDIUM | | 5.5 | | CVE-2026-90320 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate external xattr entries when reading metadata |
| MEDIUM | | 5.5 | | CVE-2026-90321 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate inline xattrs during inode block validation |
| MEDIUM | | 5.5 | | CVE-2026-90324 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ublk: check import_ubuf() return value |
| MEDIUM | | 4.7 | | CVE-2026-90326 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-cgroup: fix race between policy activation and blkg destruction |
| MEDIUM | | 5.5 | | CVE-2026-90328 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: HID: steam: Reject short reads |
| MEDIUM | | 6.4 | | CVE-2026-90333 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dm-integrity: replace forgeable discard filler with a keyed sector marker |
| MEDIUM | | 4.1 | | CVE-2026-90336 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: clear freed pointers on uart_register_driver() failure |
| MEDIUM | | 5.5 | | CVE-2026-90337 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: do fallible allocations before the console can be registered |
| MEDIUM | | 7 | | CVE-2026-90343 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: stop PMSR before P2P and NAN teardown |
| MEDIUM | | 5.5 | | CVE-2026-90345 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: brcmfmac: fix P2P action frame handling without device vif |
| MEDIUM | | 7 | | CVE-2026-90347 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry |
| MEDIUM | | 5.5 | | CVE-2026-90351 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed |
| MEDIUM | | 4.4 | | CVE-2026-90359 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject >8 byte return values on return-reading trampoline paths |
| MEDIUM | | 5.5 | | CVE-2026-90363 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: don't tear down KMS twice when KMS init fails |
| MEDIUM | | 5.5 | | CVE-2026-90365 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: cancel reset and rc work on device unregister |
| MEDIUM | | 5.5 | | CVE-2026-90367 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER |
| MEDIUM | | 4.8 | | CVE-2026-90379 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash |
| MEDIUM | | 3.3 | | CVE-2026-90401 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md: remove REQ_NOWAIT support from raid1/10/456 |
| MEDIUM | | 5.5 | | CVE-2026-90408 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() |
| MEDIUM | | 5.5 | | CVE-2026-90409 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Add vm_bind region with kbo range overlap check |
| MEDIUM | | 4.7 | | CVE-2026-90417 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() |
| MEDIUM | | 5.5 | | CVE-2026-90421 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI: Fix UAF when probe runs concurrent to dyn ID removal |
| MEDIUM | | 5.5 | | CVE-2026-90422 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path |
| MEDIUM | | 4.7 | | CVE-2026-90427 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() |
| MEDIUM | | 5.5 | | CVE-2026-92480 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Validate string descriptors |
| MEDIUM | | 5.5 | | CVE-2026-92482 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip |
| MEDIUM | | 3.3 | | CVE-2026-92485 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix WARNING in bpf_tracing_link_release |
| MEDIUM | | 5.5 | | CVE-2026-92499 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext4: validate readdir offset before accessing dirent |
| MEDIUM | | 4.7 | | CVE-2026-92500 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext4: use fsdata to track inline data write state and fix race |
| MEDIUM | | 5.5 | | CVE-2026-92503 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() |
| MEDIUM | | 5.5 | | CVE-2026-92518 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv, bpf: Fix kernel stack corruption in tailcall with CFI |
| MEDIUM | | 5.5 | | CVE-2026-92520 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Zero queue and stack outputs on lock failure |
| MEDIUM | | 5.5 | | CVE-2026-93044 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for arena-related insns |
| MEDIUM | | 5.5 | | CVE-2026-93047 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Associate BOs with every job that accesses them |
| MEDIUM | | 5.5 | | CVE-2026-93058 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Only fini scheduler after successful init |
| MEDIUM | | 5.5 | | CVE-2026-93081 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_scmi: Fix SCMI device destroy lifetimes |
| MEDIUM | | 4.7 | | CVE-2026-93099 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Fix UAF from worker threads when domains are removed |
| MEDIUM | | 4.7 | | CVE-2026-93100 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() |
| MEDIUM | | 4.7 | | CVE-2026-93104 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rvt: Return NULL after port allocation failure |
| MEDIUM | | 7 | | CVE-2026-93105 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: esp: do not unref managed frag pages in esp_ssg_unref() |
| MEDIUM | | 5.5 | | CVE-2026-93122 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: usb: gadget: uac: validate rate list length before storing |
| MEDIUM | | 5.5 | | CVE-2026-93135 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject programs with inlined helpers if JIT is not available |
| MEDIUM | | 7 | | CVE-2026-93148 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject MEM_ALLOC BTF accesses past object bounds |
| MEDIUM | | 7 | | CVE-2026-93154 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Add refcounting to user ring MRs |
| MEDIUM | | 5.5 | | CVE-2026-93168 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout |
| MEDIUM | | 5.5 | | CVE-2026-93175 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in CRTC reset function |
| MEDIUM | | 4.7 | | CVE-2026-93176 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in plane reset function |
| MEDIUM | | 5.5 | | CVE-2026-93270 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn |
| MEDIUM | | 5.5 | | CVE-2026-93272 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 |
| MEDIUM | | 5.5 | | CVE-2026-93276 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator |
| MEDIUM | | 5.5 | | CVE-2026-93282 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix maximum allowed access checks |
| MEDIUM | | 7.1 | | CVE-2026-97422 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: fix SMI event cross-process information leak |
| MEDIUM | | 5.5 | | CVE-2026-97432 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: fix P2P-Device binding handling |
| MEDIUM | | 5.5 | | CVE-2026-97478 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virt: acrn: Fix irqfd use-after-free during eventfd shutdown |
| MEDIUM | | 7.1 | | CVE-2026-97493 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS |
| MEDIUM | | 5.5 | | CVE-2026-97499 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: perf: Retrieve path and source from event data |
| MEDIUM | | 5.5 | | CVE-2026-97513 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Release m2m_ctx after Instance Removed from List |
| MEDIUM | | 5.5 | | CVE-2026-97515 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 |
| MEDIUM | | 5.5 | | CVE-2026-97526 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/pai: Support CPU hotplug for PMU PAI |
| MEDIUM | | 5.5 | | CVE-2026-97538 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (asus_rog_ryujin) Validate HID report lengths |
| MEDIUM | | 5.5 | | CVE-2026-97554 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() |
| MEDIUM | | 7 | | CVE-2026-97561 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid |
| MEDIUM | | 7 | | CVE-2026-97563 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97565 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject short READ responses in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97960 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel: Prevent drain_pebs() reentry |
| MEDIUM | | 5.5 | | CVE-2026-97962 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Move representor vnic reporter to eswitch devlink port |
| MEDIUM | | 5.1 | | CVE-2026-97975 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() |
| MEDIUM | | 4.7 | | CVE-2026-97988 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vhost: invalidate vring access on IOTLB transitions |
| MEDIUM | | 5.5 | | CVE-2026-98019 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: mark a NULL call argument precise |
| MEDIUM | | 5.3 | | CVE-2026-98032 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tracing: Fix subbuf resize races with trace_pipe_raw readers |
| MEDIUM | | 7 | | CVE-2026-98033 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Preserve inner map identity in callback frames |
| MEDIUM | | 7 | | CVE-2026-98034 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark NULL kptr stores precise |
| MEDIUM | | 5.5 | | CVE-2026-98043 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Don't infer non-NULL from a pointer with an unbounded offset |
| MEDIUM | | 7 | | CVE-2026-98047 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check ancestor frames for rbtree callbacks |
| MEDIUM | | 7 | | CVE-2026-98048 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: don't rewrite bpf_fastcall patterns entered by a jump |
| MEDIUM | | 5.5 | | CVE-2026-98049 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: zero extend the result of an arena 32-bit cmpxchg |
| MEDIUM | | 5.5 | | CVE-2026-98053 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Refactor and fix init_config access |
| MEDIUM | | 5.5 | | CVE-2026-98062 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark signal tracepoint siginfo arguments as scalar |
| MEDIUM | | 5.5 | | CVE-2026-98085 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge |
| MEDIUM | | | | CVE-2026-98099 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 5.5 | | CVE-2026-98115 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely drain sessions during logoff |
| MEDIUM | | 5.5 | | CVE-2026-98118 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix readahead synchronisation issues by loading all folios upfront |
| MEDIUM | | 5.5 | | CVE-2026-98124 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/client: invalidate fscache for fallocate range operations |
| MEDIUM | | 5.5 | | CVE-2026-98125 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix stale page cache in insert/collapse range |
| MEDIUM | | 5.5 | | CVE-2026-98131 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix dma mapping leak in stmmac_tso_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-98134 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: check_cond_jmp_op(): properly infer if register is null |
| MEDIUM | | 5.3 | | CVE-2026-98156 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/virtio: use the DMA API for resource backing on Xen |
| MEDIUM | | 5.5 | | CVE-2026-98162 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/server: fix tree connection leak in smb2_tree_connect() |
| MEDIUM | | 5.5 | | CVE-2026-98180 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: RCU-free the scheduler-containing ring and VM objects |
| MEDIUM | | 5.5 | | CVE-2026-98228 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ |
| MEDIUM | | 4.4 | | CVE-2026-98273 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: x86/kprobes: Fix crash when probing CS CALL instructions |
| MEDIUM | | 5.5 | | CVE-2026-98277 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: ring the doorbell if a burst ends in a drop |
| MEDIUM | | 5.5 | | CVE-2026-98279 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: handle lack of space when cleaning up verity items |
| MEDIUM | | 5.3 | | CVE-2026-98284 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netlink: do not free nlk->groups while lockless readers can use it |
| MEDIUM | | 4.1 | | CVE-2026-98286 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown |
| MEDIUM | | 5.5 | | CVE-2026-98288 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix TSO header length truncation |
| MEDIUM | | 5.5 | | CVE-2026-98292 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| MEDIUM | | 5.5 | | CVE-2026-98294 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_qca: Do not write to the serial port after it is closed |
| MEDIUM | | 7 | | CVE-2026-98296 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btintel_pcie: validate TX skb length in send_sync |
| MEDIUM | | 5.5 | | CVE-2026-98313 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/dp: skip PUSH_IDLE when the link was never enabled |
| MEDIUM | | 7 | | CVE-2026-98330 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: get the wiphy out of a dying network namespace |
| MEDIUM | | 5.5 | | CVE-2026-98333 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: reset the LED state when ifup fails |
| MEDIUM | | 7 | | CVE-2026-98341 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: don't free driver-owned scan requests |
| MEDIUM | | 5.5 | | CVE-2026-98353 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables |
| MEDIUM | | 5.5 | | CVE-2026-98355 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rtrs: guard against null kobj name |
| MEDIUM | | 5.5 | | CVE-2026-98376 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Use array_map_meta_equal for percpu array inner map replacement |
| MEDIUM | | 5.5 | | CVE-2026-98408 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: watchdog: rzv2h: Avoid division by zero |
| MEDIUM | | 5.5 | | CVE-2026-98420 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: follow SMB2 session expiration semantics |
| MEDIUM | | | | CVE-2026-98436 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: a ... |
| MEDIUM | | 6.5 | | CVE-2026-98439 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/server: cancel async requests when closing connection |
| MEDIUM | | 4.7 | | CVE-2026-98444 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: drop dquot flush lock when we can't find a buffer to flush |
| MEDIUM | | 6.5 | | CVE-2026-98449 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: delete compound mids on send failure before unlock |
| MEDIUM | | 5.3 | | CVE-2026-98471 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Do cache maintenance on the source VM during intra-host migration |
| MEDIUM | | 5.5 | | CVE-2026-98556 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gve: DQO: reject TSO packets with an out of range MSS |
| MEDIUM | | 4.1 | | CVE-2026-98558 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: flush skb_defer_nodes in dev_cpu_dead() |
| MEDIUM | | 5.9 | | CVE-2026-98570 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: ipv6: keep room for the mac header in dst_dev_overhead() |
| MEDIUM | | 6.7 | | CVE-2026-98589 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject pkt arguments in mutating subprogs |
| MEDIUM | | 4.7 | | CVE-2026-98598 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv6: Prevent rt6_insert_exception() for dying fib6_info |
| MEDIUM | | 6.7 | | CVE-2026-98599 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() |
| MEDIUM | | 4.1 | | CVE-2026-98616 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: reset num_napi when the napi vectors are freed |
| MEDIUM | | 5.5 | | CVE-2026-98652 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Add missing srcu in kvm_s390_set_irq_state() |
| MEDIUM | | 5.5 | | CVE-2026-98674 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iio: adc: adi-axi-adc: Initialize state mutex |
| MEDIUM | | 5.6 | | CVE-2026-98714 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| MEDIUM | | 4.1 | | CVE-2026-98740 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety |
| MEDIUM | | 4.4 | | CVE-2026-98747 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix NULL pointer dereference in serial_core_unregister_port() |
| MEDIUM | | 4.7 | | CVE-2026-98786 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: guard dc_sink dereferences in MST mode validation |
| MEDIUM | | 4.4 | | CVE-2026-98789 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix objects stuck in free_by_rcu_ttrace |
| MEDIUM | | 4.4 | | CVE-2026-98795 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: skip ptp deinit if init was skipped |
| MEDIUM | | 4.4 | | CVE-2026-98799 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Skip detached progs in trampoline images that are still in use |
| MEDIUM | | 4.7 | | CVE-2026-98800 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: kernel: Denial of Service via use-after-free in BPF trampoline |
| MEDIUM | | 6.5 | | CVE-2026-98803 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix rx Scatter-Gather support |
| MEDIUM | | 6.1 | | CVE-2026-98810 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() |
| MEDIUM | | 4.4 | | CVE-2026-98813 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Hold map BTF for the memory allocator destructor record |
| MEDIUM | | 4.4 | | CVE-2026-98814 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix command effects log lifetime for multipath heads |
| MEDIUM | | 4.1 | | CVE-2026-98815 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix cdev lifetime |
| MEDIUM | | 4.1 | | CVE-2026-98816 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix overflow of jump offset in constant blinding |
| MEDIUM | | 5.5 | | CVE-2026-98820 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: set RQF_USE_SCHED when the operation is known |
| MEDIUM | | 5.3 | | CVE-2026-98824 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate TX status rate metadata |
| MEDIUM | | 6.5 | | CVE-2026-98829 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: drop oversized fragments to avoid extra_len overflow |
| MEDIUM | | 4.1 | | CVE-2026-98834 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mtd: core: avoid double-free of OTP NVMEM device |
| MEDIUM | | 6.1 | | CVE-2026-98839 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() |
| MEDIUM | | 4.4 | | CVE-2026-98843 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: zero gaps in read-gaps folio to avoid writing back stale data |
| MEDIUM | | 5.6 | | CVE-2026-98863 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| MEDIUM | | 4.6 | | CVE-2019-15213 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: use-after-free caused by malicious USB device in drivers/media/usb/dvb-usb/dvb-usb-init.c |
| MEDIUM | | 4.1 | | CVE-2019-16089 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Improper return check in nbd_genl_status function in drivers/block/nbd.c |
| MEDIUM | | 4.7 | | CVE-2019-20794 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: task processes not being properly ended could lead to resource exhaustion |
| MEDIUM | | 4.4 | | CVE-2020-14304 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ethtool when reading eeprom of device could lead to memory leak |
| MEDIUM | | 6.7 | | CVE-2020-36694 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: use-after-free in the packet processing context |
| MEDIUM | | 5.5 | | CVE-2023-31082 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sleeping function called from an invalid context in gsmld_write |
| MEDIUM | | 7 | | CVE-2023-3397 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: slab-use-after-free Write in txEnd due to race condition |
| MEDIUM | | 5.5 | | CVE-2023-37454 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: udf: use-after-free write in udf_close_lvid |
| MEDIUM | | 6.7 | | CVE-2023-6238 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvme: memory corruption via unprivileged user passthrough |
| MEDIUM | | 6.5 | | CVE-2023-6240 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation |
| MEDIUM | | 5.5 | | CVE-2024-2193 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | hw: Spectre-SRC that is Speculative Race Conditions (SRCs) for synchronization primitives similar like Spectre V1 with p |
| MEDIUM | | 4.7 | | CVE-2024-24864 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | A race condition was found in the Linux kernel's media/dvb-core in dvb ... |
| MEDIUM | | 5.5 | | CVE-2024-25740 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory leak in ubi driver |
| MEDIUM | | 5.5 | | CVE-2024-56709 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring: check if iowq is killed before queuing |
| MEDIUM | | 5.5 | | CVE-2024-58074 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/i915: Grab intel_display from the encoder to avoid potential oopsies |
| MEDIUM | | 5.5 | | CVE-2025-21752 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents |
| MEDIUM | | 5.5 | | CVE-2025-21949 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Set hugetlb mmap base address aligned with pmd size |
| MEDIUM | | 5.5 | | CVE-2025-22109 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ax25: Remove broken autobind |
| MEDIUM | | 5.5 | | CVE-2025-23132 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: quota: fix to avoid warning in dquot_writeback_dquots() |
| MEDIUM | | 5.5 | | CVE-2025-23135 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Teardown riscv specific bits after kvm_exit |
| MEDIUM | | 5.5 | | CVE-2025-37743 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Avoid memory leak while enabling statistics |
| MEDIUM | | 5.5 | | CVE-2025-37746 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/dwc_pcie: fix duplicate pci_dev devices |
| MEDIUM | | 5.5 | | CVE-2025-37880 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: um: work around sched_yield not yielding in time-travel mode |
| MEDIUM | | 4.7 | | CVE-2025-37906 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: ublk race condition causes kernel crash |
| MEDIUM | | 5.5 | | CVE-2025-38029 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to sleepable page allocation in KASAN |
| MEDIUM | | 5.5 | | CVE-2025-38036 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to null pointer dereference in GT MMIO initialization for VFs |
| MEDIUM | | 5.5 | | CVE-2025-38041 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clk: sunxi-ng: h616: Reparent GPU clock during frequency changes |
| MEDIUM | | 5.5 | | CVE-2025-38042 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn |
| MEDIUM | | 6.7 | | CVE-2025-38064 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio: break and reset virtio devices on device_shutdown() |
| MEDIUM | | 5.5 | | CVE-2025-38132 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: holding cscfg_csdev_lock while removing cscfg from csdev |
| MEDIUM | | 5.5 | | CVE-2025-38140 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Local denial of service in device mapper |
| MEDIUM | | 5.5 | | CVE-2025-38199 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix memory leak due to multiple rx_stats allocation |
| MEDIUM | | 5.5 | | CVE-2025-38207 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm: fix uprobe pte be overwritten when expanding vma |
| MEDIUM | | 5.5 | | CVE-2025-38261 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv: save the SR_SUM status over switches |
| MEDIUM | | 5.5 | | CVE-2025-38284 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: configure manual DAC mode via PCI config API only |
| MEDIUM | | 5.5 | | CVE-2025-38311 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel (iavf): Denial of Service due to a locking issue |
| MEDIUM | | 5.5 | | CVE-2025-38359 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Fix in_atomic() handling in do_secure_storage_access() |
| MEDIUM | | 5.5 | | CVE-2025-38597 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port |
| MEDIUM | | 5.5 | | CVE-2025-38605 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() |
| MEDIUM | | 5.5 | | CVE-2025-39677 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Fix backlog accounting in qdisc_dequeue_internal |
| MEDIUM | | 5.5 | | CVE-2025-39762 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: add null check |
| MEDIUM | | 5.5 | | CVE-2025-39775 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: mremap local denial of service |
| MEDIUM | | 5.5 | | CVE-2025-39789 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: crypto: x86/aegis - Add missing error checks |
| MEDIUM | | 6.1 | | CVE-2025-39822 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/kbuf: fix signedness in this_len calculation |
| MEDIUM | | 5.5 | | CVE-2025-39830 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path |
| MEDIUM | | 5.5 | | CVE-2025-39834 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow |
| MEDIUM | | 6.2 | | CVE-2025-39910 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() |
| MEDIUM | | 7.1 | | CVE-2025-39933 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length |
| MEDIUM | | 2.5 | | CVE-2025-40113 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E |
| MEDIUM | | 6.8 | | CVE-2025-40130 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling |
| MEDIUM | | 6.2 | | CVE-2025-40146 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: fix potential deadlock while nr_requests grown |
| MEDIUM | | 5.2 | | CVE-2025-40217 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pidfs: validate extensible ioctls |
| MEDIUM | | | | CVE-2025-40247 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Fix pgtable prealloc error path |
| MEDIUM | | 5.2 | | CVE-2025-40338 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Do not share the name pointer between components |
| MEDIUM | | 6.1 | | CVE-2025-40355 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sysfs: check visibility before changing group attribute ownership |
| MEDIUM | | 5.5 | | CVE-2025-68209 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mlx5: Fix default values in create CQ |
| MEDIUM | | 5.5 | | CVE-2025-68236 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service during UFS power down |
| MEDIUM | | 5.5 | | CVE-2025-68304 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_core: lookup hci_conn on RX path on protocol side |
| MEDIUM | | | | CVE-2025-68318 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL |
| MEDIUM | | 6.1 | | CVE-2025-68319 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netconsole: Acquire su_mutex before navigating configs hierarchy |
| MEDIUM | | 5.5 | | CVE-2025-68353 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service via NULL pointer dereference in VXLAN module |
| MEDIUM | | 4.5 | | CVE-2025-68360 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks |
| MEDIUM | | 5.5 | | CVE-2025-68368 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service in md driver via uninitialized bioset |
| MEDIUM | | 6.5 | | CVE-2025-68729 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix MSDU buffer types handling in RX error path |
| MEDIUM | | 5.5 | | CVE-2025-68730 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() |
| MEDIUM | | 4.7 | | CVE-2025-68745 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset |
| MEDIUM | | 7.8 | | CVE-2025-71074 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel functionfs: Use-After-Free vulnerability due to open/removal races |
| MEDIUM | | 5.5 | | CVE-2025-71117 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service via deadlock in block layer sysfs store callbacks |
| MEDIUM | | 5.5 | | CVE-2025-71141 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/tilcdc: Fix removal actions in case of failed probe |
| MEDIUM | | 5.5 | | CVE-2025-71188 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: lpc18xx-dmamux: fix device leak on route allocation |
| MEDIUM | | 6.5 | | CVE-2025-71202 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Memory Corruption and Kernel Crashes via IOMMU SVA coherency issue |
| MEDIUM | | 5.5 | | CVE-2025-71227 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: don't WARN for connections on invalid channels |
| MEDIUM | | 5.5 | | CVE-2025-71285 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels |
| MEDIUM | | 5.5 | | CVE-2025-71302 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: fix for dma-fence safe access rules |
| MEDIUM | | 7 | | CVE-2025-71313 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI: endpoint: Add missing NULL check for alloc_workqueue() |
| MEDIUM | | 5.5 | | CVE-2025-71315 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/vkms: Convert to DRM's vblank timer |
| MEDIUM | | 5.5 | | CVE-2026-100074 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| MEDIUM | | 5.5 | | CVE-2026-100076 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths |
| MEDIUM | | 5.5 | | CVE-2026-100077 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Recover HW before retire hung submit |
| MEDIUM | | 5.5 | | CVE-2026-23007 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: block: zero non-PI portion of auto integrity buffer |
| MEDIUM | | 5.5 | | CVE-2026-23017 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: idpf: fix error handling in the init_task on load |
| MEDIUM | | 5.5 | | CVE-2026-23143 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix misalignment bug in struct virtnet_info |
| MEDIUM | | 7.1 | | CVE-2026-23152 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: correctly decode TTLM with default link map |
| MEDIUM | | 5.5 | | CVE-2026-23217 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv: trace: fix snapshot deadlock with sbi ecall |
| MEDIUM | | 5.5 | | CVE-2026-23259 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/rw: free potentially allocated iovec on cache put failure |
| MEDIUM | | 5.5 | | CVE-2026-23265 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer in {read,write}_end_io |
| MEDIUM | | 5.5 | | CVE-2026-23348 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix race of nvdimm_bus object when creating nvdimm objects |
| MEDIUM | | 5.5 | | CVE-2026-23371 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting |
| MEDIUM | | 5.5 | | CVE-2026-23377 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz |
| MEDIUM | | 5.5 | | CVE-2026-23385 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: clone set on flush only |
| MEDIUM | | 5.5 | | CVE-2026-23472 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN |
| MEDIUM | | 5.5 | | CVE-2026-31435 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix read abandonment during retry |
| MEDIUM | | 5.5 | | CVE-2026-31526 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix exception exit lock checking for subprogs |
| MEDIUM | | 5.5 | | CVE-2026-31537 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: server: make use of smbdirect_socket.send_io.bcredits |
| MEDIUM | | 5.5 | | CVE-2026-31562 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register |
| MEDIUM | | 5.5 | | CVE-2026-31579 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit |
| MEDIUM | | 5.5 | | CVE-2026-31591 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish |
| MEDIUM | | 5.5 | | CVE-2026-31592 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock |
| MEDIUM | | 5.5 | | CVE-2026-31630 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rxrpc: proc: size address buffers for %pISpc output |
| MEDIUM | | 7.1 | | CVE-2026-31692 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns |
| MEDIUM | | 5.5 | | CVE-2026-31771 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_event: move wake reason storage into validated event handlers |
| MEDIUM | | 5.5 | | CVE-2026-31777 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: ctxfi: Check the error for index mapping |
| MEDIUM | | 5.5 | | CVE-2026-43009 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix incorrect pruning due to atomic fetch precision tracking |
| MEDIUM | | 5.5 | | CVE-2026-43022 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists |
| MEDIUM | | 5.5 | | CVE-2026-43029 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mptcp: fix soft lockup in mptcp_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-43034 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: set backing store type from query type |
| MEDIUM | | 7.1 | | CVE-2026-43042 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mpls: add seqcount to protect the platform_label{,s} pair |
| MEDIUM | | 5.5 | | CVE-2026-43048 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: HID: core: Mitigate potential OOB by removing bogus memset() |
| MEDIUM | | 5.5 | | CVE-2026-43053 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: close crash window in attr dabtree inactivation |
| MEDIUM | | 5.5 | | CVE-2026-43083 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: ioam6: fix OOB and missing lock |
| MEDIUM | | 5.5 | | CVE-2026-43101 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() |
| MEDIUM | | 5.5 | | CVE-2026-43115 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: srcu: Use irq_work to start GP in tiny SRCU |
| MEDIUM | | 5.5 | | CVE-2026-43118 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix zero size inode with non-zero size after log replay |
| MEDIUM | | 5.5 | | CVE-2026-43127 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs3: fix circular locking dependency in run_unpack_ex |
| MEDIUM | | 5.5 | | CVE-2026-43172 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: fix 22000 series SMEM parsing |
| MEDIUM | | 5.5 | | CVE-2026-43191 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 |
| MEDIUM | | 5.5 | | CVE-2026-43204 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: qcom: q6asm: drop DSP responses for closed data streams |
| MEDIUM | | 5.5 | | CVE-2026-43213 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: validate sequence number of TX release report |
| MEDIUM | | 5.5 | | CVE-2026-43234 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: team: avoid NETDEV_CHANGEMTU event when unregistering slave |
| MEDIUM | | 5.5 | | CVE-2026-43272 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ring-buffer: Fix possible dereference of uninitialized pointer |
| MEDIUM | | 5.5 | | CVE-2026-43294 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels |
| MEDIUM | | 5.5 | | CVE-2026-43298 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Skip vcn poison irq release on VF |
| MEDIUM | | 5.5 | | CVE-2026-43299 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() |
| MEDIUM | | 5.5 | | CVE-2026-43301 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix PM runtime usage count underflow |
| MEDIUM | | 5.5 | | CVE-2026-43308 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() |
| MEDIUM | | 5.5 | | CVE-2026-43309 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md raid: fix hang when stopping arrays with metadata through dm-raid |
| MEDIUM | | 5.5 | | CVE-2026-43310 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC |
| MEDIUM | | 5.5 | | CVE-2026-43311 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soc/tegra: pmc: Fix unsafe generic_handle_irq() call |
| MEDIUM | | 5.5 | | CVE-2026-43325 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: don't send a 6E related command when not supported |
| MEDIUM | | 5.5 | | CVE-2026-43326 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback |
| MEDIUM | | 5.5 | | CVE-2026-43337 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() |
| MEDIUM | | 5.5 | | CVE-2026-43346 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ice: ptp: don't WARN when controlling PF is unavailable |
| MEDIUM | | 5.5 | | CVE-2026-43352 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue |
| MEDIUM | | 5.5 | | CVE-2026-43353 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue |
| MEDIUM | | 7.1 | | CVE-2026-43414 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Completely fix fcport double free |
| MEDIUM | | 5.5 | | CVE-2026-43416 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: powerpc, perf: Check that current->mm is alive before getting user callchain |
| MEDIUM | | 5.5 | | CVE-2026-43443 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: amd: acp-mach-common: Add missing error check for clock acquisition |
| MEDIUM | | 5.5 | | CVE-2026-43463 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() |
| MEDIUM | | 5.5 | | CVE-2026-43464 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ |
| MEDIUM | | 5.5 | | CVE-2026-43465 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ |
| MEDIUM | | 5.5 | | CVE-2026-43485 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nouveau/gsp: drop WARN_ON in ACPI probes |
| MEDIUM | | 6.4 | | CVE-2026-45932 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix tcx/netkit detach permissions when prog fd isn't given |
| MEDIUM | | 7 | | CVE-2026-45934 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation |
| MEDIUM | | 5.5 | | CVE-2026-45940 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix oops when split header is enabled |
| MEDIUM | | 5.5 | | CVE-2026-45961 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gfs2: fix memory leaks in gfs2_fill_super error path |
| MEDIUM | | 5.5 | | CVE-2026-46014 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Add missing save/restore handling of LBR MSRs |
| MEDIUM | | 7 | | CVE-2026-46017 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm: fix deferred split queue races during migration |
| MEDIUM | | 7 | | CVE-2026-46032 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT |
| MEDIUM | | 5.5 | | CVE-2026-46044 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipmi:ssif: Clean up kthread on errors |
| MEDIUM | | 5.5 | | CVE-2026-46059 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN |
| MEDIUM | | 5.5 | | CVE-2026-46066 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix num_ops off-by-one when crypto allocation fails |
| MEDIUM | | 5.5 | | CVE-2026-46071 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 |
| MEDIUM | | 5.5 | | CVE-2026-46096 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() |
| MEDIUM | | 5.5 | | CVE-2026-46147 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() |
| MEDIUM | | 5.5 | | CVE-2026-46148 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: spi: microchip-core-qspi: control built-in cs manually |
| MEDIUM | | 5.5 | | CVE-2026-46153 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: 8021q: delete cleared egress QoS mappings |
| MEDIUM | | 5.5 | | CVE-2026-46171 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv: kvm: fix vector context allocation leak |
| MEDIUM | | 5.5 | | CVE-2026-46228 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: spi: ch341: fix devres lifetime |
| MEDIUM | | 5.5 | | CVE-2026-46245 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dc_link NULL handling in HPD init |
| MEDIUM | | 5.5 | | CVE-2026-46256 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages |
| MEDIUM | | 4.7 | | CVE-2026-46272 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: tmc-etr: Fix race condition between sysfs and perf mode |
| MEDIUM | | 5.5 | | CVE-2026-46302 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: selinux: allow multiple opens of /sys/fs/selinux/policy |
| MEDIUM | | 5.5 | | CVE-2026-46314 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Reject empty multisync extension to prevent infinite loop |
| MEDIUM | | 7 | | CVE-2026-46317 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock |
| MEDIUM | | 7 | | CVE-2026-46324 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: netfilter nf_tables denial of service via race condition in netlink hook unregistration |
| MEDIUM | | 7 | | CVE-2026-46325 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE |
| MEDIUM | | 7 | | CVE-2026-46330 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Revert "net/smc: Introduce TCP ULP support" |
| MEDIUM | | 5.5 | | CVE-2026-52937 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR |
| MEDIUM | | 7 | | CVE-2026-52953 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Fix oops due to out of scope access |
| MEDIUM | | 7 | | CVE-2026-52956 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() |
| MEDIUM | | 5.5 | | CVE-2026-52994 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting |
| MEDIUM | | 7 | | CVE-2026-53009 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ice: fix double-free of tx_buf skb |
| MEDIUM | | 5.5 | | CVE-2026-53017 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix data loss caused by incorrect use of nat_entry flag |
| MEDIUM | | 5.5 | | CVE-2026-53018 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: avoid reading already updated pages during GC |
| MEDIUM | | 5.5 | | CVE-2026-53103 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync |
| MEDIUM | | 5.5 | | CVE-2026-53104 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: Fix memory leak destroying device |
| MEDIUM | | 5.5 | | CVE-2026-53106 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Do not allow deleting local storage in NMI |
| MEDIUM | | 5.5 | | CVE-2026-53107 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: libertas: don't kill URBs in interrupt context |
| MEDIUM | | 5.5 | | CVE-2026-53108 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: powerpc/64s: Fix unmap race with PMD migration entries |
| MEDIUM | | | | CVE-2026-53178 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction |
| MEDIUM | | 7 | | CVE-2026-53224 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate embedded INIT chunk and address list lengths in cookie |
| MEDIUM | | 7 | | CVE-2026-53246 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing |
| MEDIUM | | 5.5 | | CVE-2026-53258 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: fix leak if split 6 GHz scanning fails |
| MEDIUM | | 5.5 | | CVE-2026-53281 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption |
| MEDIUM | | 5.5 | | CVE-2026-53285 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED |
| MEDIUM | | 5.5 | | CVE-2026-53292 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind |
| MEDIUM | | 5.5 | | CVE-2026-53297 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: mana: Guard mana_remove against double invocation |
| MEDIUM | | 5.5 | | CVE-2026-53321 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/napi: cap busy_poll_to 10 msec |
| MEDIUM | | 5.5 | | CVE-2026-53377 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: always recover the gpu |
| MEDIUM | | | | CVE-2026-53401 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: omap2: fix use-after-free in omapfb_mmap |
| MEDIUM | | | | CVE-2026-63805 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: crypto: nx - fix nx_crypto_ctx_exit argument |
| MEDIUM | | | | CVE-2026-63811 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: read COW data with the original inode during atomic write |
| MEDIUM | | | | CVE-2026-63819 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on f2fs_get_node_folio_ra() |
| MEDIUM | | 5.5 | | CVE-2026-63832 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: add wcid publish check in mt76_sta_add |
| MEDIUM | | 5.5 | | CVE-2026-63853 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring |
| MEDIUM | | | | CVE-2026-63857 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-63858 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: add hook transactions for device deletions |
| MEDIUM | | | | CVE-2026-63859 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue() |
| MEDIUM | | 7 | | CVE-2026-63941 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor |
| MEDIUM | | 7 | | CVE-2026-63979 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/handshake: hand off the pinned file reference to accept_doit |
| MEDIUM | | 5.5 | | CVE-2026-63998 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ethtool: module: call ethnl_ops_complete() on module flash errors |
| MEDIUM | | 5.5 | | CVE-2026-63999 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure |
| MEDIUM | | 5.5 | | CVE-2026-64006 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: fix dst corruption in same register operation |
| MEDIUM | | 7 | | CVE-2026-64024 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction |
| MEDIUM | | 5.5 | | CVE-2026-64036 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cgroup/rstat: validate cpu before css_rstat_cpu() access |
| MEDIUM | | 5.5 | | CVE-2026-64038 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Stop work before releasing hwmon device |
| MEDIUM | | 5.5 | | CVE-2026-64060 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix leak of request in netfs_write_begin() error handling |
| MEDIUM | | 7.1 | | CVE-2026-64066 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_read_to_pagecache() to pause on subreq failure |
| MEDIUM | | 5.5 | | CVE-2026-64067 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing barriers when accessing stream->subrequests locklessly |
| MEDIUM | | 7 | | CVE-2026-64068 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing locking around retry adding new subreqs |
| MEDIUM | | 5.5 | | CVE-2026-64076 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: bridge: eb_tables: close module init race |
| MEDIUM | | 5.5 | | CVE-2026-64077 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: ebtables: move to two-stage removal scheme |
| MEDIUM | | 7.1 | | CVE-2026-64078 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: add and use xtables_unregister_table_exit |
| MEDIUM | | 5.5 | | CVE-2026-64079 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: allocate hook ops while under mutex |
| MEDIUM | | 7 | | CVE-2026-64117 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb |
| MEDIUM | | 5.5 | | CVE-2026-64146 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix metabuf leak in inode xattr initialization |
| MEDIUM | | 5.5 | | CVE-2026-64154 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() |
| MEDIUM | | 5.5 | | CVE-2026-64159 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix zeropoint update where i_size > remote_i_size |
| MEDIUM | | 7 | | CVE-2026-64160 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point |
| MEDIUM | | 5.5 | | CVE-2026-64190 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: team: fix NULL pointer dereference in team_xmit during mode change |
| MEDIUM | | 5.5 | | CVE-2026-64212 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it |
| MEDIUM | | 5.5 | | CVE-2026-64213 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Add lock protection to lm90_alert |
| MEDIUM | | 7 | | CVE-2026-64255 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers |
| MEDIUM | | 7 | | CVE-2026-64520 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies |
| MEDIUM | | 7 | | CVE-2026-68086 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/khugepaged: write all dirty file folios when collapsing |
| MEDIUM | | 5.5 | | CVE-2026-68211 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: stm32-dcmipp: Return queued buffers on start_streaming() failure |
| MEDIUM | | 5.5 | | CVE-2026-68233 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/vc4: Shut down BO cache timer before teardown |
| MEDIUM | | 5.5 | | CVE-2026-68242 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/gt: Fix NULL deref on sched_engine alloc failure |
| MEDIUM | | 5.5 | | CVE-2026-68258 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size |
| MEDIUM | | 5.5 | | CVE-2026-68291 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: idpf driver null pointer dereference leads to Denial of Service |
| MEDIUM | | 5.5 | | CVE-2026-68295 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: BPF: Zero-extend signed ALU32 div/mod results |
| MEDIUM | | 5.5 | | CVE-2026-68312 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths |
| MEDIUM | | 7 | | CVE-2026-68323 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tipc: serialize udp bearer replicast list updates |
| MEDIUM | | 5.5 | | CVE-2026-68382 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Hold device ref until queue teardown completes |
| MEDIUM | | 5.5 | | CVE-2026-68383 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Keep scheduler timeline name alive |
| MEDIUM | | 7 | | CVE-2026-68393 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: extend conn_hash lookup critical sections |
| MEDIUM | | 6.4 | | CVE-2026-68399 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix UAF in sock clone early bailouts |
| MEDIUM | | 7 | | CVE-2026-68400 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation |
| MEDIUM | | 7 | | CVE-2026-68401 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() |
| MEDIUM | | 7 | | CVE-2026-68404 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect |
| MEDIUM | | 5.5 | | CVE-2026-68421 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() |
| MEDIUM | | 5.5 | | CVE-2026-68435 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Fix address space mismatch in kexec command line lookup |
| MEDIUM | | 5.5 | | CVE-2026-68441 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains |
| MEDIUM | | 5.5 | | CVE-2026-68447 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size |
| MEDIUM | | 7 | | CVE-2026-68448 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ovl: check access to copy_file_range source with src mounter creds |
| MEDIUM | | 7 | | CVE-2026-68453 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey |
| MEDIUM | | 5.5 | | CVE-2026-68471 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ieee80211: validate MLE common info length |
| MEDIUM | | 5.5 | | CVE-2026-72073 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mmc: vub300: fix use-after-free on probe failure |
| MEDIUM | | 5.5 | | CVE-2026-72162 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec |
| MEDIUM | | 7 | | CVE-2026-72288 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling |
| MEDIUM | | 7 | | CVE-2026-72329 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/liquidio: drop cached VF pci_dev LUT |
| MEDIUM | | 5.5 | | CVE-2026-72337 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: 6lowpan: avoid untracked enable work |
| MEDIUM | | 5.5 | | CVE-2026-72341 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Fix publication race for priv->channel_stats[] |
| MEDIUM | | 5.5 | | CVE-2026-72355 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix barriering when walking subrequest list |
| MEDIUM | | 5.5 | | CVE-2026-72365 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix writethrough to use collection offload |
| MEDIUM | | 5.5 | | CVE-2026-72367 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iomap: guard io_size EOF trim against concurrent truncate underflow |
| MEDIUM | | 5.5 | | CVE-2026-72375 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix reinitialisation of the inode, in particular ->lock_work |
| MEDIUM | | 5.5 | | CVE-2026-72380 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xen/pvcalls: bound backend response req_id before indexing rsp[] |
| MEDIUM | | 5.5 | | CVE-2026-72383 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: fix addr_wq_timer race in sctp_free_addr_wq() |
| MEDIUM | | 5.5 | | CVE-2026-72388 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock |
| MEDIUM | | 5.5 | | CVE-2026-72397 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() |
| MEDIUM | | 7 | | CVE-2026-72398 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: add INIT verification after cookie unpacking |
| MEDIUM | | 5.5 | | CVE-2026-72404 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() |
| MEDIUM | | 5.5 | | CVE-2026-72423 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Guard conntrack opts error writes |
| MEDIUM | | 5.5 | | CVE-2026-72440 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1: fix writes_pending and barrier reference leaks on write failures |
| MEDIUM | | 5.5 | | CVE-2026-72454 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() |
| MEDIUM | | 5.5 | | CVE-2026-72488 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soundwire: fix bug in sdw_add_element_group_count found by syzkaller |
| MEDIUM | | 5.5 | | CVE-2026-72493 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: serialize netif_running() check in enqueue_to_backlog() |
| MEDIUM | | 5.5 | | CVE-2026-72495 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages |
| MEDIUM | | 7 | | CVE-2026-72499 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free CQ toggle page after firmware teardown |
| MEDIUM | | 7 | | CVE-2026-72500 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown |
| MEDIUM | | | | CVE-2026-72501 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: R ... |
| MEDIUM | | 5.5 | | CVE-2026-74257 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sockmap: Fix use-after-free in udp_bpf_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-74264 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: watchdog: fix refcount tracking races |
| MEDIUM | | 5.5 | | CVE-2026-74272 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Resolve region deletion races |
| MEDIUM | | 5.5 | | CVE-2026-74273 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Block region delete during region creation |
| MEDIUM | | 5.5 | | CVE-2026-74314 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Cancel special fields on map value recycle |
| MEDIUM | | 5.5 | | CVE-2026-74317 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ixgbe: do not configure xps for XDP queues |
| MEDIUM | | 5.5 | | CVE-2026-74324 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: validate skb length in testmode query |
| MEDIUM | | 5.5 | | CVE-2026-74337 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks |
| MEDIUM | | 5.5 | | CVE-2026-74342 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: kernfs: link kn to its parent before the LSM init hook |
| MEDIUM | | 5.5 | | CVE-2026-74344 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear rb node linkage when freeing bpf_rb_root |
| MEDIUM | | 5.5 | | CVE-2026-74350 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate fast symlink target during inode read |
| MEDIUM | | 5.5 | | CVE-2026-74354 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Take mmap_lock in zap_pages() |
| MEDIUM | | 5.5 | | CVE-2026-74368 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() |
| MEDIUM | | 6.5 | | CVE-2026-74385 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock |
| MEDIUM | | 5.5 | | CVE-2026-74388 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data |
| MEDIUM | | 7 | | CVE-2026-74405 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: OPP: Fix race between OPP addition and lookup |
| MEDIUM | | 5.5 | | CVE-2026-74407 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath11k: cancel SSR work items during PCI shutdown |
| MEDIUM | | 5.5 | | CVE-2026-74449 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport |
| MEDIUM | | 5.5 | | CVE-2026-74466 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Close speculative mem read possibility |
| MEDIUM | | 7 | | CVE-2026-74506 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix UAF when sending a message |
| MEDIUM | | 7 | | CVE-2026-74513 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister |
| MEDIUM | | 5.5 | | CVE-2026-74527 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-af: Block VFs from clobbering special CGX PKIND state |
| MEDIUM | | 5.5 | | CVE-2026-74529 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback |
| MEDIUM | | 5.5 | | CVE-2026-74530 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback |
| MEDIUM | | 7 | | CVE-2026-74533 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero |
| MEDIUM | | 7 | | CVE-2026-74537 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: hold sk properly in iso_conn_ready |
| MEDIUM | | 5.5 | | CVE-2026-74538 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: lock sk in iso_connect_ind |
| MEDIUM | | 5.5 | | CVE-2026-74542 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix folio_queue ENOMEM in writeback by adding a mempool |
| MEDIUM | | 5.5 | | CVE-2026-74544 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds |
| MEDIUM | | 5.5 | | CVE-2026-74600 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/page_table_check: skip special zero mappings |
| MEDIUM | | 5.5 | | CVE-2026-74605 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: eventfs: Use children field for rcu head and add memory barriers |
| MEDIUM | | 7 | | CVE-2026-74611 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tls: rx: restore msg_iter before TLS 1.3 optimistic retry |
| MEDIUM | | 5.5 | | CVE-2026-74638 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Serialize the scheduler timeout handlers |
| MEDIUM | | 5.5 | | CVE-2026-74687 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: watchdog: at91sam9_wdt: prevent timer rearm during teardown |
| MEDIUM | | 7 | | CVE-2026-74695 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() |
| MEDIUM | | 7 | | CVE-2026-74697 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Disable EOP for TPA on all chips to prevent data corruption |
| MEDIUM | | 5.5 | | CVE-2026-74711 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus) Fix type confusion in notification logic |
| MEDIUM | | 5.5 | | CVE-2026-74713 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vhost_iotlb: bound map allocation in add_range |
| MEDIUM | | 7 | | CVE-2026-74715 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix netns reference imbalance in conntrack kfuncs |
| MEDIUM | | 5.5 | | CVE-2026-74723 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject inline extents without valid headers |
| MEDIUM | | 5.5 | | CVE-2026-74729 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read |
| MEDIUM | | 5.5 | | CVE-2026-74747 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipvs: revalidate ihl to prevent out-of-bounds access |
| MEDIUM | | 5.5 | | CVE-2026-80579 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: clear fb_info->mode before deleting a videomode |
| MEDIUM | | 5.5 | | CVE-2026-80580 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: bound mode sysfs output to the sysfs buffer |
| MEDIUM | | 5.5 | | CVE-2026-80614 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: emac: Fix NULL pointer dereference in emac_probe |
| MEDIUM | | 5.5 | | CVE-2026-80623 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: ete: Always save state on power down |
| MEDIUM | | 5.5 | | CVE-2026-80628 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Serialize readq reset state with q->lock |
| MEDIUM | | 5.5 | | CVE-2026-80631 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject compressed segment that overflows the compressed input |
| MEDIUM | | 5.5 | | CVE-2026-80634 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag |
| MEDIUM | | 5.5 | | CVE-2026-80655 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soc: xilinx: Fix race condition in event registration |
| MEDIUM | | 5.5 | | CVE-2026-80662 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size |
| MEDIUM | | 7 | | CVE-2026-80668 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations |
| MEDIUM | | 5.5 | | CVE-2026-80670 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() |
| MEDIUM | | 5.5 | | CVE-2026-80692 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks |
| MEDIUM | | 7 | | CVE-2026-80693 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: idpf: bound interrupt-vector register fill to the allocated array |
| MEDIUM | | 5.5 | | CVE-2026-80698 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: idxd: fix double free of wq, engine, and group structs |
| MEDIUM | | 5.5 | | CVE-2026-80721 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: ensure no dangling hcon references in iso_conn |
| MEDIUM | | | | CVE-2026-80761 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| MEDIUM | | 5.5 | | CVE-2026-80905 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: tap: fix wrong transport_header when sending VLAN-tagged frame |
| MEDIUM | | 5.5 | | CVE-2026-80920 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring: defer eventfd signaling when queued from a wakeup handler |
| MEDIUM | | 5.5 | | CVE-2026-81010 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/waitid: honor task_work cancellation |
| MEDIUM | | 7 | | CVE-2026-89528 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Reject Read lists that exceed the page budget |
| MEDIUM | | 4.8 | | CVE-2026-89534 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| MEDIUM | | 7 | | CVE-2026-89537 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 |
| MEDIUM | | 7.2 | | CVE-2026-89610 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs: verify run length exceeding volume boundary |
| MEDIUM | | 5.5 | | CVE-2026-89611 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs: validate non-resident attribute offsets |
| MEDIUM | | 7.1 | | CVE-2026-89632 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() |
| MEDIUM | | 7 | | CVE-2026-89637 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 |
| MEDIUM | | 5.5 | | CVE-2026-89639 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC |
| MEDIUM | | 3.3 | | CVE-2026-89642 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cifs: call pagecache_isize_extended() in cifs_setsize() when extending |
| MEDIUM | | 6.2 | | CVE-2026-89648 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ceph: cap delegated inode count in ceph_parse_deleg_inos() |
| MEDIUM | | 7 | | CVE-2026-89654 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix UAF in check_new_map() on session freed during unlock |
| MEDIUM | | 5.3 | | CVE-2026-89682 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net |
| MEDIUM | | 5.3 | | CVE-2026-89705 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths |
| MEDIUM | | 5.9 | | CVE-2026-89709 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: lockd, nfsd: RCU-protect nlmsvc_ops dispatch |
| MEDIUM | | 5.5 | | CVE-2026-89722 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() |
| MEDIUM | | 5.5 | | CVE-2026-89757 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/mglru: fix and remove redundant unevictable folio handling |
| MEDIUM | | 4.7 | | CVE-2026-89810 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix error path at svm_migrate_copy_to_ram |
| MEDIUM | | | | CVE-2026-89826 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| MEDIUM | | | | CVE-2026-89833 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| MEDIUM | | | | CVE-2026-89866 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| MEDIUM | | | | CVE-2026-89906 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| MEDIUM | | 4.7 | | CVE-2026-89913 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables |
| MEDIUM | | 4.7 | | CVE-2026-89920 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Fix memory corruption by not reinjecting CK machine checks |
| MEDIUM | | | | CVE-2026-89935 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 3.6 | | CVE-2026-89987 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/huge_memory: transfer the pmd dirty bit to the folio on zap |
| MEDIUM | | 5.5 | | CVE-2026-90040 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped |
| MEDIUM | | 5.5 | | CVE-2026-90061 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: skip double clone set expressions on element insert |
| MEDIUM | | 5.5 | | CVE-2026-90083 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: act_ife: Only operate on Ethernet frames |
| MEDIUM | | 5.5 | | CVE-2026-90087 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: do not leak an hci_conn when a second LE connect is rejected |
| MEDIUM | | 7 | | CVE-2026-90093 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: access chan->conn safely in get/setsockopt |
| MEDIUM | | 5.5 | | CVE-2026-90098 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: fix sleep in atomic context in MAC table access |
| MEDIUM | | 7 | | CVE-2026-90099 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: account classifier filter allocations to memcg |
| MEDIUM | | 7 | | CVE-2026-90104 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFSv4.1: zero referring call lists before decoding |
| MEDIUM | | 5.5 | | CVE-2026-90105 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vxlan: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90106 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: arp/nd proxy: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90116 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: mtpav: shut down output timer before card teardown |
| MEDIUM | | 5.5 | | CVE-2026-90142 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix resize of the RX ring |
| MEDIUM | | 5.5 | | CVE-2026-90149 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers |
| MEDIUM | | 5.5 | | CVE-2026-90154 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: scope session state changes to bound connections |
| MEDIUM | | 5.5 | | CVE-2026-90155 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: detach blocked lock requests before freeing |
| MEDIUM | | 5.5 | | CVE-2026-90156 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely discard unregistered deferred locks |
| MEDIUM | | 7 | | CVE-2026-90161 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix interlaced ztailpacking pclusters |
| MEDIUM | | 5.5 | | CVE-2026-90162 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: defer publishing granted locks to prevent UAF/double-free race |
| MEDIUM | | 5.5 | | CVE-2026-90167 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: serialize oplock close with pending break ownership |
| MEDIUM | | 5.5 | | CVE-2026-90174 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() |
| MEDIUM | | 5.5 | | CVE-2026-90177 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check pointer type for all atomic RMW paths |
| MEDIUM | | 5.5 | | CVE-2026-90179 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix deadlock in complain-mode change_hat |
| MEDIUM | | 5.5 | | CVE-2026-90204 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate DIO orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90205 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90208 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type |
| MEDIUM | | 5.5 | | CVE-2026-90217 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Compare iterator types during state pruning |
| MEDIUM | | 5.5 | | CVE-2026-90231 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix unconfined user namespace restriction forced stack |
| MEDIUM | | 5.5 | | CVE-2026-90232 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: amt: Don't support cross-netns setup |
| MEDIUM | | 5.1 | | CVE-2026-90234 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFS: Return a delegation the client fails to record |
| MEDIUM | | 7 | | CVE-2026-90237 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nft_ct: move custom expectation support to helper |
| MEDIUM | | 7 | | CVE-2026-90240 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Flush context cache with correct SID when tearing down aliases |
| MEDIUM | | 5.5 | | CVE-2026-90247 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix mmap_lock leak in irq_work path |
| MEDIUM | | 5.9 | | CVE-2026-90256 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind |
| MEDIUM | | 5.5 | | CVE-2026-90259 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() |
| MEDIUM | | 4.7 | | CVE-2026-90260 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: don't clobber the extent buffer when zeroing it out |
| MEDIUM | | 3.3 | | CVE-2026-90263 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: check if root is readonly when setting posix acl |
| MEDIUM | | 5.5 | | CVE-2026-90264 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: always wait for ordered extents to avoid OE races |
| MEDIUM | | 5.5 | | CVE-2026-90265 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: defrag: fix deadlock between defrag and delalloc space reservation |
| MEDIUM | | 5.5 | | CVE-2026-90273 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable |
| MEDIUM | | 5.5 | | CVE-2026-90289 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Resize MST HDCP per-connector arrays to 32 |
| MEDIUM | | 5.5 | | CVE-2026-90300 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear buf on error in __bpf_get_task_stack |
| MEDIUM | | 5.5 | | CVE-2026-90301 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: o2hb: quiesce negotiate handlers and timeout work |
| MEDIUM | | 7 | | CVE-2026-90317 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Invalidate RCU pointers after final spin unlock |
| MEDIUM | | 5.5 | | CVE-2026-90320 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate external xattr entries when reading metadata |
| MEDIUM | | 5.5 | | CVE-2026-90321 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate inline xattrs during inode block validation |
| MEDIUM | | 5.5 | | CVE-2026-90324 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ublk: check import_ubuf() return value |
| MEDIUM | | 4.7 | | CVE-2026-90326 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-cgroup: fix race between policy activation and blkg destruction |
| MEDIUM | | 5.5 | | CVE-2026-90328 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: HID: steam: Reject short reads |
| MEDIUM | | 6.4 | | CVE-2026-90333 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dm-integrity: replace forgeable discard filler with a keyed sector marker |
| MEDIUM | | 4.1 | | CVE-2026-90336 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: clear freed pointers on uart_register_driver() failure |
| MEDIUM | | 5.5 | | CVE-2026-90337 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: do fallible allocations before the console can be registered |
| MEDIUM | | 7 | | CVE-2026-90343 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: stop PMSR before P2P and NAN teardown |
| MEDIUM | | 5.5 | | CVE-2026-90345 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: brcmfmac: fix P2P action frame handling without device vif |
| MEDIUM | | 7 | | CVE-2026-90347 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry |
| MEDIUM | | 5.5 | | CVE-2026-90351 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed |
| MEDIUM | | 4.4 | | CVE-2026-90359 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject >8 byte return values on return-reading trampoline paths |
| MEDIUM | | 5.5 | | CVE-2026-90363 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: don't tear down KMS twice when KMS init fails |
| MEDIUM | | 5.5 | | CVE-2026-90365 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: cancel reset and rc work on device unregister |
| MEDIUM | | 5.5 | | CVE-2026-90367 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER |
| MEDIUM | | 4.8 | | CVE-2026-90379 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash |
| MEDIUM | | 3.3 | | CVE-2026-90401 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md: remove REQ_NOWAIT support from raid1/10/456 |
| MEDIUM | | 5.5 | | CVE-2026-90408 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() |
| MEDIUM | | 5.5 | | CVE-2026-90409 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Add vm_bind region with kbo range overlap check |
| MEDIUM | | 4.7 | | CVE-2026-90417 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() |
| MEDIUM | | 5.5 | | CVE-2026-90421 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI: Fix UAF when probe runs concurrent to dyn ID removal |
| MEDIUM | | 5.5 | | CVE-2026-90422 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path |
| MEDIUM | | 4.7 | | CVE-2026-90427 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() |
| MEDIUM | | 5.5 | | CVE-2026-92480 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Validate string descriptors |
| MEDIUM | | 5.5 | | CVE-2026-92482 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip |
| MEDIUM | | 3.3 | | CVE-2026-92485 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix WARNING in bpf_tracing_link_release |
| MEDIUM | | 5.5 | | CVE-2026-92499 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext4: validate readdir offset before accessing dirent |
| MEDIUM | | 4.7 | | CVE-2026-92500 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext4: use fsdata to track inline data write state and fix race |
| MEDIUM | | 5.5 | | CVE-2026-92503 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() |
| MEDIUM | | 5.5 | | CVE-2026-92518 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv, bpf: Fix kernel stack corruption in tailcall with CFI |
| MEDIUM | | 5.5 | | CVE-2026-92520 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Zero queue and stack outputs on lock failure |
| MEDIUM | | 5.5 | | CVE-2026-93044 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for arena-related insns |
| MEDIUM | | 5.5 | | CVE-2026-93047 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Associate BOs with every job that accesses them |
| MEDIUM | | 5.5 | | CVE-2026-93058 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Only fini scheduler after successful init |
| MEDIUM | | 5.5 | | CVE-2026-93081 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_scmi: Fix SCMI device destroy lifetimes |
| MEDIUM | | 4.7 | | CVE-2026-93099 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Fix UAF from worker threads when domains are removed |
| MEDIUM | | 4.7 | | CVE-2026-93100 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() |
| MEDIUM | | 4.7 | | CVE-2026-93104 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rvt: Return NULL after port allocation failure |
| MEDIUM | | 7 | | CVE-2026-93105 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: esp: do not unref managed frag pages in esp_ssg_unref() |
| MEDIUM | | 5.5 | | CVE-2026-93122 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: usb: gadget: uac: validate rate list length before storing |
| MEDIUM | | 5.5 | | CVE-2026-93135 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject programs with inlined helpers if JIT is not available |
| MEDIUM | | 7 | | CVE-2026-93148 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject MEM_ALLOC BTF accesses past object bounds |
| MEDIUM | | 7 | | CVE-2026-93154 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Add refcounting to user ring MRs |
| MEDIUM | | 5.5 | | CVE-2026-93168 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout |
| MEDIUM | | 5.5 | | CVE-2026-93175 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in CRTC reset function |
| MEDIUM | | 4.7 | | CVE-2026-93176 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in plane reset function |
| MEDIUM | | 5.5 | | CVE-2026-93270 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn |
| MEDIUM | | 5.5 | | CVE-2026-93272 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 |
| MEDIUM | | 5.5 | | CVE-2026-93276 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator |
| MEDIUM | | 5.5 | | CVE-2026-93282 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix maximum allowed access checks |
| MEDIUM | | 7.1 | | CVE-2026-97422 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: fix SMI event cross-process information leak |
| MEDIUM | | 5.5 | | CVE-2026-97432 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: fix P2P-Device binding handling |
| MEDIUM | | 5.5 | | CVE-2026-97478 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virt: acrn: Fix irqfd use-after-free during eventfd shutdown |
| MEDIUM | | 7.1 | | CVE-2026-97493 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS |
| MEDIUM | | 5.5 | | CVE-2026-97499 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: perf: Retrieve path and source from event data |
| MEDIUM | | 5.5 | | CVE-2026-97513 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Release m2m_ctx after Instance Removed from List |
| MEDIUM | | 5.5 | | CVE-2026-97515 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 |
| MEDIUM | | 5.5 | | CVE-2026-97526 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/pai: Support CPU hotplug for PMU PAI |
| MEDIUM | | 5.5 | | CVE-2026-97538 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (asus_rog_ryujin) Validate HID report lengths |
| MEDIUM | | 5.5 | | CVE-2026-97554 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() |
| MEDIUM | | 7 | | CVE-2026-97561 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid |
| MEDIUM | | 7 | | CVE-2026-97563 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97565 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject short READ responses in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97960 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel: Prevent drain_pebs() reentry |
| MEDIUM | | 5.5 | | CVE-2026-97962 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Move representor vnic reporter to eswitch devlink port |
| MEDIUM | | 5.1 | | CVE-2026-97975 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() |
| MEDIUM | | 4.7 | | CVE-2026-97988 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vhost: invalidate vring access on IOTLB transitions |
| MEDIUM | | 5.5 | | CVE-2026-98019 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: mark a NULL call argument precise |
| MEDIUM | | 5.3 | | CVE-2026-98032 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tracing: Fix subbuf resize races with trace_pipe_raw readers |
| MEDIUM | | 7 | | CVE-2026-98033 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Preserve inner map identity in callback frames |
| MEDIUM | | 7 | | CVE-2026-98034 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark NULL kptr stores precise |
| MEDIUM | | 5.5 | | CVE-2026-98043 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Don't infer non-NULL from a pointer with an unbounded offset |
| MEDIUM | | 7 | | CVE-2026-98047 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check ancestor frames for rbtree callbacks |
| MEDIUM | | 7 | | CVE-2026-98048 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: don't rewrite bpf_fastcall patterns entered by a jump |
| MEDIUM | | 5.5 | | CVE-2026-98049 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: zero extend the result of an arena 32-bit cmpxchg |
| MEDIUM | | 5.5 | | CVE-2026-98053 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Refactor and fix init_config access |
| MEDIUM | | 5.5 | | CVE-2026-98062 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark signal tracepoint siginfo arguments as scalar |
| MEDIUM | | 5.5 | | CVE-2026-98085 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge |
| MEDIUM | | | | CVE-2026-98099 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 5.5 | | CVE-2026-98115 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely drain sessions during logoff |
| MEDIUM | | 5.5 | | CVE-2026-98118 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix readahead synchronisation issues by loading all folios upfront |
| MEDIUM | | 5.5 | | CVE-2026-98124 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/client: invalidate fscache for fallocate range operations |
| MEDIUM | | 5.5 | | CVE-2026-98125 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix stale page cache in insert/collapse range |
| MEDIUM | | 5.5 | | CVE-2026-98131 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix dma mapping leak in stmmac_tso_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-98134 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: check_cond_jmp_op(): properly infer if register is null |
| MEDIUM | | 5.3 | | CVE-2026-98156 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/virtio: use the DMA API for resource backing on Xen |
| MEDIUM | | 5.5 | | CVE-2026-98162 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/server: fix tree connection leak in smb2_tree_connect() |
| MEDIUM | | 5.5 | | CVE-2026-98180 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: RCU-free the scheduler-containing ring and VM objects |
| MEDIUM | | 5.5 | | CVE-2026-98228 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ |
| MEDIUM | | 4.4 | | CVE-2026-98273 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: x86/kprobes: Fix crash when probing CS CALL instructions |
| MEDIUM | | 5.5 | | CVE-2026-98277 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: ring the doorbell if a burst ends in a drop |
| MEDIUM | | 5.5 | | CVE-2026-98279 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: handle lack of space when cleaning up verity items |
| MEDIUM | | 5.3 | | CVE-2026-98284 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netlink: do not free nlk->groups while lockless readers can use it |
| MEDIUM | | 4.1 | | CVE-2026-98286 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown |
| MEDIUM | | 5.5 | | CVE-2026-98288 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix TSO header length truncation |
| MEDIUM | | 5.5 | | CVE-2026-98292 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| MEDIUM | | 5.5 | | CVE-2026-98294 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_qca: Do not write to the serial port after it is closed |
| MEDIUM | | 7 | | CVE-2026-98296 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btintel_pcie: validate TX skb length in send_sync |
| MEDIUM | | 5.5 | | CVE-2026-98313 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/dp: skip PUSH_IDLE when the link was never enabled |
| MEDIUM | | 7 | | CVE-2026-98330 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: get the wiphy out of a dying network namespace |
| MEDIUM | | 5.5 | | CVE-2026-98333 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: reset the LED state when ifup fails |
| MEDIUM | | 7 | | CVE-2026-98341 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: don't free driver-owned scan requests |
| MEDIUM | | 5.5 | | CVE-2026-98353 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables |
| MEDIUM | | 5.5 | | CVE-2026-98355 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rtrs: guard against null kobj name |
| MEDIUM | | 5.5 | | CVE-2026-98376 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Use array_map_meta_equal for percpu array inner map replacement |
| MEDIUM | | 5.5 | | CVE-2026-98408 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: watchdog: rzv2h: Avoid division by zero |
| MEDIUM | | 5.5 | | CVE-2026-98420 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: follow SMB2 session expiration semantics |
| MEDIUM | | | | CVE-2026-98436 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: a ... |
| MEDIUM | | 6.5 | | CVE-2026-98439 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/server: cancel async requests when closing connection |
| MEDIUM | | 4.7 | | CVE-2026-98444 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: drop dquot flush lock when we can't find a buffer to flush |
| MEDIUM | | 6.5 | | CVE-2026-98449 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: delete compound mids on send failure before unlock |
| MEDIUM | | 5.3 | | CVE-2026-98471 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Do cache maintenance on the source VM during intra-host migration |
| MEDIUM | | 5.5 | | CVE-2026-98556 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gve: DQO: reject TSO packets with an out of range MSS |
| MEDIUM | | 4.1 | | CVE-2026-98558 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: flush skb_defer_nodes in dev_cpu_dead() |
| MEDIUM | | 5.9 | | CVE-2026-98570 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: ipv6: keep room for the mac header in dst_dev_overhead() |
| MEDIUM | | 6.7 | | CVE-2026-98589 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject pkt arguments in mutating subprogs |
| MEDIUM | | 4.7 | | CVE-2026-98598 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv6: Prevent rt6_insert_exception() for dying fib6_info |
| MEDIUM | | 6.7 | | CVE-2026-98599 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() |
| MEDIUM | | 4.1 | | CVE-2026-98616 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: reset num_napi when the napi vectors are freed |
| MEDIUM | | 5.5 | | CVE-2026-98652 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Add missing srcu in kvm_s390_set_irq_state() |
| MEDIUM | | 5.5 | | CVE-2026-98674 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iio: adc: adi-axi-adc: Initialize state mutex |
| MEDIUM | | 5.6 | | CVE-2026-98714 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| MEDIUM | | 4.1 | | CVE-2026-98740 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety |
| MEDIUM | | 4.4 | | CVE-2026-98747 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix NULL pointer dereference in serial_core_unregister_port() |
| MEDIUM | | 4.7 | | CVE-2026-98786 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: guard dc_sink dereferences in MST mode validation |
| MEDIUM | | 4.4 | | CVE-2026-98789 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix objects stuck in free_by_rcu_ttrace |
| MEDIUM | | 4.4 | | CVE-2026-98795 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: skip ptp deinit if init was skipped |
| MEDIUM | | 4.4 | | CVE-2026-98799 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Skip detached progs in trampoline images that are still in use |
| MEDIUM | | 4.7 | | CVE-2026-98800 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: kernel: Denial of Service via use-after-free in BPF trampoline |
| MEDIUM | | 6.5 | | CVE-2026-98803 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix rx Scatter-Gather support |
| MEDIUM | | 6.1 | | CVE-2026-98810 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() |
| MEDIUM | | 4.4 | | CVE-2026-98813 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Hold map BTF for the memory allocator destructor record |
| MEDIUM | | 4.4 | | CVE-2026-98814 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix command effects log lifetime for multipath heads |
| MEDIUM | | 4.1 | | CVE-2026-98815 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix cdev lifetime |
| MEDIUM | | 4.1 | | CVE-2026-98816 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix overflow of jump offset in constant blinding |
| MEDIUM | | 5.5 | | CVE-2026-98820 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: set RQF_USE_SCHED when the operation is known |
| MEDIUM | | 5.3 | | CVE-2026-98824 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate TX status rate metadata |
| MEDIUM | | 6.5 | | CVE-2026-98829 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: drop oversized fragments to avoid extra_len overflow |
| MEDIUM | | 4.1 | | CVE-2026-98834 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mtd: core: avoid double-free of OTP NVMEM device |
| MEDIUM | | 6.1 | | CVE-2026-98839 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() |
| MEDIUM | | 4.4 | | CVE-2026-98843 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: zero gaps in read-gaps folio to avoid writing back stale data |
| MEDIUM | | 5.6 | | CVE-2026-98863 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| MEDIUM | | 4.6 | | CVE-2019-15213 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: use-after-free caused by malicious USB device in drivers/media/usb/dvb-usb/dvb-usb-init.c |
| MEDIUM | | 4.1 | | CVE-2019-16089 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Improper return check in nbd_genl_status function in drivers/block/nbd.c |
| MEDIUM | | 4.7 | | CVE-2019-20794 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: task processes not being properly ended could lead to resource exhaustion |
| MEDIUM | | 4.4 | | CVE-2020-14304 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ethtool when reading eeprom of device could lead to memory leak |
| MEDIUM | | 6.7 | | CVE-2020-36694 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: use-after-free in the packet processing context |
| MEDIUM | | 5.5 | | CVE-2023-31082 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sleeping function called from an invalid context in gsmld_write |
| MEDIUM | | 7 | | CVE-2023-3397 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: slab-use-after-free Write in txEnd due to race condition |
| MEDIUM | | 5.5 | | CVE-2023-37454 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: udf: use-after-free write in udf_close_lvid |
| MEDIUM | | 6.7 | | CVE-2023-6238 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvme: memory corruption via unprivileged user passthrough |
| MEDIUM | | 6.5 | | CVE-2023-6240 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation |
| MEDIUM | | 5.5 | | CVE-2024-2193 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | hw: Spectre-SRC that is Speculative Race Conditions (SRCs) for synchronization primitives similar like Spectre V1 with p |
| MEDIUM | | 4.7 | | CVE-2024-24864 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | A race condition was found in the Linux kernel's media/dvb-core in dvb ... |
| MEDIUM | | 5.5 | | CVE-2024-25740 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory leak in ubi driver |
| MEDIUM | | 5.5 | | CVE-2024-56709 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring: check if iowq is killed before queuing |
| MEDIUM | | 5.5 | | CVE-2024-58074 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/i915: Grab intel_display from the encoder to avoid potential oopsies |
| MEDIUM | | 5.5 | | CVE-2025-21752 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents |
| MEDIUM | | 5.5 | | CVE-2025-21949 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Set hugetlb mmap base address aligned with pmd size |
| MEDIUM | | 5.5 | | CVE-2025-22109 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ax25: Remove broken autobind |
| MEDIUM | | 5.5 | | CVE-2025-23132 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: quota: fix to avoid warning in dquot_writeback_dquots() |
| MEDIUM | | 5.5 | | CVE-2025-23135 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Teardown riscv specific bits after kvm_exit |
| MEDIUM | | 5.5 | | CVE-2025-37743 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Avoid memory leak while enabling statistics |
| MEDIUM | | 5.5 | | CVE-2025-37746 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/dwc_pcie: fix duplicate pci_dev devices |
| MEDIUM | | 5.5 | | CVE-2025-37880 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: um: work around sched_yield not yielding in time-travel mode |
| MEDIUM | | 4.7 | | CVE-2025-37906 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: ublk race condition causes kernel crash |
| MEDIUM | | 5.5 | | CVE-2025-38029 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to sleepable page allocation in KASAN |
| MEDIUM | | 5.5 | | CVE-2025-38036 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to null pointer dereference in GT MMIO initialization for VFs |
| MEDIUM | | 5.5 | | CVE-2025-38041 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clk: sunxi-ng: h616: Reparent GPU clock during frequency changes |
| MEDIUM | | 5.5 | | CVE-2025-38042 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn |
| MEDIUM | | 6.7 | | CVE-2025-38064 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio: break and reset virtio devices on device_shutdown() |
| MEDIUM | | 5.5 | | CVE-2025-38132 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: holding cscfg_csdev_lock while removing cscfg from csdev |
| MEDIUM | | 5.5 | | CVE-2025-38140 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Local denial of service in device mapper |
| MEDIUM | | 5.5 | | CVE-2025-38199 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix memory leak due to multiple rx_stats allocation |
| MEDIUM | | 5.5 | | CVE-2025-38207 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm: fix uprobe pte be overwritten when expanding vma |
| MEDIUM | | 5.5 | | CVE-2025-38261 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv: save the SR_SUM status over switches |
| MEDIUM | | 5.5 | | CVE-2025-38284 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: configure manual DAC mode via PCI config API only |
| MEDIUM | | 5.5 | | CVE-2025-38311 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel (iavf): Denial of Service due to a locking issue |
| MEDIUM | | 5.5 | | CVE-2025-38359 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Fix in_atomic() handling in do_secure_storage_access() |
| MEDIUM | | 5.5 | | CVE-2025-38597 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port |
| MEDIUM | | 5.5 | | CVE-2025-38605 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() |
| MEDIUM | | 5.5 | | CVE-2025-39677 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Fix backlog accounting in qdisc_dequeue_internal |
| MEDIUM | | 5.5 | | CVE-2025-39762 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: add null check |
| MEDIUM | | 5.5 | | CVE-2025-39775 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: mremap local denial of service |
| MEDIUM | | 5.5 | | CVE-2025-39789 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: crypto: x86/aegis - Add missing error checks |
| MEDIUM | | 6.1 | | CVE-2025-39822 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/kbuf: fix signedness in this_len calculation |
| MEDIUM | | 5.5 | | CVE-2025-39830 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path |
| MEDIUM | | 5.5 | | CVE-2025-39834 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow |
| MEDIUM | | 6.2 | | CVE-2025-39910 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() |
| MEDIUM | | 7.1 | | CVE-2025-39933 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length |
| MEDIUM | | 2.5 | | CVE-2025-40113 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E |
| MEDIUM | | 6.8 | | CVE-2025-40130 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling |
| MEDIUM | | 6.2 | | CVE-2025-40146 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: fix potential deadlock while nr_requests grown |
| MEDIUM | | 5.2 | | CVE-2025-40217 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pidfs: validate extensible ioctls |
| MEDIUM | | | | CVE-2025-40247 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Fix pgtable prealloc error path |
| MEDIUM | | 5.2 | | CVE-2025-40338 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Do not share the name pointer between components |
| MEDIUM | | 6.1 | | CVE-2025-40355 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sysfs: check visibility before changing group attribute ownership |
| MEDIUM | | 5.5 | | CVE-2025-68209 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mlx5: Fix default values in create CQ |
| MEDIUM | | 5.5 | | CVE-2025-68236 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service during UFS power down |
| MEDIUM | | 5.5 | | CVE-2025-68304 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_core: lookup hci_conn on RX path on protocol side |
| MEDIUM | | | | CVE-2025-68318 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL |
| MEDIUM | | 6.1 | | CVE-2025-68319 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netconsole: Acquire su_mutex before navigating configs hierarchy |
| MEDIUM | | 5.5 | | CVE-2025-68353 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service via NULL pointer dereference in VXLAN module |
| MEDIUM | | 4.5 | | CVE-2025-68360 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks |
| MEDIUM | | 5.5 | | CVE-2025-68368 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service in md driver via uninitialized bioset |
| MEDIUM | | 6.5 | | CVE-2025-68729 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix MSDU buffer types handling in RX error path |
| MEDIUM | | 5.5 | | CVE-2025-68730 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() |
| MEDIUM | | 4.7 | | CVE-2025-68745 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset |
| MEDIUM | | 7.8 | | CVE-2025-71074 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel functionfs: Use-After-Free vulnerability due to open/removal races |
| MEDIUM | | 5.5 | | CVE-2025-71117 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service via deadlock in block layer sysfs store callbacks |
| MEDIUM | | 5.5 | | CVE-2025-71141 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/tilcdc: Fix removal actions in case of failed probe |
| MEDIUM | | 5.5 | | CVE-2025-71188 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: lpc18xx-dmamux: fix device leak on route allocation |
| MEDIUM | | 6.5 | | CVE-2025-71202 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Memory Corruption and Kernel Crashes via IOMMU SVA coherency issue |
| MEDIUM | | 5.5 | | CVE-2025-71227 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: don't WARN for connections on invalid channels |
| MEDIUM | | 5.5 | | CVE-2025-71285 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels |
| MEDIUM | | 5.5 | | CVE-2025-71302 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: fix for dma-fence safe access rules |
| MEDIUM | | 7 | | CVE-2025-71313 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI: endpoint: Add missing NULL check for alloc_workqueue() |
| MEDIUM | | 5.5 | | CVE-2025-71315 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/vkms: Convert to DRM's vblank timer |
| MEDIUM | | 5.5 | | CVE-2026-100074 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| MEDIUM | | 5.5 | | CVE-2026-100076 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths |
| MEDIUM | | 5.5 | | CVE-2026-100077 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Recover HW before retire hung submit |
| MEDIUM | | 5.5 | | CVE-2026-23007 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: block: zero non-PI portion of auto integrity buffer |
| MEDIUM | | 5.5 | | CVE-2026-23017 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: idpf: fix error handling in the init_task on load |
| MEDIUM | | 5.5 | | CVE-2026-23143 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix misalignment bug in struct virtnet_info |
| MEDIUM | | 7.1 | | CVE-2026-23152 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: correctly decode TTLM with default link map |
| MEDIUM | | 5.5 | | CVE-2026-23217 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv: trace: fix snapshot deadlock with sbi ecall |
| MEDIUM | | 5.5 | | CVE-2026-23259 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/rw: free potentially allocated iovec on cache put failure |
| MEDIUM | | 5.5 | | CVE-2026-23265 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer in {read,write}_end_io |
| MEDIUM | | 5.5 | | CVE-2026-23348 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix race of nvdimm_bus object when creating nvdimm objects |
| MEDIUM | | 5.5 | | CVE-2026-23371 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting |
| MEDIUM | | 5.5 | | CVE-2026-23377 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz |
| MEDIUM | | 5.5 | | CVE-2026-23385 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: clone set on flush only |
| MEDIUM | | 5.5 | | CVE-2026-23472 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN |
| MEDIUM | | 5.5 | | CVE-2026-31435 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix read abandonment during retry |
| MEDIUM | | 5.5 | | CVE-2026-31526 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix exception exit lock checking for subprogs |
| MEDIUM | | 5.5 | | CVE-2026-31537 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: server: make use of smbdirect_socket.send_io.bcredits |
| MEDIUM | | 5.5 | | CVE-2026-31562 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register |
| MEDIUM | | 5.5 | | CVE-2026-31579 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit |
| MEDIUM | | 5.5 | | CVE-2026-31591 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish |
| MEDIUM | | 5.5 | | CVE-2026-31592 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock |
| MEDIUM | | 5.5 | | CVE-2026-31630 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rxrpc: proc: size address buffers for %pISpc output |
| MEDIUM | | 7.1 | | CVE-2026-31692 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns |
| MEDIUM | | 5.5 | | CVE-2026-31771 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_event: move wake reason storage into validated event handlers |
| MEDIUM | | 5.5 | | CVE-2026-31777 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: ctxfi: Check the error for index mapping |
| MEDIUM | | 5.5 | | CVE-2026-43009 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix incorrect pruning due to atomic fetch precision tracking |
| MEDIUM | | 5.5 | | CVE-2026-43022 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists |
| MEDIUM | | 5.5 | | CVE-2026-43029 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mptcp: fix soft lockup in mptcp_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-43034 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: set backing store type from query type |
| MEDIUM | | 7.1 | | CVE-2026-43042 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mpls: add seqcount to protect the platform_label{,s} pair |
| MEDIUM | | 5.5 | | CVE-2026-43048 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: HID: core: Mitigate potential OOB by removing bogus memset() |
| MEDIUM | | 5.5 | | CVE-2026-43053 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: close crash window in attr dabtree inactivation |
| MEDIUM | | 5.5 | | CVE-2026-43083 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: ioam6: fix OOB and missing lock |
| MEDIUM | | 5.5 | | CVE-2026-43101 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() |
| MEDIUM | | 5.5 | | CVE-2026-43115 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: srcu: Use irq_work to start GP in tiny SRCU |
| MEDIUM | | 5.5 | | CVE-2026-43118 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix zero size inode with non-zero size after log replay |
| MEDIUM | | 5.5 | | CVE-2026-43127 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs3: fix circular locking dependency in run_unpack_ex |
| MEDIUM | | 5.5 | | CVE-2026-43172 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: fix 22000 series SMEM parsing |
| MEDIUM | | 5.5 | | CVE-2026-43191 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 |
| MEDIUM | | 5.5 | | CVE-2026-43204 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: qcom: q6asm: drop DSP responses for closed data streams |
| MEDIUM | | 5.5 | | CVE-2026-43213 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: validate sequence number of TX release report |
| MEDIUM | | 5.5 | | CVE-2026-43234 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: team: avoid NETDEV_CHANGEMTU event when unregistering slave |
| MEDIUM | | 5.5 | | CVE-2026-43272 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ring-buffer: Fix possible dereference of uninitialized pointer |
| MEDIUM | | 5.5 | | CVE-2026-43294 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels |
| MEDIUM | | 5.5 | | CVE-2026-43298 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Skip vcn poison irq release on VF |
| MEDIUM | | 5.5 | | CVE-2026-43299 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() |
| MEDIUM | | 5.5 | | CVE-2026-43301 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix PM runtime usage count underflow |
| MEDIUM | | 5.5 | | CVE-2026-43308 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() |
| MEDIUM | | 5.5 | | CVE-2026-43309 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md raid: fix hang when stopping arrays with metadata through dm-raid |
| MEDIUM | | 5.5 | | CVE-2026-43310 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC |
| MEDIUM | | 5.5 | | CVE-2026-43311 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soc/tegra: pmc: Fix unsafe generic_handle_irq() call |
| MEDIUM | | 5.5 | | CVE-2026-43325 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: don't send a 6E related command when not supported |
| MEDIUM | | 5.5 | | CVE-2026-43326 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback |
| MEDIUM | | 5.5 | | CVE-2026-43337 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() |
| MEDIUM | | 5.5 | | CVE-2026-43346 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ice: ptp: don't WARN when controlling PF is unavailable |
| MEDIUM | | 5.5 | | CVE-2026-43352 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue |
| MEDIUM | | 5.5 | | CVE-2026-43353 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue |
| MEDIUM | | 7.1 | | CVE-2026-43414 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Completely fix fcport double free |
| MEDIUM | | 5.5 | | CVE-2026-43416 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: powerpc, perf: Check that current->mm is alive before getting user callchain |
| MEDIUM | | 5.5 | | CVE-2026-43443 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: amd: acp-mach-common: Add missing error check for clock acquisition |
| MEDIUM | | 5.5 | | CVE-2026-43463 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() |
| MEDIUM | | 5.5 | | CVE-2026-43464 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ |
| MEDIUM | | 5.5 | | CVE-2026-43465 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ |
| MEDIUM | | 5.5 | | CVE-2026-43485 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nouveau/gsp: drop WARN_ON in ACPI probes |
| MEDIUM | | 6.4 | | CVE-2026-45932 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix tcx/netkit detach permissions when prog fd isn't given |
| MEDIUM | | 7 | | CVE-2026-45934 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation |
| MEDIUM | | 5.5 | | CVE-2026-45940 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix oops when split header is enabled |
| MEDIUM | | 5.5 | | CVE-2026-45961 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gfs2: fix memory leaks in gfs2_fill_super error path |
| MEDIUM | | 5.5 | | CVE-2026-46014 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Add missing save/restore handling of LBR MSRs |
| MEDIUM | | 7 | | CVE-2026-46017 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm: fix deferred split queue races during migration |
| MEDIUM | | 7 | | CVE-2026-46032 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT |
| MEDIUM | | 5.5 | | CVE-2026-46044 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipmi:ssif: Clean up kthread on errors |
| MEDIUM | | 5.5 | | CVE-2026-46059 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN |
| MEDIUM | | 5.5 | | CVE-2026-46066 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix num_ops off-by-one when crypto allocation fails |
| MEDIUM | | 5.5 | | CVE-2026-46071 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 |
| MEDIUM | | 5.5 | | CVE-2026-46096 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() |
| MEDIUM | | 5.5 | | CVE-2026-46147 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() |
| MEDIUM | | 5.5 | | CVE-2026-46148 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: spi: microchip-core-qspi: control built-in cs manually |
| MEDIUM | | 5.5 | | CVE-2026-46153 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: 8021q: delete cleared egress QoS mappings |
| MEDIUM | | 5.5 | | CVE-2026-46171 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv: kvm: fix vector context allocation leak |
| MEDIUM | | 5.5 | | CVE-2026-46228 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: spi: ch341: fix devres lifetime |
| MEDIUM | | 5.5 | | CVE-2026-46245 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dc_link NULL handling in HPD init |
| MEDIUM | | 5.5 | | CVE-2026-46256 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages |
| MEDIUM | | 4.7 | | CVE-2026-46272 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: tmc-etr: Fix race condition between sysfs and perf mode |
| MEDIUM | | 5.5 | | CVE-2026-46302 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: selinux: allow multiple opens of /sys/fs/selinux/policy |
| MEDIUM | | 5.5 | | CVE-2026-46314 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Reject empty multisync extension to prevent infinite loop |
| MEDIUM | | 7 | | CVE-2026-46317 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock |
| MEDIUM | | 7 | | CVE-2026-46324 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: netfilter nf_tables denial of service via race condition in netlink hook unregistration |
| MEDIUM | | 7 | | CVE-2026-46325 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE |
| MEDIUM | | 7 | | CVE-2026-46330 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Revert "net/smc: Introduce TCP ULP support" |
| MEDIUM | | 5.5 | | CVE-2026-52937 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR |
| MEDIUM | | 7 | | CVE-2026-52953 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Fix oops due to out of scope access |
| MEDIUM | | 7 | | CVE-2026-52956 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() |
| MEDIUM | | 5.5 | | CVE-2026-52994 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting |
| MEDIUM | | 7 | | CVE-2026-53009 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ice: fix double-free of tx_buf skb |
| MEDIUM | | 5.5 | | CVE-2026-53017 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix data loss caused by incorrect use of nat_entry flag |
| MEDIUM | | 5.5 | | CVE-2026-53018 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: avoid reading already updated pages during GC |
| MEDIUM | | 5.5 | | CVE-2026-53103 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync |
| MEDIUM | | 5.5 | | CVE-2026-53104 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: Fix memory leak destroying device |
| MEDIUM | | 5.5 | | CVE-2026-53106 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Do not allow deleting local storage in NMI |
| MEDIUM | | 5.5 | | CVE-2026-53107 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: libertas: don't kill URBs in interrupt context |
| MEDIUM | | 5.5 | | CVE-2026-53108 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: powerpc/64s: Fix unmap race with PMD migration entries |
| MEDIUM | | | | CVE-2026-53178 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction |
| MEDIUM | | 7 | | CVE-2026-53224 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate embedded INIT chunk and address list lengths in cookie |
| MEDIUM | | 7 | | CVE-2026-53246 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing |
| MEDIUM | | 5.5 | | CVE-2026-53258 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: fix leak if split 6 GHz scanning fails |
| MEDIUM | | 5.5 | | CVE-2026-53281 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption |
| MEDIUM | | 5.5 | | CVE-2026-53285 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED |
| MEDIUM | | 5.5 | | CVE-2026-53292 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind |
| MEDIUM | | 5.5 | | CVE-2026-53297 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: mana: Guard mana_remove against double invocation |
| MEDIUM | | 5.5 | | CVE-2026-53321 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/napi: cap busy_poll_to 10 msec |
| MEDIUM | | 5.5 | | CVE-2026-53377 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: always recover the gpu |
| MEDIUM | | | | CVE-2026-53401 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: omap2: fix use-after-free in omapfb_mmap |
| MEDIUM | | | | CVE-2026-63805 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: crypto: nx - fix nx_crypto_ctx_exit argument |
| MEDIUM | | | | CVE-2026-63811 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: read COW data with the original inode during atomic write |
| MEDIUM | | | | CVE-2026-63819 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on f2fs_get_node_folio_ra() |
| MEDIUM | | 5.5 | | CVE-2026-63832 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: add wcid publish check in mt76_sta_add |
| MEDIUM | | 5.5 | | CVE-2026-63853 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring |
| MEDIUM | | | | CVE-2026-63857 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-63858 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: add hook transactions for device deletions |
| MEDIUM | | | | CVE-2026-63859 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue() |
| MEDIUM | | 7 | | CVE-2026-63941 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor |
| MEDIUM | | 7 | | CVE-2026-63979 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/handshake: hand off the pinned file reference to accept_doit |
| MEDIUM | | 5.5 | | CVE-2026-63998 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ethtool: module: call ethnl_ops_complete() on module flash errors |
| MEDIUM | | 5.5 | | CVE-2026-63999 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure |
| MEDIUM | | 5.5 | | CVE-2026-64006 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: fix dst corruption in same register operation |
| MEDIUM | | 7 | | CVE-2026-64024 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction |
| MEDIUM | | 5.5 | | CVE-2026-64036 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cgroup/rstat: validate cpu before css_rstat_cpu() access |
| MEDIUM | | 5.5 | | CVE-2026-64038 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Stop work before releasing hwmon device |
| MEDIUM | | 5.5 | | CVE-2026-64060 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix leak of request in netfs_write_begin() error handling |
| MEDIUM | | 7.1 | | CVE-2026-64066 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_read_to_pagecache() to pause on subreq failure |
| MEDIUM | | 5.5 | | CVE-2026-64067 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing barriers when accessing stream->subrequests locklessly |
| MEDIUM | | 7 | | CVE-2026-64068 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing locking around retry adding new subreqs |
| MEDIUM | | 5.5 | | CVE-2026-64076 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: bridge: eb_tables: close module init race |
| MEDIUM | | 5.5 | | CVE-2026-64077 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: ebtables: move to two-stage removal scheme |
| MEDIUM | | 7.1 | | CVE-2026-64078 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: add and use xtables_unregister_table_exit |
| MEDIUM | | 5.5 | | CVE-2026-64079 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: allocate hook ops while under mutex |
| MEDIUM | | 7 | | CVE-2026-64117 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb |
| MEDIUM | | 5.5 | | CVE-2026-64146 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix metabuf leak in inode xattr initialization |
| MEDIUM | | 5.5 | | CVE-2026-64154 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() |
| MEDIUM | | 5.5 | | CVE-2026-64159 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix zeropoint update where i_size > remote_i_size |
| MEDIUM | | 7 | | CVE-2026-64160 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point |
| MEDIUM | | 5.5 | | CVE-2026-64190 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: team: fix NULL pointer dereference in team_xmit during mode change |
| MEDIUM | | 5.5 | | CVE-2026-64212 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it |
| MEDIUM | | 5.5 | | CVE-2026-64213 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Add lock protection to lm90_alert |
| MEDIUM | | 7 | | CVE-2026-64255 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers |
| MEDIUM | | 7 | | CVE-2026-64520 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies |
| MEDIUM | | 7 | | CVE-2026-68086 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/khugepaged: write all dirty file folios when collapsing |
| MEDIUM | | 5.5 | | CVE-2026-68211 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: stm32-dcmipp: Return queued buffers on start_streaming() failure |
| MEDIUM | | 5.5 | | CVE-2026-68233 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/vc4: Shut down BO cache timer before teardown |
| MEDIUM | | 5.5 | | CVE-2026-68242 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/gt: Fix NULL deref on sched_engine alloc failure |
| MEDIUM | | 5.5 | | CVE-2026-68258 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size |
| MEDIUM | | 5.5 | | CVE-2026-68291 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: idpf driver null pointer dereference leads to Denial of Service |
| MEDIUM | | 5.5 | | CVE-2026-68295 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: BPF: Zero-extend signed ALU32 div/mod results |
| MEDIUM | | 5.5 | | CVE-2026-68312 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths |
| MEDIUM | | 7 | | CVE-2026-68323 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tipc: serialize udp bearer replicast list updates |
| MEDIUM | | 5.5 | | CVE-2026-68382 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Hold device ref until queue teardown completes |
| MEDIUM | | 5.5 | | CVE-2026-68383 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Keep scheduler timeline name alive |
| MEDIUM | | 7 | | CVE-2026-68393 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: extend conn_hash lookup critical sections |
| MEDIUM | | 6.4 | | CVE-2026-68399 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix UAF in sock clone early bailouts |
| MEDIUM | | 7 | | CVE-2026-68400 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation |
| MEDIUM | | 7 | | CVE-2026-68401 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() |
| MEDIUM | | 7 | | CVE-2026-68404 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect |
| MEDIUM | | 5.5 | | CVE-2026-68421 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() |
| MEDIUM | | 5.5 | | CVE-2026-68435 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Fix address space mismatch in kexec command line lookup |
| MEDIUM | | 5.5 | | CVE-2026-68441 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains |
| MEDIUM | | 5.5 | | CVE-2026-68447 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size |
| MEDIUM | | 7 | | CVE-2026-68448 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ovl: check access to copy_file_range source with src mounter creds |
| MEDIUM | | 7 | | CVE-2026-68453 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey |
| MEDIUM | | 5.5 | | CVE-2026-68471 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ieee80211: validate MLE common info length |
| MEDIUM | | 5.5 | | CVE-2026-72073 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mmc: vub300: fix use-after-free on probe failure |
| MEDIUM | | 5.5 | | CVE-2026-72162 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec |
| MEDIUM | | 7 | | CVE-2026-72288 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling |
| MEDIUM | | 7 | | CVE-2026-72329 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/liquidio: drop cached VF pci_dev LUT |
| MEDIUM | | 5.5 | | CVE-2026-72337 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: 6lowpan: avoid untracked enable work |
| MEDIUM | | 5.5 | | CVE-2026-72341 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Fix publication race for priv->channel_stats[] |
| MEDIUM | | 5.5 | | CVE-2026-72355 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix barriering when walking subrequest list |
| MEDIUM | | 5.5 | | CVE-2026-72365 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix writethrough to use collection offload |
| MEDIUM | | 5.5 | | CVE-2026-72367 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iomap: guard io_size EOF trim against concurrent truncate underflow |
| MEDIUM | | 5.5 | | CVE-2026-72375 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix reinitialisation of the inode, in particular ->lock_work |
| MEDIUM | | 5.5 | | CVE-2026-72380 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xen/pvcalls: bound backend response req_id before indexing rsp[] |
| MEDIUM | | 5.5 | | CVE-2026-72383 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: fix addr_wq_timer race in sctp_free_addr_wq() |
| MEDIUM | | 5.5 | | CVE-2026-72388 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock |
| MEDIUM | | 5.5 | | CVE-2026-72397 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() |
| MEDIUM | | 7 | | CVE-2026-72398 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: add INIT verification after cookie unpacking |
| MEDIUM | | 5.5 | | CVE-2026-72404 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() |
| MEDIUM | | 5.5 | | CVE-2026-72423 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Guard conntrack opts error writes |
| MEDIUM | | 5.5 | | CVE-2026-72440 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1: fix writes_pending and barrier reference leaks on write failures |
| MEDIUM | | 5.5 | | CVE-2026-72454 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() |
| MEDIUM | | 5.5 | | CVE-2026-72488 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soundwire: fix bug in sdw_add_element_group_count found by syzkaller |
| MEDIUM | | 5.5 | | CVE-2026-72493 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: serialize netif_running() check in enqueue_to_backlog() |
| MEDIUM | | 5.5 | | CVE-2026-72495 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages |
| MEDIUM | | 7 | | CVE-2026-72499 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free CQ toggle page after firmware teardown |
| MEDIUM | | 7 | | CVE-2026-72500 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown |
| MEDIUM | | | | CVE-2026-72501 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: R ... |
| MEDIUM | | 5.5 | | CVE-2026-74257 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sockmap: Fix use-after-free in udp_bpf_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-74264 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: watchdog: fix refcount tracking races |
| MEDIUM | | 5.5 | | CVE-2026-74272 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Resolve region deletion races |
| MEDIUM | | 5.5 | | CVE-2026-74273 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Block region delete during region creation |
| MEDIUM | | 5.5 | | CVE-2026-74314 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Cancel special fields on map value recycle |
| MEDIUM | | 5.5 | | CVE-2026-74317 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ixgbe: do not configure xps for XDP queues |
| MEDIUM | | 5.5 | | CVE-2026-74324 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: validate skb length in testmode query |
| MEDIUM | | 5.5 | | CVE-2026-74337 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks |
| MEDIUM | | 5.5 | | CVE-2026-74342 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: kernfs: link kn to its parent before the LSM init hook |
| MEDIUM | | 5.5 | | CVE-2026-74344 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear rb node linkage when freeing bpf_rb_root |
| MEDIUM | | 5.5 | | CVE-2026-74350 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate fast symlink target during inode read |
| MEDIUM | | 5.5 | | CVE-2026-74354 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Take mmap_lock in zap_pages() |
| MEDIUM | | 5.5 | | CVE-2026-74368 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() |
| MEDIUM | | 6.5 | | CVE-2026-74385 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock |
| MEDIUM | | 5.5 | | CVE-2026-74388 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data |
| MEDIUM | | 7 | | CVE-2026-74405 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: OPP: Fix race between OPP addition and lookup |
| MEDIUM | | 5.5 | | CVE-2026-74407 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath11k: cancel SSR work items during PCI shutdown |
| MEDIUM | | 5.5 | | CVE-2026-74449 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport |
| MEDIUM | | 5.5 | | CVE-2026-74466 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Close speculative mem read possibility |
| MEDIUM | | 7 | | CVE-2026-74506 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix UAF when sending a message |
| MEDIUM | | 7 | | CVE-2026-74513 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister |
| MEDIUM | | 5.5 | | CVE-2026-74527 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-af: Block VFs from clobbering special CGX PKIND state |
| MEDIUM | | 5.5 | | CVE-2026-74529 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback |
| MEDIUM | | 5.5 | | CVE-2026-74530 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback |
| MEDIUM | | 7 | | CVE-2026-74533 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero |
| MEDIUM | | 7 | | CVE-2026-74537 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: hold sk properly in iso_conn_ready |
| MEDIUM | | 5.5 | | CVE-2026-74538 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: lock sk in iso_connect_ind |
| MEDIUM | | 5.5 | | CVE-2026-74542 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix folio_queue ENOMEM in writeback by adding a mempool |
| MEDIUM | | 5.5 | | CVE-2026-74544 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds |
| MEDIUM | | 5.5 | | CVE-2026-74600 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/page_table_check: skip special zero mappings |
| MEDIUM | | 5.5 | | CVE-2026-74605 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: eventfs: Use children field for rcu head and add memory barriers |
| MEDIUM | | 7 | | CVE-2026-74611 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tls: rx: restore msg_iter before TLS 1.3 optimistic retry |
| MEDIUM | | 5.5 | | CVE-2026-74638 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Serialize the scheduler timeout handlers |
| MEDIUM | | 5.5 | | CVE-2026-74687 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: watchdog: at91sam9_wdt: prevent timer rearm during teardown |
| MEDIUM | | 7 | | CVE-2026-74695 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() |
| MEDIUM | | 7 | | CVE-2026-74697 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Disable EOP for TPA on all chips to prevent data corruption |
| MEDIUM | | 5.5 | | CVE-2026-74711 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus) Fix type confusion in notification logic |
| MEDIUM | | 5.5 | | CVE-2026-74713 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vhost_iotlb: bound map allocation in add_range |
| MEDIUM | | 7 | | CVE-2026-74715 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix netns reference imbalance in conntrack kfuncs |
| MEDIUM | | 5.5 | | CVE-2026-74723 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject inline extents without valid headers |
| MEDIUM | | 5.5 | | CVE-2026-74729 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read |
| MEDIUM | | 5.5 | | CVE-2026-74747 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipvs: revalidate ihl to prevent out-of-bounds access |
| MEDIUM | | 5.5 | | CVE-2026-80579 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: clear fb_info->mode before deleting a videomode |
| MEDIUM | | 5.5 | | CVE-2026-80580 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: bound mode sysfs output to the sysfs buffer |
| MEDIUM | | 5.5 | | CVE-2026-80614 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: emac: Fix NULL pointer dereference in emac_probe |
| MEDIUM | | 5.5 | | CVE-2026-80623 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: ete: Always save state on power down |
| MEDIUM | | 5.5 | | CVE-2026-80628 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Serialize readq reset state with q->lock |
| MEDIUM | | 5.5 | | CVE-2026-80631 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject compressed segment that overflows the compressed input |
| MEDIUM | | 5.5 | | CVE-2026-80634 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag |
| MEDIUM | | 5.5 | | CVE-2026-80655 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soc: xilinx: Fix race condition in event registration |
| MEDIUM | | 5.5 | | CVE-2026-80662 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size |
| MEDIUM | | 7 | | CVE-2026-80668 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations |
| MEDIUM | | 5.5 | | CVE-2026-80670 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() |
| MEDIUM | | 5.5 | | CVE-2026-80692 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks |
| MEDIUM | | 7 | | CVE-2026-80693 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: idpf: bound interrupt-vector register fill to the allocated array |
| MEDIUM | | 5.5 | | CVE-2026-80698 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: idxd: fix double free of wq, engine, and group structs |
| MEDIUM | | 5.5 | | CVE-2026-80721 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: ensure no dangling hcon references in iso_conn |
| MEDIUM | | | | CVE-2026-80761 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| MEDIUM | | 5.5 | | CVE-2026-80905 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: tap: fix wrong transport_header when sending VLAN-tagged frame |
| MEDIUM | | 5.5 | | CVE-2026-80920 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring: defer eventfd signaling when queued from a wakeup handler |
| MEDIUM | | 5.5 | | CVE-2026-81010 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/waitid: honor task_work cancellation |
| MEDIUM | | 7 | | CVE-2026-89528 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Reject Read lists that exceed the page budget |
| MEDIUM | | 4.8 | | CVE-2026-89534 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| MEDIUM | | 7 | | CVE-2026-89537 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 |
| MEDIUM | | 7.2 | | CVE-2026-89610 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs: verify run length exceeding volume boundary |
| MEDIUM | | 5.5 | | CVE-2026-89611 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs: validate non-resident attribute offsets |
| MEDIUM | | 7.1 | | CVE-2026-89632 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() |
| MEDIUM | | 7 | | CVE-2026-89637 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 |
| MEDIUM | | 5.5 | | CVE-2026-89639 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC |
| MEDIUM | | 3.3 | | CVE-2026-89642 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cifs: call pagecache_isize_extended() in cifs_setsize() when extending |
| MEDIUM | | 6.2 | | CVE-2026-89648 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ceph: cap delegated inode count in ceph_parse_deleg_inos() |
| MEDIUM | | 7 | | CVE-2026-89654 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix UAF in check_new_map() on session freed during unlock |
| MEDIUM | | 5.3 | | CVE-2026-89682 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net |
| MEDIUM | | 5.3 | | CVE-2026-89705 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths |
| MEDIUM | | 5.9 | | CVE-2026-89709 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: lockd, nfsd: RCU-protect nlmsvc_ops dispatch |
| MEDIUM | | 5.5 | | CVE-2026-89722 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() |
| MEDIUM | | 5.5 | | CVE-2026-89757 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/mglru: fix and remove redundant unevictable folio handling |
| MEDIUM | | 4.7 | | CVE-2026-89810 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix error path at svm_migrate_copy_to_ram |
| MEDIUM | | | | CVE-2026-89826 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| MEDIUM | | | | CVE-2026-89833 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| MEDIUM | | | | CVE-2026-89866 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| MEDIUM | | | | CVE-2026-89906 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| MEDIUM | | 4.7 | | CVE-2026-89913 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables |
| MEDIUM | | 4.7 | | CVE-2026-89920 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Fix memory corruption by not reinjecting CK machine checks |
| MEDIUM | | | | CVE-2026-89935 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 3.6 | | CVE-2026-89987 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/huge_memory: transfer the pmd dirty bit to the folio on zap |
| MEDIUM | | 5.5 | | CVE-2026-90040 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped |
| MEDIUM | | 5.5 | | CVE-2026-90061 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: skip double clone set expressions on element insert |
| MEDIUM | | 5.5 | | CVE-2026-90083 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: act_ife: Only operate on Ethernet frames |
| MEDIUM | | 5.5 | | CVE-2026-90087 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: do not leak an hci_conn when a second LE connect is rejected |
| MEDIUM | | 7 | | CVE-2026-90093 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: access chan->conn safely in get/setsockopt |
| MEDIUM | | 5.5 | | CVE-2026-90098 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: fix sleep in atomic context in MAC table access |
| MEDIUM | | 7 | | CVE-2026-90099 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: account classifier filter allocations to memcg |
| MEDIUM | | 7 | | CVE-2026-90104 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFSv4.1: zero referring call lists before decoding |
| MEDIUM | | 5.5 | | CVE-2026-90105 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vxlan: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90106 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: arp/nd proxy: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90116 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: mtpav: shut down output timer before card teardown |
| MEDIUM | | 5.5 | | CVE-2026-90142 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix resize of the RX ring |
| MEDIUM | | 5.5 | | CVE-2026-90149 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers |
| MEDIUM | | 5.5 | | CVE-2026-90154 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: scope session state changes to bound connections |
| MEDIUM | | 5.5 | | CVE-2026-90155 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: detach blocked lock requests before freeing |
| MEDIUM | | 5.5 | | CVE-2026-90156 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely discard unregistered deferred locks |
| MEDIUM | | 7 | | CVE-2026-90161 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix interlaced ztailpacking pclusters |
| MEDIUM | | 5.5 | | CVE-2026-90162 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: defer publishing granted locks to prevent UAF/double-free race |
| MEDIUM | | 5.5 | | CVE-2026-90167 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: serialize oplock close with pending break ownership |
| MEDIUM | | 5.5 | | CVE-2026-90174 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() |
| MEDIUM | | 5.5 | | CVE-2026-90177 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check pointer type for all atomic RMW paths |
| MEDIUM | | 5.5 | | CVE-2026-90179 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix deadlock in complain-mode change_hat |
| MEDIUM | | 5.5 | | CVE-2026-90204 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate DIO orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90205 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90208 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type |
| MEDIUM | | 5.5 | | CVE-2026-90217 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Compare iterator types during state pruning |
| MEDIUM | | 5.5 | | CVE-2026-90231 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix unconfined user namespace restriction forced stack |
| MEDIUM | | 5.5 | | CVE-2026-90232 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: amt: Don't support cross-netns setup |
| MEDIUM | | 5.1 | | CVE-2026-90234 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFS: Return a delegation the client fails to record |
| MEDIUM | | 7 | | CVE-2026-90237 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nft_ct: move custom expectation support to helper |
| MEDIUM | | 7 | | CVE-2026-90240 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Flush context cache with correct SID when tearing down aliases |
| MEDIUM | | 5.5 | | CVE-2026-90247 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix mmap_lock leak in irq_work path |
| MEDIUM | | 5.9 | | CVE-2026-90256 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind |
| MEDIUM | | 5.5 | | CVE-2026-90259 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() |
| MEDIUM | | 4.7 | | CVE-2026-90260 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: don't clobber the extent buffer when zeroing it out |
| MEDIUM | | 3.3 | | CVE-2026-90263 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: check if root is readonly when setting posix acl |
| MEDIUM | | 5.5 | | CVE-2026-90264 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: always wait for ordered extents to avoid OE races |
| MEDIUM | | 5.5 | | CVE-2026-90265 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: defrag: fix deadlock between defrag and delalloc space reservation |
| MEDIUM | | 5.5 | | CVE-2026-90273 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable |
| MEDIUM | | 5.5 | | CVE-2026-90289 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Resize MST HDCP per-connector arrays to 32 |
| MEDIUM | | 5.5 | | CVE-2026-90300 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear buf on error in __bpf_get_task_stack |
| MEDIUM | | 5.5 | | CVE-2026-90301 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: o2hb: quiesce negotiate handlers and timeout work |
| MEDIUM | | 7 | | CVE-2026-90317 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Invalidate RCU pointers after final spin unlock |
| MEDIUM | | 5.5 | | CVE-2026-90320 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate external xattr entries when reading metadata |
| MEDIUM | | 5.5 | | CVE-2026-90321 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate inline xattrs during inode block validation |
| MEDIUM | | 5.5 | | CVE-2026-90324 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ublk: check import_ubuf() return value |
| MEDIUM | | 4.7 | | CVE-2026-90326 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-cgroup: fix race between policy activation and blkg destruction |
| MEDIUM | | 5.5 | | CVE-2026-90328 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: HID: steam: Reject short reads |
| MEDIUM | | 6.4 | | CVE-2026-90333 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dm-integrity: replace forgeable discard filler with a keyed sector marker |
| MEDIUM | | 4.1 | | CVE-2026-90336 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: clear freed pointers on uart_register_driver() failure |
| MEDIUM | | 5.5 | | CVE-2026-90337 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: do fallible allocations before the console can be registered |
| MEDIUM | | 7 | | CVE-2026-90343 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: stop PMSR before P2P and NAN teardown |
| MEDIUM | | 5.5 | | CVE-2026-90345 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: brcmfmac: fix P2P action frame handling without device vif |
| MEDIUM | | 7 | | CVE-2026-90347 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry |
| MEDIUM | | 5.5 | | CVE-2026-90351 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed |
| MEDIUM | | 4.4 | | CVE-2026-90359 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject >8 byte return values on return-reading trampoline paths |
| MEDIUM | | 5.5 | | CVE-2026-90363 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: don't tear down KMS twice when KMS init fails |
| MEDIUM | | 5.5 | | CVE-2026-90365 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: cancel reset and rc work on device unregister |
| MEDIUM | | 5.5 | | CVE-2026-90367 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER |
| MEDIUM | | 4.8 | | CVE-2026-90379 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash |
| MEDIUM | | 3.3 | | CVE-2026-90401 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md: remove REQ_NOWAIT support from raid1/10/456 |
| MEDIUM | | 5.5 | | CVE-2026-90408 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() |
| MEDIUM | | 5.5 | | CVE-2026-90409 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Add vm_bind region with kbo range overlap check |
| MEDIUM | | 4.7 | | CVE-2026-90417 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() |
| MEDIUM | | 5.5 | | CVE-2026-90421 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI: Fix UAF when probe runs concurrent to dyn ID removal |
| MEDIUM | | 5.5 | | CVE-2026-90422 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path |
| MEDIUM | | 4.7 | | CVE-2026-90427 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() |
| MEDIUM | | 5.5 | | CVE-2026-92480 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Validate string descriptors |
| MEDIUM | | 5.5 | | CVE-2026-92482 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip |
| MEDIUM | | 3.3 | | CVE-2026-92485 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix WARNING in bpf_tracing_link_release |
| MEDIUM | | 5.5 | | CVE-2026-92499 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext4: validate readdir offset before accessing dirent |
| MEDIUM | | 4.7 | | CVE-2026-92500 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext4: use fsdata to track inline data write state and fix race |
| MEDIUM | | 5.5 | | CVE-2026-92503 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() |
| MEDIUM | | 5.5 | | CVE-2026-92518 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv, bpf: Fix kernel stack corruption in tailcall with CFI |
| MEDIUM | | 5.5 | | CVE-2026-92520 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Zero queue and stack outputs on lock failure |
| MEDIUM | | 5.5 | | CVE-2026-93044 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for arena-related insns |
| MEDIUM | | 5.5 | | CVE-2026-93047 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Associate BOs with every job that accesses them |
| MEDIUM | | 5.5 | | CVE-2026-93058 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Only fini scheduler after successful init |
| MEDIUM | | 5.5 | | CVE-2026-93081 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_scmi: Fix SCMI device destroy lifetimes |
| MEDIUM | | 4.7 | | CVE-2026-93099 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Fix UAF from worker threads when domains are removed |
| MEDIUM | | 4.7 | | CVE-2026-93100 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() |
| MEDIUM | | 4.7 | | CVE-2026-93104 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rvt: Return NULL after port allocation failure |
| MEDIUM | | 7 | | CVE-2026-93105 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: esp: do not unref managed frag pages in esp_ssg_unref() |
| MEDIUM | | 5.5 | | CVE-2026-93122 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: usb: gadget: uac: validate rate list length before storing |
| MEDIUM | | 5.5 | | CVE-2026-93135 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject programs with inlined helpers if JIT is not available |
| MEDIUM | | 7 | | CVE-2026-93148 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject MEM_ALLOC BTF accesses past object bounds |
| MEDIUM | | 7 | | CVE-2026-93154 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Add refcounting to user ring MRs |
| MEDIUM | | 5.5 | | CVE-2026-93168 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout |
| MEDIUM | | 5.5 | | CVE-2026-93175 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in CRTC reset function |
| MEDIUM | | 4.7 | | CVE-2026-93176 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in plane reset function |
| MEDIUM | | 5.5 | | CVE-2026-93270 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn |
| MEDIUM | | 5.5 | | CVE-2026-93272 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 |
| MEDIUM | | 5.5 | | CVE-2026-93276 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator |
| MEDIUM | | 5.5 | | CVE-2026-93282 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix maximum allowed access checks |
| MEDIUM | | 7.1 | | CVE-2026-97422 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: fix SMI event cross-process information leak |
| MEDIUM | | 5.5 | | CVE-2026-97432 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: fix P2P-Device binding handling |
| MEDIUM | | 5.5 | | CVE-2026-97478 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virt: acrn: Fix irqfd use-after-free during eventfd shutdown |
| MEDIUM | | 7.1 | | CVE-2026-97493 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS |
| MEDIUM | | 5.5 | | CVE-2026-97499 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: perf: Retrieve path and source from event data |
| MEDIUM | | 5.5 | | CVE-2026-97513 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Release m2m_ctx after Instance Removed from List |
| MEDIUM | | 5.5 | | CVE-2026-97515 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 |
| MEDIUM | | 5.5 | | CVE-2026-97526 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/pai: Support CPU hotplug for PMU PAI |
| MEDIUM | | 5.5 | | CVE-2026-97538 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (asus_rog_ryujin) Validate HID report lengths |
| MEDIUM | | 5.5 | | CVE-2026-97554 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() |
| MEDIUM | | 7 | | CVE-2026-97561 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid |
| MEDIUM | | 7 | | CVE-2026-97563 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97565 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject short READ responses in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97960 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel: Prevent drain_pebs() reentry |
| MEDIUM | | 5.5 | | CVE-2026-97962 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Move representor vnic reporter to eswitch devlink port |
| MEDIUM | | 5.1 | | CVE-2026-97975 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() |
| MEDIUM | | 4.7 | | CVE-2026-97988 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vhost: invalidate vring access on IOTLB transitions |
| MEDIUM | | 5.5 | | CVE-2026-98019 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: mark a NULL call argument precise |
| MEDIUM | | 5.3 | | CVE-2026-98032 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tracing: Fix subbuf resize races with trace_pipe_raw readers |
| MEDIUM | | 7 | | CVE-2026-98033 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Preserve inner map identity in callback frames |
| MEDIUM | | 7 | | CVE-2026-98034 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark NULL kptr stores precise |
| MEDIUM | | 5.5 | | CVE-2026-98043 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Don't infer non-NULL from a pointer with an unbounded offset |
| MEDIUM | | 7 | | CVE-2026-98047 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check ancestor frames for rbtree callbacks |
| MEDIUM | | 7 | | CVE-2026-98048 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: don't rewrite bpf_fastcall patterns entered by a jump |
| MEDIUM | | 5.5 | | CVE-2026-98049 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: zero extend the result of an arena 32-bit cmpxchg |
| MEDIUM | | 5.5 | | CVE-2026-98053 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Refactor and fix init_config access |
| MEDIUM | | 5.5 | | CVE-2026-98062 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark signal tracepoint siginfo arguments as scalar |
| MEDIUM | | 5.5 | | CVE-2026-98085 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge |
| MEDIUM | | | | CVE-2026-98099 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 5.5 | | CVE-2026-98115 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely drain sessions during logoff |
| MEDIUM | | 5.5 | | CVE-2026-98118 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix readahead synchronisation issues by loading all folios upfront |
| MEDIUM | | 5.5 | | CVE-2026-98124 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/client: invalidate fscache for fallocate range operations |
| MEDIUM | | 5.5 | | CVE-2026-98125 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix stale page cache in insert/collapse range |
| MEDIUM | | 5.5 | | CVE-2026-98131 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix dma mapping leak in stmmac_tso_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-98134 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: check_cond_jmp_op(): properly infer if register is null |
| MEDIUM | | 5.3 | | CVE-2026-98156 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/virtio: use the DMA API for resource backing on Xen |
| MEDIUM | | 5.5 | | CVE-2026-98162 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/server: fix tree connection leak in smb2_tree_connect() |
| MEDIUM | | 5.5 | | CVE-2026-98180 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: RCU-free the scheduler-containing ring and VM objects |
| MEDIUM | | 5.5 | | CVE-2026-98228 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ |
| MEDIUM | | 4.4 | | CVE-2026-98273 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: x86/kprobes: Fix crash when probing CS CALL instructions |
| MEDIUM | | 5.5 | | CVE-2026-98277 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: ring the doorbell if a burst ends in a drop |
| MEDIUM | | 5.5 | | CVE-2026-98279 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: handle lack of space when cleaning up verity items |
| MEDIUM | | 5.3 | | CVE-2026-98284 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netlink: do not free nlk->groups while lockless readers can use it |
| MEDIUM | | 4.1 | | CVE-2026-98286 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown |
| MEDIUM | | 5.5 | | CVE-2026-98288 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix TSO header length truncation |
| MEDIUM | | 5.5 | | CVE-2026-98292 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| MEDIUM | | 5.5 | | CVE-2026-98294 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_qca: Do not write to the serial port after it is closed |
| MEDIUM | | 7 | | CVE-2026-98296 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btintel_pcie: validate TX skb length in send_sync |
| MEDIUM | | 5.5 | | CVE-2026-98313 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/dp: skip PUSH_IDLE when the link was never enabled |
| MEDIUM | | 7 | | CVE-2026-98330 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: get the wiphy out of a dying network namespace |
| MEDIUM | | 5.5 | | CVE-2026-98333 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: reset the LED state when ifup fails |
| MEDIUM | | 7 | | CVE-2026-98341 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: don't free driver-owned scan requests |
| MEDIUM | | 5.5 | | CVE-2026-98353 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables |
| MEDIUM | | 5.5 | | CVE-2026-98355 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rtrs: guard against null kobj name |
| MEDIUM | | 5.5 | | CVE-2026-98376 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Use array_map_meta_equal for percpu array inner map replacement |
| MEDIUM | | 5.5 | | CVE-2026-98408 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: watchdog: rzv2h: Avoid division by zero |
| MEDIUM | | 5.5 | | CVE-2026-98420 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: follow SMB2 session expiration semantics |
| MEDIUM | | | | CVE-2026-98436 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: a ... |
| MEDIUM | | 6.5 | | CVE-2026-98439 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/server: cancel async requests when closing connection |
| MEDIUM | | 4.7 | | CVE-2026-98444 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: drop dquot flush lock when we can't find a buffer to flush |
| MEDIUM | | 6.5 | | CVE-2026-98449 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: delete compound mids on send failure before unlock |
| MEDIUM | | 5.3 | | CVE-2026-98471 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Do cache maintenance on the source VM during intra-host migration |
| MEDIUM | | 5.5 | | CVE-2026-98556 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gve: DQO: reject TSO packets with an out of range MSS |
| MEDIUM | | 4.1 | | CVE-2026-98558 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: flush skb_defer_nodes in dev_cpu_dead() |
| MEDIUM | | 5.9 | | CVE-2026-98570 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: ipv6: keep room for the mac header in dst_dev_overhead() |
| MEDIUM | | 6.7 | | CVE-2026-98589 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject pkt arguments in mutating subprogs |
| MEDIUM | | 4.7 | | CVE-2026-98598 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv6: Prevent rt6_insert_exception() for dying fib6_info |
| MEDIUM | | 6.7 | | CVE-2026-98599 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() |
| MEDIUM | | 4.1 | | CVE-2026-98616 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: reset num_napi when the napi vectors are freed |
| MEDIUM | | 5.5 | | CVE-2026-98652 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Add missing srcu in kvm_s390_set_irq_state() |
| MEDIUM | | 5.5 | | CVE-2026-98674 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iio: adc: adi-axi-adc: Initialize state mutex |
| MEDIUM | | 5.6 | | CVE-2026-98714 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| MEDIUM | | 4.1 | | CVE-2026-98740 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety |
| MEDIUM | | 4.4 | | CVE-2026-98747 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix NULL pointer dereference in serial_core_unregister_port() |
| MEDIUM | | 4.7 | | CVE-2026-98786 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: guard dc_sink dereferences in MST mode validation |
| MEDIUM | | 4.4 | | CVE-2026-98789 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix objects stuck in free_by_rcu_ttrace |
| MEDIUM | | 4.4 | | CVE-2026-98795 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: skip ptp deinit if init was skipped |
| MEDIUM | | 4.4 | | CVE-2026-98799 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Skip detached progs in trampoline images that are still in use |
| MEDIUM | | 4.7 | | CVE-2026-98800 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: kernel: Denial of Service via use-after-free in BPF trampoline |
| MEDIUM | | 6.5 | | CVE-2026-98803 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix rx Scatter-Gather support |
| MEDIUM | | 6.1 | | CVE-2026-98810 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() |
| MEDIUM | | 4.4 | | CVE-2026-98813 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Hold map BTF for the memory allocator destructor record |
| MEDIUM | | 4.4 | | CVE-2026-98814 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix command effects log lifetime for multipath heads |
| MEDIUM | | 4.1 | | CVE-2026-98815 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix cdev lifetime |
| MEDIUM | | 4.1 | | CVE-2026-98816 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix overflow of jump offset in constant blinding |
| MEDIUM | | 5.5 | | CVE-2026-98820 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: set RQF_USE_SCHED when the operation is known |
| MEDIUM | | 5.3 | | CVE-2026-98824 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate TX status rate metadata |
| MEDIUM | | 6.5 | | CVE-2026-98829 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: drop oversized fragments to avoid extra_len overflow |
| MEDIUM | | 4.1 | | CVE-2026-98834 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mtd: core: avoid double-free of OTP NVMEM device |
| MEDIUM | | 6.1 | | CVE-2026-98839 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() |
| MEDIUM | | 4.4 | | CVE-2026-98843 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: zero gaps in read-gaps folio to avoid writing back stale data |
| MEDIUM | | 5.6 | | CVE-2026-98863 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| MEDIUM | | 4.6 | | CVE-2019-15213 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: use-after-free caused by malicious USB device in drivers/media/usb/dvb-usb/dvb-usb-init.c |
| MEDIUM | | 4.1 | | CVE-2019-16089 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Improper return check in nbd_genl_status function in drivers/block/nbd.c |
| MEDIUM | | 4.7 | | CVE-2019-20794 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: task processes not being properly ended could lead to resource exhaustion |
| MEDIUM | | 4.4 | | CVE-2020-14304 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ethtool when reading eeprom of device could lead to memory leak |
| MEDIUM | | 6.7 | | CVE-2020-36694 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: use-after-free in the packet processing context |
| MEDIUM | | 5.5 | | CVE-2023-31082 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sleeping function called from an invalid context in gsmld_write |
| MEDIUM | | 7 | | CVE-2023-3397 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: slab-use-after-free Write in txEnd due to race condition |
| MEDIUM | | 5.5 | | CVE-2023-37454 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: udf: use-after-free write in udf_close_lvid |
| MEDIUM | | 6.7 | | CVE-2023-6238 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvme: memory corruption via unprivileged user passthrough |
| MEDIUM | | 6.5 | | CVE-2023-6240 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation |
| MEDIUM | | 5.5 | | CVE-2024-2193 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | hw: Spectre-SRC that is Speculative Race Conditions (SRCs) for synchronization primitives similar like Spectre V1 with p |
| MEDIUM | | 4.7 | | CVE-2024-24864 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | A race condition was found in the Linux kernel's media/dvb-core in dvb ... |
| MEDIUM | | 5.5 | | CVE-2024-25740 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory leak in ubi driver |
| MEDIUM | | 5.5 | | CVE-2024-56709 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring: check if iowq is killed before queuing |
| MEDIUM | | 5.5 | | CVE-2024-58074 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/i915: Grab intel_display from the encoder to avoid potential oopsies |
| MEDIUM | | 5.5 | | CVE-2025-21752 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents |
| MEDIUM | | 5.5 | | CVE-2025-21949 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Set hugetlb mmap base address aligned with pmd size |
| MEDIUM | | 5.5 | | CVE-2025-22109 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ax25: Remove broken autobind |
| MEDIUM | | 5.5 | | CVE-2025-23132 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: quota: fix to avoid warning in dquot_writeback_dquots() |
| MEDIUM | | 5.5 | | CVE-2025-23135 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Teardown riscv specific bits after kvm_exit |
| MEDIUM | | 5.5 | | CVE-2025-37743 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Avoid memory leak while enabling statistics |
| MEDIUM | | 5.5 | | CVE-2025-37746 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/dwc_pcie: fix duplicate pci_dev devices |
| MEDIUM | | 5.5 | | CVE-2025-37880 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: um: work around sched_yield not yielding in time-travel mode |
| MEDIUM | | 4.7 | | CVE-2025-37906 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: ublk race condition causes kernel crash |
| MEDIUM | | 5.5 | | CVE-2025-38029 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to sleepable page allocation in KASAN |
| MEDIUM | | 5.5 | | CVE-2025-38036 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to null pointer dereference in GT MMIO initialization for VFs |
| MEDIUM | | 5.5 | | CVE-2025-38041 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clk: sunxi-ng: h616: Reparent GPU clock during frequency changes |
| MEDIUM | | 5.5 | | CVE-2025-38042 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn |
| MEDIUM | | 6.7 | | CVE-2025-38064 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio: break and reset virtio devices on device_shutdown() |
| MEDIUM | | 5.5 | | CVE-2025-38132 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: holding cscfg_csdev_lock while removing cscfg from csdev |
| MEDIUM | | 5.5 | | CVE-2025-38140 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Local denial of service in device mapper |
| MEDIUM | | 5.5 | | CVE-2025-38199 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix memory leak due to multiple rx_stats allocation |
| MEDIUM | | 5.5 | | CVE-2025-38207 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm: fix uprobe pte be overwritten when expanding vma |
| MEDIUM | | 5.5 | | CVE-2025-38261 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv: save the SR_SUM status over switches |
| MEDIUM | | 5.5 | | CVE-2025-38284 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: configure manual DAC mode via PCI config API only |
| MEDIUM | | 5.5 | | CVE-2025-38311 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel (iavf): Denial of Service due to a locking issue |
| MEDIUM | | 5.5 | | CVE-2025-38359 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Fix in_atomic() handling in do_secure_storage_access() |
| MEDIUM | | 5.5 | | CVE-2025-38597 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port |
| MEDIUM | | 5.5 | | CVE-2025-38605 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() |
| MEDIUM | | 5.5 | | CVE-2025-39677 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Fix backlog accounting in qdisc_dequeue_internal |
| MEDIUM | | 5.5 | | CVE-2025-39762 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: add null check |
| MEDIUM | | 5.5 | | CVE-2025-39775 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: mremap local denial of service |
| MEDIUM | | 5.5 | | CVE-2025-39789 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: crypto: x86/aegis - Add missing error checks |
| MEDIUM | | 6.1 | | CVE-2025-39822 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/kbuf: fix signedness in this_len calculation |
| MEDIUM | | 5.5 | | CVE-2025-39830 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path |
| MEDIUM | | 5.5 | | CVE-2025-39834 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow |
| MEDIUM | | 6.2 | | CVE-2025-39910 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() |
| MEDIUM | | 7.1 | | CVE-2025-39933 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length |
| MEDIUM | | 2.5 | | CVE-2025-40113 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E |
| MEDIUM | | 6.8 | | CVE-2025-40130 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling |
| MEDIUM | | 6.2 | | CVE-2025-40146 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: fix potential deadlock while nr_requests grown |
| MEDIUM | | 5.2 | | CVE-2025-40217 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pidfs: validate extensible ioctls |
| MEDIUM | | | | CVE-2025-40247 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Fix pgtable prealloc error path |
| MEDIUM | | 5.2 | | CVE-2025-40338 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Do not share the name pointer between components |
| MEDIUM | | 6.1 | | CVE-2025-40355 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sysfs: check visibility before changing group attribute ownership |
| MEDIUM | | 5.5 | | CVE-2025-68209 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mlx5: Fix default values in create CQ |
| MEDIUM | | 5.5 | | CVE-2025-68236 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service during UFS power down |
| MEDIUM | | 5.5 | | CVE-2025-68304 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_core: lookup hci_conn on RX path on protocol side |
| MEDIUM | | | | CVE-2025-68318 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL |
| MEDIUM | | 6.1 | | CVE-2025-68319 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netconsole: Acquire su_mutex before navigating configs hierarchy |
| MEDIUM | | 5.5 | | CVE-2025-68353 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service via NULL pointer dereference in VXLAN module |
| MEDIUM | | 4.5 | | CVE-2025-68360 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks |
| MEDIUM | | 5.5 | | CVE-2025-68368 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service in md driver via uninitialized bioset |
| MEDIUM | | 6.5 | | CVE-2025-68729 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix MSDU buffer types handling in RX error path |
| MEDIUM | | 5.5 | | CVE-2025-68730 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() |
| MEDIUM | | 4.7 | | CVE-2025-68745 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset |
| MEDIUM | | 7.8 | | CVE-2025-71074 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel functionfs: Use-After-Free vulnerability due to open/removal races |
| MEDIUM | | 5.5 | | CVE-2025-71117 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service via deadlock in block layer sysfs store callbacks |
| MEDIUM | | 5.5 | | CVE-2025-71141 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/tilcdc: Fix removal actions in case of failed probe |
| MEDIUM | | 5.5 | | CVE-2025-71188 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: lpc18xx-dmamux: fix device leak on route allocation |
| MEDIUM | | 6.5 | | CVE-2025-71202 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Memory Corruption and Kernel Crashes via IOMMU SVA coherency issue |
| MEDIUM | | 5.5 | | CVE-2025-71227 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: don't WARN for connections on invalid channels |
| MEDIUM | | 5.5 | | CVE-2025-71285 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels |
| MEDIUM | | 5.5 | | CVE-2025-71302 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: fix for dma-fence safe access rules |
| MEDIUM | | 7 | | CVE-2025-71313 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI: endpoint: Add missing NULL check for alloc_workqueue() |
| MEDIUM | | 5.5 | | CVE-2025-71315 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/vkms: Convert to DRM's vblank timer |
| MEDIUM | | 5.5 | | CVE-2026-100074 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| MEDIUM | | 5.5 | | CVE-2026-100076 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths |
| MEDIUM | | 5.5 | | CVE-2026-100077 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Recover HW before retire hung submit |
| MEDIUM | | 5.5 | | CVE-2026-23007 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: block: zero non-PI portion of auto integrity buffer |
| MEDIUM | | 5.5 | | CVE-2026-23017 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: idpf: fix error handling in the init_task on load |
| MEDIUM | | 5.5 | | CVE-2026-23143 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix misalignment bug in struct virtnet_info |
| MEDIUM | | 7.1 | | CVE-2026-23152 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: correctly decode TTLM with default link map |
| MEDIUM | | 5.5 | | CVE-2026-23217 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv: trace: fix snapshot deadlock with sbi ecall |
| MEDIUM | | 5.5 | | CVE-2026-23259 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/rw: free potentially allocated iovec on cache put failure |
| MEDIUM | | 5.5 | | CVE-2026-23265 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer in {read,write}_end_io |
| MEDIUM | | 5.5 | | CVE-2026-23348 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix race of nvdimm_bus object when creating nvdimm objects |
| MEDIUM | | 5.5 | | CVE-2026-23371 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting |
| MEDIUM | | 5.5 | | CVE-2026-23377 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz |
| MEDIUM | | 5.5 | | CVE-2026-23385 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: clone set on flush only |
| MEDIUM | | 5.5 | | CVE-2026-23472 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN |
| MEDIUM | | 5.5 | | CVE-2026-31435 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix read abandonment during retry |
| MEDIUM | | 5.5 | | CVE-2026-31526 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix exception exit lock checking for subprogs |
| MEDIUM | | 5.5 | | CVE-2026-31537 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: server: make use of smbdirect_socket.send_io.bcredits |
| MEDIUM | | 5.5 | | CVE-2026-31562 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register |
| MEDIUM | | 5.5 | | CVE-2026-31579 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit |
| MEDIUM | | 5.5 | | CVE-2026-31591 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish |
| MEDIUM | | 5.5 | | CVE-2026-31592 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock |
| MEDIUM | | 5.5 | | CVE-2026-31630 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rxrpc: proc: size address buffers for %pISpc output |
| MEDIUM | | 7.1 | | CVE-2026-31692 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns |
| MEDIUM | | 5.5 | | CVE-2026-31771 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_event: move wake reason storage into validated event handlers |
| MEDIUM | | 5.5 | | CVE-2026-31777 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: ctxfi: Check the error for index mapping |
| MEDIUM | | 5.5 | | CVE-2026-43009 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix incorrect pruning due to atomic fetch precision tracking |
| MEDIUM | | 5.5 | | CVE-2026-43022 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists |
| MEDIUM | | 5.5 | | CVE-2026-43029 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mptcp: fix soft lockup in mptcp_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-43034 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: set backing store type from query type |
| MEDIUM | | 7.1 | | CVE-2026-43042 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mpls: add seqcount to protect the platform_label{,s} pair |
| MEDIUM | | 5.5 | | CVE-2026-43048 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: HID: core: Mitigate potential OOB by removing bogus memset() |
| MEDIUM | | 5.5 | | CVE-2026-43053 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: close crash window in attr dabtree inactivation |
| MEDIUM | | 5.5 | | CVE-2026-43083 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: ioam6: fix OOB and missing lock |
| MEDIUM | | 5.5 | | CVE-2026-43101 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() |
| MEDIUM | | 5.5 | | CVE-2026-43115 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: srcu: Use irq_work to start GP in tiny SRCU |
| MEDIUM | | 5.5 | | CVE-2026-43118 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix zero size inode with non-zero size after log replay |
| MEDIUM | | 5.5 | | CVE-2026-43127 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs3: fix circular locking dependency in run_unpack_ex |
| MEDIUM | | 5.5 | | CVE-2026-43172 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: fix 22000 series SMEM parsing |
| MEDIUM | | 5.5 | | CVE-2026-43191 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 |
| MEDIUM | | 5.5 | | CVE-2026-43204 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: qcom: q6asm: drop DSP responses for closed data streams |
| MEDIUM | | 5.5 | | CVE-2026-43213 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: validate sequence number of TX release report |
| MEDIUM | | 5.5 | | CVE-2026-43234 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: team: avoid NETDEV_CHANGEMTU event when unregistering slave |
| MEDIUM | | 5.5 | | CVE-2026-43272 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ring-buffer: Fix possible dereference of uninitialized pointer |
| MEDIUM | | 5.5 | | CVE-2026-43294 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels |
| MEDIUM | | 5.5 | | CVE-2026-43298 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Skip vcn poison irq release on VF |
| MEDIUM | | 5.5 | | CVE-2026-43299 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() |
| MEDIUM | | 5.5 | | CVE-2026-43301 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix PM runtime usage count underflow |
| MEDIUM | | 5.5 | | CVE-2026-43308 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() |
| MEDIUM | | 5.5 | | CVE-2026-43309 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md raid: fix hang when stopping arrays with metadata through dm-raid |
| MEDIUM | | 5.5 | | CVE-2026-43310 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC |
| MEDIUM | | 5.5 | | CVE-2026-43311 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soc/tegra: pmc: Fix unsafe generic_handle_irq() call |
| MEDIUM | | 5.5 | | CVE-2026-43325 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: don't send a 6E related command when not supported |
| MEDIUM | | 5.5 | | CVE-2026-43326 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback |
| MEDIUM | | 5.5 | | CVE-2026-43337 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() |
| MEDIUM | | 5.5 | | CVE-2026-43346 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ice: ptp: don't WARN when controlling PF is unavailable |
| MEDIUM | | 5.5 | | CVE-2026-43352 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue |
| MEDIUM | | 5.5 | | CVE-2026-43353 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue |
| MEDIUM | | 7.1 | | CVE-2026-43414 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Completely fix fcport double free |
| MEDIUM | | 5.5 | | CVE-2026-43416 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: powerpc, perf: Check that current->mm is alive before getting user callchain |
| MEDIUM | | 5.5 | | CVE-2026-43443 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: amd: acp-mach-common: Add missing error check for clock acquisition |
| MEDIUM | | 5.5 | | CVE-2026-43463 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() |
| MEDIUM | | 5.5 | | CVE-2026-43464 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ |
| MEDIUM | | 5.5 | | CVE-2026-43465 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ |
| MEDIUM | | 5.5 | | CVE-2026-43485 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nouveau/gsp: drop WARN_ON in ACPI probes |
| MEDIUM | | 6.4 | | CVE-2026-45932 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix tcx/netkit detach permissions when prog fd isn't given |
| MEDIUM | | 7 | | CVE-2026-45934 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation |
| MEDIUM | | 5.5 | | CVE-2026-45940 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix oops when split header is enabled |
| MEDIUM | | 5.5 | | CVE-2026-45961 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gfs2: fix memory leaks in gfs2_fill_super error path |
| MEDIUM | | 5.5 | | CVE-2026-46014 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Add missing save/restore handling of LBR MSRs |
| MEDIUM | | 7 | | CVE-2026-46017 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm: fix deferred split queue races during migration |
| MEDIUM | | 7 | | CVE-2026-46032 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT |
| MEDIUM | | 5.5 | | CVE-2026-46044 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipmi:ssif: Clean up kthread on errors |
| MEDIUM | | 5.5 | | CVE-2026-46059 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN |
| MEDIUM | | 5.5 | | CVE-2026-46066 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix num_ops off-by-one when crypto allocation fails |
| MEDIUM | | 5.5 | | CVE-2026-46071 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 |
| MEDIUM | | 5.5 | | CVE-2026-46096 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() |
| MEDIUM | | 5.5 | | CVE-2026-46147 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() |
| MEDIUM | | 5.5 | | CVE-2026-46148 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: spi: microchip-core-qspi: control built-in cs manually |
| MEDIUM | | 5.5 | | CVE-2026-46153 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: 8021q: delete cleared egress QoS mappings |
| MEDIUM | | 5.5 | | CVE-2026-46171 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv: kvm: fix vector context allocation leak |
| MEDIUM | | 5.5 | | CVE-2026-46228 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: spi: ch341: fix devres lifetime |
| MEDIUM | | 5.5 | | CVE-2026-46245 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dc_link NULL handling in HPD init |
| MEDIUM | | 5.5 | | CVE-2026-46256 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages |
| MEDIUM | | 4.7 | | CVE-2026-46272 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: tmc-etr: Fix race condition between sysfs and perf mode |
| MEDIUM | | 5.5 | | CVE-2026-46302 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: selinux: allow multiple opens of /sys/fs/selinux/policy |
| MEDIUM | | 5.5 | | CVE-2026-46314 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Reject empty multisync extension to prevent infinite loop |
| MEDIUM | | 7 | | CVE-2026-46317 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock |
| MEDIUM | | 7 | | CVE-2026-46324 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: netfilter nf_tables denial of service via race condition in netlink hook unregistration |
| MEDIUM | | 7 | | CVE-2026-46325 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE |
| MEDIUM | | 7 | | CVE-2026-46330 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Revert "net/smc: Introduce TCP ULP support" |
| MEDIUM | | 5.5 | | CVE-2026-52937 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR |
| MEDIUM | | 7 | | CVE-2026-52953 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Fix oops due to out of scope access |
| MEDIUM | | 7 | | CVE-2026-52956 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() |
| MEDIUM | | 5.5 | | CVE-2026-52994 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting |
| MEDIUM | | 7 | | CVE-2026-53009 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ice: fix double-free of tx_buf skb |
| MEDIUM | | 5.5 | | CVE-2026-53017 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix data loss caused by incorrect use of nat_entry flag |
| MEDIUM | | 5.5 | | CVE-2026-53018 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: avoid reading already updated pages during GC |
| MEDIUM | | 5.5 | | CVE-2026-53103 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync |
| MEDIUM | | 5.5 | | CVE-2026-53104 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: Fix memory leak destroying device |
| MEDIUM | | 5.5 | | CVE-2026-53106 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Do not allow deleting local storage in NMI |
| MEDIUM | | 5.5 | | CVE-2026-53107 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: libertas: don't kill URBs in interrupt context |
| MEDIUM | | 5.5 | | CVE-2026-53108 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: powerpc/64s: Fix unmap race with PMD migration entries |
| MEDIUM | | | | CVE-2026-53178 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction |
| MEDIUM | | 7 | | CVE-2026-53224 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate embedded INIT chunk and address list lengths in cookie |
| MEDIUM | | 7 | | CVE-2026-53246 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing |
| MEDIUM | | 5.5 | | CVE-2026-53258 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: fix leak if split 6 GHz scanning fails |
| MEDIUM | | 5.5 | | CVE-2026-53281 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption |
| MEDIUM | | 5.5 | | CVE-2026-53285 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED |
| MEDIUM | | 5.5 | | CVE-2026-53292 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind |
| MEDIUM | | 5.5 | | CVE-2026-53297 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: mana: Guard mana_remove against double invocation |
| MEDIUM | | 5.5 | | CVE-2026-53321 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/napi: cap busy_poll_to 10 msec |
| MEDIUM | | 5.5 | | CVE-2026-53377 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: always recover the gpu |
| MEDIUM | | | | CVE-2026-53401 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: omap2: fix use-after-free in omapfb_mmap |
| MEDIUM | | | | CVE-2026-63805 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: crypto: nx - fix nx_crypto_ctx_exit argument |
| MEDIUM | | | | CVE-2026-63811 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: read COW data with the original inode during atomic write |
| MEDIUM | | | | CVE-2026-63819 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on f2fs_get_node_folio_ra() |
| MEDIUM | | 5.5 | | CVE-2026-63832 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: add wcid publish check in mt76_sta_add |
| MEDIUM | | 5.5 | | CVE-2026-63853 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring |
| MEDIUM | | | | CVE-2026-63857 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-63858 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: add hook transactions for device deletions |
| MEDIUM | | | | CVE-2026-63859 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue() |
| MEDIUM | | 7 | | CVE-2026-63941 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor |
| MEDIUM | | 7 | | CVE-2026-63979 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/handshake: hand off the pinned file reference to accept_doit |
| MEDIUM | | 5.5 | | CVE-2026-63998 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ethtool: module: call ethnl_ops_complete() on module flash errors |
| MEDIUM | | 5.5 | | CVE-2026-63999 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure |
| MEDIUM | | 5.5 | | CVE-2026-64006 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: fix dst corruption in same register operation |
| MEDIUM | | 7 | | CVE-2026-64024 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction |
| MEDIUM | | 5.5 | | CVE-2026-64036 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cgroup/rstat: validate cpu before css_rstat_cpu() access |
| MEDIUM | | 5.5 | | CVE-2026-64038 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Stop work before releasing hwmon device |
| MEDIUM | | 5.5 | | CVE-2026-64060 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix leak of request in netfs_write_begin() error handling |
| MEDIUM | | 7.1 | | CVE-2026-64066 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_read_to_pagecache() to pause on subreq failure |
| MEDIUM | | 5.5 | | CVE-2026-64067 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing barriers when accessing stream->subrequests locklessly |
| MEDIUM | | 7 | | CVE-2026-64068 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing locking around retry adding new subreqs |
| MEDIUM | | 5.5 | | CVE-2026-64076 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: bridge: eb_tables: close module init race |
| MEDIUM | | 5.5 | | CVE-2026-64077 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: ebtables: move to two-stage removal scheme |
| MEDIUM | | 7.1 | | CVE-2026-64078 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: add and use xtables_unregister_table_exit |
| MEDIUM | | 5.5 | | CVE-2026-64079 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: allocate hook ops while under mutex |
| MEDIUM | | 7 | | CVE-2026-64117 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb |
| MEDIUM | | 5.5 | | CVE-2026-64146 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix metabuf leak in inode xattr initialization |
| MEDIUM | | 5.5 | | CVE-2026-64154 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() |
| MEDIUM | | 5.5 | | CVE-2026-64159 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix zeropoint update where i_size > remote_i_size |
| MEDIUM | | 7 | | CVE-2026-64160 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point |
| MEDIUM | | 5.5 | | CVE-2026-64190 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: team: fix NULL pointer dereference in team_xmit during mode change |
| MEDIUM | | 5.5 | | CVE-2026-64212 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it |
| MEDIUM | | 5.5 | | CVE-2026-64213 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Add lock protection to lm90_alert |
| MEDIUM | | 7 | | CVE-2026-64255 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers |
| MEDIUM | | 7 | | CVE-2026-64520 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies |
| MEDIUM | | 7 | | CVE-2026-68086 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/khugepaged: write all dirty file folios when collapsing |
| MEDIUM | | 5.5 | | CVE-2026-68211 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: stm32-dcmipp: Return queued buffers on start_streaming() failure |
| MEDIUM | | 5.5 | | CVE-2026-68233 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/vc4: Shut down BO cache timer before teardown |
| MEDIUM | | 5.5 | | CVE-2026-68242 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/gt: Fix NULL deref on sched_engine alloc failure |
| MEDIUM | | 5.5 | | CVE-2026-68258 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size |
| MEDIUM | | 5.5 | | CVE-2026-68291 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: idpf driver null pointer dereference leads to Denial of Service |
| MEDIUM | | 5.5 | | CVE-2026-68295 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: BPF: Zero-extend signed ALU32 div/mod results |
| MEDIUM | | 5.5 | | CVE-2026-68312 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths |
| MEDIUM | | 7 | | CVE-2026-68323 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tipc: serialize udp bearer replicast list updates |
| MEDIUM | | 5.5 | | CVE-2026-68382 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Hold device ref until queue teardown completes |
| MEDIUM | | 5.5 | | CVE-2026-68383 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Keep scheduler timeline name alive |
| MEDIUM | | 7 | | CVE-2026-68393 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: extend conn_hash lookup critical sections |
| MEDIUM | | 6.4 | | CVE-2026-68399 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix UAF in sock clone early bailouts |
| MEDIUM | | 7 | | CVE-2026-68400 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation |
| MEDIUM | | 7 | | CVE-2026-68401 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() |
| MEDIUM | | 7 | | CVE-2026-68404 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect |
| MEDIUM | | 5.5 | | CVE-2026-68421 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() |
| MEDIUM | | 5.5 | | CVE-2026-68435 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Fix address space mismatch in kexec command line lookup |
| MEDIUM | | 5.5 | | CVE-2026-68441 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains |
| MEDIUM | | 5.5 | | CVE-2026-68447 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size |
| MEDIUM | | 7 | | CVE-2026-68448 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ovl: check access to copy_file_range source with src mounter creds |
| MEDIUM | | 7 | | CVE-2026-68453 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey |
| MEDIUM | | 5.5 | | CVE-2026-68471 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ieee80211: validate MLE common info length |
| MEDIUM | | 5.5 | | CVE-2026-72073 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mmc: vub300: fix use-after-free on probe failure |
| MEDIUM | | 5.5 | | CVE-2026-72162 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec |
| MEDIUM | | 7 | | CVE-2026-72288 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling |
| MEDIUM | | 7 | | CVE-2026-72329 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/liquidio: drop cached VF pci_dev LUT |
| MEDIUM | | 5.5 | | CVE-2026-72337 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: 6lowpan: avoid untracked enable work |
| MEDIUM | | 5.5 | | CVE-2026-72341 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Fix publication race for priv->channel_stats[] |
| MEDIUM | | 5.5 | | CVE-2026-72355 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix barriering when walking subrequest list |
| MEDIUM | | 5.5 | | CVE-2026-72365 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix writethrough to use collection offload |
| MEDIUM | | 5.5 | | CVE-2026-72367 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iomap: guard io_size EOF trim against concurrent truncate underflow |
| MEDIUM | | 5.5 | | CVE-2026-72375 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix reinitialisation of the inode, in particular ->lock_work |
| MEDIUM | | 5.5 | | CVE-2026-72380 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xen/pvcalls: bound backend response req_id before indexing rsp[] |
| MEDIUM | | 5.5 | | CVE-2026-72383 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: fix addr_wq_timer race in sctp_free_addr_wq() |
| MEDIUM | | 5.5 | | CVE-2026-72388 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock |
| MEDIUM | | 5.5 | | CVE-2026-72397 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() |
| MEDIUM | | 7 | | CVE-2026-72398 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: add INIT verification after cookie unpacking |
| MEDIUM | | 5.5 | | CVE-2026-72404 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() |
| MEDIUM | | 5.5 | | CVE-2026-72423 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Guard conntrack opts error writes |
| MEDIUM | | 5.5 | | CVE-2026-72440 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1: fix writes_pending and barrier reference leaks on write failures |
| MEDIUM | | 5.5 | | CVE-2026-72454 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() |
| MEDIUM | | 5.5 | | CVE-2026-72488 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soundwire: fix bug in sdw_add_element_group_count found by syzkaller |
| MEDIUM | | 5.5 | | CVE-2026-72493 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: serialize netif_running() check in enqueue_to_backlog() |
| MEDIUM | | 5.5 | | CVE-2026-72495 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages |
| MEDIUM | | 7 | | CVE-2026-72499 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free CQ toggle page after firmware teardown |
| MEDIUM | | 7 | | CVE-2026-72500 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown |
| MEDIUM | | | | CVE-2026-72501 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: R ... |
| MEDIUM | | 5.5 | | CVE-2026-74257 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sockmap: Fix use-after-free in udp_bpf_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-74264 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: watchdog: fix refcount tracking races |
| MEDIUM | | 5.5 | | CVE-2026-74272 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Resolve region deletion races |
| MEDIUM | | 5.5 | | CVE-2026-74273 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Block region delete during region creation |
| MEDIUM | | 5.5 | | CVE-2026-74314 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Cancel special fields on map value recycle |
| MEDIUM | | 5.5 | | CVE-2026-74317 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ixgbe: do not configure xps for XDP queues |
| MEDIUM | | 5.5 | | CVE-2026-74324 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: validate skb length in testmode query |
| MEDIUM | | 5.5 | | CVE-2026-74337 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks |
| MEDIUM | | 5.5 | | CVE-2026-74342 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: kernfs: link kn to its parent before the LSM init hook |
| MEDIUM | | 5.5 | | CVE-2026-74344 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear rb node linkage when freeing bpf_rb_root |
| MEDIUM | | 5.5 | | CVE-2026-74350 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate fast symlink target during inode read |
| MEDIUM | | 5.5 | | CVE-2026-74354 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Take mmap_lock in zap_pages() |
| MEDIUM | | 5.5 | | CVE-2026-74368 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() |
| MEDIUM | | 6.5 | | CVE-2026-74385 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock |
| MEDIUM | | 5.5 | | CVE-2026-74388 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data |
| MEDIUM | | 7 | | CVE-2026-74405 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: OPP: Fix race between OPP addition and lookup |
| MEDIUM | | 5.5 | | CVE-2026-74407 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath11k: cancel SSR work items during PCI shutdown |
| MEDIUM | | 5.5 | | CVE-2026-74449 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport |
| MEDIUM | | 5.5 | | CVE-2026-74466 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Close speculative mem read possibility |
| MEDIUM | | 7 | | CVE-2026-74506 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix UAF when sending a message |
| MEDIUM | | 7 | | CVE-2026-74513 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister |
| MEDIUM | | 5.5 | | CVE-2026-74527 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-af: Block VFs from clobbering special CGX PKIND state |
| MEDIUM | | 5.5 | | CVE-2026-74529 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback |
| MEDIUM | | 5.5 | | CVE-2026-74530 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback |
| MEDIUM | | 7 | | CVE-2026-74533 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero |
| MEDIUM | | 7 | | CVE-2026-74537 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: hold sk properly in iso_conn_ready |
| MEDIUM | | 5.5 | | CVE-2026-74538 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: lock sk in iso_connect_ind |
| MEDIUM | | 5.5 | | CVE-2026-74542 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix folio_queue ENOMEM in writeback by adding a mempool |
| MEDIUM | | 5.5 | | CVE-2026-74544 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds |
| MEDIUM | | 5.5 | | CVE-2026-74600 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/page_table_check: skip special zero mappings |
| MEDIUM | | 5.5 | | CVE-2026-74605 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: eventfs: Use children field for rcu head and add memory barriers |
| MEDIUM | | 7 | | CVE-2026-74611 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tls: rx: restore msg_iter before TLS 1.3 optimistic retry |
| MEDIUM | | 5.5 | | CVE-2026-74638 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Serialize the scheduler timeout handlers |
| MEDIUM | | 5.5 | | CVE-2026-74687 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: watchdog: at91sam9_wdt: prevent timer rearm during teardown |
| MEDIUM | | 7 | | CVE-2026-74695 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() |
| MEDIUM | | 7 | | CVE-2026-74697 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Disable EOP for TPA on all chips to prevent data corruption |
| MEDIUM | | 5.5 | | CVE-2026-74711 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus) Fix type confusion in notification logic |
| MEDIUM | | 5.5 | | CVE-2026-74713 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vhost_iotlb: bound map allocation in add_range |
| MEDIUM | | 7 | | CVE-2026-74715 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix netns reference imbalance in conntrack kfuncs |
| MEDIUM | | 5.5 | | CVE-2026-74723 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject inline extents without valid headers |
| MEDIUM | | 5.5 | | CVE-2026-74729 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read |
| MEDIUM | | 5.5 | | CVE-2026-74747 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipvs: revalidate ihl to prevent out-of-bounds access |
| MEDIUM | | 5.5 | | CVE-2026-80579 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: clear fb_info->mode before deleting a videomode |
| MEDIUM | | 5.5 | | CVE-2026-80580 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: bound mode sysfs output to the sysfs buffer |
| MEDIUM | | 5.5 | | CVE-2026-80614 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: emac: Fix NULL pointer dereference in emac_probe |
| MEDIUM | | 5.5 | | CVE-2026-80623 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: ete: Always save state on power down |
| MEDIUM | | 5.5 | | CVE-2026-80628 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Serialize readq reset state with q->lock |
| MEDIUM | | 5.5 | | CVE-2026-80631 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject compressed segment that overflows the compressed input |
| MEDIUM | | 5.5 | | CVE-2026-80634 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag |
| MEDIUM | | 5.5 | | CVE-2026-80655 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soc: xilinx: Fix race condition in event registration |
| MEDIUM | | 5.5 | | CVE-2026-80662 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size |
| MEDIUM | | 7 | | CVE-2026-80668 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations |
| MEDIUM | | 5.5 | | CVE-2026-80670 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() |
| MEDIUM | | 5.5 | | CVE-2026-80692 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks |
| MEDIUM | | 7 | | CVE-2026-80693 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: idpf: bound interrupt-vector register fill to the allocated array |
| MEDIUM | | 5.5 | | CVE-2026-80698 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: idxd: fix double free of wq, engine, and group structs |
| MEDIUM | | 5.5 | | CVE-2026-80721 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: ensure no dangling hcon references in iso_conn |
| MEDIUM | | | | CVE-2026-80761 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| MEDIUM | | 5.5 | | CVE-2026-80905 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: tap: fix wrong transport_header when sending VLAN-tagged frame |
| MEDIUM | | 5.5 | | CVE-2026-80920 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring: defer eventfd signaling when queued from a wakeup handler |
| MEDIUM | | 5.5 | | CVE-2026-81010 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/waitid: honor task_work cancellation |
| MEDIUM | | 7 | | CVE-2026-89528 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Reject Read lists that exceed the page budget |
| MEDIUM | | 4.8 | | CVE-2026-89534 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| MEDIUM | | 7 | | CVE-2026-89537 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 |
| MEDIUM | | 7.2 | | CVE-2026-89610 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs: verify run length exceeding volume boundary |
| MEDIUM | | 5.5 | | CVE-2026-89611 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs: validate non-resident attribute offsets |
| MEDIUM | | 7.1 | | CVE-2026-89632 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() |
| MEDIUM | | 7 | | CVE-2026-89637 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 |
| MEDIUM | | 5.5 | | CVE-2026-89639 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC |
| MEDIUM | | 3.3 | | CVE-2026-89642 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cifs: call pagecache_isize_extended() in cifs_setsize() when extending |
| MEDIUM | | 6.2 | | CVE-2026-89648 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ceph: cap delegated inode count in ceph_parse_deleg_inos() |
| MEDIUM | | 7 | | CVE-2026-89654 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix UAF in check_new_map() on session freed during unlock |
| MEDIUM | | 5.3 | | CVE-2026-89682 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net |
| MEDIUM | | 5.3 | | CVE-2026-89705 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths |
| MEDIUM | | 5.9 | | CVE-2026-89709 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: lockd, nfsd: RCU-protect nlmsvc_ops dispatch |
| MEDIUM | | 5.5 | | CVE-2026-89722 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() |
| MEDIUM | | 5.5 | | CVE-2026-89757 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/mglru: fix and remove redundant unevictable folio handling |
| MEDIUM | | 4.7 | | CVE-2026-89810 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix error path at svm_migrate_copy_to_ram |
| MEDIUM | | | | CVE-2026-89826 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| MEDIUM | | | | CVE-2026-89833 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| MEDIUM | | | | CVE-2026-89866 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| MEDIUM | | | | CVE-2026-89906 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| MEDIUM | | 4.7 | | CVE-2026-89913 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables |
| MEDIUM | | 4.7 | | CVE-2026-89920 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Fix memory corruption by not reinjecting CK machine checks |
| MEDIUM | | | | CVE-2026-89935 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 3.6 | | CVE-2026-89987 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/huge_memory: transfer the pmd dirty bit to the folio on zap |
| MEDIUM | | 5.5 | | CVE-2026-90040 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped |
| MEDIUM | | 5.5 | | CVE-2026-90061 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: skip double clone set expressions on element insert |
| MEDIUM | | 5.5 | | CVE-2026-90083 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: act_ife: Only operate on Ethernet frames |
| MEDIUM | | 5.5 | | CVE-2026-90087 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: do not leak an hci_conn when a second LE connect is rejected |
| MEDIUM | | 7 | | CVE-2026-90093 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: access chan->conn safely in get/setsockopt |
| MEDIUM | | 5.5 | | CVE-2026-90098 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: fix sleep in atomic context in MAC table access |
| MEDIUM | | 7 | | CVE-2026-90099 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: account classifier filter allocations to memcg |
| MEDIUM | | 7 | | CVE-2026-90104 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFSv4.1: zero referring call lists before decoding |
| MEDIUM | | 5.5 | | CVE-2026-90105 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vxlan: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90106 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: arp/nd proxy: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90116 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: mtpav: shut down output timer before card teardown |
| MEDIUM | | 5.5 | | CVE-2026-90142 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix resize of the RX ring |
| MEDIUM | | 5.5 | | CVE-2026-90149 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers |
| MEDIUM | | 5.5 | | CVE-2026-90154 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: scope session state changes to bound connections |
| MEDIUM | | 5.5 | | CVE-2026-90155 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: detach blocked lock requests before freeing |
| MEDIUM | | 5.5 | | CVE-2026-90156 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely discard unregistered deferred locks |
| MEDIUM | | 7 | | CVE-2026-90161 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix interlaced ztailpacking pclusters |
| MEDIUM | | 5.5 | | CVE-2026-90162 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: defer publishing granted locks to prevent UAF/double-free race |
| MEDIUM | | 5.5 | | CVE-2026-90167 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: serialize oplock close with pending break ownership |
| MEDIUM | | 5.5 | | CVE-2026-90174 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() |
| MEDIUM | | 5.5 | | CVE-2026-90177 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check pointer type for all atomic RMW paths |
| MEDIUM | | 5.5 | | CVE-2026-90179 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix deadlock in complain-mode change_hat |
| MEDIUM | | 5.5 | | CVE-2026-90204 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate DIO orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90205 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90208 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type |
| MEDIUM | | 5.5 | | CVE-2026-90217 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Compare iterator types during state pruning |
| MEDIUM | | 5.5 | | CVE-2026-90231 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix unconfined user namespace restriction forced stack |
| MEDIUM | | 5.5 | | CVE-2026-90232 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: amt: Don't support cross-netns setup |
| MEDIUM | | 5.1 | | CVE-2026-90234 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFS: Return a delegation the client fails to record |
| MEDIUM | | 7 | | CVE-2026-90237 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nft_ct: move custom expectation support to helper |
| MEDIUM | | 7 | | CVE-2026-90240 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Flush context cache with correct SID when tearing down aliases |
| MEDIUM | | 5.5 | | CVE-2026-90247 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix mmap_lock leak in irq_work path |
| MEDIUM | | 5.9 | | CVE-2026-90256 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind |
| MEDIUM | | 5.5 | | CVE-2026-90259 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() |
| MEDIUM | | 4.7 | | CVE-2026-90260 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: don't clobber the extent buffer when zeroing it out |
| MEDIUM | | 3.3 | | CVE-2026-90263 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: check if root is readonly when setting posix acl |
| MEDIUM | | 5.5 | | CVE-2026-90264 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: always wait for ordered extents to avoid OE races |
| MEDIUM | | 5.5 | | CVE-2026-90265 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: defrag: fix deadlock between defrag and delalloc space reservation |
| MEDIUM | | 5.5 | | CVE-2026-90273 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable |
| MEDIUM | | 5.5 | | CVE-2026-90289 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Resize MST HDCP per-connector arrays to 32 |
| MEDIUM | | 5.5 | | CVE-2026-90300 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear buf on error in __bpf_get_task_stack |
| MEDIUM | | 5.5 | | CVE-2026-90301 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: o2hb: quiesce negotiate handlers and timeout work |
| MEDIUM | | 7 | | CVE-2026-90317 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Invalidate RCU pointers after final spin unlock |
| MEDIUM | | 5.5 | | CVE-2026-90320 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate external xattr entries when reading metadata |
| MEDIUM | | 5.5 | | CVE-2026-90321 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate inline xattrs during inode block validation |
| MEDIUM | | 5.5 | | CVE-2026-90324 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ublk: check import_ubuf() return value |
| MEDIUM | | 4.7 | | CVE-2026-90326 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-cgroup: fix race between policy activation and blkg destruction |
| MEDIUM | | 5.5 | | CVE-2026-90328 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: HID: steam: Reject short reads |
| MEDIUM | | 6.4 | | CVE-2026-90333 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dm-integrity: replace forgeable discard filler with a keyed sector marker |
| MEDIUM | | 4.1 | | CVE-2026-90336 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: clear freed pointers on uart_register_driver() failure |
| MEDIUM | | 5.5 | | CVE-2026-90337 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: do fallible allocations before the console can be registered |
| MEDIUM | | 7 | | CVE-2026-90343 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: stop PMSR before P2P and NAN teardown |
| MEDIUM | | 5.5 | | CVE-2026-90345 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: brcmfmac: fix P2P action frame handling without device vif |
| MEDIUM | | 7 | | CVE-2026-90347 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry |
| MEDIUM | | 5.5 | | CVE-2026-90351 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed |
| MEDIUM | | 4.4 | | CVE-2026-90359 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject >8 byte return values on return-reading trampoline paths |
| MEDIUM | | 5.5 | | CVE-2026-90363 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: don't tear down KMS twice when KMS init fails |
| MEDIUM | | 5.5 | | CVE-2026-90365 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: cancel reset and rc work on device unregister |
| MEDIUM | | 5.5 | | CVE-2026-90367 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER |
| MEDIUM | | 4.8 | | CVE-2026-90379 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash |
| MEDIUM | | 3.3 | | CVE-2026-90401 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md: remove REQ_NOWAIT support from raid1/10/456 |
| MEDIUM | | 5.5 | | CVE-2026-90408 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() |
| MEDIUM | | 5.5 | | CVE-2026-90409 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Add vm_bind region with kbo range overlap check |
| MEDIUM | | 4.7 | | CVE-2026-90417 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() |
| MEDIUM | | 5.5 | | CVE-2026-90421 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI: Fix UAF when probe runs concurrent to dyn ID removal |
| MEDIUM | | 5.5 | | CVE-2026-90422 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path |
| MEDIUM | | 4.7 | | CVE-2026-90427 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() |
| MEDIUM | | 5.5 | | CVE-2026-92480 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Validate string descriptors |
| MEDIUM | | 5.5 | | CVE-2026-92482 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip |
| MEDIUM | | 3.3 | | CVE-2026-92485 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix WARNING in bpf_tracing_link_release |
| MEDIUM | | 5.5 | | CVE-2026-92499 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext4: validate readdir offset before accessing dirent |
| MEDIUM | | 4.7 | | CVE-2026-92500 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext4: use fsdata to track inline data write state and fix race |
| MEDIUM | | 5.5 | | CVE-2026-92503 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() |
| MEDIUM | | 5.5 | | CVE-2026-92518 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv, bpf: Fix kernel stack corruption in tailcall with CFI |
| MEDIUM | | 5.5 | | CVE-2026-92520 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Zero queue and stack outputs on lock failure |
| MEDIUM | | 5.5 | | CVE-2026-93044 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for arena-related insns |
| MEDIUM | | 5.5 | | CVE-2026-93047 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Associate BOs with every job that accesses them |
| MEDIUM | | 5.5 | | CVE-2026-93058 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Only fini scheduler after successful init |
| MEDIUM | | 5.5 | | CVE-2026-93081 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_scmi: Fix SCMI device destroy lifetimes |
| MEDIUM | | 4.7 | | CVE-2026-93099 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Fix UAF from worker threads when domains are removed |
| MEDIUM | | 4.7 | | CVE-2026-93100 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() |
| MEDIUM | | 4.7 | | CVE-2026-93104 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rvt: Return NULL after port allocation failure |
| MEDIUM | | 7 | | CVE-2026-93105 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: esp: do not unref managed frag pages in esp_ssg_unref() |
| MEDIUM | | 5.5 | | CVE-2026-93122 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: usb: gadget: uac: validate rate list length before storing |
| MEDIUM | | 5.5 | | CVE-2026-93135 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject programs with inlined helpers if JIT is not available |
| MEDIUM | | 7 | | CVE-2026-93148 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject MEM_ALLOC BTF accesses past object bounds |
| MEDIUM | | 7 | | CVE-2026-93154 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Add refcounting to user ring MRs |
| MEDIUM | | 5.5 | | CVE-2026-93168 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout |
| MEDIUM | | 5.5 | | CVE-2026-93175 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in CRTC reset function |
| MEDIUM | | 4.7 | | CVE-2026-93176 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in plane reset function |
| MEDIUM | | 5.5 | | CVE-2026-93270 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn |
| MEDIUM | | 5.5 | | CVE-2026-93272 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 |
| MEDIUM | | 5.5 | | CVE-2026-93276 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator |
| MEDIUM | | 5.5 | | CVE-2026-93282 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix maximum allowed access checks |
| MEDIUM | | 7.1 | | CVE-2026-97422 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: fix SMI event cross-process information leak |
| MEDIUM | | 5.5 | | CVE-2026-97432 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: fix P2P-Device binding handling |
| MEDIUM | | 5.5 | | CVE-2026-97478 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virt: acrn: Fix irqfd use-after-free during eventfd shutdown |
| MEDIUM | | 7.1 | | CVE-2026-97493 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS |
| MEDIUM | | 5.5 | | CVE-2026-97499 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: perf: Retrieve path and source from event data |
| MEDIUM | | 5.5 | | CVE-2026-97513 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Release m2m_ctx after Instance Removed from List |
| MEDIUM | | 5.5 | | CVE-2026-97515 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 |
| MEDIUM | | 5.5 | | CVE-2026-97526 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/pai: Support CPU hotplug for PMU PAI |
| MEDIUM | | 5.5 | | CVE-2026-97538 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (asus_rog_ryujin) Validate HID report lengths |
| MEDIUM | | 5.5 | | CVE-2026-97554 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() |
| MEDIUM | | 7 | | CVE-2026-97561 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid |
| MEDIUM | | 7 | | CVE-2026-97563 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97565 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject short READ responses in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97960 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel: Prevent drain_pebs() reentry |
| MEDIUM | | 5.5 | | CVE-2026-97962 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Move representor vnic reporter to eswitch devlink port |
| MEDIUM | | 5.1 | | CVE-2026-97975 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() |
| MEDIUM | | 4.7 | | CVE-2026-97988 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vhost: invalidate vring access on IOTLB transitions |
| MEDIUM | | 5.5 | | CVE-2026-98019 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: mark a NULL call argument precise |
| MEDIUM | | 5.3 | | CVE-2026-98032 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tracing: Fix subbuf resize races with trace_pipe_raw readers |
| MEDIUM | | 7 | | CVE-2026-98033 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Preserve inner map identity in callback frames |
| MEDIUM | | 7 | | CVE-2026-98034 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark NULL kptr stores precise |
| MEDIUM | | 5.5 | | CVE-2026-98043 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Don't infer non-NULL from a pointer with an unbounded offset |
| MEDIUM | | 7 | | CVE-2026-98047 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check ancestor frames for rbtree callbacks |
| MEDIUM | | 7 | | CVE-2026-98048 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: don't rewrite bpf_fastcall patterns entered by a jump |
| MEDIUM | | 5.5 | | CVE-2026-98049 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: zero extend the result of an arena 32-bit cmpxchg |
| MEDIUM | | 5.5 | | CVE-2026-98053 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Refactor and fix init_config access |
| MEDIUM | | 5.5 | | CVE-2026-98062 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark signal tracepoint siginfo arguments as scalar |
| MEDIUM | | 5.5 | | CVE-2026-98085 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge |
| MEDIUM | | | | CVE-2026-98099 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 5.5 | | CVE-2026-98115 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely drain sessions during logoff |
| MEDIUM | | 5.5 | | CVE-2026-98118 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix readahead synchronisation issues by loading all folios upfront |
| MEDIUM | | 5.5 | | CVE-2026-98124 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/client: invalidate fscache for fallocate range operations |
| MEDIUM | | 5.5 | | CVE-2026-98125 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix stale page cache in insert/collapse range |
| MEDIUM | | 5.5 | | CVE-2026-98131 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix dma mapping leak in stmmac_tso_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-98134 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: check_cond_jmp_op(): properly infer if register is null |
| MEDIUM | | 5.3 | | CVE-2026-98156 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/virtio: use the DMA API for resource backing on Xen |
| MEDIUM | | 5.5 | | CVE-2026-98162 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/server: fix tree connection leak in smb2_tree_connect() |
| MEDIUM | | 5.5 | | CVE-2026-98180 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: RCU-free the scheduler-containing ring and VM objects |
| MEDIUM | | 5.5 | | CVE-2026-98228 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ |
| MEDIUM | | 4.4 | | CVE-2026-98273 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: x86/kprobes: Fix crash when probing CS CALL instructions |
| MEDIUM | | 5.5 | | CVE-2026-98277 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: ring the doorbell if a burst ends in a drop |
| MEDIUM | | 5.5 | | CVE-2026-98279 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: handle lack of space when cleaning up verity items |
| MEDIUM | | 5.3 | | CVE-2026-98284 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netlink: do not free nlk->groups while lockless readers can use it |
| MEDIUM | | 4.1 | | CVE-2026-98286 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown |
| MEDIUM | | 5.5 | | CVE-2026-98288 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix TSO header length truncation |
| MEDIUM | | 5.5 | | CVE-2026-98292 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| MEDIUM | | 5.5 | | CVE-2026-98294 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_qca: Do not write to the serial port after it is closed |
| MEDIUM | | 7 | | CVE-2026-98296 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btintel_pcie: validate TX skb length in send_sync |
| MEDIUM | | 5.5 | | CVE-2026-98313 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/dp: skip PUSH_IDLE when the link was never enabled |
| MEDIUM | | 7 | | CVE-2026-98330 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: get the wiphy out of a dying network namespace |
| MEDIUM | | 5.5 | | CVE-2026-98333 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: reset the LED state when ifup fails |
| MEDIUM | | 7 | | CVE-2026-98341 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: don't free driver-owned scan requests |
| MEDIUM | | 5.5 | | CVE-2026-98353 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables |
| MEDIUM | | 5.5 | | CVE-2026-98355 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rtrs: guard against null kobj name |
| MEDIUM | | 5.5 | | CVE-2026-98376 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Use array_map_meta_equal for percpu array inner map replacement |
| MEDIUM | | 5.5 | | CVE-2026-98408 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: watchdog: rzv2h: Avoid division by zero |
| MEDIUM | | 5.5 | | CVE-2026-98420 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: follow SMB2 session expiration semantics |
| MEDIUM | | | | CVE-2026-98436 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: a ... |
| MEDIUM | | 6.5 | | CVE-2026-98439 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/server: cancel async requests when closing connection |
| MEDIUM | | 4.7 | | CVE-2026-98444 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: drop dquot flush lock when we can't find a buffer to flush |
| MEDIUM | | 6.5 | | CVE-2026-98449 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: delete compound mids on send failure before unlock |
| MEDIUM | | 5.3 | | CVE-2026-98471 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Do cache maintenance on the source VM during intra-host migration |
| MEDIUM | | 5.5 | | CVE-2026-98556 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gve: DQO: reject TSO packets with an out of range MSS |
| MEDIUM | | 4.1 | | CVE-2026-98558 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: flush skb_defer_nodes in dev_cpu_dead() |
| MEDIUM | | 5.9 | | CVE-2026-98570 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: ipv6: keep room for the mac header in dst_dev_overhead() |
| MEDIUM | | 6.7 | | CVE-2026-98589 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject pkt arguments in mutating subprogs |
| MEDIUM | | 4.7 | | CVE-2026-98598 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv6: Prevent rt6_insert_exception() for dying fib6_info |
| MEDIUM | | 6.7 | | CVE-2026-98599 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() |
| MEDIUM | | 4.1 | | CVE-2026-98616 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: reset num_napi when the napi vectors are freed |
| MEDIUM | | 5.5 | | CVE-2026-98652 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Add missing srcu in kvm_s390_set_irq_state() |
| MEDIUM | | 5.5 | | CVE-2026-98674 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iio: adc: adi-axi-adc: Initialize state mutex |
| MEDIUM | | 5.6 | | CVE-2026-98714 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| MEDIUM | | 4.1 | | CVE-2026-98740 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety |
| MEDIUM | | 4.4 | | CVE-2026-98747 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix NULL pointer dereference in serial_core_unregister_port() |
| MEDIUM | | 4.7 | | CVE-2026-98786 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: guard dc_sink dereferences in MST mode validation |
| MEDIUM | | 4.4 | | CVE-2026-98789 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix objects stuck in free_by_rcu_ttrace |
| MEDIUM | | 4.4 | | CVE-2026-98795 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: skip ptp deinit if init was skipped |
| MEDIUM | | 4.4 | | CVE-2026-98799 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Skip detached progs in trampoline images that are still in use |
| MEDIUM | | 4.7 | | CVE-2026-98800 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: kernel: Denial of Service via use-after-free in BPF trampoline |
| MEDIUM | | 6.5 | | CVE-2026-98803 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix rx Scatter-Gather support |
| MEDIUM | | 6.1 | | CVE-2026-98810 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() |
| MEDIUM | | 4.4 | | CVE-2026-98813 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Hold map BTF for the memory allocator destructor record |
| MEDIUM | | 4.4 | | CVE-2026-98814 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix command effects log lifetime for multipath heads |
| MEDIUM | | 4.1 | | CVE-2026-98815 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix cdev lifetime |
| MEDIUM | | 4.1 | | CVE-2026-98816 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix overflow of jump offset in constant blinding |
| MEDIUM | | 5.5 | | CVE-2026-98820 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: set RQF_USE_SCHED when the operation is known |
| MEDIUM | | 5.3 | | CVE-2026-98824 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate TX status rate metadata |
| MEDIUM | | 6.5 | | CVE-2026-98829 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: drop oversized fragments to avoid extra_len overflow |
| MEDIUM | | 4.1 | | CVE-2026-98834 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mtd: core: avoid double-free of OTP NVMEM device |
| MEDIUM | | 6.1 | | CVE-2026-98839 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() |
| MEDIUM | | 4.4 | | CVE-2026-98843 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: zero gaps in read-gaps folio to avoid writing back stale data |
| MEDIUM | | 5.6 | | CVE-2026-98863 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| MEDIUM | | 4.6 | | CVE-2019-15213 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: use-after-free caused by malicious USB device in drivers/media/usb/dvb-usb/dvb-usb-init.c |
| MEDIUM | | 4.1 | | CVE-2019-16089 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Improper return check in nbd_genl_status function in drivers/block/nbd.c |
| MEDIUM | | 4.7 | | CVE-2019-20794 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: task processes not being properly ended could lead to resource exhaustion |
| MEDIUM | | 4.4 | | CVE-2020-14304 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ethtool when reading eeprom of device could lead to memory leak |
| MEDIUM | | 6.7 | | CVE-2020-36694 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: use-after-free in the packet processing context |
| MEDIUM | | 5.5 | | CVE-2023-31082 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sleeping function called from an invalid context in gsmld_write |
| MEDIUM | | 7 | | CVE-2023-3397 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: slab-use-after-free Write in txEnd due to race condition |
| MEDIUM | | 5.5 | | CVE-2023-37454 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: udf: use-after-free write in udf_close_lvid |
| MEDIUM | | 6.7 | | CVE-2023-6238 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvme: memory corruption via unprivileged user passthrough |
| MEDIUM | | 6.5 | | CVE-2023-6240 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation |
| MEDIUM | | 5.5 | | CVE-2024-2193 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | hw: Spectre-SRC that is Speculative Race Conditions (SRCs) for synchronization primitives similar like Spectre V1 with p |
| MEDIUM | | 4.7 | | CVE-2024-24864 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | A race condition was found in the Linux kernel's media/dvb-core in dvb ... |
| MEDIUM | | 5.5 | | CVE-2024-25740 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory leak in ubi driver |
| MEDIUM | | 5.5 | | CVE-2024-56709 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring: check if iowq is killed before queuing |
| MEDIUM | | 5.5 | | CVE-2024-58074 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/i915: Grab intel_display from the encoder to avoid potential oopsies |
| MEDIUM | | 5.5 | | CVE-2025-21752 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents |
| MEDIUM | | 5.5 | | CVE-2025-21949 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Set hugetlb mmap base address aligned with pmd size |
| MEDIUM | | 5.5 | | CVE-2025-22109 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ax25: Remove broken autobind |
| MEDIUM | | 5.5 | | CVE-2025-23132 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: quota: fix to avoid warning in dquot_writeback_dquots() |
| MEDIUM | | 5.5 | | CVE-2025-23135 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Teardown riscv specific bits after kvm_exit |
| MEDIUM | | 5.5 | | CVE-2025-37743 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Avoid memory leak while enabling statistics |
| MEDIUM | | 5.5 | | CVE-2025-37746 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/dwc_pcie: fix duplicate pci_dev devices |
| MEDIUM | | 5.5 | | CVE-2025-37880 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: um: work around sched_yield not yielding in time-travel mode |
| MEDIUM | | 4.7 | | CVE-2025-37906 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: ublk race condition causes kernel crash |
| MEDIUM | | 5.5 | | CVE-2025-38029 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to sleepable page allocation in KASAN |
| MEDIUM | | 5.5 | | CVE-2025-38036 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to null pointer dereference in GT MMIO initialization for VFs |
| MEDIUM | | 5.5 | | CVE-2025-38041 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clk: sunxi-ng: h616: Reparent GPU clock during frequency changes |
| MEDIUM | | 5.5 | | CVE-2025-38042 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn |
| MEDIUM | | 6.7 | | CVE-2025-38064 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio: break and reset virtio devices on device_shutdown() |
| MEDIUM | | 5.5 | | CVE-2025-38132 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: holding cscfg_csdev_lock while removing cscfg from csdev |
| MEDIUM | | 5.5 | | CVE-2025-38140 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Local denial of service in device mapper |
| MEDIUM | | 5.5 | | CVE-2025-38199 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix memory leak due to multiple rx_stats allocation |
| MEDIUM | | 5.5 | | CVE-2025-38207 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm: fix uprobe pte be overwritten when expanding vma |
| MEDIUM | | 5.5 | | CVE-2025-38261 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv: save the SR_SUM status over switches |
| MEDIUM | | 5.5 | | CVE-2025-38284 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: configure manual DAC mode via PCI config API only |
| MEDIUM | | 5.5 | | CVE-2025-38311 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel (iavf): Denial of Service due to a locking issue |
| MEDIUM | | 5.5 | | CVE-2025-38359 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Fix in_atomic() handling in do_secure_storage_access() |
| MEDIUM | | 5.5 | | CVE-2025-38597 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port |
| MEDIUM | | 5.5 | | CVE-2025-38605 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() |
| MEDIUM | | 5.5 | | CVE-2025-39677 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Fix backlog accounting in qdisc_dequeue_internal |
| MEDIUM | | 5.5 | | CVE-2025-39762 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: add null check |
| MEDIUM | | 5.5 | | CVE-2025-39775 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: mremap local denial of service |
| MEDIUM | | 5.5 | | CVE-2025-39789 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: crypto: x86/aegis - Add missing error checks |
| MEDIUM | | 6.1 | | CVE-2025-39822 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/kbuf: fix signedness in this_len calculation |
| MEDIUM | | 5.5 | | CVE-2025-39830 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path |
| MEDIUM | | 5.5 | | CVE-2025-39834 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow |
| MEDIUM | | 6.2 | | CVE-2025-39910 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() |
| MEDIUM | | 7.1 | | CVE-2025-39933 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length |
| MEDIUM | | 2.5 | | CVE-2025-40113 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E |
| MEDIUM | | 6.8 | | CVE-2025-40130 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling |
| MEDIUM | | 6.2 | | CVE-2025-40146 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: fix potential deadlock while nr_requests grown |
| MEDIUM | | 5.2 | | CVE-2025-40217 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pidfs: validate extensible ioctls |
| MEDIUM | | | | CVE-2025-40247 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Fix pgtable prealloc error path |
| MEDIUM | | 5.2 | | CVE-2025-40338 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Do not share the name pointer between components |
| MEDIUM | | 6.1 | | CVE-2025-40355 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sysfs: check visibility before changing group attribute ownership |
| MEDIUM | | 5.5 | | CVE-2025-68209 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mlx5: Fix default values in create CQ |
| MEDIUM | | 5.5 | | CVE-2025-68236 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service during UFS power down |
| MEDIUM | | 5.5 | | CVE-2025-68304 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_core: lookup hci_conn on RX path on protocol side |
| MEDIUM | | | | CVE-2025-68318 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL |
| MEDIUM | | 6.1 | | CVE-2025-68319 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netconsole: Acquire su_mutex before navigating configs hierarchy |
| MEDIUM | | 5.5 | | CVE-2025-68353 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service via NULL pointer dereference in VXLAN module |
| MEDIUM | | 4.5 | | CVE-2025-68360 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks |
| MEDIUM | | 5.5 | | CVE-2025-68368 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service in md driver via uninitialized bioset |
| MEDIUM | | 6.5 | | CVE-2025-68729 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix MSDU buffer types handling in RX error path |
| MEDIUM | | 5.5 | | CVE-2025-68730 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() |
| MEDIUM | | 4.7 | | CVE-2025-68745 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset |
| MEDIUM | | 7.8 | | CVE-2025-71074 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel functionfs: Use-After-Free vulnerability due to open/removal races |
| MEDIUM | | 5.5 | | CVE-2025-71117 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service via deadlock in block layer sysfs store callbacks |
| MEDIUM | | 5.5 | | CVE-2025-71141 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/tilcdc: Fix removal actions in case of failed probe |
| MEDIUM | | 5.5 | | CVE-2025-71188 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: lpc18xx-dmamux: fix device leak on route allocation |
| MEDIUM | | 6.5 | | CVE-2025-71202 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Memory Corruption and Kernel Crashes via IOMMU SVA coherency issue |
| MEDIUM | | 5.5 | | CVE-2025-71227 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: don't WARN for connections on invalid channels |
| MEDIUM | | 5.5 | | CVE-2025-71285 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels |
| MEDIUM | | 5.5 | | CVE-2025-71302 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: fix for dma-fence safe access rules |
| MEDIUM | | 7 | | CVE-2025-71313 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI: endpoint: Add missing NULL check for alloc_workqueue() |
| MEDIUM | | 5.5 | | CVE-2025-71315 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/vkms: Convert to DRM's vblank timer |
| MEDIUM | | 5.5 | | CVE-2026-100074 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| MEDIUM | | 5.5 | | CVE-2026-100076 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths |
| MEDIUM | | 5.5 | | CVE-2026-100077 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Recover HW before retire hung submit |
| MEDIUM | | 5.5 | | CVE-2026-23007 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: block: zero non-PI portion of auto integrity buffer |
| MEDIUM | | 5.5 | | CVE-2026-23017 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: idpf: fix error handling in the init_task on load |
| MEDIUM | | 5.5 | | CVE-2026-23143 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix misalignment bug in struct virtnet_info |
| MEDIUM | | 7.1 | | CVE-2026-23152 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: correctly decode TTLM with default link map |
| MEDIUM | | 5.5 | | CVE-2026-23217 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv: trace: fix snapshot deadlock with sbi ecall |
| MEDIUM | | 5.5 | | CVE-2026-23259 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/rw: free potentially allocated iovec on cache put failure |
| MEDIUM | | 5.5 | | CVE-2026-23265 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer in {read,write}_end_io |
| MEDIUM | | 5.5 | | CVE-2026-23348 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix race of nvdimm_bus object when creating nvdimm objects |
| MEDIUM | | 5.5 | | CVE-2026-23371 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting |
| MEDIUM | | 5.5 | | CVE-2026-23377 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz |
| MEDIUM | | 5.5 | | CVE-2026-23385 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: clone set on flush only |
| MEDIUM | | 5.5 | | CVE-2026-23472 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN |
| MEDIUM | | 5.5 | | CVE-2026-31435 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix read abandonment during retry |
| MEDIUM | | 5.5 | | CVE-2026-31526 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix exception exit lock checking for subprogs |
| MEDIUM | | 5.5 | | CVE-2026-31537 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: server: make use of smbdirect_socket.send_io.bcredits |
| MEDIUM | | 5.5 | | CVE-2026-31562 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register |
| MEDIUM | | 5.5 | | CVE-2026-31579 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit |
| MEDIUM | | 5.5 | | CVE-2026-31591 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish |
| MEDIUM | | 5.5 | | CVE-2026-31592 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock |
| MEDIUM | | 5.5 | | CVE-2026-31630 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rxrpc: proc: size address buffers for %pISpc output |
| MEDIUM | | 7.1 | | CVE-2026-31692 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns |
| MEDIUM | | 5.5 | | CVE-2026-31771 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_event: move wake reason storage into validated event handlers |
| MEDIUM | | 5.5 | | CVE-2026-31777 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: ctxfi: Check the error for index mapping |
| MEDIUM | | 5.5 | | CVE-2026-43009 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix incorrect pruning due to atomic fetch precision tracking |
| MEDIUM | | 5.5 | | CVE-2026-43022 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists |
| MEDIUM | | 5.5 | | CVE-2026-43029 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mptcp: fix soft lockup in mptcp_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-43034 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: set backing store type from query type |
| MEDIUM | | 7.1 | | CVE-2026-43042 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mpls: add seqcount to protect the platform_label{,s} pair |
| MEDIUM | | 5.5 | | CVE-2026-43048 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: HID: core: Mitigate potential OOB by removing bogus memset() |
| MEDIUM | | 5.5 | | CVE-2026-43053 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: close crash window in attr dabtree inactivation |
| MEDIUM | | 5.5 | | CVE-2026-43083 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: ioam6: fix OOB and missing lock |
| MEDIUM | | 5.5 | | CVE-2026-43101 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() |
| MEDIUM | | 5.5 | | CVE-2026-43115 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: srcu: Use irq_work to start GP in tiny SRCU |
| MEDIUM | | 5.5 | | CVE-2026-43118 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix zero size inode with non-zero size after log replay |
| MEDIUM | | 5.5 | | CVE-2026-43127 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs3: fix circular locking dependency in run_unpack_ex |
| MEDIUM | | 5.5 | | CVE-2026-43172 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: fix 22000 series SMEM parsing |
| MEDIUM | | 5.5 | | CVE-2026-43191 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 |
| MEDIUM | | 5.5 | | CVE-2026-43204 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: qcom: q6asm: drop DSP responses for closed data streams |
| MEDIUM | | 5.5 | | CVE-2026-43213 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: validate sequence number of TX release report |
| MEDIUM | | 5.5 | | CVE-2026-43234 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: team: avoid NETDEV_CHANGEMTU event when unregistering slave |
| MEDIUM | | 5.5 | | CVE-2026-43272 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ring-buffer: Fix possible dereference of uninitialized pointer |
| MEDIUM | | 5.5 | | CVE-2026-43294 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels |
| MEDIUM | | 5.5 | | CVE-2026-43298 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Skip vcn poison irq release on VF |
| MEDIUM | | 5.5 | | CVE-2026-43299 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() |
| MEDIUM | | 5.5 | | CVE-2026-43301 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix PM runtime usage count underflow |
| MEDIUM | | 5.5 | | CVE-2026-43308 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() |
| MEDIUM | | 5.5 | | CVE-2026-43309 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md raid: fix hang when stopping arrays with metadata through dm-raid |
| MEDIUM | | 5.5 | | CVE-2026-43310 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC |
| MEDIUM | | 5.5 | | CVE-2026-43311 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soc/tegra: pmc: Fix unsafe generic_handle_irq() call |
| MEDIUM | | 5.5 | | CVE-2026-43325 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: don't send a 6E related command when not supported |
| MEDIUM | | 5.5 | | CVE-2026-43326 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback |
| MEDIUM | | 5.5 | | CVE-2026-43337 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() |
| MEDIUM | | 5.5 | | CVE-2026-43346 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ice: ptp: don't WARN when controlling PF is unavailable |
| MEDIUM | | 5.5 | | CVE-2026-43352 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue |
| MEDIUM | | 5.5 | | CVE-2026-43353 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue |
| MEDIUM | | 7.1 | | CVE-2026-43414 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Completely fix fcport double free |
| MEDIUM | | 5.5 | | CVE-2026-43416 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: powerpc, perf: Check that current->mm is alive before getting user callchain |
| MEDIUM | | 5.5 | | CVE-2026-43443 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: amd: acp-mach-common: Add missing error check for clock acquisition |
| MEDIUM | | 5.5 | | CVE-2026-43463 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() |
| MEDIUM | | 5.5 | | CVE-2026-43464 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ |
| MEDIUM | | 5.5 | | CVE-2026-43465 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ |
| MEDIUM | | 5.5 | | CVE-2026-43485 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nouveau/gsp: drop WARN_ON in ACPI probes |
| MEDIUM | | 6.4 | | CVE-2026-45932 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix tcx/netkit detach permissions when prog fd isn't given |
| MEDIUM | | 7 | | CVE-2026-45934 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation |
| MEDIUM | | 5.5 | | CVE-2026-45940 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix oops when split header is enabled |
| MEDIUM | | 5.5 | | CVE-2026-45961 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gfs2: fix memory leaks in gfs2_fill_super error path |
| MEDIUM | | 5.5 | | CVE-2026-46014 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Add missing save/restore handling of LBR MSRs |
| MEDIUM | | 7 | | CVE-2026-46017 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm: fix deferred split queue races during migration |
| MEDIUM | | 7 | | CVE-2026-46032 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT |
| MEDIUM | | 5.5 | | CVE-2026-46044 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipmi:ssif: Clean up kthread on errors |
| MEDIUM | | 5.5 | | CVE-2026-46059 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN |
| MEDIUM | | 5.5 | | CVE-2026-46066 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix num_ops off-by-one when crypto allocation fails |
| MEDIUM | | 5.5 | | CVE-2026-46071 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 |
| MEDIUM | | 5.5 | | CVE-2026-46096 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() |
| MEDIUM | | 5.5 | | CVE-2026-46147 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() |
| MEDIUM | | 5.5 | | CVE-2026-46148 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: spi: microchip-core-qspi: control built-in cs manually |
| MEDIUM | | 5.5 | | CVE-2026-46153 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: 8021q: delete cleared egress QoS mappings |
| MEDIUM | | 5.5 | | CVE-2026-46171 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv: kvm: fix vector context allocation leak |
| MEDIUM | | 5.5 | | CVE-2026-46228 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: spi: ch341: fix devres lifetime |
| MEDIUM | | 5.5 | | CVE-2026-46245 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dc_link NULL handling in HPD init |
| MEDIUM | | 5.5 | | CVE-2026-46256 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages |
| MEDIUM | | 4.7 | | CVE-2026-46272 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: tmc-etr: Fix race condition between sysfs and perf mode |
| MEDIUM | | 5.5 | | CVE-2026-46302 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: selinux: allow multiple opens of /sys/fs/selinux/policy |
| MEDIUM | | 5.5 | | CVE-2026-46314 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Reject empty multisync extension to prevent infinite loop |
| MEDIUM | | 7 | | CVE-2026-46317 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock |
| MEDIUM | | 7 | | CVE-2026-46324 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: netfilter nf_tables denial of service via race condition in netlink hook unregistration |
| MEDIUM | | 7 | | CVE-2026-46325 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE |
| MEDIUM | | 7 | | CVE-2026-46330 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Revert "net/smc: Introduce TCP ULP support" |
| MEDIUM | | 5.5 | | CVE-2026-52937 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR |
| MEDIUM | | 7 | | CVE-2026-52953 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Fix oops due to out of scope access |
| MEDIUM | | 7 | | CVE-2026-52956 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() |
| MEDIUM | | 5.5 | | CVE-2026-52994 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting |
| MEDIUM | | 7 | | CVE-2026-53009 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ice: fix double-free of tx_buf skb |
| MEDIUM | | 5.5 | | CVE-2026-53017 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix data loss caused by incorrect use of nat_entry flag |
| MEDIUM | | 5.5 | | CVE-2026-53018 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: avoid reading already updated pages during GC |
| MEDIUM | | 5.5 | | CVE-2026-53103 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync |
| MEDIUM | | 5.5 | | CVE-2026-53104 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: Fix memory leak destroying device |
| MEDIUM | | 5.5 | | CVE-2026-53106 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Do not allow deleting local storage in NMI |
| MEDIUM | | 5.5 | | CVE-2026-53107 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: libertas: don't kill URBs in interrupt context |
| MEDIUM | | 5.5 | | CVE-2026-53108 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: powerpc/64s: Fix unmap race with PMD migration entries |
| MEDIUM | | | | CVE-2026-53178 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction |
| MEDIUM | | 7 | | CVE-2026-53224 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate embedded INIT chunk and address list lengths in cookie |
| MEDIUM | | 7 | | CVE-2026-53246 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing |
| MEDIUM | | 5.5 | | CVE-2026-53258 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: fix leak if split 6 GHz scanning fails |
| MEDIUM | | 5.5 | | CVE-2026-53281 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption |
| MEDIUM | | 5.5 | | CVE-2026-53285 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED |
| MEDIUM | | 5.5 | | CVE-2026-53292 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind |
| MEDIUM | | 5.5 | | CVE-2026-53297 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: mana: Guard mana_remove against double invocation |
| MEDIUM | | 5.5 | | CVE-2026-53321 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/napi: cap busy_poll_to 10 msec |
| MEDIUM | | 5.5 | | CVE-2026-53377 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: always recover the gpu |
| MEDIUM | | | | CVE-2026-53401 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: omap2: fix use-after-free in omapfb_mmap |
| MEDIUM | | | | CVE-2026-63805 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: crypto: nx - fix nx_crypto_ctx_exit argument |
| MEDIUM | | | | CVE-2026-63811 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: read COW data with the original inode during atomic write |
| MEDIUM | | | | CVE-2026-63819 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on f2fs_get_node_folio_ra() |
| MEDIUM | | 5.5 | | CVE-2026-63832 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: add wcid publish check in mt76_sta_add |
| MEDIUM | | 5.5 | | CVE-2026-63853 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring |
| MEDIUM | | | | CVE-2026-63857 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-63858 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: add hook transactions for device deletions |
| MEDIUM | | | | CVE-2026-63859 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue() |
| MEDIUM | | 7 | | CVE-2026-63941 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor |
| MEDIUM | | 7 | | CVE-2026-63979 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/handshake: hand off the pinned file reference to accept_doit |
| MEDIUM | | 5.5 | | CVE-2026-63998 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ethtool: module: call ethnl_ops_complete() on module flash errors |
| MEDIUM | | 5.5 | | CVE-2026-63999 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure |
| MEDIUM | | 5.5 | | CVE-2026-64006 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: fix dst corruption in same register operation |
| MEDIUM | | 7 | | CVE-2026-64024 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction |
| MEDIUM | | 5.5 | | CVE-2026-64036 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cgroup/rstat: validate cpu before css_rstat_cpu() access |
| MEDIUM | | 5.5 | | CVE-2026-64038 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Stop work before releasing hwmon device |
| MEDIUM | | 5.5 | | CVE-2026-64060 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix leak of request in netfs_write_begin() error handling |
| MEDIUM | | 7.1 | | CVE-2026-64066 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_read_to_pagecache() to pause on subreq failure |
| MEDIUM | | 5.5 | | CVE-2026-64067 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing barriers when accessing stream->subrequests locklessly |
| MEDIUM | | 7 | | CVE-2026-64068 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing locking around retry adding new subreqs |
| MEDIUM | | 5.5 | | CVE-2026-64076 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: bridge: eb_tables: close module init race |
| MEDIUM | | 5.5 | | CVE-2026-64077 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: ebtables: move to two-stage removal scheme |
| MEDIUM | | 7.1 | | CVE-2026-64078 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: add and use xtables_unregister_table_exit |
| MEDIUM | | 5.5 | | CVE-2026-64079 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: allocate hook ops while under mutex |
| MEDIUM | | 7 | | CVE-2026-64117 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb |
| MEDIUM | | 5.5 | | CVE-2026-64146 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix metabuf leak in inode xattr initialization |
| MEDIUM | | 5.5 | | CVE-2026-64154 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() |
| MEDIUM | | 5.5 | | CVE-2026-64159 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix zeropoint update where i_size > remote_i_size |
| MEDIUM | | 7 | | CVE-2026-64160 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point |
| MEDIUM | | 5.5 | | CVE-2026-64190 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: team: fix NULL pointer dereference in team_xmit during mode change |
| MEDIUM | | 5.5 | | CVE-2026-64212 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it |
| MEDIUM | | 5.5 | | CVE-2026-64213 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Add lock protection to lm90_alert |
| MEDIUM | | 7 | | CVE-2026-64255 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers |
| MEDIUM | | 7 | | CVE-2026-64520 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies |
| MEDIUM | | 7 | | CVE-2026-68086 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/khugepaged: write all dirty file folios when collapsing |
| MEDIUM | | 5.5 | | CVE-2026-68211 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: stm32-dcmipp: Return queued buffers on start_streaming() failure |
| MEDIUM | | 5.5 | | CVE-2026-68233 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/vc4: Shut down BO cache timer before teardown |
| MEDIUM | | 5.5 | | CVE-2026-68242 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/gt: Fix NULL deref on sched_engine alloc failure |
| MEDIUM | | 5.5 | | CVE-2026-68258 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size |
| MEDIUM | | 5.5 | | CVE-2026-68291 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: idpf driver null pointer dereference leads to Denial of Service |
| MEDIUM | | 5.5 | | CVE-2026-68295 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: BPF: Zero-extend signed ALU32 div/mod results |
| MEDIUM | | 5.5 | | CVE-2026-68312 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths |
| MEDIUM | | 7 | | CVE-2026-68323 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tipc: serialize udp bearer replicast list updates |
| MEDIUM | | 5.5 | | CVE-2026-68382 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Hold device ref until queue teardown completes |
| MEDIUM | | 5.5 | | CVE-2026-68383 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Keep scheduler timeline name alive |
| MEDIUM | | 7 | | CVE-2026-68393 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: extend conn_hash lookup critical sections |
| MEDIUM | | 6.4 | | CVE-2026-68399 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix UAF in sock clone early bailouts |
| MEDIUM | | 7 | | CVE-2026-68400 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation |
| MEDIUM | | 7 | | CVE-2026-68401 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() |
| MEDIUM | | 7 | | CVE-2026-68404 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect |
| MEDIUM | | 5.5 | | CVE-2026-68421 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() |
| MEDIUM | | 5.5 | | CVE-2026-68435 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Fix address space mismatch in kexec command line lookup |
| MEDIUM | | 5.5 | | CVE-2026-68441 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains |
| MEDIUM | | 5.5 | | CVE-2026-68447 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size |
| MEDIUM | | 7 | | CVE-2026-68448 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ovl: check access to copy_file_range source with src mounter creds |
| MEDIUM | | 7 | | CVE-2026-68453 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey |
| MEDIUM | | 5.5 | | CVE-2026-68471 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ieee80211: validate MLE common info length |
| MEDIUM | | 5.5 | | CVE-2026-72073 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mmc: vub300: fix use-after-free on probe failure |
| MEDIUM | | 5.5 | | CVE-2026-72162 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec |
| MEDIUM | | 7 | | CVE-2026-72288 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling |
| MEDIUM | | 7 | | CVE-2026-72329 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/liquidio: drop cached VF pci_dev LUT |
| MEDIUM | | 5.5 | | CVE-2026-72337 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: 6lowpan: avoid untracked enable work |
| MEDIUM | | 5.5 | | CVE-2026-72341 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Fix publication race for priv->channel_stats[] |
| MEDIUM | | 5.5 | | CVE-2026-72355 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix barriering when walking subrequest list |
| MEDIUM | | 5.5 | | CVE-2026-72365 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix writethrough to use collection offload |
| MEDIUM | | 5.5 | | CVE-2026-72367 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iomap: guard io_size EOF trim against concurrent truncate underflow |
| MEDIUM | | 5.5 | | CVE-2026-72375 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix reinitialisation of the inode, in particular ->lock_work |
| MEDIUM | | 5.5 | | CVE-2026-72380 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xen/pvcalls: bound backend response req_id before indexing rsp[] |
| MEDIUM | | 5.5 | | CVE-2026-72383 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: fix addr_wq_timer race in sctp_free_addr_wq() |
| MEDIUM | | 5.5 | | CVE-2026-72388 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock |
| MEDIUM | | 5.5 | | CVE-2026-72397 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() |
| MEDIUM | | 7 | | CVE-2026-72398 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sctp: add INIT verification after cookie unpacking |
| MEDIUM | | 5.5 | | CVE-2026-72404 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() |
| MEDIUM | | 5.5 | | CVE-2026-72423 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Guard conntrack opts error writes |
| MEDIUM | | 5.5 | | CVE-2026-72440 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1: fix writes_pending and barrier reference leaks on write failures |
| MEDIUM | | 5.5 | | CVE-2026-72454 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() |
| MEDIUM | | 5.5 | | CVE-2026-72488 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soundwire: fix bug in sdw_add_element_group_count found by syzkaller |
| MEDIUM | | 5.5 | | CVE-2026-72493 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: serialize netif_running() check in enqueue_to_backlog() |
| MEDIUM | | 5.5 | | CVE-2026-72495 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages |
| MEDIUM | | 7 | | CVE-2026-72499 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free CQ toggle page after firmware teardown |
| MEDIUM | | 7 | | CVE-2026-72500 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown |
| MEDIUM | | | | CVE-2026-72501 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: R ... |
| MEDIUM | | 5.5 | | CVE-2026-74257 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sockmap: Fix use-after-free in udp_bpf_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-74264 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: watchdog: fix refcount tracking races |
| MEDIUM | | 5.5 | | CVE-2026-74272 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Resolve region deletion races |
| MEDIUM | | 5.5 | | CVE-2026-74273 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Block region delete during region creation |
| MEDIUM | | 5.5 | | CVE-2026-74314 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Cancel special fields on map value recycle |
| MEDIUM | | 5.5 | | CVE-2026-74317 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ixgbe: do not configure xps for XDP queues |
| MEDIUM | | 5.5 | | CVE-2026-74324 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: validate skb length in testmode query |
| MEDIUM | | 5.5 | | CVE-2026-74337 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks |
| MEDIUM | | 5.5 | | CVE-2026-74342 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: kernfs: link kn to its parent before the LSM init hook |
| MEDIUM | | 5.5 | | CVE-2026-74344 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear rb node linkage when freeing bpf_rb_root |
| MEDIUM | | 5.5 | | CVE-2026-74350 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate fast symlink target during inode read |
| MEDIUM | | 5.5 | | CVE-2026-74354 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Take mmap_lock in zap_pages() |
| MEDIUM | | 5.5 | | CVE-2026-74368 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() |
| MEDIUM | | 6.5 | | CVE-2026-74385 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock |
| MEDIUM | | 5.5 | | CVE-2026-74388 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data |
| MEDIUM | | 7 | | CVE-2026-74405 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: OPP: Fix race between OPP addition and lookup |
| MEDIUM | | 5.5 | | CVE-2026-74407 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath11k: cancel SSR work items during PCI shutdown |
| MEDIUM | | 5.5 | | CVE-2026-74449 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport |
| MEDIUM | | 5.5 | | CVE-2026-74466 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Close speculative mem read possibility |
| MEDIUM | | 7 | | CVE-2026-74506 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix UAF when sending a message |
| MEDIUM | | 7 | | CVE-2026-74513 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister |
| MEDIUM | | 5.5 | | CVE-2026-74527 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-af: Block VFs from clobbering special CGX PKIND state |
| MEDIUM | | 5.5 | | CVE-2026-74529 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback |
| MEDIUM | | 5.5 | | CVE-2026-74530 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback |
| MEDIUM | | 7 | | CVE-2026-74533 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero |
| MEDIUM | | 7 | | CVE-2026-74537 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: hold sk properly in iso_conn_ready |
| MEDIUM | | 5.5 | | CVE-2026-74538 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: lock sk in iso_connect_ind |
| MEDIUM | | 5.5 | | CVE-2026-74542 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix folio_queue ENOMEM in writeback by adding a mempool |
| MEDIUM | | 5.5 | | CVE-2026-74544 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds |
| MEDIUM | | 5.5 | | CVE-2026-74600 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/page_table_check: skip special zero mappings |
| MEDIUM | | 5.5 | | CVE-2026-74605 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: eventfs: Use children field for rcu head and add memory barriers |
| MEDIUM | | 7 | | CVE-2026-74611 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tls: rx: restore msg_iter before TLS 1.3 optimistic retry |
| MEDIUM | | 5.5 | | CVE-2026-74638 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Serialize the scheduler timeout handlers |
| MEDIUM | | 5.5 | | CVE-2026-74687 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: watchdog: at91sam9_wdt: prevent timer rearm during teardown |
| MEDIUM | | 7 | | CVE-2026-74695 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() |
| MEDIUM | | 7 | | CVE-2026-74697 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Disable EOP for TPA on all chips to prevent data corruption |
| MEDIUM | | 5.5 | | CVE-2026-74711 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus) Fix type confusion in notification logic |
| MEDIUM | | 5.5 | | CVE-2026-74713 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vhost_iotlb: bound map allocation in add_range |
| MEDIUM | | 7 | | CVE-2026-74715 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix netns reference imbalance in conntrack kfuncs |
| MEDIUM | | 5.5 | | CVE-2026-74723 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject inline extents without valid headers |
| MEDIUM | | 5.5 | | CVE-2026-74729 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read |
| MEDIUM | | 5.5 | | CVE-2026-74747 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipvs: revalidate ihl to prevent out-of-bounds access |
| MEDIUM | | 5.5 | | CVE-2026-80579 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: clear fb_info->mode before deleting a videomode |
| MEDIUM | | 5.5 | | CVE-2026-80580 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: bound mode sysfs output to the sysfs buffer |
| MEDIUM | | 5.5 | | CVE-2026-80614 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: emac: Fix NULL pointer dereference in emac_probe |
| MEDIUM | | 5.5 | | CVE-2026-80623 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: ete: Always save state on power down |
| MEDIUM | | 5.5 | | CVE-2026-80628 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Serialize readq reset state with q->lock |
| MEDIUM | | 5.5 | | CVE-2026-80631 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject compressed segment that overflows the compressed input |
| MEDIUM | | 5.5 | | CVE-2026-80634 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag |
| MEDIUM | | 5.5 | | CVE-2026-80655 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: soc: xilinx: Fix race condition in event registration |
| MEDIUM | | 5.5 | | CVE-2026-80662 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size |
| MEDIUM | | 7 | | CVE-2026-80668 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations |
| MEDIUM | | 5.5 | | CVE-2026-80670 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() |
| MEDIUM | | 5.5 | | CVE-2026-80692 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks |
| MEDIUM | | 7 | | CVE-2026-80693 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: idpf: bound interrupt-vector register fill to the allocated array |
| MEDIUM | | 5.5 | | CVE-2026-80698 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: idxd: fix double free of wq, engine, and group structs |
| MEDIUM | | 5.5 | | CVE-2026-80721 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: ensure no dangling hcon references in iso_conn |
| MEDIUM | | | | CVE-2026-80761 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| MEDIUM | | 5.5 | | CVE-2026-80905 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: tap: fix wrong transport_header when sending VLAN-tagged frame |
| MEDIUM | | 5.5 | | CVE-2026-80920 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring: defer eventfd signaling when queued from a wakeup handler |
| MEDIUM | | 5.5 | | CVE-2026-81010 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: io_uring/waitid: honor task_work cancellation |
| MEDIUM | | 7 | | CVE-2026-89528 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Reject Read lists that exceed the page budget |
| MEDIUM | | 4.8 | | CVE-2026-89534 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| MEDIUM | | 7 | | CVE-2026-89537 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 |
| MEDIUM | | 7.2 | | CVE-2026-89610 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs: verify run length exceeding volume boundary |
| MEDIUM | | 5.5 | | CVE-2026-89611 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs: validate non-resident attribute offsets |
| MEDIUM | | 7.1 | | CVE-2026-89632 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() |
| MEDIUM | | 7 | | CVE-2026-89637 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 |
| MEDIUM | | 5.5 | | CVE-2026-89639 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC |
| MEDIUM | | 3.3 | | CVE-2026-89642 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cifs: call pagecache_isize_extended() in cifs_setsize() when extending |
| MEDIUM | | 6.2 | | CVE-2026-89648 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ceph: cap delegated inode count in ceph_parse_deleg_inos() |
| MEDIUM | | 7 | | CVE-2026-89654 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix UAF in check_new_map() on session freed during unlock |
| MEDIUM | | 5.3 | | CVE-2026-89682 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net |
| MEDIUM | | 5.3 | | CVE-2026-89705 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths |
| MEDIUM | | 5.9 | | CVE-2026-89709 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: lockd, nfsd: RCU-protect nlmsvc_ops dispatch |
| MEDIUM | | 5.5 | | CVE-2026-89722 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() |
| MEDIUM | | 5.5 | | CVE-2026-89757 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/mglru: fix and remove redundant unevictable folio handling |
| MEDIUM | | 4.7 | | CVE-2026-89810 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix error path at svm_migrate_copy_to_ram |
| MEDIUM | | | | CVE-2026-89826 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| MEDIUM | | | | CVE-2026-89833 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| MEDIUM | | | | CVE-2026-89866 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| MEDIUM | | | | CVE-2026-89906 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| MEDIUM | | 4.7 | | CVE-2026-89913 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables |
| MEDIUM | | 4.7 | | CVE-2026-89920 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Fix memory corruption by not reinjecting CK machine checks |
| MEDIUM | | | | CVE-2026-89935 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 3.6 | | CVE-2026-89987 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/huge_memory: transfer the pmd dirty bit to the folio on zap |
| MEDIUM | | 5.5 | | CVE-2026-90040 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped |
| MEDIUM | | 5.5 | | CVE-2026-90061 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: skip double clone set expressions on element insert |
| MEDIUM | | 5.5 | | CVE-2026-90083 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: act_ife: Only operate on Ethernet frames |
| MEDIUM | | 5.5 | | CVE-2026-90087 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: do not leak an hci_conn when a second LE connect is rejected |
| MEDIUM | | 7 | | CVE-2026-90093 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: access chan->conn safely in get/setsockopt |
| MEDIUM | | 5.5 | | CVE-2026-90098 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: fix sleep in atomic context in MAC table access |
| MEDIUM | | 7 | | CVE-2026-90099 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: account classifier filter allocations to memcg |
| MEDIUM | | 7 | | CVE-2026-90104 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFSv4.1: zero referring call lists before decoding |
| MEDIUM | | 5.5 | | CVE-2026-90105 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vxlan: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90106 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: arp/nd proxy: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90116 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: mtpav: shut down output timer before card teardown |
| MEDIUM | | 5.5 | | CVE-2026-90142 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix resize of the RX ring |
| MEDIUM | | 5.5 | | CVE-2026-90149 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers |
| MEDIUM | | 5.5 | | CVE-2026-90154 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: scope session state changes to bound connections |
| MEDIUM | | 5.5 | | CVE-2026-90155 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: detach blocked lock requests before freeing |
| MEDIUM | | 5.5 | | CVE-2026-90156 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely discard unregistered deferred locks |
| MEDIUM | | 7 | | CVE-2026-90161 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix interlaced ztailpacking pclusters |
| MEDIUM | | 5.5 | | CVE-2026-90162 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: defer publishing granted locks to prevent UAF/double-free race |
| MEDIUM | | 5.5 | | CVE-2026-90167 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: serialize oplock close with pending break ownership |
| MEDIUM | | 5.5 | | CVE-2026-90174 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() |
| MEDIUM | | 5.5 | | CVE-2026-90177 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check pointer type for all atomic RMW paths |
| MEDIUM | | 5.5 | | CVE-2026-90179 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix deadlock in complain-mode change_hat |
| MEDIUM | | 5.5 | | CVE-2026-90204 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate DIO orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90205 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90208 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type |
| MEDIUM | | 5.5 | | CVE-2026-90217 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Compare iterator types during state pruning |
| MEDIUM | | 5.5 | | CVE-2026-90231 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix unconfined user namespace restriction forced stack |
| MEDIUM | | 5.5 | | CVE-2026-90232 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: amt: Don't support cross-netns setup |
| MEDIUM | | 5.1 | | CVE-2026-90234 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NFS: Return a delegation the client fails to record |
| MEDIUM | | 7 | | CVE-2026-90237 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nft_ct: move custom expectation support to helper |
| MEDIUM | | 7 | | CVE-2026-90240 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Flush context cache with correct SID when tearing down aliases |
| MEDIUM | | 5.5 | | CVE-2026-90247 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix mmap_lock leak in irq_work path |
| MEDIUM | | 5.9 | | CVE-2026-90256 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind |
| MEDIUM | | 5.5 | | CVE-2026-90259 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() |
| MEDIUM | | 4.7 | | CVE-2026-90260 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: don't clobber the extent buffer when zeroing it out |
| MEDIUM | | 3.3 | | CVE-2026-90263 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: check if root is readonly when setting posix acl |
| MEDIUM | | 5.5 | | CVE-2026-90264 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: always wait for ordered extents to avoid OE races |
| MEDIUM | | 5.5 | | CVE-2026-90265 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: defrag: fix deadlock between defrag and delalloc space reservation |
| MEDIUM | | 5.5 | | CVE-2026-90273 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable |
| MEDIUM | | 5.5 | | CVE-2026-90289 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Resize MST HDCP per-connector arrays to 32 |
| MEDIUM | | 5.5 | | CVE-2026-90300 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear buf on error in __bpf_get_task_stack |
| MEDIUM | | 5.5 | | CVE-2026-90301 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: o2hb: quiesce negotiate handlers and timeout work |
| MEDIUM | | 7 | | CVE-2026-90317 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Invalidate RCU pointers after final spin unlock |
| MEDIUM | | 5.5 | | CVE-2026-90320 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate external xattr entries when reading metadata |
| MEDIUM | | 5.5 | | CVE-2026-90321 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate inline xattrs during inode block validation |
| MEDIUM | | 5.5 | | CVE-2026-90324 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ublk: check import_ubuf() return value |
| MEDIUM | | 4.7 | | CVE-2026-90326 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-cgroup: fix race between policy activation and blkg destruction |
| MEDIUM | | 5.5 | | CVE-2026-90328 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: HID: steam: Reject short reads |
| MEDIUM | | 6.4 | | CVE-2026-90333 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dm-integrity: replace forgeable discard filler with a keyed sector marker |
| MEDIUM | | 4.1 | | CVE-2026-90336 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: clear freed pointers on uart_register_driver() failure |
| MEDIUM | | 5.5 | | CVE-2026-90337 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: do fallible allocations before the console can be registered |
| MEDIUM | | 7 | | CVE-2026-90343 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: stop PMSR before P2P and NAN teardown |
| MEDIUM | | 5.5 | | CVE-2026-90345 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: brcmfmac: fix P2P action frame handling without device vif |
| MEDIUM | | 7 | | CVE-2026-90347 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry |
| MEDIUM | | 5.5 | | CVE-2026-90351 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed |
| MEDIUM | | 4.4 | | CVE-2026-90359 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject >8 byte return values on return-reading trampoline paths |
| MEDIUM | | 5.5 | | CVE-2026-90363 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: don't tear down KMS twice when KMS init fails |
| MEDIUM | | 5.5 | | CVE-2026-90365 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: cancel reset and rc work on device unregister |
| MEDIUM | | 5.5 | | CVE-2026-90367 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER |
| MEDIUM | | 4.8 | | CVE-2026-90379 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash |
| MEDIUM | | 3.3 | | CVE-2026-90401 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md: remove REQ_NOWAIT support from raid1/10/456 |
| MEDIUM | | 5.5 | | CVE-2026-90408 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() |
| MEDIUM | | 5.5 | | CVE-2026-90409 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Add vm_bind region with kbo range overlap check |
| MEDIUM | | 4.7 | | CVE-2026-90417 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() |
| MEDIUM | | 5.5 | | CVE-2026-90421 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: PCI: Fix UAF when probe runs concurrent to dyn ID removal |
| MEDIUM | | 5.5 | | CVE-2026-90422 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path |
| MEDIUM | | 4.7 | | CVE-2026-90427 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() |
| MEDIUM | | 5.5 | | CVE-2026-92480 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Validate string descriptors |
| MEDIUM | | 5.5 | | CVE-2026-92482 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip |
| MEDIUM | | 3.3 | | CVE-2026-92485 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix WARNING in bpf_tracing_link_release |
| MEDIUM | | 5.5 | | CVE-2026-92499 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext4: validate readdir offset before accessing dirent |
| MEDIUM | | 4.7 | | CVE-2026-92500 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext4: use fsdata to track inline data write state and fix race |
| MEDIUM | | 5.5 | | CVE-2026-92503 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() |
| MEDIUM | | 5.5 | | CVE-2026-92518 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: riscv, bpf: Fix kernel stack corruption in tailcall with CFI |
| MEDIUM | | 5.5 | | CVE-2026-92520 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Zero queue and stack outputs on lock failure |
| MEDIUM | | 5.5 | | CVE-2026-93044 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for arena-related insns |
| MEDIUM | | 5.5 | | CVE-2026-93047 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Associate BOs with every job that accesses them |
| MEDIUM | | 5.5 | | CVE-2026-93058 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Only fini scheduler after successful init |
| MEDIUM | | 5.5 | | CVE-2026-93081 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_scmi: Fix SCMI device destroy lifetimes |
| MEDIUM | | 4.7 | | CVE-2026-93099 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Fix UAF from worker threads when domains are removed |
| MEDIUM | | 4.7 | | CVE-2026-93100 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() |
| MEDIUM | | 4.7 | | CVE-2026-93104 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rvt: Return NULL after port allocation failure |
| MEDIUM | | 7 | | CVE-2026-93105 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: esp: do not unref managed frag pages in esp_ssg_unref() |
| MEDIUM | | 5.5 | | CVE-2026-93122 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: usb: gadget: uac: validate rate list length before storing |
| MEDIUM | | 5.5 | | CVE-2026-93135 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject programs with inlined helpers if JIT is not available |
| MEDIUM | | 7 | | CVE-2026-93148 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject MEM_ALLOC BTF accesses past object bounds |
| MEDIUM | | 7 | | CVE-2026-93154 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Add refcounting to user ring MRs |
| MEDIUM | | 5.5 | | CVE-2026-93168 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout |
| MEDIUM | | 5.5 | | CVE-2026-93175 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in CRTC reset function |
| MEDIUM | | 4.7 | | CVE-2026-93176 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in plane reset function |
| MEDIUM | | 5.5 | | CVE-2026-93270 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn |
| MEDIUM | | 5.5 | | CVE-2026-93272 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 |
| MEDIUM | | 5.5 | | CVE-2026-93276 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator |
| MEDIUM | | 5.5 | | CVE-2026-93282 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix maximum allowed access checks |
| MEDIUM | | 7.1 | | CVE-2026-97422 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: fix SMI event cross-process information leak |
| MEDIUM | | 5.5 | | CVE-2026-97432 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: fix P2P-Device binding handling |
| MEDIUM | | 5.5 | | CVE-2026-97478 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virt: acrn: Fix irqfd use-after-free during eventfd shutdown |
| MEDIUM | | 7.1 | | CVE-2026-97493 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS |
| MEDIUM | | 5.5 | | CVE-2026-97499 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: perf: Retrieve path and source from event data |
| MEDIUM | | 5.5 | | CVE-2026-97513 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Release m2m_ctx after Instance Removed from List |
| MEDIUM | | 5.5 | | CVE-2026-97515 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 |
| MEDIUM | | 5.5 | | CVE-2026-97526 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/pai: Support CPU hotplug for PMU PAI |
| MEDIUM | | 5.5 | | CVE-2026-97538 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (asus_rog_ryujin) Validate HID report lengths |
| MEDIUM | | 5.5 | | CVE-2026-97554 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() |
| MEDIUM | | 7 | | CVE-2026-97561 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid |
| MEDIUM | | 7 | | CVE-2026-97563 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97565 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject short READ responses in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97960 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel: Prevent drain_pebs() reentry |
| MEDIUM | | 5.5 | | CVE-2026-97962 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Move representor vnic reporter to eswitch devlink port |
| MEDIUM | | 5.1 | | CVE-2026-97975 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() |
| MEDIUM | | 4.7 | | CVE-2026-97988 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vhost: invalidate vring access on IOTLB transitions |
| MEDIUM | | 5.5 | | CVE-2026-98019 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: mark a NULL call argument precise |
| MEDIUM | | 5.3 | | CVE-2026-98032 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tracing: Fix subbuf resize races with trace_pipe_raw readers |
| MEDIUM | | 7 | | CVE-2026-98033 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Preserve inner map identity in callback frames |
| MEDIUM | | 7 | | CVE-2026-98034 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark NULL kptr stores precise |
| MEDIUM | | 5.5 | | CVE-2026-98043 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Don't infer non-NULL from a pointer with an unbounded offset |
| MEDIUM | | 7 | | CVE-2026-98047 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check ancestor frames for rbtree callbacks |
| MEDIUM | | 7 | | CVE-2026-98048 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: don't rewrite bpf_fastcall patterns entered by a jump |
| MEDIUM | | 5.5 | | CVE-2026-98049 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: zero extend the result of an arena 32-bit cmpxchg |
| MEDIUM | | 5.5 | | CVE-2026-98053 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Refactor and fix init_config access |
| MEDIUM | | 5.5 | | CVE-2026-98062 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark signal tracepoint siginfo arguments as scalar |
| MEDIUM | | 5.5 | | CVE-2026-98085 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge |
| MEDIUM | | | | CVE-2026-98099 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 5.5 | | CVE-2026-98115 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely drain sessions during logoff |
| MEDIUM | | 5.5 | | CVE-2026-98118 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix readahead synchronisation issues by loading all folios upfront |
| MEDIUM | | 5.5 | | CVE-2026-98124 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/client: invalidate fscache for fallocate range operations |
| MEDIUM | | 5.5 | | CVE-2026-98125 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix stale page cache in insert/collapse range |
| MEDIUM | | 5.5 | | CVE-2026-98131 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix dma mapping leak in stmmac_tso_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-98134 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: check_cond_jmp_op(): properly infer if register is null |
| MEDIUM | | 5.3 | | CVE-2026-98156 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/virtio: use the DMA API for resource backing on Xen |
| MEDIUM | | 5.5 | | CVE-2026-98162 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/server: fix tree connection leak in smb2_tree_connect() |
| MEDIUM | | 5.5 | | CVE-2026-98180 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: RCU-free the scheduler-containing ring and VM objects |
| MEDIUM | | 5.5 | | CVE-2026-98228 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ |
| MEDIUM | | 4.4 | | CVE-2026-98273 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: x86/kprobes: Fix crash when probing CS CALL instructions |
| MEDIUM | | 5.5 | | CVE-2026-98277 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: ring the doorbell if a burst ends in a drop |
| MEDIUM | | 5.5 | | CVE-2026-98279 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: handle lack of space when cleaning up verity items |
| MEDIUM | | 5.3 | | CVE-2026-98284 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netlink: do not free nlk->groups while lockless readers can use it |
| MEDIUM | | 4.1 | | CVE-2026-98286 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown |
| MEDIUM | | 5.5 | | CVE-2026-98288 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix TSO header length truncation |
| MEDIUM | | 5.5 | | CVE-2026-98292 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| MEDIUM | | 5.5 | | CVE-2026-98294 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_qca: Do not write to the serial port after it is closed |
| MEDIUM | | 7 | | CVE-2026-98296 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btintel_pcie: validate TX skb length in send_sync |
| MEDIUM | | 5.5 | | CVE-2026-98313 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/dp: skip PUSH_IDLE when the link was never enabled |
| MEDIUM | | 7 | | CVE-2026-98330 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: get the wiphy out of a dying network namespace |
| MEDIUM | | 5.5 | | CVE-2026-98333 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: reset the LED state when ifup fails |
| MEDIUM | | 7 | | CVE-2026-98341 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: don't free driver-owned scan requests |
| MEDIUM | | 5.5 | | CVE-2026-98353 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables |
| MEDIUM | | 5.5 | | CVE-2026-98355 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rtrs: guard against null kobj name |
| MEDIUM | | 5.5 | | CVE-2026-98376 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Use array_map_meta_equal for percpu array inner map replacement |
| MEDIUM | | 5.5 | | CVE-2026-98408 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: watchdog: rzv2h: Avoid division by zero |
| MEDIUM | | 5.5 | | CVE-2026-98420 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: follow SMB2 session expiration semantics |
| MEDIUM | | | | CVE-2026-98436 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: a ... |
| MEDIUM | | 6.5 | | CVE-2026-98439 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/server: cancel async requests when closing connection |
| MEDIUM | | 4.7 | | CVE-2026-98444 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: drop dquot flush lock when we can't find a buffer to flush |
| MEDIUM | | 6.5 | | CVE-2026-98449 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: delete compound mids on send failure before unlock |
| MEDIUM | | 5.3 | | CVE-2026-98471 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Do cache maintenance on the source VM during intra-host migration |
| MEDIUM | | 5.5 | | CVE-2026-98556 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gve: DQO: reject TSO packets with an out of range MSS |
| MEDIUM | | 4.1 | | CVE-2026-98558 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: flush skb_defer_nodes in dev_cpu_dead() |
| MEDIUM | | 5.9 | | CVE-2026-98570 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: ipv6: keep room for the mac header in dst_dev_overhead() |
| MEDIUM | | 6.7 | | CVE-2026-98589 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject pkt arguments in mutating subprogs |
| MEDIUM | | 4.7 | | CVE-2026-98598 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv6: Prevent rt6_insert_exception() for dying fib6_info |
| MEDIUM | | 6.7 | | CVE-2026-98599 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() |
| MEDIUM | | 4.1 | | CVE-2026-98616 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: reset num_napi when the napi vectors are freed |
| MEDIUM | | 5.5 | | CVE-2026-98652 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Add missing srcu in kvm_s390_set_irq_state() |
| MEDIUM | | 5.5 | | CVE-2026-98674 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iio: adc: adi-axi-adc: Initialize state mutex |
| MEDIUM | | 5.6 | | CVE-2026-98714 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| MEDIUM | | 4.1 | | CVE-2026-98740 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety |
| MEDIUM | | 4.4 | | CVE-2026-98747 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix NULL pointer dereference in serial_core_unregister_port() |
| MEDIUM | | 4.7 | | CVE-2026-98786 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: guard dc_sink dereferences in MST mode validation |
| MEDIUM | | 4.4 | | CVE-2026-98789 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix objects stuck in free_by_rcu_ttrace |
| MEDIUM | | 4.4 | | CVE-2026-98795 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: skip ptp deinit if init was skipped |
| MEDIUM | | 4.4 | | CVE-2026-98799 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Skip detached progs in trampoline images that are still in use |
| MEDIUM | | 4.7 | | CVE-2026-98800 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: kernel: Denial of Service via use-after-free in BPF trampoline |
| MEDIUM | | 6.5 | | CVE-2026-98803 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix rx Scatter-Gather support |
| MEDIUM | | 6.1 | | CVE-2026-98810 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() |
| MEDIUM | | 4.4 | | CVE-2026-98813 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Hold map BTF for the memory allocator destructor record |
| MEDIUM | | 4.4 | | CVE-2026-98814 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix command effects log lifetime for multipath heads |
| MEDIUM | | 4.1 | | CVE-2026-98815 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix cdev lifetime |
| MEDIUM | | 4.1 | | CVE-2026-98816 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix overflow of jump offset in constant blinding |
| MEDIUM | | 5.5 | | CVE-2026-98820 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: set RQF_USE_SCHED when the operation is known |
| MEDIUM | | 5.3 | | CVE-2026-98824 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate TX status rate metadata |
| MEDIUM | | 6.5 | | CVE-2026-98829 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: drop oversized fragments to avoid extra_len overflow |
| MEDIUM | | 4.1 | | CVE-2026-98834 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mtd: core: avoid double-free of OTP NVMEM device |
| MEDIUM | | 6.1 | | CVE-2026-98839 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() |
| MEDIUM | | 4.4 | | CVE-2026-98843 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: zero gaps in read-gaps folio to avoid writing back stale data |
| MEDIUM | | 5.6 | | CVE-2026-98863 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| MEDIUM | | 4.6 | | CVE-2019-15213 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: use-after-free caused by malicious USB device in drivers/media/usb/dvb-usb/dvb-usb-init.c |
| MEDIUM | | 4.1 | | CVE-2019-16089 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Improper return check in nbd_genl_status function in drivers/block/nbd.c |
| MEDIUM | | 4.7 | | CVE-2019-20794 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: task processes not being properly ended could lead to resource exhaustion |
| MEDIUM | | 4.4 | | CVE-2020-14304 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ethtool when reading eeprom of device could lead to memory leak |
| MEDIUM | | 6.7 | | CVE-2020-36694 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: use-after-free in the packet processing context |
| MEDIUM | | 5.5 | | CVE-2023-31082 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sleeping function called from an invalid context in gsmld_write |
| MEDIUM | | 7 | | CVE-2023-3397 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: slab-use-after-free Write in txEnd due to race condition |
| MEDIUM | | 5.5 | | CVE-2023-37454 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: udf: use-after-free write in udf_close_lvid |
| MEDIUM | | 6.7 | | CVE-2023-6238 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvme: memory corruption via unprivileged user passthrough |
| MEDIUM | | 6.5 | | CVE-2023-6240 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation |
| MEDIUM | | 5.5 | | CVE-2024-2193 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | hw: Spectre-SRC that is Speculative Race Conditions (SRCs) for synchronization primitives similar like Spectre V1 with p |
| MEDIUM | | 4.7 | | CVE-2024-24864 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | A race condition was found in the Linux kernel's media/dvb-core in dvb ... |
| MEDIUM | | 5.5 | | CVE-2024-25740 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory leak in ubi driver |
| MEDIUM | | 5.5 | | CVE-2024-56709 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring: check if iowq is killed before queuing |
| MEDIUM | | 5.5 | | CVE-2024-58074 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/i915: Grab intel_display from the encoder to avoid potential oopsies |
| MEDIUM | | 5.5 | | CVE-2025-21752 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents |
| MEDIUM | | 5.5 | | CVE-2025-21949 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Set hugetlb mmap base address aligned with pmd size |
| MEDIUM | | 5.5 | | CVE-2025-22109 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ax25: Remove broken autobind |
| MEDIUM | | 5.5 | | CVE-2025-23132 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: quota: fix to avoid warning in dquot_writeback_dquots() |
| MEDIUM | | 5.5 | | CVE-2025-23135 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Teardown riscv specific bits after kvm_exit |
| MEDIUM | | 5.5 | | CVE-2025-37743 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Avoid memory leak while enabling statistics |
| MEDIUM | | 5.5 | | CVE-2025-37746 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/dwc_pcie: fix duplicate pci_dev devices |
| MEDIUM | | 5.5 | | CVE-2025-37880 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: um: work around sched_yield not yielding in time-travel mode |
| MEDIUM | | 4.7 | | CVE-2025-37906 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: ublk race condition causes kernel crash |
| MEDIUM | | 5.5 | | CVE-2025-38029 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to sleepable page allocation in KASAN |
| MEDIUM | | 5.5 | | CVE-2025-38036 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to null pointer dereference in GT MMIO initialization for VFs |
| MEDIUM | | 5.5 | | CVE-2025-38041 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clk: sunxi-ng: h616: Reparent GPU clock during frequency changes |
| MEDIUM | | 5.5 | | CVE-2025-38042 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn |
| MEDIUM | | 6.7 | | CVE-2025-38064 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio: break and reset virtio devices on device_shutdown() |
| MEDIUM | | 5.5 | | CVE-2025-38132 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: holding cscfg_csdev_lock while removing cscfg from csdev |
| MEDIUM | | 5.5 | | CVE-2025-38140 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Local denial of service in device mapper |
| MEDIUM | | 5.5 | | CVE-2025-38199 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix memory leak due to multiple rx_stats allocation |
| MEDIUM | | 5.5 | | CVE-2025-38207 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm: fix uprobe pte be overwritten when expanding vma |
| MEDIUM | | 5.5 | | CVE-2025-38261 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv: save the SR_SUM status over switches |
| MEDIUM | | 5.5 | | CVE-2025-38284 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: configure manual DAC mode via PCI config API only |
| MEDIUM | | 5.5 | | CVE-2025-38311 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel (iavf): Denial of Service due to a locking issue |
| MEDIUM | | 5.5 | | CVE-2025-38359 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Fix in_atomic() handling in do_secure_storage_access() |
| MEDIUM | | 5.5 | | CVE-2025-38597 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port |
| MEDIUM | | 5.5 | | CVE-2025-38605 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() |
| MEDIUM | | 5.5 | | CVE-2025-39677 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Fix backlog accounting in qdisc_dequeue_internal |
| MEDIUM | | 5.5 | | CVE-2025-39762 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: add null check |
| MEDIUM | | 5.5 | | CVE-2025-39775 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: mremap local denial of service |
| MEDIUM | | 5.5 | | CVE-2025-39789 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: crypto: x86/aegis - Add missing error checks |
| MEDIUM | | 6.1 | | CVE-2025-39822 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/kbuf: fix signedness in this_len calculation |
| MEDIUM | | 5.5 | | CVE-2025-39830 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path |
| MEDIUM | | 5.5 | | CVE-2025-39834 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow |
| MEDIUM | | 6.2 | | CVE-2025-39910 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() |
| MEDIUM | | 7.1 | | CVE-2025-39933 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length |
| MEDIUM | | 2.5 | | CVE-2025-40113 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E |
| MEDIUM | | 6.8 | | CVE-2025-40130 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling |
| MEDIUM | | 6.2 | | CVE-2025-40146 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: fix potential deadlock while nr_requests grown |
| MEDIUM | | 5.2 | | CVE-2025-40217 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pidfs: validate extensible ioctls |
| MEDIUM | | | | CVE-2025-40247 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Fix pgtable prealloc error path |
| MEDIUM | | 5.2 | | CVE-2025-40338 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Do not share the name pointer between components |
| MEDIUM | | 6.1 | | CVE-2025-40355 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sysfs: check visibility before changing group attribute ownership |
| MEDIUM | | 5.5 | | CVE-2025-68209 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mlx5: Fix default values in create CQ |
| MEDIUM | | 5.5 | | CVE-2025-68236 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service during UFS power down |
| MEDIUM | | 5.5 | | CVE-2025-68304 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_core: lookup hci_conn on RX path on protocol side |
| MEDIUM | | | | CVE-2025-68318 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL |
| MEDIUM | | 6.1 | | CVE-2025-68319 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netconsole: Acquire su_mutex before navigating configs hierarchy |
| MEDIUM | | 5.5 | | CVE-2025-68353 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service via NULL pointer dereference in VXLAN module |
| MEDIUM | | 4.5 | | CVE-2025-68360 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks |
| MEDIUM | | 5.5 | | CVE-2025-68368 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service in md driver via uninitialized bioset |
| MEDIUM | | 6.5 | | CVE-2025-68729 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix MSDU buffer types handling in RX error path |
| MEDIUM | | 5.5 | | CVE-2025-68730 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() |
| MEDIUM | | 4.7 | | CVE-2025-68745 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset |
| MEDIUM | | 7.8 | | CVE-2025-71074 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel functionfs: Use-After-Free vulnerability due to open/removal races |
| MEDIUM | | 5.5 | | CVE-2025-71117 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service via deadlock in block layer sysfs store callbacks |
| MEDIUM | | 5.5 | | CVE-2025-71141 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/tilcdc: Fix removal actions in case of failed probe |
| MEDIUM | | 5.5 | | CVE-2025-71188 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: lpc18xx-dmamux: fix device leak on route allocation |
| MEDIUM | | 6.5 | | CVE-2025-71202 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Memory Corruption and Kernel Crashes via IOMMU SVA coherency issue |
| MEDIUM | | 5.5 | | CVE-2025-71227 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: don't WARN for connections on invalid channels |
| MEDIUM | | 5.5 | | CVE-2025-71285 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels |
| MEDIUM | | 5.5 | | CVE-2025-71302 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: fix for dma-fence safe access rules |
| MEDIUM | | 7 | | CVE-2025-71313 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI: endpoint: Add missing NULL check for alloc_workqueue() |
| MEDIUM | | 5.5 | | CVE-2025-71315 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/vkms: Convert to DRM's vblank timer |
| MEDIUM | | 5.5 | | CVE-2026-100074 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| MEDIUM | | 5.5 | | CVE-2026-100076 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths |
| MEDIUM | | 5.5 | | CVE-2026-100077 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Recover HW before retire hung submit |
| MEDIUM | | 5.5 | | CVE-2026-23007 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: block: zero non-PI portion of auto integrity buffer |
| MEDIUM | | 5.5 | | CVE-2026-23017 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: idpf: fix error handling in the init_task on load |
| MEDIUM | | 5.5 | | CVE-2026-23143 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix misalignment bug in struct virtnet_info |
| MEDIUM | | 7.1 | | CVE-2026-23152 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: correctly decode TTLM with default link map |
| MEDIUM | | 5.5 | | CVE-2026-23217 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv: trace: fix snapshot deadlock with sbi ecall |
| MEDIUM | | 5.5 | | CVE-2026-23259 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/rw: free potentially allocated iovec on cache put failure |
| MEDIUM | | 5.5 | | CVE-2026-23265 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer in {read,write}_end_io |
| MEDIUM | | 5.5 | | CVE-2026-23348 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix race of nvdimm_bus object when creating nvdimm objects |
| MEDIUM | | 5.5 | | CVE-2026-23371 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting |
| MEDIUM | | 5.5 | | CVE-2026-23377 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz |
| MEDIUM | | 5.5 | | CVE-2026-23385 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: clone set on flush only |
| MEDIUM | | 5.5 | | CVE-2026-23472 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN |
| MEDIUM | | 5.5 | | CVE-2026-31435 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix read abandonment during retry |
| MEDIUM | | 5.5 | | CVE-2026-31526 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix exception exit lock checking for subprogs |
| MEDIUM | | 5.5 | | CVE-2026-31537 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: server: make use of smbdirect_socket.send_io.bcredits |
| MEDIUM | | 5.5 | | CVE-2026-31562 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register |
| MEDIUM | | 5.5 | | CVE-2026-31579 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit |
| MEDIUM | | 5.5 | | CVE-2026-31591 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish |
| MEDIUM | | 5.5 | | CVE-2026-31592 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock |
| MEDIUM | | 5.5 | | CVE-2026-31630 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rxrpc: proc: size address buffers for %pISpc output |
| MEDIUM | | 7.1 | | CVE-2026-31692 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns |
| MEDIUM | | 5.5 | | CVE-2026-31771 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_event: move wake reason storage into validated event handlers |
| MEDIUM | | 5.5 | | CVE-2026-31777 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: ctxfi: Check the error for index mapping |
| MEDIUM | | 5.5 | | CVE-2026-43009 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix incorrect pruning due to atomic fetch precision tracking |
| MEDIUM | | 5.5 | | CVE-2026-43022 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists |
| MEDIUM | | 5.5 | | CVE-2026-43029 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mptcp: fix soft lockup in mptcp_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-43034 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: set backing store type from query type |
| MEDIUM | | 7.1 | | CVE-2026-43042 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mpls: add seqcount to protect the platform_label{,s} pair |
| MEDIUM | | 5.5 | | CVE-2026-43048 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: HID: core: Mitigate potential OOB by removing bogus memset() |
| MEDIUM | | 5.5 | | CVE-2026-43053 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: close crash window in attr dabtree inactivation |
| MEDIUM | | 5.5 | | CVE-2026-43083 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: ioam6: fix OOB and missing lock |
| MEDIUM | | 5.5 | | CVE-2026-43101 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() |
| MEDIUM | | 5.5 | | CVE-2026-43115 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: srcu: Use irq_work to start GP in tiny SRCU |
| MEDIUM | | 5.5 | | CVE-2026-43118 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix zero size inode with non-zero size after log replay |
| MEDIUM | | 5.5 | | CVE-2026-43127 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs3: fix circular locking dependency in run_unpack_ex |
| MEDIUM | | 5.5 | | CVE-2026-43172 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: fix 22000 series SMEM parsing |
| MEDIUM | | 5.5 | | CVE-2026-43191 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 |
| MEDIUM | | 5.5 | | CVE-2026-43204 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: qcom: q6asm: drop DSP responses for closed data streams |
| MEDIUM | | 5.5 | | CVE-2026-43213 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: validate sequence number of TX release report |
| MEDIUM | | 5.5 | | CVE-2026-43234 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: team: avoid NETDEV_CHANGEMTU event when unregistering slave |
| MEDIUM | | 5.5 | | CVE-2026-43272 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ring-buffer: Fix possible dereference of uninitialized pointer |
| MEDIUM | | 5.5 | | CVE-2026-43294 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels |
| MEDIUM | | 5.5 | | CVE-2026-43298 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Skip vcn poison irq release on VF |
| MEDIUM | | 5.5 | | CVE-2026-43299 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() |
| MEDIUM | | 5.5 | | CVE-2026-43301 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix PM runtime usage count underflow |
| MEDIUM | | 5.5 | | CVE-2026-43308 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() |
| MEDIUM | | 5.5 | | CVE-2026-43309 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md raid: fix hang when stopping arrays with metadata through dm-raid |
| MEDIUM | | 5.5 | | CVE-2026-43310 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC |
| MEDIUM | | 5.5 | | CVE-2026-43311 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soc/tegra: pmc: Fix unsafe generic_handle_irq() call |
| MEDIUM | | 5.5 | | CVE-2026-43325 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: don't send a 6E related command when not supported |
| MEDIUM | | 5.5 | | CVE-2026-43326 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback |
| MEDIUM | | 5.5 | | CVE-2026-43337 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() |
| MEDIUM | | 5.5 | | CVE-2026-43346 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ice: ptp: don't WARN when controlling PF is unavailable |
| MEDIUM | | 5.5 | | CVE-2026-43352 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue |
| MEDIUM | | 5.5 | | CVE-2026-43353 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue |
| MEDIUM | | 7.1 | | CVE-2026-43414 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Completely fix fcport double free |
| MEDIUM | | 5.5 | | CVE-2026-43416 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: powerpc, perf: Check that current->mm is alive before getting user callchain |
| MEDIUM | | 5.5 | | CVE-2026-43443 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: amd: acp-mach-common: Add missing error check for clock acquisition |
| MEDIUM | | 5.5 | | CVE-2026-43463 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() |
| MEDIUM | | 5.5 | | CVE-2026-43464 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ |
| MEDIUM | | 5.5 | | CVE-2026-43465 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ |
| MEDIUM | | 5.5 | | CVE-2026-43485 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nouveau/gsp: drop WARN_ON in ACPI probes |
| MEDIUM | | 6.4 | | CVE-2026-45932 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix tcx/netkit detach permissions when prog fd isn't given |
| MEDIUM | | 7 | | CVE-2026-45934 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation |
| MEDIUM | | 5.5 | | CVE-2026-45940 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix oops when split header is enabled |
| MEDIUM | | 5.5 | | CVE-2026-45961 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gfs2: fix memory leaks in gfs2_fill_super error path |
| MEDIUM | | 5.5 | | CVE-2026-46014 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Add missing save/restore handling of LBR MSRs |
| MEDIUM | | 7 | | CVE-2026-46017 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm: fix deferred split queue races during migration |
| MEDIUM | | 7 | | CVE-2026-46032 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT |
| MEDIUM | | 5.5 | | CVE-2026-46044 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipmi:ssif: Clean up kthread on errors |
| MEDIUM | | 5.5 | | CVE-2026-46059 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN |
| MEDIUM | | 5.5 | | CVE-2026-46066 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix num_ops off-by-one when crypto allocation fails |
| MEDIUM | | 5.5 | | CVE-2026-46071 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 |
| MEDIUM | | 5.5 | | CVE-2026-46096 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() |
| MEDIUM | | 5.5 | | CVE-2026-46147 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() |
| MEDIUM | | 5.5 | | CVE-2026-46148 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: spi: microchip-core-qspi: control built-in cs manually |
| MEDIUM | | 5.5 | | CVE-2026-46153 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: 8021q: delete cleared egress QoS mappings |
| MEDIUM | | 5.5 | | CVE-2026-46171 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv: kvm: fix vector context allocation leak |
| MEDIUM | | 5.5 | | CVE-2026-46228 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: spi: ch341: fix devres lifetime |
| MEDIUM | | 5.5 | | CVE-2026-46245 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dc_link NULL handling in HPD init |
| MEDIUM | | 5.5 | | CVE-2026-46256 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages |
| MEDIUM | | 4.7 | | CVE-2026-46272 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: tmc-etr: Fix race condition between sysfs and perf mode |
| MEDIUM | | 5.5 | | CVE-2026-46302 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: selinux: allow multiple opens of /sys/fs/selinux/policy |
| MEDIUM | | 5.5 | | CVE-2026-46314 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Reject empty multisync extension to prevent infinite loop |
| MEDIUM | | 7 | | CVE-2026-46317 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock |
| MEDIUM | | 7 | | CVE-2026-46324 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: netfilter nf_tables denial of service via race condition in netlink hook unregistration |
| MEDIUM | | 7 | | CVE-2026-46325 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE |
| MEDIUM | | 7 | | CVE-2026-46330 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Revert "net/smc: Introduce TCP ULP support" |
| MEDIUM | | 5.5 | | CVE-2026-52937 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR |
| MEDIUM | | 7 | | CVE-2026-52953 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Fix oops due to out of scope access |
| MEDIUM | | 7 | | CVE-2026-52956 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() |
| MEDIUM | | 5.5 | | CVE-2026-52994 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting |
| MEDIUM | | 7 | | CVE-2026-53009 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ice: fix double-free of tx_buf skb |
| MEDIUM | | 5.5 | | CVE-2026-53017 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix data loss caused by incorrect use of nat_entry flag |
| MEDIUM | | 5.5 | | CVE-2026-53018 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: avoid reading already updated pages during GC |
| MEDIUM | | 5.5 | | CVE-2026-53103 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync |
| MEDIUM | | 5.5 | | CVE-2026-53104 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: Fix memory leak destroying device |
| MEDIUM | | 5.5 | | CVE-2026-53106 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Do not allow deleting local storage in NMI |
| MEDIUM | | 5.5 | | CVE-2026-53107 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: libertas: don't kill URBs in interrupt context |
| MEDIUM | | 5.5 | | CVE-2026-53108 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: powerpc/64s: Fix unmap race with PMD migration entries |
| MEDIUM | | | | CVE-2026-53178 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction |
| MEDIUM | | 7 | | CVE-2026-53224 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate embedded INIT chunk and address list lengths in cookie |
| MEDIUM | | 7 | | CVE-2026-53246 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing |
| MEDIUM | | 5.5 | | CVE-2026-53258 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: fix leak if split 6 GHz scanning fails |
| MEDIUM | | 5.5 | | CVE-2026-53281 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption |
| MEDIUM | | 5.5 | | CVE-2026-53285 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED |
| MEDIUM | | 5.5 | | CVE-2026-53292 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind |
| MEDIUM | | 5.5 | | CVE-2026-53297 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: mana: Guard mana_remove against double invocation |
| MEDIUM | | 5.5 | | CVE-2026-53321 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/napi: cap busy_poll_to 10 msec |
| MEDIUM | | 5.5 | | CVE-2026-53377 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: always recover the gpu |
| MEDIUM | | | | CVE-2026-53401 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: omap2: fix use-after-free in omapfb_mmap |
| MEDIUM | | | | CVE-2026-63805 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: crypto: nx - fix nx_crypto_ctx_exit argument |
| MEDIUM | | | | CVE-2026-63811 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: read COW data with the original inode during atomic write |
| MEDIUM | | | | CVE-2026-63819 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on f2fs_get_node_folio_ra() |
| MEDIUM | | 5.5 | | CVE-2026-63832 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: add wcid publish check in mt76_sta_add |
| MEDIUM | | 5.5 | | CVE-2026-63853 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring |
| MEDIUM | | | | CVE-2026-63857 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-63858 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: add hook transactions for device deletions |
| MEDIUM | | | | CVE-2026-63859 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue() |
| MEDIUM | | 7 | | CVE-2026-63941 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor |
| MEDIUM | | 7 | | CVE-2026-63979 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/handshake: hand off the pinned file reference to accept_doit |
| MEDIUM | | 5.5 | | CVE-2026-63998 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ethtool: module: call ethnl_ops_complete() on module flash errors |
| MEDIUM | | 5.5 | | CVE-2026-63999 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure |
| MEDIUM | | 5.5 | | CVE-2026-64006 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: fix dst corruption in same register operation |
| MEDIUM | | 7 | | CVE-2026-64024 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction |
| MEDIUM | | 5.5 | | CVE-2026-64036 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cgroup/rstat: validate cpu before css_rstat_cpu() access |
| MEDIUM | | 5.5 | | CVE-2026-64038 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Stop work before releasing hwmon device |
| MEDIUM | | 5.5 | | CVE-2026-64060 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix leak of request in netfs_write_begin() error handling |
| MEDIUM | | 7.1 | | CVE-2026-64066 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_read_to_pagecache() to pause on subreq failure |
| MEDIUM | | 5.5 | | CVE-2026-64067 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing barriers when accessing stream->subrequests locklessly |
| MEDIUM | | 7 | | CVE-2026-64068 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing locking around retry adding new subreqs |
| MEDIUM | | 5.5 | | CVE-2026-64076 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: bridge: eb_tables: close module init race |
| MEDIUM | | 5.5 | | CVE-2026-64077 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: ebtables: move to two-stage removal scheme |
| MEDIUM | | 7.1 | | CVE-2026-64078 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: add and use xtables_unregister_table_exit |
| MEDIUM | | 5.5 | | CVE-2026-64079 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: allocate hook ops while under mutex |
| MEDIUM | | 7 | | CVE-2026-64117 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb |
| MEDIUM | | 5.5 | | CVE-2026-64146 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix metabuf leak in inode xattr initialization |
| MEDIUM | | 5.5 | | CVE-2026-64154 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() |
| MEDIUM | | 5.5 | | CVE-2026-64159 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix zeropoint update where i_size > remote_i_size |
| MEDIUM | | 7 | | CVE-2026-64160 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point |
| MEDIUM | | 5.5 | | CVE-2026-64190 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: team: fix NULL pointer dereference in team_xmit during mode change |
| MEDIUM | | 5.5 | | CVE-2026-64212 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it |
| MEDIUM | | 5.5 | | CVE-2026-64213 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Add lock protection to lm90_alert |
| MEDIUM | | 7 | | CVE-2026-64255 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers |
| MEDIUM | | 7 | | CVE-2026-64520 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies |
| MEDIUM | | 7 | | CVE-2026-68086 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/khugepaged: write all dirty file folios when collapsing |
| MEDIUM | | 5.5 | | CVE-2026-68211 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: stm32-dcmipp: Return queued buffers on start_streaming() failure |
| MEDIUM | | 5.5 | | CVE-2026-68233 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/vc4: Shut down BO cache timer before teardown |
| MEDIUM | | 5.5 | | CVE-2026-68242 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/gt: Fix NULL deref on sched_engine alloc failure |
| MEDIUM | | 5.5 | | CVE-2026-68258 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size |
| MEDIUM | | 5.5 | | CVE-2026-68291 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: idpf driver null pointer dereference leads to Denial of Service |
| MEDIUM | | 5.5 | | CVE-2026-68295 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: BPF: Zero-extend signed ALU32 div/mod results |
| MEDIUM | | 5.5 | | CVE-2026-68312 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths |
| MEDIUM | | 7 | | CVE-2026-68323 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tipc: serialize udp bearer replicast list updates |
| MEDIUM | | 5.5 | | CVE-2026-68382 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Hold device ref until queue teardown completes |
| MEDIUM | | 5.5 | | CVE-2026-68383 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Keep scheduler timeline name alive |
| MEDIUM | | 7 | | CVE-2026-68393 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: extend conn_hash lookup critical sections |
| MEDIUM | | 6.4 | | CVE-2026-68399 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix UAF in sock clone early bailouts |
| MEDIUM | | 7 | | CVE-2026-68400 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation |
| MEDIUM | | 7 | | CVE-2026-68401 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() |
| MEDIUM | | 7 | | CVE-2026-68404 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect |
| MEDIUM | | 5.5 | | CVE-2026-68421 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() |
| MEDIUM | | 5.5 | | CVE-2026-68435 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Fix address space mismatch in kexec command line lookup |
| MEDIUM | | 5.5 | | CVE-2026-68441 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains |
| MEDIUM | | 5.5 | | CVE-2026-68447 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size |
| MEDIUM | | 7 | | CVE-2026-68448 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ovl: check access to copy_file_range source with src mounter creds |
| MEDIUM | | 7 | | CVE-2026-68453 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey |
| MEDIUM | | 5.5 | | CVE-2026-68471 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ieee80211: validate MLE common info length |
| MEDIUM | | 5.5 | | CVE-2026-72073 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mmc: vub300: fix use-after-free on probe failure |
| MEDIUM | | 5.5 | | CVE-2026-72162 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec |
| MEDIUM | | 7 | | CVE-2026-72288 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling |
| MEDIUM | | 7 | | CVE-2026-72329 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/liquidio: drop cached VF pci_dev LUT |
| MEDIUM | | 5.5 | | CVE-2026-72337 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: 6lowpan: avoid untracked enable work |
| MEDIUM | | 5.5 | | CVE-2026-72341 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Fix publication race for priv->channel_stats[] |
| MEDIUM | | 5.5 | | CVE-2026-72355 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix barriering when walking subrequest list |
| MEDIUM | | 5.5 | | CVE-2026-72365 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix writethrough to use collection offload |
| MEDIUM | | 5.5 | | CVE-2026-72367 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iomap: guard io_size EOF trim against concurrent truncate underflow |
| MEDIUM | | 5.5 | | CVE-2026-72375 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix reinitialisation of the inode, in particular ->lock_work |
| MEDIUM | | 5.5 | | CVE-2026-72380 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xen/pvcalls: bound backend response req_id before indexing rsp[] |
| MEDIUM | | 5.5 | | CVE-2026-72383 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: fix addr_wq_timer race in sctp_free_addr_wq() |
| MEDIUM | | 5.5 | | CVE-2026-72388 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock |
| MEDIUM | | 5.5 | | CVE-2026-72397 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() |
| MEDIUM | | 7 | | CVE-2026-72398 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sctp: add INIT verification after cookie unpacking |
| MEDIUM | | 5.5 | | CVE-2026-72404 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() |
| MEDIUM | | 5.5 | | CVE-2026-72423 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Guard conntrack opts error writes |
| MEDIUM | | 5.5 | | CVE-2026-72440 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1: fix writes_pending and barrier reference leaks on write failures |
| MEDIUM | | 5.5 | | CVE-2026-72454 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() |
| MEDIUM | | 5.5 | | CVE-2026-72488 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soundwire: fix bug in sdw_add_element_group_count found by syzkaller |
| MEDIUM | | 5.5 | | CVE-2026-72493 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: serialize netif_running() check in enqueue_to_backlog() |
| MEDIUM | | 5.5 | | CVE-2026-72495 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages |
| MEDIUM | | 7 | | CVE-2026-72499 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free CQ toggle page after firmware teardown |
| MEDIUM | | 7 | | CVE-2026-72500 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown |
| MEDIUM | | | | CVE-2026-72501 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: R ... |
| MEDIUM | | 5.5 | | CVE-2026-74257 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sockmap: Fix use-after-free in udp_bpf_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-74264 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: watchdog: fix refcount tracking races |
| MEDIUM | | 5.5 | | CVE-2026-74272 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Resolve region deletion races |
| MEDIUM | | 5.5 | | CVE-2026-74273 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Block region delete during region creation |
| MEDIUM | | 5.5 | | CVE-2026-74314 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Cancel special fields on map value recycle |
| MEDIUM | | 5.5 | | CVE-2026-74317 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ixgbe: do not configure xps for XDP queues |
| MEDIUM | | 5.5 | | CVE-2026-74324 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: validate skb length in testmode query |
| MEDIUM | | 5.5 | | CVE-2026-74337 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks |
| MEDIUM | | 5.5 | | CVE-2026-74342 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: kernfs: link kn to its parent before the LSM init hook |
| MEDIUM | | 5.5 | | CVE-2026-74344 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear rb node linkage when freeing bpf_rb_root |
| MEDIUM | | 5.5 | | CVE-2026-74350 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate fast symlink target during inode read |
| MEDIUM | | 5.5 | | CVE-2026-74354 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Take mmap_lock in zap_pages() |
| MEDIUM | | 5.5 | | CVE-2026-74368 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() |
| MEDIUM | | 6.5 | | CVE-2026-74385 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock |
| MEDIUM | | 5.5 | | CVE-2026-74388 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data |
| MEDIUM | | 7 | | CVE-2026-74405 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: OPP: Fix race between OPP addition and lookup |
| MEDIUM | | 5.5 | | CVE-2026-74407 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath11k: cancel SSR work items during PCI shutdown |
| MEDIUM | | 5.5 | | CVE-2026-74449 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport |
| MEDIUM | | 5.5 | | CVE-2026-74466 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Close speculative mem read possibility |
| MEDIUM | | 7 | | CVE-2026-74506 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: afs: Fix UAF when sending a message |
| MEDIUM | | 7 | | CVE-2026-74513 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister |
| MEDIUM | | 5.5 | | CVE-2026-74527 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-af: Block VFs from clobbering special CGX PKIND state |
| MEDIUM | | 5.5 | | CVE-2026-74529 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback |
| MEDIUM | | 5.5 | | CVE-2026-74530 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback |
| MEDIUM | | 7 | | CVE-2026-74533 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero |
| MEDIUM | | 7 | | CVE-2026-74537 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: hold sk properly in iso_conn_ready |
| MEDIUM | | 5.5 | | CVE-2026-74538 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: lock sk in iso_connect_ind |
| MEDIUM | | 5.5 | | CVE-2026-74542 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix folio_queue ENOMEM in writeback by adding a mempool |
| MEDIUM | | 5.5 | | CVE-2026-74544 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds |
| MEDIUM | | 5.5 | | CVE-2026-74600 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/page_table_check: skip special zero mappings |
| MEDIUM | | 5.5 | | CVE-2026-74605 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: eventfs: Use children field for rcu head and add memory barriers |
| MEDIUM | | 7 | | CVE-2026-74611 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tls: rx: restore msg_iter before TLS 1.3 optimistic retry |
| MEDIUM | | 5.5 | | CVE-2026-74638 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Serialize the scheduler timeout handlers |
| MEDIUM | | 5.5 | | CVE-2026-74687 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: watchdog: at91sam9_wdt: prevent timer rearm during teardown |
| MEDIUM | | 7 | | CVE-2026-74695 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() |
| MEDIUM | | 7 | | CVE-2026-74697 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Disable EOP for TPA on all chips to prevent data corruption |
| MEDIUM | | 5.5 | | CVE-2026-74711 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus) Fix type confusion in notification logic |
| MEDIUM | | 5.5 | | CVE-2026-74713 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vhost_iotlb: bound map allocation in add_range |
| MEDIUM | | 7 | | CVE-2026-74715 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix netns reference imbalance in conntrack kfuncs |
| MEDIUM | | 5.5 | | CVE-2026-74723 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject inline extents without valid headers |
| MEDIUM | | 5.5 | | CVE-2026-74729 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read |
| MEDIUM | | 5.5 | | CVE-2026-74747 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipvs: revalidate ihl to prevent out-of-bounds access |
| MEDIUM | | 5.5 | | CVE-2026-80579 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: clear fb_info->mode before deleting a videomode |
| MEDIUM | | 5.5 | | CVE-2026-80580 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: bound mode sysfs output to the sysfs buffer |
| MEDIUM | | 5.5 | | CVE-2026-80614 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: emac: Fix NULL pointer dereference in emac_probe |
| MEDIUM | | 5.5 | | CVE-2026-80623 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: ete: Always save state on power down |
| MEDIUM | | 5.5 | | CVE-2026-80628 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Serialize readq reset state with q->lock |
| MEDIUM | | 5.5 | | CVE-2026-80631 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject compressed segment that overflows the compressed input |
| MEDIUM | | 5.5 | | CVE-2026-80634 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag |
| MEDIUM | | 5.5 | | CVE-2026-80655 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: soc: xilinx: Fix race condition in event registration |
| MEDIUM | | 5.5 | | CVE-2026-80662 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size |
| MEDIUM | | 7 | | CVE-2026-80668 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations |
| MEDIUM | | 5.5 | | CVE-2026-80670 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() |
| MEDIUM | | 5.5 | | CVE-2026-80692 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks |
| MEDIUM | | 7 | | CVE-2026-80693 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: idpf: bound interrupt-vector register fill to the allocated array |
| MEDIUM | | 5.5 | | CVE-2026-80698 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: idxd: fix double free of wq, engine, and group structs |
| MEDIUM | | 5.5 | | CVE-2026-80721 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: ensure no dangling hcon references in iso_conn |
| MEDIUM | | | | CVE-2026-80761 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| MEDIUM | | 5.5 | | CVE-2026-80905 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: tap: fix wrong transport_header when sending VLAN-tagged frame |
| MEDIUM | | 5.5 | | CVE-2026-80920 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring: defer eventfd signaling when queued from a wakeup handler |
| MEDIUM | | 5.5 | | CVE-2026-81010 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: io_uring/waitid: honor task_work cancellation |
| MEDIUM | | 7 | | CVE-2026-89528 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Reject Read lists that exceed the page budget |
| MEDIUM | | 4.8 | | CVE-2026-89534 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| MEDIUM | | 7 | | CVE-2026-89537 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 |
| MEDIUM | | 7.2 | | CVE-2026-89610 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs: verify run length exceeding volume boundary |
| MEDIUM | | 5.5 | | CVE-2026-89611 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs: validate non-resident attribute offsets |
| MEDIUM | | 7.1 | | CVE-2026-89632 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() |
| MEDIUM | | 7 | | CVE-2026-89637 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 |
| MEDIUM | | 5.5 | | CVE-2026-89639 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC |
| MEDIUM | | 3.3 | | CVE-2026-89642 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cifs: call pagecache_isize_extended() in cifs_setsize() when extending |
| MEDIUM | | 6.2 | | CVE-2026-89648 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ceph: cap delegated inode count in ceph_parse_deleg_inos() |
| MEDIUM | | 7 | | CVE-2026-89654 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ceph: fix UAF in check_new_map() on session freed during unlock |
| MEDIUM | | 5.3 | | CVE-2026-89682 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net |
| MEDIUM | | 5.3 | | CVE-2026-89705 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths |
| MEDIUM | | 5.9 | | CVE-2026-89709 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: lockd, nfsd: RCU-protect nlmsvc_ops dispatch |
| MEDIUM | | 5.5 | | CVE-2026-89722 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() |
| MEDIUM | | 5.5 | | CVE-2026-89757 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/mglru: fix and remove redundant unevictable folio handling |
| MEDIUM | | 4.7 | | CVE-2026-89810 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix error path at svm_migrate_copy_to_ram |
| MEDIUM | | | | CVE-2026-89826 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| MEDIUM | | | | CVE-2026-89833 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| MEDIUM | | | | CVE-2026-89866 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| MEDIUM | | | | CVE-2026-89906 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| MEDIUM | | 4.7 | | CVE-2026-89913 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables |
| MEDIUM | | 4.7 | | CVE-2026-89920 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Fix memory corruption by not reinjecting CK machine checks |
| MEDIUM | | | | CVE-2026-89935 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 3.6 | | CVE-2026-89987 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/huge_memory: transfer the pmd dirty bit to the folio on zap |
| MEDIUM | | 5.5 | | CVE-2026-90040 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped |
| MEDIUM | | 5.5 | | CVE-2026-90061 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: skip double clone set expressions on element insert |
| MEDIUM | | 5.5 | | CVE-2026-90083 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: act_ife: Only operate on Ethernet frames |
| MEDIUM | | 5.5 | | CVE-2026-90087 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: do not leak an hci_conn when a second LE connect is rejected |
| MEDIUM | | 7 | | CVE-2026-90093 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: access chan->conn safely in get/setsockopt |
| MEDIUM | | 5.5 | | CVE-2026-90098 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: fix sleep in atomic context in MAC table access |
| MEDIUM | | 7 | | CVE-2026-90099 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: account classifier filter allocations to memcg |
| MEDIUM | | 7 | | CVE-2026-90104 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFSv4.1: zero referring call lists before decoding |
| MEDIUM | | 5.5 | | CVE-2026-90105 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vxlan: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90106 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: arp/nd proxy: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90116 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: mtpav: shut down output timer before card teardown |
| MEDIUM | | 5.5 | | CVE-2026-90142 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix resize of the RX ring |
| MEDIUM | | 5.5 | | CVE-2026-90149 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers |
| MEDIUM | | 5.5 | | CVE-2026-90154 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: scope session state changes to bound connections |
| MEDIUM | | 5.5 | | CVE-2026-90155 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: detach blocked lock requests before freeing |
| MEDIUM | | 5.5 | | CVE-2026-90156 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely discard unregistered deferred locks |
| MEDIUM | | 7 | | CVE-2026-90161 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: erofs: fix interlaced ztailpacking pclusters |
| MEDIUM | | 5.5 | | CVE-2026-90162 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: defer publishing granted locks to prevent UAF/double-free race |
| MEDIUM | | 5.5 | | CVE-2026-90167 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: serialize oplock close with pending break ownership |
| MEDIUM | | 5.5 | | CVE-2026-90174 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() |
| MEDIUM | | 5.5 | | CVE-2026-90177 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check pointer type for all atomic RMW paths |
| MEDIUM | | 5.5 | | CVE-2026-90179 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix deadlock in complain-mode change_hat |
| MEDIUM | | 5.5 | | CVE-2026-90204 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate DIO orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90205 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90208 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type |
| MEDIUM | | 5.5 | | CVE-2026-90217 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Compare iterator types during state pruning |
| MEDIUM | | 5.5 | | CVE-2026-90231 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix unconfined user namespace restriction forced stack |
| MEDIUM | | 5.5 | | CVE-2026-90232 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: amt: Don't support cross-netns setup |
| MEDIUM | | 5.1 | | CVE-2026-90234 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NFS: Return a delegation the client fails to record |
| MEDIUM | | 7 | | CVE-2026-90237 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nft_ct: move custom expectation support to helper |
| MEDIUM | | 7 | | CVE-2026-90240 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Flush context cache with correct SID when tearing down aliases |
| MEDIUM | | 5.5 | | CVE-2026-90247 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix mmap_lock leak in irq_work path |
| MEDIUM | | 5.9 | | CVE-2026-90256 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind |
| MEDIUM | | 5.5 | | CVE-2026-90259 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() |
| MEDIUM | | 4.7 | | CVE-2026-90260 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: don't clobber the extent buffer when zeroing it out |
| MEDIUM | | 3.3 | | CVE-2026-90263 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: check if root is readonly when setting posix acl |
| MEDIUM | | 5.5 | | CVE-2026-90264 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: always wait for ordered extents to avoid OE races |
| MEDIUM | | 5.5 | | CVE-2026-90265 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: defrag: fix deadlock between defrag and delalloc space reservation |
| MEDIUM | | 5.5 | | CVE-2026-90273 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable |
| MEDIUM | | 5.5 | | CVE-2026-90289 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Resize MST HDCP per-connector arrays to 32 |
| MEDIUM | | 5.5 | | CVE-2026-90300 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear buf on error in __bpf_get_task_stack |
| MEDIUM | | 5.5 | | CVE-2026-90301 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: o2hb: quiesce negotiate handlers and timeout work |
| MEDIUM | | 7 | | CVE-2026-90317 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Invalidate RCU pointers after final spin unlock |
| MEDIUM | | 5.5 | | CVE-2026-90320 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate external xattr entries when reading metadata |
| MEDIUM | | 5.5 | | CVE-2026-90321 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate inline xattrs during inode block validation |
| MEDIUM | | 5.5 | | CVE-2026-90324 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ublk: check import_ubuf() return value |
| MEDIUM | | 4.7 | | CVE-2026-90326 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-cgroup: fix race between policy activation and blkg destruction |
| MEDIUM | | 5.5 | | CVE-2026-90328 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: HID: steam: Reject short reads |
| MEDIUM | | 6.4 | | CVE-2026-90333 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dm-integrity: replace forgeable discard filler with a keyed sector marker |
| MEDIUM | | 4.1 | | CVE-2026-90336 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: clear freed pointers on uart_register_driver() failure |
| MEDIUM | | 5.5 | | CVE-2026-90337 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: do fallible allocations before the console can be registered |
| MEDIUM | | 7 | | CVE-2026-90343 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: stop PMSR before P2P and NAN teardown |
| MEDIUM | | 5.5 | | CVE-2026-90345 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: brcmfmac: fix P2P action frame handling without device vif |
| MEDIUM | | 7 | | CVE-2026-90347 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry |
| MEDIUM | | 5.5 | | CVE-2026-90351 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed |
| MEDIUM | | 4.4 | | CVE-2026-90359 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject >8 byte return values on return-reading trampoline paths |
| MEDIUM | | 5.5 | | CVE-2026-90363 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: don't tear down KMS twice when KMS init fails |
| MEDIUM | | 5.5 | | CVE-2026-90365 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: cancel reset and rc work on device unregister |
| MEDIUM | | 5.5 | | CVE-2026-90367 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER |
| MEDIUM | | 4.8 | | CVE-2026-90379 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash |
| MEDIUM | | 3.3 | | CVE-2026-90401 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md: remove REQ_NOWAIT support from raid1/10/456 |
| MEDIUM | | 5.5 | | CVE-2026-90408 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() |
| MEDIUM | | 5.5 | | CVE-2026-90409 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Add vm_bind region with kbo range overlap check |
| MEDIUM | | 4.7 | | CVE-2026-90417 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() |
| MEDIUM | | 5.5 | | CVE-2026-90421 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: PCI: Fix UAF when probe runs concurrent to dyn ID removal |
| MEDIUM | | 5.5 | | CVE-2026-90422 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path |
| MEDIUM | | 4.7 | | CVE-2026-90427 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() |
| MEDIUM | | 5.5 | | CVE-2026-92480 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Validate string descriptors |
| MEDIUM | | 5.5 | | CVE-2026-92482 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip |
| MEDIUM | | 3.3 | | CVE-2026-92485 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix WARNING in bpf_tracing_link_release |
| MEDIUM | | 5.5 | | CVE-2026-92499 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext4: validate readdir offset before accessing dirent |
| MEDIUM | | 4.7 | | CVE-2026-92500 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext4: use fsdata to track inline data write state and fix race |
| MEDIUM | | 5.5 | | CVE-2026-92503 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() |
| MEDIUM | | 5.5 | | CVE-2026-92518 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: riscv, bpf: Fix kernel stack corruption in tailcall with CFI |
| MEDIUM | | 5.5 | | CVE-2026-92520 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Zero queue and stack outputs on lock failure |
| MEDIUM | | 5.5 | | CVE-2026-93044 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for arena-related insns |
| MEDIUM | | 5.5 | | CVE-2026-93047 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Associate BOs with every job that accesses them |
| MEDIUM | | 5.5 | | CVE-2026-93058 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Only fini scheduler after successful init |
| MEDIUM | | 5.5 | | CVE-2026-93081 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_scmi: Fix SCMI device destroy lifetimes |
| MEDIUM | | 4.7 | | CVE-2026-93099 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Fix UAF from worker threads when domains are removed |
| MEDIUM | | 4.7 | | CVE-2026-93100 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() |
| MEDIUM | | 4.7 | | CVE-2026-93104 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rvt: Return NULL after port allocation failure |
| MEDIUM | | 7 | | CVE-2026-93105 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: esp: do not unref managed frag pages in esp_ssg_unref() |
| MEDIUM | | 5.5 | | CVE-2026-93122 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: usb: gadget: uac: validate rate list length before storing |
| MEDIUM | | 5.5 | | CVE-2026-93135 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject programs with inlined helpers if JIT is not available |
| MEDIUM | | 7 | | CVE-2026-93148 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject MEM_ALLOC BTF accesses past object bounds |
| MEDIUM | | 7 | | CVE-2026-93154 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Add refcounting to user ring MRs |
| MEDIUM | | 5.5 | | CVE-2026-93168 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout |
| MEDIUM | | 5.5 | | CVE-2026-93175 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in CRTC reset function |
| MEDIUM | | 4.7 | | CVE-2026-93176 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in plane reset function |
| MEDIUM | | 5.5 | | CVE-2026-93270 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn |
| MEDIUM | | 5.5 | | CVE-2026-93272 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 |
| MEDIUM | | 5.5 | | CVE-2026-93276 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator |
| MEDIUM | | 5.5 | | CVE-2026-93282 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix maximum allowed access checks |
| MEDIUM | | 7.1 | | CVE-2026-97422 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: fix SMI event cross-process information leak |
| MEDIUM | | 5.5 | | CVE-2026-97432 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: fix P2P-Device binding handling |
| MEDIUM | | 5.5 | | CVE-2026-97478 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virt: acrn: Fix irqfd use-after-free during eventfd shutdown |
| MEDIUM | | 7.1 | | CVE-2026-97493 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS |
| MEDIUM | | 5.5 | | CVE-2026-97499 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: perf: Retrieve path and source from event data |
| MEDIUM | | 5.5 | | CVE-2026-97513 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Release m2m_ctx after Instance Removed from List |
| MEDIUM | | 5.5 | | CVE-2026-97515 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 |
| MEDIUM | | 5.5 | | CVE-2026-97526 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/pai: Support CPU hotplug for PMU PAI |
| MEDIUM | | 5.5 | | CVE-2026-97538 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: hwmon: (asus_rog_ryujin) Validate HID report lengths |
| MEDIUM | | 5.5 | | CVE-2026-97554 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() |
| MEDIUM | | 7 | | CVE-2026-97561 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid |
| MEDIUM | | 7 | | CVE-2026-97563 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97565 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject short READ responses in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97960 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel: Prevent drain_pebs() reentry |
| MEDIUM | | 5.5 | | CVE-2026-97962 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Move representor vnic reporter to eswitch devlink port |
| MEDIUM | | 5.1 | | CVE-2026-97975 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() |
| MEDIUM | | 4.7 | | CVE-2026-97988 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vhost: invalidate vring access on IOTLB transitions |
| MEDIUM | | 5.5 | | CVE-2026-98019 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: mark a NULL call argument precise |
| MEDIUM | | 5.3 | | CVE-2026-98032 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tracing: Fix subbuf resize races with trace_pipe_raw readers |
| MEDIUM | | 7 | | CVE-2026-98033 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Preserve inner map identity in callback frames |
| MEDIUM | | 7 | | CVE-2026-98034 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark NULL kptr stores precise |
| MEDIUM | | 5.5 | | CVE-2026-98043 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Don't infer non-NULL from a pointer with an unbounded offset |
| MEDIUM | | 7 | | CVE-2026-98047 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Check ancestor frames for rbtree callbacks |
| MEDIUM | | 7 | | CVE-2026-98048 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: don't rewrite bpf_fastcall patterns entered by a jump |
| MEDIUM | | 5.5 | | CVE-2026-98049 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: zero extend the result of an arena 32-bit cmpxchg |
| MEDIUM | | 5.5 | | CVE-2026-98053 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Refactor and fix init_config access |
| MEDIUM | | 5.5 | | CVE-2026-98062 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark signal tracepoint siginfo arguments as scalar |
| MEDIUM | | 5.5 | | CVE-2026-98085 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge |
| MEDIUM | | | | CVE-2026-98099 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 5.5 | | CVE-2026-98115 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely drain sessions during logoff |
| MEDIUM | | 5.5 | | CVE-2026-98118 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix readahead synchronisation issues by loading all folios upfront |
| MEDIUM | | 5.5 | | CVE-2026-98124 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/client: invalidate fscache for fallocate range operations |
| MEDIUM | | 5.5 | | CVE-2026-98125 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix stale page cache in insert/collapse range |
| MEDIUM | | 5.5 | | CVE-2026-98131 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix dma mapping leak in stmmac_tso_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-98134 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: check_cond_jmp_op(): properly infer if register is null |
| MEDIUM | | 5.3 | | CVE-2026-98156 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/virtio: use the DMA API for resource backing on Xen |
| MEDIUM | | 5.5 | | CVE-2026-98162 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/server: fix tree connection leak in smb2_tree_connect() |
| MEDIUM | | 5.5 | | CVE-2026-98180 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm: RCU-free the scheduler-containing ring and VM objects |
| MEDIUM | | 5.5 | | CVE-2026-98228 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ |
| MEDIUM | | 4.4 | | CVE-2026-98273 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: x86/kprobes: Fix crash when probing CS CALL instructions |
| MEDIUM | | 5.5 | | CVE-2026-98277 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: ring the doorbell if a burst ends in a drop |
| MEDIUM | | 5.5 | | CVE-2026-98279 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: handle lack of space when cleaning up verity items |
| MEDIUM | | 5.3 | | CVE-2026-98284 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netlink: do not free nlk->groups while lockless readers can use it |
| MEDIUM | | 4.1 | | CVE-2026-98286 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown |
| MEDIUM | | 5.5 | | CVE-2026-98288 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix TSO header length truncation |
| MEDIUM | | 5.5 | | CVE-2026-98292 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| MEDIUM | | 5.5 | | CVE-2026-98294 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_qca: Do not write to the serial port after it is closed |
| MEDIUM | | 7 | | CVE-2026-98296 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btintel_pcie: validate TX skb length in send_sync |
| MEDIUM | | 5.5 | | CVE-2026-98313 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/msm/dp: skip PUSH_IDLE when the link was never enabled |
| MEDIUM | | 7 | | CVE-2026-98330 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: get the wiphy out of a dying network namespace |
| MEDIUM | | 5.5 | | CVE-2026-98333 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: reset the LED state when ifup fails |
| MEDIUM | | 7 | | CVE-2026-98341 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: don't free driver-owned scan requests |
| MEDIUM | | 5.5 | | CVE-2026-98353 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables |
| MEDIUM | | 5.5 | | CVE-2026-98355 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/rtrs: guard against null kobj name |
| MEDIUM | | 5.5 | | CVE-2026-98376 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Use array_map_meta_equal for percpu array inner map replacement |
| MEDIUM | | 5.5 | | CVE-2026-98408 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: watchdog: rzv2h: Avoid division by zero |
| MEDIUM | | 5.5 | | CVE-2026-98420 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ksmbd: follow SMB2 session expiration semantics |
| MEDIUM | | | | CVE-2026-98436 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: a ... |
| MEDIUM | | 6.5 | | CVE-2026-98439 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/server: cancel async requests when closing connection |
| MEDIUM | | 4.7 | | CVE-2026-98444 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: drop dquot flush lock when we can't find a buffer to flush |
| MEDIUM | | 6.5 | | CVE-2026-98449 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: delete compound mids on send failure before unlock |
| MEDIUM | | 5.3 | | CVE-2026-98471 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Do cache maintenance on the source VM during intra-host migration |
| MEDIUM | | 5.5 | | CVE-2026-98556 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gve: DQO: reject TSO packets with an out of range MSS |
| MEDIUM | | 4.1 | | CVE-2026-98558 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: flush skb_defer_nodes in dev_cpu_dead() |
| MEDIUM | | 5.9 | | CVE-2026-98570 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: ipv6: keep room for the mac header in dst_dev_overhead() |
| MEDIUM | | 6.7 | | CVE-2026-98589 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject pkt arguments in mutating subprogs |
| MEDIUM | | 4.7 | | CVE-2026-98598 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv6: Prevent rt6_insert_exception() for dying fib6_info |
| MEDIUM | | 6.7 | | CVE-2026-98599 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() |
| MEDIUM | | 4.1 | | CVE-2026-98616 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: reset num_napi when the napi vectors are freed |
| MEDIUM | | 5.5 | | CVE-2026-98652 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Add missing srcu in kvm_s390_set_irq_state() |
| MEDIUM | | 5.5 | | CVE-2026-98674 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iio: adc: adi-axi-adc: Initialize state mutex |
| MEDIUM | | 5.6 | | CVE-2026-98714 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| MEDIUM | | 4.1 | | CVE-2026-98740 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety |
| MEDIUM | | 4.4 | | CVE-2026-98747 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix NULL pointer dereference in serial_core_unregister_port() |
| MEDIUM | | 4.7 | | CVE-2026-98786 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: guard dc_sink dereferences in MST mode validation |
| MEDIUM | | 4.4 | | CVE-2026-98789 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix objects stuck in free_by_rcu_ttrace |
| MEDIUM | | 4.4 | | CVE-2026-98795 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: skip ptp deinit if init was skipped |
| MEDIUM | | 4.4 | | CVE-2026-98799 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Skip detached progs in trampoline images that are still in use |
| MEDIUM | | 4.7 | | CVE-2026-98800 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: kernel: Denial of Service via use-after-free in BPF trampoline |
| MEDIUM | | 6.5 | | CVE-2026-98803 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix rx Scatter-Gather support |
| MEDIUM | | 6.1 | | CVE-2026-98810 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() |
| MEDIUM | | 4.4 | | CVE-2026-98813 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Hold map BTF for the memory allocator destructor record |
| MEDIUM | | 4.4 | | CVE-2026-98814 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix command effects log lifetime for multipath heads |
| MEDIUM | | 4.1 | | CVE-2026-98815 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: nvme: fix cdev lifetime |
| MEDIUM | | 4.1 | | CVE-2026-98816 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix overflow of jump offset in constant blinding |
| MEDIUM | | 5.5 | | CVE-2026-98820 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-mq: set RQF_USE_SCHED when the operation is known |
| MEDIUM | | 5.3 | | CVE-2026-98824 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate TX status rate metadata |
| MEDIUM | | 6.5 | | CVE-2026-98829 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: drop oversized fragments to avoid extra_len overflow |
| MEDIUM | | 4.1 | | CVE-2026-98834 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mtd: core: avoid double-free of OTP NVMEM device |
| MEDIUM | | 6.1 | | CVE-2026-98839 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() |
| MEDIUM | | 4.4 | | CVE-2026-98843 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: zero gaps in read-gaps folio to avoid writing back stale data |
| MEDIUM | | 5.6 | | CVE-2026-98863 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| MEDIUM | | 4.6 | | CVE-2019-15213 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: use-after-free caused by malicious USB device in drivers/media/usb/dvb-usb/dvb-usb-init.c |
| MEDIUM | | 4.1 | | CVE-2019-16089 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Improper return check in nbd_genl_status function in drivers/block/nbd.c |
| MEDIUM | | 4.7 | | CVE-2019-20794 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: task processes not being properly ended could lead to resource exhaustion |
| MEDIUM | | 4.4 | | CVE-2020-14304 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ethtool when reading eeprom of device could lead to memory leak |
| MEDIUM | | 6.7 | | CVE-2020-36694 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfilter: use-after-free in the packet processing context |
| MEDIUM | | 5.5 | | CVE-2023-31082 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: sleeping function called from an invalid context in gsmld_write |
| MEDIUM | | 7 | | CVE-2023-3397 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: slab-use-after-free Write in txEnd due to race condition |
| MEDIUM | | 5.5 | | CVE-2023-37454 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: udf: use-after-free write in udf_close_lvid |
| MEDIUM | | 6.7 | | CVE-2023-6238 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: nvme: memory corruption via unprivileged user passthrough |
| MEDIUM | | 6.5 | | CVE-2023-6240 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation |
| MEDIUM | | 5.5 | | CVE-2024-2193 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | hw: Spectre-SRC that is Speculative Race Conditions (SRCs) for synchronization primitives similar like Spectre V1 with p |
| MEDIUM | | 4.7 | | CVE-2024-24864 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | A race condition was found in the Linux kernel's media/dvb-core in dvb ... |
| MEDIUM | | 5.5 | | CVE-2024-25740 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: memory leak in ubi driver |
| MEDIUM | | 5.5 | | CVE-2024-56709 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: io_uring: check if iowq is killed before queuing |
| MEDIUM | | 5.5 | | CVE-2024-58074 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/i915: Grab intel_display from the encoder to avoid potential oopsies |
| MEDIUM | | 5.5 | | CVE-2025-21752 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents |
| MEDIUM | | 5.5 | | CVE-2025-21949 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Set hugetlb mmap base address aligned with pmd size |
| MEDIUM | | 5.5 | | CVE-2025-22109 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ax25: Remove broken autobind |
| MEDIUM | | 5.5 | | CVE-2025-23132 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: f2fs: quota: fix to avoid warning in dquot_writeback_dquots() |
| MEDIUM | | 5.5 | | CVE-2025-23135 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Teardown riscv specific bits after kvm_exit |
| MEDIUM | | 5.5 | | CVE-2025-37743 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Avoid memory leak while enabling statistics |
| MEDIUM | | 5.5 | | CVE-2025-37746 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: perf/dwc_pcie: fix duplicate pci_dev devices |
| MEDIUM | | 5.5 | | CVE-2025-37880 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: um: work around sched_yield not yielding in time-travel mode |
| MEDIUM | | 4.7 | | CVE-2025-37906 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: ublk race condition causes kernel crash |
| MEDIUM | | 5.5 | | CVE-2025-38029 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to sleepable page allocation in KASAN |
| MEDIUM | | 5.5 | | CVE-2025-38036 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to null pointer dereference in GT MMIO initialization for VFs |
| MEDIUM | | 5.5 | | CVE-2025-38041 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: clk: sunxi-ng: h616: Reparent GPU clock during frequency changes |
| MEDIUM | | 5.5 | | CVE-2025-38042 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn |
| MEDIUM | | 6.7 | | CVE-2025-38064 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: virtio: break and reset virtio devices on device_shutdown() |
| MEDIUM | | 5.5 | | CVE-2025-38132 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: coresight: holding cscfg_csdev_lock while removing cscfg from csdev |
| MEDIUM | | 5.5 | | CVE-2025-38140 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Local denial of service in device mapper |
| MEDIUM | | 5.5 | | CVE-2025-38199 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix memory leak due to multiple rx_stats allocation |
| MEDIUM | | 5.5 | | CVE-2025-38207 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: mm: fix uprobe pte be overwritten when expanding vma |
| MEDIUM | | 5.5 | | CVE-2025-38261 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: riscv: save the SR_SUM status over switches |
| MEDIUM | | 5.5 | | CVE-2025-38284 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: configure manual DAC mode via PCI config API only |
| MEDIUM | | 5.5 | | CVE-2025-38311 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Linux kernel (iavf): Denial of Service due to a locking issue |
| MEDIUM | | 5.5 | | CVE-2025-38359 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Fix in_atomic() handling in do_secure_storage_access() |
| MEDIUM | | 5.5 | | CVE-2025-38597 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port |
| MEDIUM | | 5.5 | | CVE-2025-38605 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() |
| MEDIUM | | 5.5 | | CVE-2025-39677 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net/sched: Fix backlog accounting in qdisc_dequeue_internal |
| MEDIUM | | 5.5 | | CVE-2025-39762 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: add null check |
| MEDIUM | | 5.5 | | CVE-2025-39775 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: mremap local denial of service |
| MEDIUM | | 5.5 | | CVE-2025-39789 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: crypto: x86/aegis - Add missing error checks |
| MEDIUM | | 6.1 | | CVE-2025-39822 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: io_uring/kbuf: fix signedness in this_len calculation |
| MEDIUM | | 5.5 | | CVE-2025-39830 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path |
| MEDIUM | | 5.5 | | CVE-2025-39834 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow |
| MEDIUM | | 6.2 | | CVE-2025-39910 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() |
| MEDIUM | | 7.1 | | CVE-2025-39933 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length |
| MEDIUM | | 2.5 | | CVE-2025-40113 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E |
| MEDIUM | | 6.8 | | CVE-2025-40130 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling |
| MEDIUM | | 6.2 | | CVE-2025-40146 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: blk-mq: fix potential deadlock while nr_requests grown |
| MEDIUM | | 5.2 | | CVE-2025-40217 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: pidfs: validate extensible ioctls |
| MEDIUM | | | | CVE-2025-40247 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Fix pgtable prealloc error path |
| MEDIUM | | 5.2 | | CVE-2025-40338 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Do not share the name pointer between components |
| MEDIUM | | 6.1 | | CVE-2025-40355 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: sysfs: check visibility before changing group attribute ownership |
| MEDIUM | | 5.5 | | CVE-2025-68209 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: mlx5: Fix default values in create CQ |
| MEDIUM | | 5.5 | | CVE-2025-68236 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service during UFS power down |
| MEDIUM | | 5.5 | | CVE-2025-68304 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_core: lookup hci_conn on RX path on protocol side |
| MEDIUM | | | | CVE-2025-68318 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL |
| MEDIUM | | 6.1 | | CVE-2025-68319 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netconsole: Acquire su_mutex before navigating configs hierarchy |
| MEDIUM | | 5.5 | | CVE-2025-68353 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service via NULL pointer dereference in VXLAN module |
| MEDIUM | | 4.5 | | CVE-2025-68360 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks |
| MEDIUM | | 5.5 | | CVE-2025-68368 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service in md driver via uninitialized bioset |
| MEDIUM | | 6.5 | | CVE-2025-68729 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix MSDU buffer types handling in RX error path |
| MEDIUM | | 5.5 | | CVE-2025-68730 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() |
| MEDIUM | | 4.7 | | CVE-2025-68745 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset |
| MEDIUM | | 7.8 | | CVE-2025-71074 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Linux kernel functionfs: Use-After-Free vulnerability due to open/removal races |
| MEDIUM | | 5.5 | | CVE-2025-71117 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service via deadlock in block layer sysfs store callbacks |
| MEDIUM | | 5.5 | | CVE-2025-71141 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/tilcdc: Fix removal actions in case of failed probe |
| MEDIUM | | 5.5 | | CVE-2025-71188 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: dmaengine: lpc18xx-dmamux: fix device leak on route allocation |
| MEDIUM | | 6.5 | | CVE-2025-71202 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Memory Corruption and Kernel Crashes via IOMMU SVA coherency issue |
| MEDIUM | | 5.5 | | CVE-2025-71227 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: don't WARN for connections on invalid channels |
| MEDIUM | | 5.5 | | CVE-2025-71285 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels |
| MEDIUM | | 5.5 | | CVE-2025-71302 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: fix for dma-fence safe access rules |
| MEDIUM | | 7 | | CVE-2025-71313 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: PCI: endpoint: Add missing NULL check for alloc_workqueue() |
| MEDIUM | | 5.5 | | CVE-2025-71315 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/vkms: Convert to DRM's vblank timer |
| MEDIUM | | 5.5 | | CVE-2026-100074 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| MEDIUM | | 5.5 | | CVE-2026-100076 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths |
| MEDIUM | | 5.5 | | CVE-2026-100077 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Recover HW before retire hung submit |
| MEDIUM | | 5.5 | | CVE-2026-23007 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: block: zero non-PI portion of auto integrity buffer |
| MEDIUM | | 5.5 | | CVE-2026-23017 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: idpf: fix error handling in the init_task on load |
| MEDIUM | | 5.5 | | CVE-2026-23143 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix misalignment bug in struct virtnet_info |
| MEDIUM | | 7.1 | | CVE-2026-23152 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: correctly decode TTLM with default link map |
| MEDIUM | | 5.5 | | CVE-2026-23217 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: riscv: trace: fix snapshot deadlock with sbi ecall |
| MEDIUM | | 5.5 | | CVE-2026-23259 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: io_uring/rw: free potentially allocated iovec on cache put failure |
| MEDIUM | | 5.5 | | CVE-2026-23265 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer in {read,write}_end_io |
| MEDIUM | | 5.5 | | CVE-2026-23348 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix race of nvdimm_bus object when creating nvdimm objects |
| MEDIUM | | 5.5 | | CVE-2026-23371 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting |
| MEDIUM | | 5.5 | | CVE-2026-23377 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz |
| MEDIUM | | 5.5 | | CVE-2026-23385 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: clone set on flush only |
| MEDIUM | | 5.5 | | CVE-2026-23472 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN |
| MEDIUM | | 5.5 | | CVE-2026-31435 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix read abandonment during retry |
| MEDIUM | | 5.5 | | CVE-2026-31526 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix exception exit lock checking for subprogs |
| MEDIUM | | 5.5 | | CVE-2026-31537 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: smb: server: make use of smbdirect_socket.send_io.bcredits |
| MEDIUM | | 5.5 | | CVE-2026-31562 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register |
| MEDIUM | | 5.5 | | CVE-2026-31579 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit |
| MEDIUM | | 5.5 | | CVE-2026-31591 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish |
| MEDIUM | | 5.5 | | CVE-2026-31592 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock |
| MEDIUM | | 5.5 | | CVE-2026-31630 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: rxrpc: proc: size address buffers for %pISpc output |
| MEDIUM | | 7.1 | | CVE-2026-31692 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns |
| MEDIUM | | 5.5 | | CVE-2026-31771 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_event: move wake reason storage into validated event handlers |
| MEDIUM | | 5.5 | | CVE-2026-31777 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ALSA: ctxfi: Check the error for index mapping |
| MEDIUM | | 5.5 | | CVE-2026-43009 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix incorrect pruning due to atomic fetch precision tracking |
| MEDIUM | | 5.5 | | CVE-2026-43022 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists |
| MEDIUM | | 5.5 | | CVE-2026-43029 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: mptcp: fix soft lockup in mptcp_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-43034 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: set backing store type from query type |
| MEDIUM | | 7.1 | | CVE-2026-43042 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: mpls: add seqcount to protect the platform_label{,s} pair |
| MEDIUM | | 5.5 | | CVE-2026-43048 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: HID: core: Mitigate potential OOB by removing bogus memset() |
| MEDIUM | | 5.5 | | CVE-2026-43053 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: xfs: close crash window in attr dabtree inactivation |
| MEDIUM | | 5.5 | | CVE-2026-43083 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: ioam6: fix OOB and missing lock |
| MEDIUM | | 5.5 | | CVE-2026-43101 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() |
| MEDIUM | | 5.5 | | CVE-2026-43115 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: srcu: Use irq_work to start GP in tiny SRCU |
| MEDIUM | | 5.5 | | CVE-2026-43118 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix zero size inode with non-zero size after log replay |
| MEDIUM | | 5.5 | | CVE-2026-43127 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ntfs3: fix circular locking dependency in run_unpack_ex |
| MEDIUM | | 5.5 | | CVE-2026-43172 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: fix 22000 series SMEM parsing |
| MEDIUM | | 5.5 | | CVE-2026-43191 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 |
| MEDIUM | | 5.5 | | CVE-2026-43204 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ASoC: qcom: q6asm: drop DSP responses for closed data streams |
| MEDIUM | | 5.5 | | CVE-2026-43213 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: validate sequence number of TX release report |
| MEDIUM | | 5.5 | | CVE-2026-43234 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: team: avoid NETDEV_CHANGEMTU event when unregistering slave |
| MEDIUM | | 5.5 | | CVE-2026-43272 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ring-buffer: Fix possible dereference of uninitialized pointer |
| MEDIUM | | 5.5 | | CVE-2026-43294 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels |
| MEDIUM | | 5.5 | | CVE-2026-43298 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Skip vcn poison irq release on VF |
| MEDIUM | | 5.5 | | CVE-2026-43299 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() |
| MEDIUM | | 5.5 | | CVE-2026-43301 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix PM runtime usage count underflow |
| MEDIUM | | 5.5 | | CVE-2026-43308 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() |
| MEDIUM | | 5.5 | | CVE-2026-43309 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: md raid: fix hang when stopping arrays with metadata through dm-raid |
| MEDIUM | | 5.5 | | CVE-2026-43310 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC |
| MEDIUM | | 5.5 | | CVE-2026-43311 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: soc/tegra: pmc: Fix unsafe generic_handle_irq() call |
| MEDIUM | | 5.5 | | CVE-2026-43325 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: don't send a 6E related command when not supported |
| MEDIUM | | 5.5 | | CVE-2026-43326 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback |
| MEDIUM | | 5.5 | | CVE-2026-43337 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() |
| MEDIUM | | 5.5 | | CVE-2026-43346 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ice: ptp: don't WARN when controlling PF is unavailable |
| MEDIUM | | 5.5 | | CVE-2026-43352 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue |
| MEDIUM | | 5.5 | | CVE-2026-43353 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue |
| MEDIUM | | 7.1 | | CVE-2026-43414 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Completely fix fcport double free |
| MEDIUM | | 5.5 | | CVE-2026-43416 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: powerpc, perf: Check that current->mm is alive before getting user callchain |
| MEDIUM | | 5.5 | | CVE-2026-43443 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ASoC: amd: acp-mach-common: Add missing error check for clock acquisition |
| MEDIUM | | 5.5 | | CVE-2026-43463 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() |
| MEDIUM | | 5.5 | | CVE-2026-43464 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ |
| MEDIUM | | 5.5 | | CVE-2026-43465 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ |
| MEDIUM | | 5.5 | | CVE-2026-43485 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: nouveau/gsp: drop WARN_ON in ACPI probes |
| MEDIUM | | 6.4 | | CVE-2026-45932 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix tcx/netkit detach permissions when prog fd isn't given |
| MEDIUM | | 7 | | CVE-2026-45934 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation |
| MEDIUM | | 5.5 | | CVE-2026-45940 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix oops when split header is enabled |
| MEDIUM | | 5.5 | | CVE-2026-45961 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: gfs2: fix memory leaks in gfs2_fill_super error path |
| MEDIUM | | 5.5 | | CVE-2026-46014 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Add missing save/restore handling of LBR MSRs |
| MEDIUM | | 7 | | CVE-2026-46017 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: mm: fix deferred split queue races during migration |
| MEDIUM | | 7 | | CVE-2026-46032 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT |
| MEDIUM | | 5.5 | | CVE-2026-46044 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ipmi:ssif: Clean up kthread on errors |
| MEDIUM | | 5.5 | | CVE-2026-46059 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN |
| MEDIUM | | 5.5 | | CVE-2026-46066 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ceph: fix num_ops off-by-one when crypto allocation fails |
| MEDIUM | | 5.5 | | CVE-2026-46071 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 |
| MEDIUM | | 5.5 | | CVE-2026-46096 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() |
| MEDIUM | | 5.5 | | CVE-2026-46147 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() |
| MEDIUM | | 5.5 | | CVE-2026-46148 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: spi: microchip-core-qspi: control built-in cs manually |
| MEDIUM | | 5.5 | | CVE-2026-46153 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: 8021q: delete cleared egress QoS mappings |
| MEDIUM | | 5.5 | | CVE-2026-46171 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: riscv: kvm: fix vector context allocation leak |
| MEDIUM | | 5.5 | | CVE-2026-46228 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: spi: ch341: fix devres lifetime |
| MEDIUM | | 5.5 | | CVE-2026-46245 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dc_link NULL handling in HPD init |
| MEDIUM | | 5.5 | | CVE-2026-46256 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages |
| MEDIUM | | 4.7 | | CVE-2026-46272 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: coresight: tmc-etr: Fix race condition between sysfs and perf mode |
| MEDIUM | | 5.5 | | CVE-2026-46302 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: selinux: allow multiple opens of /sys/fs/selinux/policy |
| MEDIUM | | 5.5 | | CVE-2026-46314 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Reject empty multisync extension to prevent infinite loop |
| MEDIUM | | 7 | | CVE-2026-46317 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock |
| MEDIUM | | 7 | | CVE-2026-46324 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: netfilter nf_tables denial of service via race condition in netlink hook unregistration |
| MEDIUM | | 7 | | CVE-2026-46325 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE |
| MEDIUM | | 7 | | CVE-2026-46330 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Revert "net/smc: Introduce TCP ULP support" |
| MEDIUM | | 5.5 | | CVE-2026-52937 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR |
| MEDIUM | | 7 | | CVE-2026-52953 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Fix oops due to out of scope access |
| MEDIUM | | 7 | | CVE-2026-52956 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() |
| MEDIUM | | 5.5 | | CVE-2026-52994 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting |
| MEDIUM | | 7 | | CVE-2026-53009 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ice: fix double-free of tx_buf skb |
| MEDIUM | | 5.5 | | CVE-2026-53017 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix data loss caused by incorrect use of nat_entry flag |
| MEDIUM | | 5.5 | | CVE-2026-53018 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: f2fs: avoid reading already updated pages during GC |
| MEDIUM | | 5.5 | | CVE-2026-53103 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync |
| MEDIUM | | 5.5 | | CVE-2026-53104 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: Fix memory leak destroying device |
| MEDIUM | | 5.5 | | CVE-2026-53106 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Do not allow deleting local storage in NMI |
| MEDIUM | | 5.5 | | CVE-2026-53107 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: libertas: don't kill URBs in interrupt context |
| MEDIUM | | 5.5 | | CVE-2026-53108 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: powerpc/64s: Fix unmap race with PMD migration entries |
| MEDIUM | | | | CVE-2026-53178 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction |
| MEDIUM | | 7 | | CVE-2026-53224 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: sctp: validate embedded INIT chunk and address list lengths in cookie |
| MEDIUM | | 7 | | CVE-2026-53246 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing |
| MEDIUM | | 5.5 | | CVE-2026-53258 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: fix leak if split 6 GHz scanning fails |
| MEDIUM | | 5.5 | | CVE-2026-53281 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption |
| MEDIUM | | 5.5 | | CVE-2026-53285 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED |
| MEDIUM | | 5.5 | | CVE-2026-53292 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind |
| MEDIUM | | 5.5 | | CVE-2026-53297 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: mana: Guard mana_remove against double invocation |
| MEDIUM | | 5.5 | | CVE-2026-53321 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: io_uring/napi: cap busy_poll_to 10 msec |
| MEDIUM | | 5.5 | | CVE-2026-53377 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/msm: always recover the gpu |
| MEDIUM | | | | CVE-2026-53401 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: fbdev: omap2: fix use-after-free in omapfb_mmap |
| MEDIUM | | | | CVE-2026-63805 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: crypto: nx - fix nx_crypto_ctx_exit argument |
| MEDIUM | | | | CVE-2026-63811 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: f2fs: read COW data with the original inode during atomic write |
| MEDIUM | | | | CVE-2026-63819 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on f2fs_get_node_folio_ra() |
| MEDIUM | | 5.5 | | CVE-2026-63832 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: add wcid publish check in mt76_sta_add |
| MEDIUM | | 5.5 | | CVE-2026-63853 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring |
| MEDIUM | | | | CVE-2026-63857 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-63858 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: add hook transactions for device deletions |
| MEDIUM | | | | CVE-2026-63859 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue() |
| MEDIUM | | 7 | | CVE-2026-63941 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor |
| MEDIUM | | 7 | | CVE-2026-63979 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net/handshake: hand off the pinned file reference to accept_doit |
| MEDIUM | | 5.5 | | CVE-2026-63998 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ethtool: module: call ethnl_ops_complete() on module flash errors |
| MEDIUM | | 5.5 | | CVE-2026-63999 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure |
| MEDIUM | | 5.5 | | CVE-2026-64006 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: fix dst corruption in same register operation |
| MEDIUM | | 7 | | CVE-2026-64024 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction |
| MEDIUM | | 5.5 | | CVE-2026-64036 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: cgroup/rstat: validate cpu before css_rstat_cpu() access |
| MEDIUM | | 5.5 | | CVE-2026-64038 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Stop work before releasing hwmon device |
| MEDIUM | | 5.5 | | CVE-2026-64060 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix leak of request in netfs_write_begin() error handling |
| MEDIUM | | 7.1 | | CVE-2026-64066 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_read_to_pagecache() to pause on subreq failure |
| MEDIUM | | 5.5 | | CVE-2026-64067 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing barriers when accessing stream->subrequests locklessly |
| MEDIUM | | 7 | | CVE-2026-64068 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing locking around retry adding new subreqs |
| MEDIUM | | 5.5 | | CVE-2026-64076 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfilter: bridge: eb_tables: close module init race |
| MEDIUM | | 5.5 | | CVE-2026-64077 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfilter: ebtables: move to two-stage removal scheme |
| MEDIUM | | 7.1 | | CVE-2026-64078 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: add and use xtables_unregister_table_exit |
| MEDIUM | | 5.5 | | CVE-2026-64079 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: allocate hook ops while under mutex |
| MEDIUM | | 7 | | CVE-2026-64117 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb |
| MEDIUM | | 5.5 | | CVE-2026-64146 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: erofs: fix metabuf leak in inode xattr initialization |
| MEDIUM | | 5.5 | | CVE-2026-64154 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() |
| MEDIUM | | 5.5 | | CVE-2026-64159 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix zeropoint update where i_size > remote_i_size |
| MEDIUM | | 7 | | CVE-2026-64160 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point |
| MEDIUM | | 5.5 | | CVE-2026-64190 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: team: fix NULL pointer dereference in team_xmit during mode change |
| MEDIUM | | 5.5 | | CVE-2026-64212 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it |
| MEDIUM | | 5.5 | | CVE-2026-64213 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Add lock protection to lm90_alert |
| MEDIUM | | 7 | | CVE-2026-64255 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers |
| MEDIUM | | 7 | | CVE-2026-64520 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies |
| MEDIUM | | 7 | | CVE-2026-68086 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: mm/khugepaged: write all dirty file folios when collapsing |
| MEDIUM | | 5.5 | | CVE-2026-68211 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: media: stm32-dcmipp: Return queued buffers on start_streaming() failure |
| MEDIUM | | 5.5 | | CVE-2026-68233 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/vc4: Shut down BO cache timer before teardown |
| MEDIUM | | 5.5 | | CVE-2026-68242 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/i915/gt: Fix NULL deref on sched_engine alloc failure |
| MEDIUM | | 5.5 | | CVE-2026-68258 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size |
| MEDIUM | | 5.5 | | CVE-2026-68291 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: idpf driver null pointer dereference leads to Denial of Service |
| MEDIUM | | 5.5 | | CVE-2026-68295 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: LoongArch: BPF: Zero-extend signed ALU32 div/mod results |
| MEDIUM | | 5.5 | | CVE-2026-68312 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths |
| MEDIUM | | 7 | | CVE-2026-68323 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: tipc: serialize udp bearer replicast list updates |
| MEDIUM | | 5.5 | | CVE-2026-68382 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Hold device ref until queue teardown completes |
| MEDIUM | | 5.5 | | CVE-2026-68383 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Keep scheduler timeline name alive |
| MEDIUM | | 7 | | CVE-2026-68393 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: extend conn_hash lookup critical sections |
| MEDIUM | | 6.4 | | CVE-2026-68399 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix UAF in sock clone early bailouts |
| MEDIUM | | 7 | | CVE-2026-68400 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation |
| MEDIUM | | 7 | | CVE-2026-68401 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() |
| MEDIUM | | 7 | | CVE-2026-68404 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect |
| MEDIUM | | 5.5 | | CVE-2026-68421 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() |
| MEDIUM | | 5.5 | | CVE-2026-68435 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Fix address space mismatch in kexec command line lookup |
| MEDIUM | | 5.5 | | CVE-2026-68441 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains |
| MEDIUM | | 5.5 | | CVE-2026-68447 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size |
| MEDIUM | | 7 | | CVE-2026-68448 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ovl: check access to copy_file_range source with src mounter creds |
| MEDIUM | | 7 | | CVE-2026-68453 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey |
| MEDIUM | | 5.5 | | CVE-2026-68471 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: ieee80211: validate MLE common info length |
| MEDIUM | | 5.5 | | CVE-2026-72073 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: mmc: vub300: fix use-after-free on probe failure |
| MEDIUM | | 5.5 | | CVE-2026-72162 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec |
| MEDIUM | | 7 | | CVE-2026-72288 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling |
| MEDIUM | | 7 | | CVE-2026-72329 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net/liquidio: drop cached VF pci_dev LUT |
| MEDIUM | | 5.5 | | CVE-2026-72337 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: 6lowpan: avoid untracked enable work |
| MEDIUM | | 5.5 | | CVE-2026-72341 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Fix publication race for priv->channel_stats[] |
| MEDIUM | | 5.5 | | CVE-2026-72355 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix barriering when walking subrequest list |
| MEDIUM | | 5.5 | | CVE-2026-72365 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix writethrough to use collection offload |
| MEDIUM | | 5.5 | | CVE-2026-72367 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: iomap: guard io_size EOF trim against concurrent truncate underflow |
| MEDIUM | | 5.5 | | CVE-2026-72375 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: afs: Fix reinitialisation of the inode, in particular ->lock_work |
| MEDIUM | | 5.5 | | CVE-2026-72380 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: xen/pvcalls: bound backend response req_id before indexing rsp[] |
| MEDIUM | | 5.5 | | CVE-2026-72383 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: sctp: fix addr_wq_timer race in sctp_free_addr_wq() |
| MEDIUM | | 5.5 | | CVE-2026-72388 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock |
| MEDIUM | | 5.5 | | CVE-2026-72397 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() |
| MEDIUM | | 7 | | CVE-2026-72398 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: sctp: add INIT verification after cookie unpacking |
| MEDIUM | | 5.5 | | CVE-2026-72404 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() |
| MEDIUM | | 5.5 | | CVE-2026-72423 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Guard conntrack opts error writes |
| MEDIUM | | 5.5 | | CVE-2026-72440 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: md/raid1: fix writes_pending and barrier reference leaks on write failures |
| MEDIUM | | 5.5 | | CVE-2026-72454 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() |
| MEDIUM | | 5.5 | | CVE-2026-72488 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: soundwire: fix bug in sdw_add_element_group_count found by syzkaller |
| MEDIUM | | 5.5 | | CVE-2026-72493 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: serialize netif_running() check in enqueue_to_backlog() |
| MEDIUM | | 5.5 | | CVE-2026-72495 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages |
| MEDIUM | | 7 | | CVE-2026-72499 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free CQ toggle page after firmware teardown |
| MEDIUM | | 7 | | CVE-2026-72500 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown |
| MEDIUM | | | | CVE-2026-72501 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: R ... |
| MEDIUM | | 5.5 | | CVE-2026-74257 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: sockmap: Fix use-after-free in udp_bpf_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-74264 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: watchdog: fix refcount tracking races |
| MEDIUM | | 5.5 | | CVE-2026-74272 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Resolve region deletion races |
| MEDIUM | | 5.5 | | CVE-2026-74273 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Block region delete during region creation |
| MEDIUM | | 5.5 | | CVE-2026-74314 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Cancel special fields on map value recycle |
| MEDIUM | | 5.5 | | CVE-2026-74317 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ixgbe: do not configure xps for XDP queues |
| MEDIUM | | 5.5 | | CVE-2026-74324 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: validate skb length in testmode query |
| MEDIUM | | 5.5 | | CVE-2026-74337 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks |
| MEDIUM | | 5.5 | | CVE-2026-74342 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: kernfs: link kn to its parent before the LSM init hook |
| MEDIUM | | 5.5 | | CVE-2026-74344 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear rb node linkage when freeing bpf_rb_root |
| MEDIUM | | 5.5 | | CVE-2026-74350 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate fast symlink target during inode read |
| MEDIUM | | 5.5 | | CVE-2026-74354 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Take mmap_lock in zap_pages() |
| MEDIUM | | 5.5 | | CVE-2026-74368 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() |
| MEDIUM | | 6.5 | | CVE-2026-74385 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock |
| MEDIUM | | 5.5 | | CVE-2026-74388 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data |
| MEDIUM | | 7 | | CVE-2026-74405 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: OPP: Fix race between OPP addition and lookup |
| MEDIUM | | 5.5 | | CVE-2026-74407 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: ath11k: cancel SSR work items during PCI shutdown |
| MEDIUM | | 5.5 | | CVE-2026-74449 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport |
| MEDIUM | | 5.5 | | CVE-2026-74466 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Close speculative mem read possibility |
| MEDIUM | | 7 | | CVE-2026-74506 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: afs: Fix UAF when sending a message |
| MEDIUM | | 7 | | CVE-2026-74513 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister |
| MEDIUM | | 5.5 | | CVE-2026-74527 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: octeontx2-af: Block VFs from clobbering special CGX PKIND state |
| MEDIUM | | 5.5 | | CVE-2026-74529 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback |
| MEDIUM | | 5.5 | | CVE-2026-74530 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback |
| MEDIUM | | 7 | | CVE-2026-74533 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero |
| MEDIUM | | 7 | | CVE-2026-74537 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: hold sk properly in iso_conn_ready |
| MEDIUM | | 5.5 | | CVE-2026-74538 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: lock sk in iso_connect_ind |
| MEDIUM | | 5.5 | | CVE-2026-74542 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix folio_queue ENOMEM in writeback by adding a mempool |
| MEDIUM | | 5.5 | | CVE-2026-74544 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds |
| MEDIUM | | 5.5 | | CVE-2026-74600 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: mm/page_table_check: skip special zero mappings |
| MEDIUM | | 5.5 | | CVE-2026-74605 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: eventfs: Use children field for rcu head and add memory barriers |
| MEDIUM | | 7 | | CVE-2026-74611 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: tls: rx: restore msg_iter before TLS 1.3 optimistic retry |
| MEDIUM | | 5.5 | | CVE-2026-74638 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Serialize the scheduler timeout handlers |
| MEDIUM | | 5.5 | | CVE-2026-74687 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: watchdog: at91sam9_wdt: prevent timer rearm during teardown |
| MEDIUM | | 7 | | CVE-2026-74695 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() |
| MEDIUM | | 7 | | CVE-2026-74697 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Disable EOP for TPA on all chips to prevent data corruption |
| MEDIUM | | 5.5 | | CVE-2026-74711 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus) Fix type confusion in notification logic |
| MEDIUM | | 5.5 | | CVE-2026-74713 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: vhost_iotlb: bound map allocation in add_range |
| MEDIUM | | 7 | | CVE-2026-74715 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix netns reference imbalance in conntrack kfuncs |
| MEDIUM | | 5.5 | | CVE-2026-74723 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject inline extents without valid headers |
| MEDIUM | | 5.5 | | CVE-2026-74729 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read |
| MEDIUM | | 5.5 | | CVE-2026-74747 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ipvs: revalidate ihl to prevent out-of-bounds access |
| MEDIUM | | 5.5 | | CVE-2026-80579 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: fbdev: clear fb_info->mode before deleting a videomode |
| MEDIUM | | 5.5 | | CVE-2026-80580 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: fbdev: bound mode sysfs output to the sysfs buffer |
| MEDIUM | | 5.5 | | CVE-2026-80614 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: emac: Fix NULL pointer dereference in emac_probe |
| MEDIUM | | 5.5 | | CVE-2026-80623 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: coresight: ete: Always save state on power down |
| MEDIUM | | 5.5 | | CVE-2026-80628 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Serialize readq reset state with q->lock |
| MEDIUM | | 5.5 | | CVE-2026-80631 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject compressed segment that overflows the compressed input |
| MEDIUM | | 5.5 | | CVE-2026-80634 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag |
| MEDIUM | | 5.5 | | CVE-2026-80655 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: soc: xilinx: Fix race condition in event registration |
| MEDIUM | | 5.5 | | CVE-2026-80662 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size |
| MEDIUM | | 7 | | CVE-2026-80668 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations |
| MEDIUM | | 5.5 | | CVE-2026-80670 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() |
| MEDIUM | | 5.5 | | CVE-2026-80692 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks |
| MEDIUM | | 7 | | CVE-2026-80693 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: idpf: bound interrupt-vector register fill to the allocated array |
| MEDIUM | | 5.5 | | CVE-2026-80698 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: dmaengine: idxd: fix double free of wq, engine, and group structs |
| MEDIUM | | 5.5 | | CVE-2026-80721 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: ensure no dangling hcon references in iso_conn |
| MEDIUM | | | | CVE-2026-80761 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| MEDIUM | | 5.5 | | CVE-2026-80905 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: tap: fix wrong transport_header when sending VLAN-tagged frame |
| MEDIUM | | 5.5 | | CVE-2026-80920 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: io_uring: defer eventfd signaling when queued from a wakeup handler |
| MEDIUM | | 5.5 | | CVE-2026-81010 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: io_uring/waitid: honor task_work cancellation |
| MEDIUM | | 7 | | CVE-2026-89528 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Reject Read lists that exceed the page budget |
| MEDIUM | | 4.8 | | CVE-2026-89534 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| MEDIUM | | 7 | | CVE-2026-89537 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 |
| MEDIUM | | 7.2 | | CVE-2026-89610 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ntfs: verify run length exceeding volume boundary |
| MEDIUM | | 5.5 | | CVE-2026-89611 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ntfs: validate non-resident attribute offsets |
| MEDIUM | | 7.1 | | CVE-2026-89632 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() |
| MEDIUM | | 7 | | CVE-2026-89637 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 |
| MEDIUM | | 5.5 | | CVE-2026-89639 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC |
| MEDIUM | | 3.3 | | CVE-2026-89642 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: cifs: call pagecache_isize_extended() in cifs_setsize() when extending |
| MEDIUM | | 6.2 | | CVE-2026-89648 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ceph: cap delegated inode count in ceph_parse_deleg_inos() |
| MEDIUM | | 7 | | CVE-2026-89654 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ceph: fix UAF in check_new_map() on session freed during unlock |
| MEDIUM | | 5.3 | | CVE-2026-89682 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net |
| MEDIUM | | 5.3 | | CVE-2026-89705 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths |
| MEDIUM | | 5.9 | | CVE-2026-89709 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: lockd, nfsd: RCU-protect nlmsvc_ops dispatch |
| MEDIUM | | 5.5 | | CVE-2026-89722 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() |
| MEDIUM | | 5.5 | | CVE-2026-89757 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: mm/mglru: fix and remove redundant unevictable folio handling |
| MEDIUM | | 4.7 | | CVE-2026-89810 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix error path at svm_migrate_copy_to_ram |
| MEDIUM | | | | CVE-2026-89826 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| MEDIUM | | | | CVE-2026-89833 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| MEDIUM | | | | CVE-2026-89866 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| MEDIUM | | | | CVE-2026-89906 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| MEDIUM | | 4.7 | | CVE-2026-89913 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables |
| MEDIUM | | 4.7 | | CVE-2026-89920 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Fix memory corruption by not reinjecting CK machine checks |
| MEDIUM | | | | CVE-2026-89935 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 3.6 | | CVE-2026-89987 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: mm/huge_memory: transfer the pmd dirty bit to the folio on zap |
| MEDIUM | | 5.5 | | CVE-2026-90040 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped |
| MEDIUM | | 5.5 | | CVE-2026-90061 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: skip double clone set expressions on element insert |
| MEDIUM | | 5.5 | | CVE-2026-90083 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net/sched: act_ife: Only operate on Ethernet frames |
| MEDIUM | | 5.5 | | CVE-2026-90087 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: do not leak an hci_conn when a second LE connect is rejected |
| MEDIUM | | 7 | | CVE-2026-90093 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: access chan->conn safely in get/setsockopt |
| MEDIUM | | 5.5 | | CVE-2026-90098 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: fix sleep in atomic context in MAC table access |
| MEDIUM | | 7 | | CVE-2026-90099 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net/sched: account classifier filter allocations to memcg |
| MEDIUM | | 7 | | CVE-2026-90104 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: NFSv4.1: zero referring call lists before decoding |
| MEDIUM | | 5.5 | | CVE-2026-90105 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: vxlan: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90106 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: bridge: arp/nd proxy: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90116 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ALSA: mtpav: shut down output timer before card teardown |
| MEDIUM | | 5.5 | | CVE-2026-90142 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix resize of the RX ring |
| MEDIUM | | 5.5 | | CVE-2026-90149 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers |
| MEDIUM | | 5.5 | | CVE-2026-90154 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ksmbd: scope session state changes to bound connections |
| MEDIUM | | 5.5 | | CVE-2026-90155 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ksmbd: detach blocked lock requests before freeing |
| MEDIUM | | 5.5 | | CVE-2026-90156 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely discard unregistered deferred locks |
| MEDIUM | | 7 | | CVE-2026-90161 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: erofs: fix interlaced ztailpacking pclusters |
| MEDIUM | | 5.5 | | CVE-2026-90162 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ksmbd: defer publishing granted locks to prevent UAF/double-free race |
| MEDIUM | | 5.5 | | CVE-2026-90167 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ksmbd: serialize oplock close with pending break ownership |
| MEDIUM | | 5.5 | | CVE-2026-90174 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() |
| MEDIUM | | 5.5 | | CVE-2026-90177 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Check pointer type for all atomic RMW paths |
| MEDIUM | | 5.5 | | CVE-2026-90179 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix deadlock in complain-mode change_hat |
| MEDIUM | | 5.5 | | CVE-2026-90204 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate DIO orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90205 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90208 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type |
| MEDIUM | | 5.5 | | CVE-2026-90217 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Compare iterator types during state pruning |
| MEDIUM | | 5.5 | | CVE-2026-90231 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix unconfined user namespace restriction forced stack |
| MEDIUM | | 5.5 | | CVE-2026-90232 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: amt: Don't support cross-netns setup |
| MEDIUM | | 5.1 | | CVE-2026-90234 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: NFS: Return a delegation the client fails to record |
| MEDIUM | | 7 | | CVE-2026-90237 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfilter: nft_ct: move custom expectation support to helper |
| MEDIUM | | 7 | | CVE-2026-90240 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Flush context cache with correct SID when tearing down aliases |
| MEDIUM | | 5.5 | | CVE-2026-90247 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix mmap_lock leak in irq_work path |
| MEDIUM | | 5.9 | | CVE-2026-90256 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind |
| MEDIUM | | 5.5 | | CVE-2026-90259 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() |
| MEDIUM | | 4.7 | | CVE-2026-90260 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: don't clobber the extent buffer when zeroing it out |
| MEDIUM | | 3.3 | | CVE-2026-90263 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: btrfs: check if root is readonly when setting posix acl |
| MEDIUM | | 5.5 | | CVE-2026-90264 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: btrfs: always wait for ordered extents to avoid OE races |
| MEDIUM | | 5.5 | | CVE-2026-90265 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: btrfs: defrag: fix deadlock between defrag and delalloc space reservation |
| MEDIUM | | 5.5 | | CVE-2026-90273 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable |
| MEDIUM | | 5.5 | | CVE-2026-90289 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Resize MST HDCP per-connector arrays to 32 |
| MEDIUM | | 5.5 | | CVE-2026-90300 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear buf on error in __bpf_get_task_stack |
| MEDIUM | | 5.5 | | CVE-2026-90301 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ocfs2: o2hb: quiesce negotiate handlers and timeout work |
| MEDIUM | | 7 | | CVE-2026-90317 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Invalidate RCU pointers after final spin unlock |
| MEDIUM | | 5.5 | | CVE-2026-90320 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate external xattr entries when reading metadata |
| MEDIUM | | 5.5 | | CVE-2026-90321 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate inline xattrs during inode block validation |
| MEDIUM | | 5.5 | | CVE-2026-90324 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ublk: check import_ubuf() return value |
| MEDIUM | | 4.7 | | CVE-2026-90326 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: blk-cgroup: fix race between policy activation and blkg destruction |
| MEDIUM | | 5.5 | | CVE-2026-90328 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: HID: steam: Reject short reads |
| MEDIUM | | 6.4 | | CVE-2026-90333 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: dm-integrity: replace forgeable discard filler with a keyed sector marker |
| MEDIUM | | 4.1 | | CVE-2026-90336 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: serial: core: clear freed pointers on uart_register_driver() failure |
| MEDIUM | | 5.5 | | CVE-2026-90337 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: serial: core: do fallible allocations before the console can be registered |
| MEDIUM | | 7 | | CVE-2026-90343 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: stop PMSR before P2P and NAN teardown |
| MEDIUM | | 5.5 | | CVE-2026-90345 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: brcmfmac: fix P2P action frame handling without device vif |
| MEDIUM | | 7 | | CVE-2026-90347 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry |
| MEDIUM | | 5.5 | | CVE-2026-90351 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed |
| MEDIUM | | 4.4 | | CVE-2026-90359 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject >8 byte return values on return-reading trampoline paths |
| MEDIUM | | 5.5 | | CVE-2026-90363 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/msm: don't tear down KMS twice when KMS init fails |
| MEDIUM | | 5.5 | | CVE-2026-90365 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: cancel reset and rc work on device unregister |
| MEDIUM | | 5.5 | | CVE-2026-90367 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER |
| MEDIUM | | 4.8 | | CVE-2026-90379 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash |
| MEDIUM | | 3.3 | | CVE-2026-90401 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: md: remove REQ_NOWAIT support from raid1/10/456 |
| MEDIUM | | 5.5 | | CVE-2026-90408 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() |
| MEDIUM | | 5.5 | | CVE-2026-90409 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Add vm_bind region with kbo range overlap check |
| MEDIUM | | 4.7 | | CVE-2026-90417 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() |
| MEDIUM | | 5.5 | | CVE-2026-90421 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: PCI: Fix UAF when probe runs concurrent to dyn ID removal |
| MEDIUM | | 5.5 | | CVE-2026-90422 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path |
| MEDIUM | | 4.7 | | CVE-2026-90427 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() |
| MEDIUM | | 5.5 | | CVE-2026-92480 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Validate string descriptors |
| MEDIUM | | 5.5 | | CVE-2026-92482 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip |
| MEDIUM | | 3.3 | | CVE-2026-92485 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix WARNING in bpf_tracing_link_release |
| MEDIUM | | 5.5 | | CVE-2026-92499 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ext4: validate readdir offset before accessing dirent |
| MEDIUM | | 4.7 | | CVE-2026-92500 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ext4: use fsdata to track inline data write state and fix race |
| MEDIUM | | 5.5 | | CVE-2026-92503 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() |
| MEDIUM | | 5.5 | | CVE-2026-92518 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: riscv, bpf: Fix kernel stack corruption in tailcall with CFI |
| MEDIUM | | 5.5 | | CVE-2026-92520 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Zero queue and stack outputs on lock failure |
| MEDIUM | | 5.5 | | CVE-2026-93044 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for arena-related insns |
| MEDIUM | | 5.5 | | CVE-2026-93047 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Associate BOs with every job that accesses them |
| MEDIUM | | 5.5 | | CVE-2026-93058 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Only fini scheduler after successful init |
| MEDIUM | | 5.5 | | CVE-2026-93081 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_scmi: Fix SCMI device destroy lifetimes |
| MEDIUM | | 4.7 | | CVE-2026-93099 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Fix UAF from worker threads when domains are removed |
| MEDIUM | | 4.7 | | CVE-2026-93100 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() |
| MEDIUM | | 4.7 | | CVE-2026-93104 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: RDMA/rvt: Return NULL after port allocation failure |
| MEDIUM | | 7 | | CVE-2026-93105 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: esp: do not unref managed frag pages in esp_ssg_unref() |
| MEDIUM | | 5.5 | | CVE-2026-93122 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: usb: gadget: uac: validate rate list length before storing |
| MEDIUM | | 5.5 | | CVE-2026-93135 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject programs with inlined helpers if JIT is not available |
| MEDIUM | | 7 | | CVE-2026-93148 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject MEM_ALLOC BTF accesses past object bounds |
| MEDIUM | | 7 | | CVE-2026-93154 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Add refcounting to user ring MRs |
| MEDIUM | | 5.5 | | CVE-2026-93168 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout |
| MEDIUM | | 5.5 | | CVE-2026-93175 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in CRTC reset function |
| MEDIUM | | 4.7 | | CVE-2026-93176 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in plane reset function |
| MEDIUM | | 5.5 | | CVE-2026-93270 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn |
| MEDIUM | | 5.5 | | CVE-2026-93272 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 |
| MEDIUM | | 5.5 | | CVE-2026-93276 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator |
| MEDIUM | | 5.5 | | CVE-2026-93282 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix maximum allowed access checks |
| MEDIUM | | 7.1 | | CVE-2026-97422 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: fix SMI event cross-process information leak |
| MEDIUM | | 5.5 | | CVE-2026-97432 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: fix P2P-Device binding handling |
| MEDIUM | | 5.5 | | CVE-2026-97478 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: virt: acrn: Fix irqfd use-after-free during eventfd shutdown |
| MEDIUM | | 7.1 | | CVE-2026-97493 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS |
| MEDIUM | | 5.5 | | CVE-2026-97499 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: coresight: perf: Retrieve path and source from event data |
| MEDIUM | | 5.5 | | CVE-2026-97513 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Release m2m_ctx after Instance Removed from List |
| MEDIUM | | 5.5 | | CVE-2026-97515 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 |
| MEDIUM | | 5.5 | | CVE-2026-97526 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: s390/pai: Support CPU hotplug for PMU PAI |
| MEDIUM | | 5.5 | | CVE-2026-97538 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: hwmon: (asus_rog_ryujin) Validate HID report lengths |
| MEDIUM | | 5.5 | | CVE-2026-97554 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() |
| MEDIUM | | 7 | | CVE-2026-97561 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid |
| MEDIUM | | 7 | | CVE-2026-97563 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97565 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject short READ responses in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97960 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel: Prevent drain_pebs() reentry |
| MEDIUM | | 5.5 | | CVE-2026-97962 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Move representor vnic reporter to eswitch devlink port |
| MEDIUM | | 5.1 | | CVE-2026-97975 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() |
| MEDIUM | | 4.7 | | CVE-2026-97988 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: vhost: invalidate vring access on IOTLB transitions |
| MEDIUM | | 5.5 | | CVE-2026-98019 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: mark a NULL call argument precise |
| MEDIUM | | 5.3 | | CVE-2026-98032 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: tracing: Fix subbuf resize races with trace_pipe_raw readers |
| MEDIUM | | 7 | | CVE-2026-98033 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Preserve inner map identity in callback frames |
| MEDIUM | | 7 | | CVE-2026-98034 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark NULL kptr stores precise |
| MEDIUM | | 5.5 | | CVE-2026-98043 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Don't infer non-NULL from a pointer with an unbounded offset |
| MEDIUM | | 7 | | CVE-2026-98047 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Check ancestor frames for rbtree callbacks |
| MEDIUM | | 7 | | CVE-2026-98048 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: don't rewrite bpf_fastcall patterns entered by a jump |
| MEDIUM | | 5.5 | | CVE-2026-98049 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: zero extend the result of an arena 32-bit cmpxchg |
| MEDIUM | | 5.5 | | CVE-2026-98053 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Refactor and fix init_config access |
| MEDIUM | | 5.5 | | CVE-2026-98062 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark signal tracepoint siginfo arguments as scalar |
| MEDIUM | | 5.5 | | CVE-2026-98085 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge |
| MEDIUM | | | | CVE-2026-98099 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 5.5 | | CVE-2026-98115 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely drain sessions during logoff |
| MEDIUM | | 5.5 | | CVE-2026-98118 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix readahead synchronisation issues by loading all folios upfront |
| MEDIUM | | 5.5 | | CVE-2026-98124 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: smb/client: invalidate fscache for fallocate range operations |
| MEDIUM | | 5.5 | | CVE-2026-98125 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix stale page cache in insert/collapse range |
| MEDIUM | | 5.5 | | CVE-2026-98131 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix dma mapping leak in stmmac_tso_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-98134 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: check_cond_jmp_op(): properly infer if register is null |
| MEDIUM | | 5.3 | | CVE-2026-98156 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/virtio: use the DMA API for resource backing on Xen |
| MEDIUM | | 5.5 | | CVE-2026-98162 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: smb/server: fix tree connection leak in smb2_tree_connect() |
| MEDIUM | | 5.5 | | CVE-2026-98180 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/msm: RCU-free the scheduler-containing ring and VM objects |
| MEDIUM | | 5.5 | | CVE-2026-98228 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ |
| MEDIUM | | 4.4 | | CVE-2026-98273 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: x86/kprobes: Fix crash when probing CS CALL instructions |
| MEDIUM | | 5.5 | | CVE-2026-98277 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: ring the doorbell if a burst ends in a drop |
| MEDIUM | | 5.5 | | CVE-2026-98279 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: btrfs: handle lack of space when cleaning up verity items |
| MEDIUM | | 5.3 | | CVE-2026-98284 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netlink: do not free nlk->groups while lockless readers can use it |
| MEDIUM | | 4.1 | | CVE-2026-98286 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown |
| MEDIUM | | 5.5 | | CVE-2026-98288 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix TSO header length truncation |
| MEDIUM | | 5.5 | | CVE-2026-98292 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| MEDIUM | | 5.5 | | CVE-2026-98294 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_qca: Do not write to the serial port after it is closed |
| MEDIUM | | 7 | | CVE-2026-98296 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btintel_pcie: validate TX skb length in send_sync |
| MEDIUM | | 5.5 | | CVE-2026-98313 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/msm/dp: skip PUSH_IDLE when the link was never enabled |
| MEDIUM | | 7 | | CVE-2026-98330 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: get the wiphy out of a dying network namespace |
| MEDIUM | | 5.5 | | CVE-2026-98333 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: reset the LED state when ifup fails |
| MEDIUM | | 7 | | CVE-2026-98341 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: don't free driver-owned scan requests |
| MEDIUM | | 5.5 | | CVE-2026-98353 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables |
| MEDIUM | | 5.5 | | CVE-2026-98355 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: RDMA/rtrs: guard against null kobj name |
| MEDIUM | | 5.5 | | CVE-2026-98376 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Use array_map_meta_equal for percpu array inner map replacement |
| MEDIUM | | 5.5 | | CVE-2026-98408 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: watchdog: rzv2h: Avoid division by zero |
| MEDIUM | | 5.5 | | CVE-2026-98420 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ksmbd: follow SMB2 session expiration semantics |
| MEDIUM | | | | CVE-2026-98436 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: a ... |
| MEDIUM | | 6.5 | | CVE-2026-98439 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: smb/server: cancel async requests when closing connection |
| MEDIUM | | 4.7 | | CVE-2026-98444 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: xfs: drop dquot flush lock when we can't find a buffer to flush |
| MEDIUM | | 6.5 | | CVE-2026-98449 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: smb: client: delete compound mids on send failure before unlock |
| MEDIUM | | 5.3 | | CVE-2026-98471 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Do cache maintenance on the source VM during intra-host migration |
| MEDIUM | | 5.5 | | CVE-2026-98556 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: gve: DQO: reject TSO packets with an out of range MSS |
| MEDIUM | | 4.1 | | CVE-2026-98558 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: flush skb_defer_nodes in dev_cpu_dead() |
| MEDIUM | | 5.9 | | CVE-2026-98570 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: ipv6: keep room for the mac header in dst_dev_overhead() |
| MEDIUM | | 6.7 | | CVE-2026-98589 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject pkt arguments in mutating subprogs |
| MEDIUM | | 4.7 | | CVE-2026-98598 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ipv6: Prevent rt6_insert_exception() for dying fib6_info |
| MEDIUM | | 6.7 | | CVE-2026-98599 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() |
| MEDIUM | | 4.1 | | CVE-2026-98616 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: reset num_napi when the napi vectors are freed |
| MEDIUM | | 5.5 | | CVE-2026-98652 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Add missing srcu in kvm_s390_set_irq_state() |
| MEDIUM | | 5.5 | | CVE-2026-98674 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: iio: adc: adi-axi-adc: Initialize state mutex |
| MEDIUM | | 5.6 | | CVE-2026-98714 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| MEDIUM | | 4.1 | | CVE-2026-98740 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety |
| MEDIUM | | 4.4 | | CVE-2026-98747 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix NULL pointer dereference in serial_core_unregister_port() |
| MEDIUM | | 4.7 | | CVE-2026-98786 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: guard dc_sink dereferences in MST mode validation |
| MEDIUM | | 4.4 | | CVE-2026-98789 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix objects stuck in free_by_rcu_ttrace |
| MEDIUM | | 4.4 | | CVE-2026-98795 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: skip ptp deinit if init was skipped |
| MEDIUM | | 4.4 | | CVE-2026-98799 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Skip detached progs in trampoline images that are still in use |
| MEDIUM | | 4.7 | | CVE-2026-98800 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: kernel: Denial of Service via use-after-free in BPF trampoline |
| MEDIUM | | 6.5 | | CVE-2026-98803 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix rx Scatter-Gather support |
| MEDIUM | | 6.1 | | CVE-2026-98810 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() |
| MEDIUM | | 4.4 | | CVE-2026-98813 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Hold map BTF for the memory allocator destructor record |
| MEDIUM | | 4.4 | | CVE-2026-98814 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: nvme: fix command effects log lifetime for multipath heads |
| MEDIUM | | 4.1 | | CVE-2026-98815 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: nvme: fix cdev lifetime |
| MEDIUM | | 4.1 | | CVE-2026-98816 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix overflow of jump offset in constant blinding |
| MEDIUM | | 5.5 | | CVE-2026-98820 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: blk-mq: set RQF_USE_SCHED when the operation is known |
| MEDIUM | | 5.3 | | CVE-2026-98824 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate TX status rate metadata |
| MEDIUM | | 6.5 | | CVE-2026-98829 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: drop oversized fragments to avoid extra_len overflow |
| MEDIUM | | 4.1 | | CVE-2026-98834 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: mtd: core: avoid double-free of OTP NVMEM device |
| MEDIUM | | 6.1 | | CVE-2026-98839 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() |
| MEDIUM | | 4.4 | | CVE-2026-98843 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfs: zero gaps in read-gaps folio to avoid writing back stale data |
| MEDIUM | | 5.6 | | CVE-2026-98863 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| MEDIUM | | 4.6 | | CVE-2019-15213 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: use-after-free caused by malicious USB device in drivers/media/usb/dvb-usb/dvb-usb-init.c |
| MEDIUM | | 4.1 | | CVE-2019-16089 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Improper return check in nbd_genl_status function in drivers/block/nbd.c |
| MEDIUM | | 4.7 | | CVE-2019-20794 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: task processes not being properly ended could lead to resource exhaustion |
| MEDIUM | | 4.4 | | CVE-2020-14304 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ethtool when reading eeprom of device could lead to memory leak |
| MEDIUM | | 6.7 | | CVE-2020-36694 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfilter: use-after-free in the packet processing context |
| MEDIUM | | 5.5 | | CVE-2023-31082 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: sleeping function called from an invalid context in gsmld_write |
| MEDIUM | | 7 | | CVE-2023-3397 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: slab-use-after-free Write in txEnd due to race condition |
| MEDIUM | | 5.5 | | CVE-2023-37454 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: udf: use-after-free write in udf_close_lvid |
| MEDIUM | | 6.7 | | CVE-2023-6238 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: nvme: memory corruption via unprivileged user passthrough |
| MEDIUM | | 6.5 | | CVE-2023-6240 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation |
| MEDIUM | | 5.5 | | CVE-2024-2193 | linux-libc-dev | 1:6.18.34-1+rpt1 | | hw: Spectre-SRC that is Speculative Race Conditions (SRCs) for synchronization primitives similar like Spectre V1 with p |
| MEDIUM | | 4.7 | | CVE-2024-24864 | linux-libc-dev | 1:6.18.34-1+rpt1 | | A race condition was found in the Linux kernel's media/dvb-core in dvb ... |
| MEDIUM | | 5.5 | | CVE-2024-25740 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: memory leak in ubi driver |
| MEDIUM | | 5.5 | | CVE-2024-56709 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: io_uring: check if iowq is killed before queuing |
| MEDIUM | | 5.5 | | CVE-2024-58074 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/i915: Grab intel_display from the encoder to avoid potential oopsies |
| MEDIUM | | 5.5 | | CVE-2025-21752 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents |
| MEDIUM | | 5.5 | | CVE-2025-21949 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Set hugetlb mmap base address aligned with pmd size |
| MEDIUM | | 5.5 | | CVE-2025-22109 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ax25: Remove broken autobind |
| MEDIUM | | 5.5 | | CVE-2025-23132 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: f2fs: quota: fix to avoid warning in dquot_writeback_dquots() |
| MEDIUM | | 5.5 | | CVE-2025-23135 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Teardown riscv specific bits after kvm_exit |
| MEDIUM | | 5.5 | | CVE-2025-37743 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Avoid memory leak while enabling statistics |
| MEDIUM | | 5.5 | | CVE-2025-37746 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: perf/dwc_pcie: fix duplicate pci_dev devices |
| MEDIUM | | 5.5 | | CVE-2025-37880 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: um: work around sched_yield not yielding in time-travel mode |
| MEDIUM | | 4.7 | | CVE-2025-37906 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: ublk race condition causes kernel crash |
| MEDIUM | | 5.5 | | CVE-2025-38029 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to sleepable page allocation in KASAN |
| MEDIUM | | 5.5 | | CVE-2025-38036 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service due to null pointer dereference in GT MMIO initialization for VFs |
| MEDIUM | | 5.5 | | CVE-2025-38041 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: clk: sunxi-ng: h616: Reparent GPU clock during frequency changes |
| MEDIUM | | 5.5 | | CVE-2025-38042 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn |
| MEDIUM | | 6.7 | | CVE-2025-38064 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: virtio: break and reset virtio devices on device_shutdown() |
| MEDIUM | | 5.5 | | CVE-2025-38132 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: coresight: holding cscfg_csdev_lock while removing cscfg from csdev |
| MEDIUM | | 5.5 | | CVE-2025-38140 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Local denial of service in device mapper |
| MEDIUM | | 5.5 | | CVE-2025-38199 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix memory leak due to multiple rx_stats allocation |
| MEDIUM | | 5.5 | | CVE-2025-38207 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: mm: fix uprobe pte be overwritten when expanding vma |
| MEDIUM | | 5.5 | | CVE-2025-38261 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: riscv: save the SR_SUM status over switches |
| MEDIUM | | 5.5 | | CVE-2025-38284 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: configure manual DAC mode via PCI config API only |
| MEDIUM | | 5.5 | | CVE-2025-38311 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Linux kernel (iavf): Denial of Service due to a locking issue |
| MEDIUM | | 5.5 | | CVE-2025-38359 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: s390/mm: Fix in_atomic() handling in do_secure_storage_access() |
| MEDIUM | | 5.5 | | CVE-2025-38597 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port |
| MEDIUM | | 5.5 | | CVE-2025-38605 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() |
| MEDIUM | | 5.5 | | CVE-2025-39677 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net/sched: Fix backlog accounting in qdisc_dequeue_internal |
| MEDIUM | | 5.5 | | CVE-2025-39762 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: add null check |
| MEDIUM | | 5.5 | | CVE-2025-39775 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: mremap local denial of service |
| MEDIUM | | 5.5 | | CVE-2025-39789 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: crypto: x86/aegis - Add missing error checks |
| MEDIUM | | 6.1 | | CVE-2025-39822 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: io_uring/kbuf: fix signedness in this_len calculation |
| MEDIUM | | 5.5 | | CVE-2025-39830 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path |
| MEDIUM | | 5.5 | | CVE-2025-39834 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow |
| MEDIUM | | 6.2 | | CVE-2025-39910 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() |
| MEDIUM | | 7.1 | | CVE-2025-39933 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length |
| MEDIUM | | 2.5 | | CVE-2025-40113 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E |
| MEDIUM | | 6.8 | | CVE-2025-40130 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling |
| MEDIUM | | 6.2 | | CVE-2025-40146 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: blk-mq: fix potential deadlock while nr_requests grown |
| MEDIUM | | 5.2 | | CVE-2025-40217 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: pidfs: validate extensible ioctls |
| MEDIUM | | | | CVE-2025-40247 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Fix pgtable prealloc error path |
| MEDIUM | | 5.2 | | CVE-2025-40338 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Do not share the name pointer between components |
| MEDIUM | | 6.1 | | CVE-2025-40355 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: sysfs: check visibility before changing group attribute ownership |
| MEDIUM | | 5.5 | | CVE-2025-68209 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: mlx5: Fix default values in create CQ |
| MEDIUM | | 5.5 | | CVE-2025-68236 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service during UFS power down |
| MEDIUM | | 5.5 | | CVE-2025-68304 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_core: lookup hci_conn on RX path on protocol side |
| MEDIUM | | | | CVE-2025-68318 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL |
| MEDIUM | | 6.1 | | CVE-2025-68319 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netconsole: Acquire su_mutex before navigating configs hierarchy |
| MEDIUM | | 5.5 | | CVE-2025-68353 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service via NULL pointer dereference in VXLAN module |
| MEDIUM | | 4.5 | | CVE-2025-68360 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks |
| MEDIUM | | 5.5 | | CVE-2025-68368 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Kernel: Denial of Service in md driver via uninitialized bioset |
| MEDIUM | | 6.5 | | CVE-2025-68729 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: Fix MSDU buffer types handling in RX error path |
| MEDIUM | | 5.5 | | CVE-2025-68730 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() |
| MEDIUM | | 4.7 | | CVE-2025-68745 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset |
| MEDIUM | | 7.8 | | CVE-2025-71074 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Linux kernel functionfs: Use-After-Free vulnerability due to open/removal races |
| MEDIUM | | 5.5 | | CVE-2025-71117 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Denial of Service via deadlock in block layer sysfs store callbacks |
| MEDIUM | | 5.5 | | CVE-2025-71141 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/tilcdc: Fix removal actions in case of failed probe |
| MEDIUM | | 5.5 | | CVE-2025-71188 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: dmaengine: lpc18xx-dmamux: fix device leak on route allocation |
| MEDIUM | | 6.5 | | CVE-2025-71202 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: Memory Corruption and Kernel Crashes via IOMMU SVA coherency issue |
| MEDIUM | | 5.5 | | CVE-2025-71227 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: don't WARN for connections on invalid channels |
| MEDIUM | | 5.5 | | CVE-2025-71285 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels |
| MEDIUM | | 5.5 | | CVE-2025-71302 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: fix for dma-fence safe access rules |
| MEDIUM | | 7 | | CVE-2025-71313 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: PCI: endpoint: Add missing NULL check for alloc_workqueue() |
| MEDIUM | | 5.5 | | CVE-2025-71315 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/vkms: Convert to DRM's vblank timer |
| MEDIUM | | 5.5 | | CVE-2026-100074 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| MEDIUM | | 5.5 | | CVE-2026-100076 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths |
| MEDIUM | | 5.5 | | CVE-2026-100077 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Recover HW before retire hung submit |
| MEDIUM | | 5.5 | | CVE-2026-23007 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: block: zero non-PI portion of auto integrity buffer |
| MEDIUM | | 5.5 | | CVE-2026-23017 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: idpf: fix error handling in the init_task on load |
| MEDIUM | | 5.5 | | CVE-2026-23143 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix misalignment bug in struct virtnet_info |
| MEDIUM | | 7.1 | | CVE-2026-23152 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: correctly decode TTLM with default link map |
| MEDIUM | | 5.5 | | CVE-2026-23217 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: riscv: trace: fix snapshot deadlock with sbi ecall |
| MEDIUM | | 5.5 | | CVE-2026-23259 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: io_uring/rw: free potentially allocated iovec on cache put failure |
| MEDIUM | | 5.5 | | CVE-2026-23265 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on node footer in {read,write}_end_io |
| MEDIUM | | 5.5 | | CVE-2026-23348 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix race of nvdimm_bus object when creating nvdimm objects |
| MEDIUM | | 5.5 | | CVE-2026-23371 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting |
| MEDIUM | | 5.5 | | CVE-2026-23377 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz |
| MEDIUM | | 5.5 | | CVE-2026-23385 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: clone set on flush only |
| MEDIUM | | 5.5 | | CVE-2026-23472 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN |
| MEDIUM | | 5.5 | | CVE-2026-31435 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix read abandonment during retry |
| MEDIUM | | 5.5 | | CVE-2026-31526 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix exception exit lock checking for subprogs |
| MEDIUM | | 5.5 | | CVE-2026-31537 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: smb: server: make use of smbdirect_socket.send_io.bcredits |
| MEDIUM | | 5.5 | | CVE-2026-31562 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register |
| MEDIUM | | 5.5 | | CVE-2026-31579 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit |
| MEDIUM | | 5.5 | | CVE-2026-31591 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish |
| MEDIUM | | 5.5 | | CVE-2026-31592 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock |
| MEDIUM | | 5.5 | | CVE-2026-31630 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: rxrpc: proc: size address buffers for %pISpc output |
| MEDIUM | | 7.1 | | CVE-2026-31692 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns |
| MEDIUM | | 5.5 | | CVE-2026-31771 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_event: move wake reason storage into validated event handlers |
| MEDIUM | | 5.5 | | CVE-2026-31777 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ALSA: ctxfi: Check the error for index mapping |
| MEDIUM | | 5.5 | | CVE-2026-43009 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix incorrect pruning due to atomic fetch precision tracking |
| MEDIUM | | 5.5 | | CVE-2026-43022 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists |
| MEDIUM | | 5.5 | | CVE-2026-43029 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: mptcp: fix soft lockup in mptcp_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-43034 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: set backing store type from query type |
| MEDIUM | | 7.1 | | CVE-2026-43042 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: mpls: add seqcount to protect the platform_label{,s} pair |
| MEDIUM | | 5.5 | | CVE-2026-43048 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: HID: core: Mitigate potential OOB by removing bogus memset() |
| MEDIUM | | 5.5 | | CVE-2026-43053 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: xfs: close crash window in attr dabtree inactivation |
| MEDIUM | | 5.5 | | CVE-2026-43083 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: ioam6: fix OOB and missing lock |
| MEDIUM | | 5.5 | | CVE-2026-43101 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() |
| MEDIUM | | 5.5 | | CVE-2026-43115 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: srcu: Use irq_work to start GP in tiny SRCU |
| MEDIUM | | 5.5 | | CVE-2026-43118 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix zero size inode with non-zero size after log replay |
| MEDIUM | | 5.5 | | CVE-2026-43127 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ntfs3: fix circular locking dependency in run_unpack_ex |
| MEDIUM | | 5.5 | | CVE-2026-43172 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: fix 22000 series SMEM parsing |
| MEDIUM | | 5.5 | | CVE-2026-43191 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 |
| MEDIUM | | 5.5 | | CVE-2026-43204 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ASoC: qcom: q6asm: drop DSP responses for closed data streams |
| MEDIUM | | 5.5 | | CVE-2026-43213 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: rtw89: pci: validate sequence number of TX release report |
| MEDIUM | | 5.5 | | CVE-2026-43234 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: team: avoid NETDEV_CHANGEMTU event when unregistering slave |
| MEDIUM | | 5.5 | | CVE-2026-43272 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ring-buffer: Fix possible dereference of uninitialized pointer |
| MEDIUM | | 5.5 | | CVE-2026-43294 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels |
| MEDIUM | | 5.5 | | CVE-2026-43298 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Skip vcn poison irq release on VF |
| MEDIUM | | 5.5 | | CVE-2026-43299 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() |
| MEDIUM | | 5.5 | | CVE-2026-43301 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix PM runtime usage count underflow |
| MEDIUM | | 5.5 | | CVE-2026-43308 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() |
| MEDIUM | | 5.5 | | CVE-2026-43309 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: md raid: fix hang when stopping arrays with metadata through dm-raid |
| MEDIUM | | 5.5 | | CVE-2026-43310 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC |
| MEDIUM | | 5.5 | | CVE-2026-43311 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: soc/tegra: pmc: Fix unsafe generic_handle_irq() call |
| MEDIUM | | 5.5 | | CVE-2026-43325 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: don't send a 6E related command when not supported |
| MEDIUM | | 5.5 | | CVE-2026-43326 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback |
| MEDIUM | | 5.5 | | CVE-2026-43337 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() |
| MEDIUM | | 5.5 | | CVE-2026-43346 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ice: ptp: don't WARN when controlling PF is unavailable |
| MEDIUM | | 5.5 | | CVE-2026-43352 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue |
| MEDIUM | | 5.5 | | CVE-2026-43353 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue |
| MEDIUM | | 7.1 | | CVE-2026-43414 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Completely fix fcport double free |
| MEDIUM | | 5.5 | | CVE-2026-43416 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: powerpc, perf: Check that current->mm is alive before getting user callchain |
| MEDIUM | | 5.5 | | CVE-2026-43443 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ASoC: amd: acp-mach-common: Add missing error check for clock acquisition |
| MEDIUM | | 5.5 | | CVE-2026-43463 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() |
| MEDIUM | | 5.5 | | CVE-2026-43464 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ |
| MEDIUM | | 5.5 | | CVE-2026-43465 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ |
| MEDIUM | | 5.5 | | CVE-2026-43485 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: nouveau/gsp: drop WARN_ON in ACPI probes |
| MEDIUM | | 6.4 | | CVE-2026-45932 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix tcx/netkit detach permissions when prog fd isn't given |
| MEDIUM | | 7 | | CVE-2026-45934 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation |
| MEDIUM | | 5.5 | | CVE-2026-45940 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix oops when split header is enabled |
| MEDIUM | | 5.5 | | CVE-2026-45961 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: gfs2: fix memory leaks in gfs2_fill_super error path |
| MEDIUM | | 5.5 | | CVE-2026-46014 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Add missing save/restore handling of LBR MSRs |
| MEDIUM | | 7 | | CVE-2026-46017 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: mm: fix deferred split queue races during migration |
| MEDIUM | | 7 | | CVE-2026-46032 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT |
| MEDIUM | | 5.5 | | CVE-2026-46044 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ipmi:ssif: Clean up kthread on errors |
| MEDIUM | | 5.5 | | CVE-2026-46059 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN |
| MEDIUM | | 5.5 | | CVE-2026-46066 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ceph: fix num_ops off-by-one when crypto allocation fails |
| MEDIUM | | 5.5 | | CVE-2026-46071 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 |
| MEDIUM | | 5.5 | | CVE-2026-46096 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() |
| MEDIUM | | 5.5 | | CVE-2026-46147 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() |
| MEDIUM | | 5.5 | | CVE-2026-46148 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: spi: microchip-core-qspi: control built-in cs manually |
| MEDIUM | | 5.5 | | CVE-2026-46153 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: 8021q: delete cleared egress QoS mappings |
| MEDIUM | | 5.5 | | CVE-2026-46171 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: riscv: kvm: fix vector context allocation leak |
| MEDIUM | | 5.5 | | CVE-2026-46228 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: spi: ch341: fix devres lifetime |
| MEDIUM | | 5.5 | | CVE-2026-46245 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dc_link NULL handling in HPD init |
| MEDIUM | | 5.5 | | CVE-2026-46256 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages |
| MEDIUM | | 4.7 | | CVE-2026-46272 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: coresight: tmc-etr: Fix race condition between sysfs and perf mode |
| MEDIUM | | 5.5 | | CVE-2026-46302 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: selinux: allow multiple opens of /sys/fs/selinux/policy |
| MEDIUM | | 5.5 | | CVE-2026-46314 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Reject empty multisync extension to prevent infinite loop |
| MEDIUM | | 7 | | CVE-2026-46317 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock |
| MEDIUM | | 7 | | CVE-2026-46324 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: netfilter nf_tables denial of service via race condition in netlink hook unregistration |
| MEDIUM | | 7 | | CVE-2026-46325 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE |
| MEDIUM | | 7 | | CVE-2026-46330 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Revert "net/smc: Introduce TCP ULP support" |
| MEDIUM | | 5.5 | | CVE-2026-52937 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR |
| MEDIUM | | 7 | | CVE-2026-52953 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Fix oops due to out of scope access |
| MEDIUM | | 7 | | CVE-2026-52956 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() |
| MEDIUM | | 5.5 | | CVE-2026-52994 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting |
| MEDIUM | | 7 | | CVE-2026-53009 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ice: fix double-free of tx_buf skb |
| MEDIUM | | 5.5 | | CVE-2026-53017 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix data loss caused by incorrect use of nat_entry flag |
| MEDIUM | | 5.5 | | CVE-2026-53018 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: f2fs: avoid reading already updated pages during GC |
| MEDIUM | | 5.5 | | CVE-2026-53103 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync |
| MEDIUM | | 5.5 | | CVE-2026-53104 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: Fix memory leak destroying device |
| MEDIUM | | 5.5 | | CVE-2026-53106 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Do not allow deleting local storage in NMI |
| MEDIUM | | 5.5 | | CVE-2026-53107 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: libertas: don't kill URBs in interrupt context |
| MEDIUM | | 5.5 | | CVE-2026-53108 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: powerpc/64s: Fix unmap race with PMD migration entries |
| MEDIUM | | | | CVE-2026-53178 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction |
| MEDIUM | | 7 | | CVE-2026-53224 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: sctp: validate embedded INIT chunk and address list lengths in cookie |
| MEDIUM | | 7 | | CVE-2026-53246 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing |
| MEDIUM | | 5.5 | | CVE-2026-53258 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: fix leak if split 6 GHz scanning fails |
| MEDIUM | | 5.5 | | CVE-2026-53281 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption |
| MEDIUM | | 5.5 | | CVE-2026-53285 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED |
| MEDIUM | | 5.5 | | CVE-2026-53292 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind |
| MEDIUM | | 5.5 | | CVE-2026-53297 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: mana: Guard mana_remove against double invocation |
| MEDIUM | | 5.5 | | CVE-2026-53321 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: io_uring/napi: cap busy_poll_to 10 msec |
| MEDIUM | | 5.5 | | CVE-2026-53377 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/msm: always recover the gpu |
| MEDIUM | | | | CVE-2026-53401 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: fbdev: omap2: fix use-after-free in omapfb_mmap |
| MEDIUM | | | | CVE-2026-63805 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: crypto: nx - fix nx_crypto_ctx_exit argument |
| MEDIUM | | | | CVE-2026-63811 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: f2fs: read COW data with the original inode during atomic write |
| MEDIUM | | | | CVE-2026-63819 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix to do sanity check on f2fs_get_node_folio_ra() |
| MEDIUM | | 5.5 | | CVE-2026-63832 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: add wcid publish check in mt76_sta_add |
| MEDIUM | | 5.5 | | CVE-2026-63853 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring |
| MEDIUM | | | | CVE-2026-63857 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-63858 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: add hook transactions for device deletions |
| MEDIUM | | | | CVE-2026-63859 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue() |
| MEDIUM | | 7 | | CVE-2026-63941 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor |
| MEDIUM | | 7 | | CVE-2026-63979 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net/handshake: hand off the pinned file reference to accept_doit |
| MEDIUM | | 5.5 | | CVE-2026-63998 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ethtool: module: call ethnl_ops_complete() on module flash errors |
| MEDIUM | | 5.5 | | CVE-2026-63999 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure |
| MEDIUM | | 5.5 | | CVE-2026-64006 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: fix dst corruption in same register operation |
| MEDIUM | | 7 | | CVE-2026-64024 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction |
| MEDIUM | | 5.5 | | CVE-2026-64036 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: cgroup/rstat: validate cpu before css_rstat_cpu() access |
| MEDIUM | | 5.5 | | CVE-2026-64038 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Stop work before releasing hwmon device |
| MEDIUM | | 5.5 | | CVE-2026-64060 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix leak of request in netfs_write_begin() error handling |
| MEDIUM | | 7.1 | | CVE-2026-64066 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_read_to_pagecache() to pause on subreq failure |
| MEDIUM | | 5.5 | | CVE-2026-64067 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing barriers when accessing stream->subrequests locklessly |
| MEDIUM | | 7 | | CVE-2026-64068 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix missing locking around retry adding new subreqs |
| MEDIUM | | 5.5 | | CVE-2026-64076 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfilter: bridge: eb_tables: close module init race |
| MEDIUM | | 5.5 | | CVE-2026-64077 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfilter: ebtables: move to two-stage removal scheme |
| MEDIUM | | 7.1 | | CVE-2026-64078 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: add and use xtables_unregister_table_exit |
| MEDIUM | | 5.5 | | CVE-2026-64079 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfilter: x_tables: allocate hook ops while under mutex |
| MEDIUM | | 7 | | CVE-2026-64117 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb |
| MEDIUM | | 5.5 | | CVE-2026-64146 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: erofs: fix metabuf leak in inode xattr initialization |
| MEDIUM | | 5.5 | | CVE-2026-64154 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() |
| MEDIUM | | 5.5 | | CVE-2026-64159 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix zeropoint update where i_size > remote_i_size |
| MEDIUM | | 7 | | CVE-2026-64160 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point |
| MEDIUM | | 5.5 | | CVE-2026-64190 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: team: fix NULL pointer dereference in team_xmit during mode change |
| MEDIUM | | 5.5 | | CVE-2026-64212 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it |
| MEDIUM | | 5.5 | | CVE-2026-64213 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: hwmon: (lm90) Add lock protection to lm90_alert |
| MEDIUM | | 7 | | CVE-2026-64255 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers |
| MEDIUM | | 7 | | CVE-2026-64520 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies |
| MEDIUM | | 7 | | CVE-2026-68086 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: mm/khugepaged: write all dirty file folios when collapsing |
| MEDIUM | | 5.5 | | CVE-2026-68211 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: media: stm32-dcmipp: Return queued buffers on start_streaming() failure |
| MEDIUM | | 5.5 | | CVE-2026-68233 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/vc4: Shut down BO cache timer before teardown |
| MEDIUM | | 5.5 | | CVE-2026-68242 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/i915/gt: Fix NULL deref on sched_engine alloc failure |
| MEDIUM | | 5.5 | | CVE-2026-68258 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size |
| MEDIUM | | 5.5 | | CVE-2026-68291 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Linux kernel: idpf driver null pointer dereference leads to Denial of Service |
| MEDIUM | | 5.5 | | CVE-2026-68295 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: LoongArch: BPF: Zero-extend signed ALU32 div/mod results |
| MEDIUM | | 5.5 | | CVE-2026-68312 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths |
| MEDIUM | | 7 | | CVE-2026-68323 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: tipc: serialize udp bearer replicast list updates |
| MEDIUM | | 5.5 | | CVE-2026-68382 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Hold device ref until queue teardown completes |
| MEDIUM | | 5.5 | | CVE-2026-68383 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Keep scheduler timeline name alive |
| MEDIUM | | 7 | | CVE-2026-68393 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: extend conn_hash lookup critical sections |
| MEDIUM | | 6.4 | | CVE-2026-68399 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix UAF in sock clone early bailouts |
| MEDIUM | | 7 | | CVE-2026-68400 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation |
| MEDIUM | | 7 | | CVE-2026-68401 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() |
| MEDIUM | | 7 | | CVE-2026-68404 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect |
| MEDIUM | | 5.5 | | CVE-2026-68421 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() |
| MEDIUM | | 5.5 | | CVE-2026-68435 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: LoongArch: Fix address space mismatch in kexec command line lookup |
| MEDIUM | | 5.5 | | CVE-2026-68441 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains |
| MEDIUM | | 5.5 | | CVE-2026-68447 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size |
| MEDIUM | | 7 | | CVE-2026-68448 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ovl: check access to copy_file_range source with src mounter creds |
| MEDIUM | | 7 | | CVE-2026-68453 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey |
| MEDIUM | | 5.5 | | CVE-2026-68471 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: ieee80211: validate MLE common info length |
| MEDIUM | | 5.5 | | CVE-2026-72073 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: mmc: vub300: fix use-after-free on probe failure |
| MEDIUM | | 5.5 | | CVE-2026-72162 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec |
| MEDIUM | | 7 | | CVE-2026-72288 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling |
| MEDIUM | | 7 | | CVE-2026-72329 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net/liquidio: drop cached VF pci_dev LUT |
| MEDIUM | | 5.5 | | CVE-2026-72337 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: 6lowpan: avoid untracked enable work |
| MEDIUM | | 5.5 | | CVE-2026-72341 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Fix publication race for priv->channel_stats[] |
| MEDIUM | | 5.5 | | CVE-2026-72355 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix barriering when walking subrequest list |
| MEDIUM | | 5.5 | | CVE-2026-72365 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix writethrough to use collection offload |
| MEDIUM | | 5.5 | | CVE-2026-72367 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: iomap: guard io_size EOF trim against concurrent truncate underflow |
| MEDIUM | | 5.5 | | CVE-2026-72375 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: afs: Fix reinitialisation of the inode, in particular ->lock_work |
| MEDIUM | | 5.5 | | CVE-2026-72380 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: xen/pvcalls: bound backend response req_id before indexing rsp[] |
| MEDIUM | | 5.5 | | CVE-2026-72383 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: sctp: fix addr_wq_timer race in sctp_free_addr_wq() |
| MEDIUM | | 5.5 | | CVE-2026-72388 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock |
| MEDIUM | | 5.5 | | CVE-2026-72397 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() |
| MEDIUM | | 7 | | CVE-2026-72398 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: sctp: add INIT verification after cookie unpacking |
| MEDIUM | | 5.5 | | CVE-2026-72404 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() |
| MEDIUM | | 5.5 | | CVE-2026-72423 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Guard conntrack opts error writes |
| MEDIUM | | 5.5 | | CVE-2026-72440 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: md/raid1: fix writes_pending and barrier reference leaks on write failures |
| MEDIUM | | 5.5 | | CVE-2026-72454 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() |
| MEDIUM | | 5.5 | | CVE-2026-72488 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: soundwire: fix bug in sdw_add_element_group_count found by syzkaller |
| MEDIUM | | 5.5 | | CVE-2026-72493 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: serialize netif_running() check in enqueue_to_backlog() |
| MEDIUM | | 5.5 | | CVE-2026-72495 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages |
| MEDIUM | | 7 | | CVE-2026-72499 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free CQ toggle page after firmware teardown |
| MEDIUM | | 7 | | CVE-2026-72500 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown |
| MEDIUM | | | | CVE-2026-72501 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: R ... |
| MEDIUM | | 5.5 | | CVE-2026-74257 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: sockmap: Fix use-after-free in udp_bpf_recvmsg() |
| MEDIUM | | 5.5 | | CVE-2026-74264 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: watchdog: fix refcount tracking races |
| MEDIUM | | 5.5 | | CVE-2026-74272 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Resolve region deletion races |
| MEDIUM | | 5.5 | | CVE-2026-74273 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: cxl/region: Block region delete during region creation |
| MEDIUM | | 5.5 | | CVE-2026-74314 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Cancel special fields on map value recycle |
| MEDIUM | | 5.5 | | CVE-2026-74317 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ixgbe: do not configure xps for XDP queues |
| MEDIUM | | 5.5 | | CVE-2026-74324 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7925: validate skb length in testmode query |
| MEDIUM | | 5.5 | | CVE-2026-74337 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks |
| MEDIUM | | 5.5 | | CVE-2026-74342 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: kernfs: link kn to its parent before the LSM init hook |
| MEDIUM | | 5.5 | | CVE-2026-74344 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear rb node linkage when freeing bpf_rb_root |
| MEDIUM | | 5.5 | | CVE-2026-74350 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate fast symlink target during inode read |
| MEDIUM | | 5.5 | | CVE-2026-74354 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Take mmap_lock in zap_pages() |
| MEDIUM | | 5.5 | | CVE-2026-74368 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() |
| MEDIUM | | 6.5 | | CVE-2026-74385 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock |
| MEDIUM | | 5.5 | | CVE-2026-74388 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data |
| MEDIUM | | 7 | | CVE-2026-74405 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: OPP: Fix race between OPP addition and lookup |
| MEDIUM | | 5.5 | | CVE-2026-74407 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: ath11k: cancel SSR work items during PCI shutdown |
| MEDIUM | | 5.5 | | CVE-2026-74449 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport |
| MEDIUM | | 5.5 | | CVE-2026-74466 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: s390/zcrypt: Close speculative mem read possibility |
| MEDIUM | | 7 | | CVE-2026-74506 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: afs: Fix UAF when sending a message |
| MEDIUM | | 7 | | CVE-2026-74513 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister |
| MEDIUM | | 5.5 | | CVE-2026-74527 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: octeontx2-af: Block VFs from clobbering special CGX PKIND state |
| MEDIUM | | 5.5 | | CVE-2026-74529 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback |
| MEDIUM | | 5.5 | | CVE-2026-74530 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback |
| MEDIUM | | 7 | | CVE-2026-74533 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero |
| MEDIUM | | 7 | | CVE-2026-74537 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: hold sk properly in iso_conn_ready |
| MEDIUM | | 5.5 | | CVE-2026-74538 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: lock sk in iso_connect_ind |
| MEDIUM | | 5.5 | | CVE-2026-74542 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix folio_queue ENOMEM in writeback by adding a mempool |
| MEDIUM | | 5.5 | | CVE-2026-74544 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds |
| MEDIUM | | 5.5 | | CVE-2026-74600 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: mm/page_table_check: skip special zero mappings |
| MEDIUM | | 5.5 | | CVE-2026-74605 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: eventfs: Use children field for rcu head and add memory barriers |
| MEDIUM | | 7 | | CVE-2026-74611 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: tls: rx: restore msg_iter before TLS 1.3 optimistic retry |
| MEDIUM | | 5.5 | | CVE-2026-74638 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Serialize the scheduler timeout handlers |
| MEDIUM | | 5.5 | | CVE-2026-74687 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: watchdog: at91sam9_wdt: prevent timer rearm during teardown |
| MEDIUM | | 7 | | CVE-2026-74695 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() |
| MEDIUM | | 7 | | CVE-2026-74697 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Disable EOP for TPA on all chips to prevent data corruption |
| MEDIUM | | 5.5 | | CVE-2026-74711 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: hwmon: (pmbus) Fix type confusion in notification logic |
| MEDIUM | | 5.5 | | CVE-2026-74713 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: vhost_iotlb: bound map allocation in add_range |
| MEDIUM | | 7 | | CVE-2026-74715 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix netns reference imbalance in conntrack kfuncs |
| MEDIUM | | 5.5 | | CVE-2026-74723 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject inline extents without valid headers |
| MEDIUM | | 5.5 | | CVE-2026-74729 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read |
| MEDIUM | | 5.5 | | CVE-2026-74747 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ipvs: revalidate ihl to prevent out-of-bounds access |
| MEDIUM | | 5.5 | | CVE-2026-80579 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: fbdev: clear fb_info->mode before deleting a videomode |
| MEDIUM | | 5.5 | | CVE-2026-80580 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: fbdev: bound mode sysfs output to the sysfs buffer |
| MEDIUM | | 5.5 | | CVE-2026-80614 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: emac: Fix NULL pointer dereference in emac_probe |
| MEDIUM | | 5.5 | | CVE-2026-80623 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: coresight: ete: Always save state on power down |
| MEDIUM | | 5.5 | | CVE-2026-80628 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: oss: Serialize readq reset state with q->lock |
| MEDIUM | | 5.5 | | CVE-2026-80631 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: btrfs: lzo: reject compressed segment that overflows the compressed input |
| MEDIUM | | 5.5 | | CVE-2026-80634 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag |
| MEDIUM | | 5.5 | | CVE-2026-80655 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: soc: xilinx: Fix race condition in event registration |
| MEDIUM | | 5.5 | | CVE-2026-80662 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size |
| MEDIUM | | 7 | | CVE-2026-80668 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations |
| MEDIUM | | 5.5 | | CVE-2026-80670 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() |
| MEDIUM | | 5.5 | | CVE-2026-80692 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks |
| MEDIUM | | 7 | | CVE-2026-80693 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: idpf: bound interrupt-vector register fill to the allocated array |
| MEDIUM | | 5.5 | | CVE-2026-80698 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: dmaengine: idxd: fix double free of wq, engine, and group structs |
| MEDIUM | | 5.5 | | CVE-2026-80721 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: ISO: ensure no dangling hcon references in iso_conn |
| MEDIUM | | | | CVE-2026-80761 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| MEDIUM | | 5.5 | | CVE-2026-80905 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: tap: fix wrong transport_header when sending VLAN-tagged frame |
| MEDIUM | | 5.5 | | CVE-2026-80920 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: io_uring: defer eventfd signaling when queued from a wakeup handler |
| MEDIUM | | 5.5 | | CVE-2026-81010 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: io_uring/waitid: honor task_work cancellation |
| MEDIUM | | 7 | | CVE-2026-89528 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Reject Read lists that exceed the page budget |
| MEDIUM | | 4.8 | | CVE-2026-89534 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| MEDIUM | | 7 | | CVE-2026-89537 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 |
| MEDIUM | | 7.2 | | CVE-2026-89610 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ntfs: verify run length exceeding volume boundary |
| MEDIUM | | 5.5 | | CVE-2026-89611 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ntfs: validate non-resident attribute offsets |
| MEDIUM | | 7.1 | | CVE-2026-89632 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() |
| MEDIUM | | 7 | | CVE-2026-89637 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 |
| MEDIUM | | 5.5 | | CVE-2026-89639 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC |
| MEDIUM | | 3.3 | | CVE-2026-89642 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: cifs: call pagecache_isize_extended() in cifs_setsize() when extending |
| MEDIUM | | 6.2 | | CVE-2026-89648 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ceph: cap delegated inode count in ceph_parse_deleg_inos() |
| MEDIUM | | 7 | | CVE-2026-89654 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ceph: fix UAF in check_new_map() on session freed during unlock |
| MEDIUM | | 5.3 | | CVE-2026-89682 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net |
| MEDIUM | | 5.3 | | CVE-2026-89705 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths |
| MEDIUM | | 5.9 | | CVE-2026-89709 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: lockd, nfsd: RCU-protect nlmsvc_ops dispatch |
| MEDIUM | | 5.5 | | CVE-2026-89722 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() |
| MEDIUM | | 5.5 | | CVE-2026-89757 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: mm/mglru: fix and remove redundant unevictable folio handling |
| MEDIUM | | 4.7 | | CVE-2026-89810 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix error path at svm_migrate_copy_to_ram |
| MEDIUM | | | | CVE-2026-89826 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| MEDIUM | | | | CVE-2026-89833 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| MEDIUM | | | | CVE-2026-89866 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| MEDIUM | | | | CVE-2026-89906 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| MEDIUM | | 4.7 | | CVE-2026-89913 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables |
| MEDIUM | | 4.7 | | CVE-2026-89920 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Fix memory corruption by not reinjecting CK machine checks |
| MEDIUM | | | | CVE-2026-89935 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 3.6 | | CVE-2026-89987 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: mm/huge_memory: transfer the pmd dirty bit to the folio on zap |
| MEDIUM | | 5.5 | | CVE-2026-90040 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped |
| MEDIUM | | 5.5 | | CVE-2026-90061 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_tables: skip double clone set expressions on element insert |
| MEDIUM | | 5.5 | | CVE-2026-90083 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net/sched: act_ife: Only operate on Ethernet frames |
| MEDIUM | | 5.5 | | CVE-2026-90087 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: do not leak an hci_conn when a second LE connect is rejected |
| MEDIUM | | 7 | | CVE-2026-90093 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: access chan->conn safely in get/setsockopt |
| MEDIUM | | 5.5 | | CVE-2026-90098 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: fix sleep in atomic context in MAC table access |
| MEDIUM | | 7 | | CVE-2026-90099 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net/sched: account classifier filter allocations to memcg |
| MEDIUM | | 7 | | CVE-2026-90104 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: NFSv4.1: zero referring call lists before decoding |
| MEDIUM | | 5.5 | | CVE-2026-90105 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: vxlan: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90106 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: bridge: arp/nd proxy: fix reading neigh ha |
| MEDIUM | | 5.5 | | CVE-2026-90116 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ALSA: mtpav: shut down output timer before card teardown |
| MEDIUM | | 5.5 | | CVE-2026-90142 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: virtio_net: Fix resize of the RX ring |
| MEDIUM | | 5.5 | | CVE-2026-90149 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers |
| MEDIUM | | 5.5 | | CVE-2026-90154 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ksmbd: scope session state changes to bound connections |
| MEDIUM | | 5.5 | | CVE-2026-90155 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ksmbd: detach blocked lock requests before freeing |
| MEDIUM | | 5.5 | | CVE-2026-90156 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely discard unregistered deferred locks |
| MEDIUM | | 7 | | CVE-2026-90161 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: erofs: fix interlaced ztailpacking pclusters |
| MEDIUM | | 5.5 | | CVE-2026-90162 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ksmbd: defer publishing granted locks to prevent UAF/double-free race |
| MEDIUM | | 5.5 | | CVE-2026-90167 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ksmbd: serialize oplock close with pending break ownership |
| MEDIUM | | 5.5 | | CVE-2026-90174 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() |
| MEDIUM | | 5.5 | | CVE-2026-90177 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Check pointer type for all atomic RMW paths |
| MEDIUM | | 5.5 | | CVE-2026-90179 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix deadlock in complain-mode change_hat |
| MEDIUM | | 5.5 | | CVE-2026-90204 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate DIO orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90205 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate orphan slot during inode read |
| MEDIUM | | 5.5 | | CVE-2026-90208 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type |
| MEDIUM | | 5.5 | | CVE-2026-90217 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Compare iterator types during state pruning |
| MEDIUM | | 5.5 | | CVE-2026-90231 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: apparmor: fix unconfined user namespace restriction forced stack |
| MEDIUM | | 5.5 | | CVE-2026-90232 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: amt: Don't support cross-netns setup |
| MEDIUM | | 5.1 | | CVE-2026-90234 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: NFS: Return a delegation the client fails to record |
| MEDIUM | | 7 | | CVE-2026-90237 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfilter: nft_ct: move custom expectation support to helper |
| MEDIUM | | 7 | | CVE-2026-90240 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: iommu/vt-d: Flush context cache with correct SID when tearing down aliases |
| MEDIUM | | 5.5 | | CVE-2026-90247 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix mmap_lock leak in irq_work path |
| MEDIUM | | 5.9 | | CVE-2026-90256 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind |
| MEDIUM | | 5.5 | | CVE-2026-90259 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() |
| MEDIUM | | 4.7 | | CVE-2026-90260 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: don't clobber the extent buffer when zeroing it out |
| MEDIUM | | 3.3 | | CVE-2026-90263 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: btrfs: check if root is readonly when setting posix acl |
| MEDIUM | | 5.5 | | CVE-2026-90264 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: btrfs: always wait for ordered extents to avoid OE races |
| MEDIUM | | 5.5 | | CVE-2026-90265 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: btrfs: defrag: fix deadlock between defrag and delalloc space reservation |
| MEDIUM | | 5.5 | | CVE-2026-90273 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable |
| MEDIUM | | 5.5 | | CVE-2026-90289 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Resize MST HDCP per-connector arrays to 32 |
| MEDIUM | | 5.5 | | CVE-2026-90300 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Clear buf on error in __bpf_get_task_stack |
| MEDIUM | | 5.5 | | CVE-2026-90301 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ocfs2: o2hb: quiesce negotiate handlers and timeout work |
| MEDIUM | | 7 | | CVE-2026-90317 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Invalidate RCU pointers after final spin unlock |
| MEDIUM | | 5.5 | | CVE-2026-90320 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate external xattr entries when reading metadata |
| MEDIUM | | 5.5 | | CVE-2026-90321 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ocfs2: validate inline xattrs during inode block validation |
| MEDIUM | | 5.5 | | CVE-2026-90324 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ublk: check import_ubuf() return value |
| MEDIUM | | 4.7 | | CVE-2026-90326 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: blk-cgroup: fix race between policy activation and blkg destruction |
| MEDIUM | | 5.5 | | CVE-2026-90328 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: HID: steam: Reject short reads |
| MEDIUM | | 6.4 | | CVE-2026-90333 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: dm-integrity: replace forgeable discard filler with a keyed sector marker |
| MEDIUM | | 4.1 | | CVE-2026-90336 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: serial: core: clear freed pointers on uart_register_driver() failure |
| MEDIUM | | 5.5 | | CVE-2026-90337 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: serial: core: do fallible allocations before the console can be registered |
| MEDIUM | | 7 | | CVE-2026-90343 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: stop PMSR before P2P and NAN teardown |
| MEDIUM | | 5.5 | | CVE-2026-90345 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: brcmfmac: fix P2P action frame handling without device vif |
| MEDIUM | | 7 | | CVE-2026-90347 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry |
| MEDIUM | | 5.5 | | CVE-2026-90351 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed |
| MEDIUM | | 4.4 | | CVE-2026-90359 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject >8 byte return values on return-reading trampoline paths |
| MEDIUM | | 5.5 | | CVE-2026-90363 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/msm: don't tear down KMS twice when KMS init fails |
| MEDIUM | | 5.5 | | CVE-2026-90365 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: cancel reset and rc work on device unregister |
| MEDIUM | | 5.5 | | CVE-2026-90367 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER |
| MEDIUM | | 4.8 | | CVE-2026-90379 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash |
| MEDIUM | | 3.3 | | CVE-2026-90401 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: md: remove REQ_NOWAIT support from raid1/10/456 |
| MEDIUM | | 5.5 | | CVE-2026-90408 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() |
| MEDIUM | | 5.5 | | CVE-2026-90409 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/panthor: Add vm_bind region with kbo range overlap check |
| MEDIUM | | 4.7 | | CVE-2026-90417 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() |
| MEDIUM | | 5.5 | | CVE-2026-90421 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: PCI: Fix UAF when probe runs concurrent to dyn ID removal |
| MEDIUM | | 5.5 | | CVE-2026-90422 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path |
| MEDIUM | | 4.7 | | CVE-2026-90427 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() |
| MEDIUM | | 5.5 | | CVE-2026-92480 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: scsi: ufs: core: Validate string descriptors |
| MEDIUM | | 5.5 | | CVE-2026-92482 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip |
| MEDIUM | | 3.3 | | CVE-2026-92485 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix WARNING in bpf_tracing_link_release |
| MEDIUM | | 5.5 | | CVE-2026-92499 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ext4: validate readdir offset before accessing dirent |
| MEDIUM | | 4.7 | | CVE-2026-92500 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ext4: use fsdata to track inline data write state and fix race |
| MEDIUM | | 5.5 | | CVE-2026-92503 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() |
| MEDIUM | | 5.5 | | CVE-2026-92518 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: riscv, bpf: Fix kernel stack corruption in tailcall with CFI |
| MEDIUM | | 5.5 | | CVE-2026-92520 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Zero queue and stack outputs on lock failure |
| MEDIUM | | 5.5 | | CVE-2026-93044 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for arena-related insns |
| MEDIUM | | 5.5 | | CVE-2026-93047 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/v3d: Associate BOs with every job that accesses them |
| MEDIUM | | 5.5 | | CVE-2026-93058 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/msm: Only fini scheduler after successful init |
| MEDIUM | | 5.5 | | CVE-2026-93081 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: firmware: arm_scmi: Fix SCMI device destroy lifetimes |
| MEDIUM | | 4.7 | | CVE-2026-93099 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Fix UAF from worker threads when domains are removed |
| MEDIUM | | 4.7 | | CVE-2026-93100 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() |
| MEDIUM | | 4.7 | | CVE-2026-93104 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: RDMA/rvt: Return NULL after port allocation failure |
| MEDIUM | | 7 | | CVE-2026-93105 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: esp: do not unref managed frag pages in esp_ssg_unref() |
| MEDIUM | | 5.5 | | CVE-2026-93122 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: usb: gadget: uac: validate rate list length before storing |
| MEDIUM | | 5.5 | | CVE-2026-93135 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject programs with inlined helpers if JIT is not available |
| MEDIUM | | 7 | | CVE-2026-93148 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject MEM_ALLOC BTF accesses past object bounds |
| MEDIUM | | 7 | | CVE-2026-93154 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Add refcounting to user ring MRs |
| MEDIUM | | 5.5 | | CVE-2026-93168 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout |
| MEDIUM | | 5.5 | | CVE-2026-93175 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in CRTC reset function |
| MEDIUM | | 4.7 | | CVE-2026-93176 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: Fix dangling pointer in plane reset function |
| MEDIUM | | 5.5 | | CVE-2026-93270 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn |
| MEDIUM | | 5.5 | | CVE-2026-93272 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 |
| MEDIUM | | 5.5 | | CVE-2026-93276 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator |
| MEDIUM | | 5.5 | | CVE-2026-93282 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ksmbd: fix maximum allowed access checks |
| MEDIUM | | 7.1 | | CVE-2026-97422 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: fix SMI event cross-process information leak |
| MEDIUM | | 5.5 | | CVE-2026-97432 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: mvm: fix P2P-Device binding handling |
| MEDIUM | | 5.5 | | CVE-2026-97478 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: virt: acrn: Fix irqfd use-after-free during eventfd shutdown |
| MEDIUM | | 7.1 | | CVE-2026-97493 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS |
| MEDIUM | | 5.5 | | CVE-2026-97499 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: coresight: perf: Retrieve path and source from event data |
| MEDIUM | | 5.5 | | CVE-2026-97513 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Release m2m_ctx after Instance Removed from List |
| MEDIUM | | 5.5 | | CVE-2026-97515 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 |
| MEDIUM | | 5.5 | | CVE-2026-97526 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: s390/pai: Support CPU hotplug for PMU PAI |
| MEDIUM | | 5.5 | | CVE-2026-97538 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: hwmon: (asus_rog_ryujin) Validate HID report lengths |
| MEDIUM | | 5.5 | | CVE-2026-97554 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() |
| MEDIUM | | 7 | | CVE-2026-97561 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid |
| MEDIUM | | 7 | | CVE-2026-97563 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97565 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: smb: client: reject short READ responses in CIFSSMBRead() |
| MEDIUM | | 5.5 | | CVE-2026-97960 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel: Prevent drain_pebs() reentry |
| MEDIUM | | 5.5 | | CVE-2026-97962 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net/mlx5e: Move representor vnic reporter to eswitch devlink port |
| MEDIUM | | 5.1 | | CVE-2026-97975 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() |
| MEDIUM | | 4.7 | | CVE-2026-97988 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: vhost: invalidate vring access on IOTLB transitions |
| MEDIUM | | 5.5 | | CVE-2026-98019 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: mark a NULL call argument precise |
| MEDIUM | | 5.3 | | CVE-2026-98032 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: tracing: Fix subbuf resize races with trace_pipe_raw readers |
| MEDIUM | | 7 | | CVE-2026-98033 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Preserve inner map identity in callback frames |
| MEDIUM | | 7 | | CVE-2026-98034 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark NULL kptr stores precise |
| MEDIUM | | 5.5 | | CVE-2026-98043 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Don't infer non-NULL from a pointer with an unbounded offset |
| MEDIUM | | 7 | | CVE-2026-98047 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Check ancestor frames for rbtree callbacks |
| MEDIUM | | 7 | | CVE-2026-98048 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: don't rewrite bpf_fastcall patterns entered by a jump |
| MEDIUM | | 5.5 | | CVE-2026-98049 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: zero extend the result of an arena 32-bit cmpxchg |
| MEDIUM | | 5.5 | | CVE-2026-98053 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ASoC: Intel: avs: Refactor and fix init_config access |
| MEDIUM | | 5.5 | | CVE-2026-98062 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark signal tracepoint siginfo arguments as scalar |
| MEDIUM | | 5.5 | | CVE-2026-98085 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge |
| MEDIUM | | | | CVE-2026-98099 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| MEDIUM | | 5.5 | | CVE-2026-98115 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ksmbd: safely drain sessions during logoff |
| MEDIUM | | 5.5 | | CVE-2026-98118 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix readahead synchronisation issues by loading all folios upfront |
| MEDIUM | | 5.5 | | CVE-2026-98124 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: smb/client: invalidate fscache for fallocate range operations |
| MEDIUM | | 5.5 | | CVE-2026-98125 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix stale page cache in insert/collapse range |
| MEDIUM | | 5.5 | | CVE-2026-98131 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix dma mapping leak in stmmac_tso_xmit() |
| MEDIUM | | 5.5 | | CVE-2026-98134 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: check_cond_jmp_op(): properly infer if register is null |
| MEDIUM | | 5.3 | | CVE-2026-98156 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/virtio: use the DMA API for resource backing on Xen |
| MEDIUM | | 5.5 | | CVE-2026-98162 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: smb/server: fix tree connection leak in smb2_tree_connect() |
| MEDIUM | | 5.5 | | CVE-2026-98180 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/msm: RCU-free the scheduler-containing ring and VM objects |
| MEDIUM | | 5.5 | | CVE-2026-98228 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ |
| MEDIUM | | 4.4 | | CVE-2026-98273 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: x86/kprobes: Fix crash when probing CS CALL instructions |
| MEDIUM | | 5.5 | | CVE-2026-98277 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: ring the doorbell if a burst ends in a drop |
| MEDIUM | | 5.5 | | CVE-2026-98279 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: btrfs: handle lack of space when cleaning up verity items |
| MEDIUM | | 5.3 | | CVE-2026-98284 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netlink: do not free nlk->groups while lockless readers can use it |
| MEDIUM | | 4.1 | | CVE-2026-98286 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown |
| MEDIUM | | 5.5 | | CVE-2026-98288 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix TSO header length truncation |
| MEDIUM | | 5.5 | | CVE-2026-98292 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| MEDIUM | | 5.5 | | CVE-2026-98294 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: hci_qca: Do not write to the serial port after it is closed |
| MEDIUM | | 7 | | CVE-2026-98296 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Bluetooth: btintel_pcie: validate TX skb length in send_sync |
| MEDIUM | | 5.5 | | CVE-2026-98313 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/msm/dp: skip PUSH_IDLE when the link was never enabled |
| MEDIUM | | 7 | | CVE-2026-98330 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: get the wiphy out of a dying network namespace |
| MEDIUM | | 5.5 | | CVE-2026-98333 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: reset the LED state when ifup fails |
| MEDIUM | | 7 | | CVE-2026-98341 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: don't free driver-owned scan requests |
| MEDIUM | | 5.5 | | CVE-2026-98353 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables |
| MEDIUM | | 5.5 | | CVE-2026-98355 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: RDMA/rtrs: guard against null kobj name |
| MEDIUM | | 5.5 | | CVE-2026-98376 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Use array_map_meta_equal for percpu array inner map replacement |
| MEDIUM | | 5.5 | | CVE-2026-98408 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: watchdog: rzv2h: Avoid division by zero |
| MEDIUM | | 5.5 | | CVE-2026-98420 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ksmbd: follow SMB2 session expiration semantics |
| MEDIUM | | | | CVE-2026-98436 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: a ... |
| MEDIUM | | 6.5 | | CVE-2026-98439 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: smb/server: cancel async requests when closing connection |
| MEDIUM | | 4.7 | | CVE-2026-98444 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: xfs: drop dquot flush lock when we can't find a buffer to flush |
| MEDIUM | | 6.5 | | CVE-2026-98449 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: smb: client: delete compound mids on send failure before unlock |
| MEDIUM | | 5.3 | | CVE-2026-98471 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KVM: SEV: Do cache maintenance on the source VM during intra-host migration |
| MEDIUM | | 5.5 | | CVE-2026-98556 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: gve: DQO: reject TSO packets with an out of range MSS |
| MEDIUM | | 4.1 | | CVE-2026-98558 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: flush skb_defer_nodes in dev_cpu_dead() |
| MEDIUM | | 5.9 | | CVE-2026-98570 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: ipv6: keep room for the mac header in dst_dev_overhead() |
| MEDIUM | | 6.7 | | CVE-2026-98589 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject pkt arguments in mutating subprogs |
| MEDIUM | | 4.7 | | CVE-2026-98598 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ipv6: Prevent rt6_insert_exception() for dying fib6_info |
| MEDIUM | | 6.7 | | CVE-2026-98599 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() |
| MEDIUM | | 4.1 | | CVE-2026-98616 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: eth: fbnic: reset num_napi when the napi vectors are freed |
| MEDIUM | | 5.5 | | CVE-2026-98652 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KVM: s390: Add missing srcu in kvm_s390_set_irq_state() |
| MEDIUM | | 5.5 | | CVE-2026-98674 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: iio: adc: adi-axi-adc: Initialize state mutex |
| MEDIUM | | 5.6 | | CVE-2026-98714 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| MEDIUM | | 4.1 | | CVE-2026-98740 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety |
| MEDIUM | | 4.4 | | CVE-2026-98747 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: serial: core: fix NULL pointer dereference in serial_core_unregister_port() |
| MEDIUM | | 4.7 | | CVE-2026-98786 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: guard dc_sink dereferences in MST mode validation |
| MEDIUM | | 4.4 | | CVE-2026-98789 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix objects stuck in free_by_rcu_ttrace |
| MEDIUM | | 4.4 | | CVE-2026-98795 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: sparx5: skip ptp deinit if init was skipped |
| MEDIUM | | 4.4 | | CVE-2026-98799 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Skip detached progs in trampoline images that are still in use |
| MEDIUM | | 4.7 | | CVE-2026-98800 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: kernel: Denial of Service via use-after-free in BPF trampoline |
| MEDIUM | | 6.5 | | CVE-2026-98803 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: stmmac: fix rx Scatter-Gather support |
| MEDIUM | | 6.1 | | CVE-2026-98810 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() |
| MEDIUM | | 4.4 | | CVE-2026-98813 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Hold map BTF for the memory allocator destructor record |
| MEDIUM | | 4.4 | | CVE-2026-98814 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: nvme: fix command effects log lifetime for multipath heads |
| MEDIUM | | 4.1 | | CVE-2026-98815 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: nvme: fix cdev lifetime |
| MEDIUM | | 4.1 | | CVE-2026-98816 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Fix overflow of jump offset in constant blinding |
| MEDIUM | | 5.5 | | CVE-2026-98820 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: blk-mq: set RQF_USE_SCHED when the operation is known |
| MEDIUM | | 5.3 | | CVE-2026-98824 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: validate TX status rate metadata |
| MEDIUM | | 6.5 | | CVE-2026-98829 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: drop oversized fragments to avoid extra_len overflow |
| MEDIUM | | 4.1 | | CVE-2026-98834 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: mtd: core: avoid double-free of OTP NVMEM device |
| MEDIUM | | 6.1 | | CVE-2026-98839 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() |
| MEDIUM | | 4.4 | | CVE-2026-98843 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfs: zero gaps in read-gaps folio to avoid writing back stale data |
| MEDIUM | | 5.6 | | CVE-2026-98863 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| MEDIUM | | 4.9 | | CVE-2026-18374 | locales | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string |
| MEDIUM | | 6.8 | | CVE-2026-19499 | locales | 2.41-12+rpt1+deb13u3 | | glibc: Buffer Overflow in strfmon right-justification padding |
| MEDIUM | | 4.2 | | CVE-2026-19542 | locales | 2.41-12+rpt1+deb13u3 | | glibc: Fix out-of-bounds array write in tdelete |
| MEDIUM | | 5.9 | | CVE-2026-5435 | locales | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Out-of-bounds write via TSIG record processing |
| MEDIUM | | 6.5 | | CVE-2026-6238 | locales | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Application crash or uninitialized memory read via crafted DNS response |
| MEDIUM | | 5.5 | | CVE-2026-6368 | locales | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Process abort due to invalid memory in wordexp |
| MEDIUM | | 5.9 | | CVE-2026-6791 | locales | 2.41-12+rpt1+deb13u3 | | glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion |
| MEDIUM | | 5.9 | | CVE-2026-77117 | locales | 2.41-12+rpt1+deb13u3 | | glibc: Non-progress DoS in SHIFT_JISX0213 -> |
| MEDIUM | | 5.9 | | CVE-2026-80489 | locales | 2.41-12+rpt1+deb13u3 | | glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state |
| MEDIUM | | 5.3 | | CVE-2026-8674 | locales | 2.41-12+rpt1+deb13u3 | | glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration |
| MEDIUM | | 7 | | CVE-2026-86805 | locales | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader |
| MEDIUM | | 4.2 | | CVE-2026-89092 | locales | 2.41-12+rpt1+deb13u3 | | glibc: nscd stack overflow leads to degraded DNS resolution |
| MEDIUM | | 7 | | CVE-2026-95818 | locales | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow. |
| MEDIUM | | 6.8 | | CVE-2026-13595 | login | 1:4.16.0-2+really2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: heap use-after-free in libblkid nested partition probing |
| MEDIUM | | 4.7 | | CVE-2026-27456 | login | 1:4.16.0-2+really2.41-5 | 2.41.5-0+deb13u1 | util-linux: TOCTOU in the mount program when setting up loop devices |
| MEDIUM | | 5.3 | | CVE-2026-3184 | login | 1:4.16.0-2+really2.41-5 | | util-linux: util-linux: Access control bypass due to improper hostname canonicalization |
| MEDIUM | | 6.8 | | CVE-2026-13595 | mount | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: heap use-after-free in libblkid nested partition probing |
| MEDIUM | | 4.7 | | CVE-2026-27456 | mount | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: TOCTOU in the mount program when setting up loop devices |
| MEDIUM | | 5.3 | | CVE-2026-3184 | mount | 2.41-5 | | util-linux: util-linux: Access control bypass due to improper hostname canonicalization |
| MEDIUM | | 6.8 | | CVE-2026-6390 | nano | 8.4-1+deb13u1 | | nano: GNU nano: Arbitrary memory writes, information disclosure, or denial of service via format string vulnerability in |
| MEDIUM | | 6.7 | | CVE-2026-10805 | network-manager-l10n | 1.52.1-1+rpt4 | | NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend |
| MEDIUM | | 6.7 | | CVE-2026-10805 | network-manager | 1.52.1-1+rpt4 | | NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend |
| MEDIUM | | | | CVE-2026-42617 | ntfs-3g | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u2 | In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_t ... |
| MEDIUM | | | | CVE-2026-42618 | ntfs-3g | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u2 | In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_deco ... |
| MEDIUM | | | | CVE-2026-46570 | ntfs-3g | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u2 | In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_inde ... |
| MEDIUM | | | | CVE-2026-46571 | ntfs-3g | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u2 | In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_fi ... |
| MEDIUM | | | | CVE-2026-46572 | ntfs-3g | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u2 | In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_c ... |
| MEDIUM | | | | CVE-2026-56135 | ntfs-3g | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u2 | In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in t ... |
| MEDIUM | | | | CVE-2026-56136 | ntfs-3g | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u2 | In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_ ... |
| MEDIUM | | 6.5 | | CVE-2026-106552 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: openssh: Arbitrary file write via directory traversal during sftp recursive copy |
| MEDIUM | | 6.5 | | CVE-2026-106585 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: openssh: Denial of service via oversized decompressed packets |
| MEDIUM | | 4.3 | | CVE-2026-106586 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Security restriction bypass via unenforced restrict directive in tunnel forwarding |
| MEDIUM | | 5.4 | | CVE-2026-59995 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: sftp client allows attacker to control downloaded file location |
| MEDIUM | | 5.4 | | CVE-2026-59996 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy |
| MEDIUM | | 5.4 | | CVE-2026-59997 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw |
| MEDIUM | | 6.5 | | CVE-2026-59998 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory |
| MEDIUM | | 6.5 | | CVE-2026-60001 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay |
| MEDIUM | | 5.6 | | CVE-2026-73282 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client |
| MEDIUM | | 5.4 | | CVE-2026-73283 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Tunnel forwarding restriction bypass |
| MEDIUM | | 6.5 | | CVE-2026-106552 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: openssh: Arbitrary file write via directory traversal during sftp recursive copy |
| MEDIUM | | 6.5 | | CVE-2026-106585 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: openssh: Denial of service via oversized decompressed packets |
| MEDIUM | | 4.3 | | CVE-2026-106586 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Security restriction bypass via unenforced restrict directive in tunnel forwarding |
| MEDIUM | | 5.4 | | CVE-2026-59995 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: sftp client allows attacker to control downloaded file location |
| MEDIUM | | 5.4 | | CVE-2026-59996 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy |
| MEDIUM | | 5.4 | | CVE-2026-59997 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw |
| MEDIUM | | 6.5 | | CVE-2026-59998 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory |
| MEDIUM | | 6.5 | | CVE-2026-60001 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay |
| MEDIUM | | 5.6 | | CVE-2026-73282 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client |
| MEDIUM | | 5.4 | | CVE-2026-73283 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Tunnel forwarding restriction bypass |
| MEDIUM | | 6.5 | | CVE-2026-106552 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: openssh: Arbitrary file write via directory traversal during sftp recursive copy |
| MEDIUM | | 6.5 | | CVE-2026-106585 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: openssh: Denial of service via oversized decompressed packets |
| MEDIUM | | 4.3 | | CVE-2026-106586 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Security restriction bypass via unenforced restrict directive in tunnel forwarding |
| MEDIUM | | 5.4 | | CVE-2026-59995 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: sftp client allows attacker to control downloaded file location |
| MEDIUM | | 5.4 | | CVE-2026-59996 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy |
| MEDIUM | | 5.4 | | CVE-2026-59997 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw |
| MEDIUM | | 6.5 | | CVE-2026-59998 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory |
| MEDIUM | | 6.5 | | CVE-2026-60001 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay |
| MEDIUM | | 5.6 | | CVE-2026-73282 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client |
| MEDIUM | | 5.4 | | CVE-2026-73283 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Tunnel forwarding restriction bypass |
| MEDIUM | | 7.5 | | CVE-2026-18798 | openssl-provider-legacy | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: QUIC server may trigger double free when processing INITIAL packet |
| MEDIUM | | 5.3 | | CVE-2026-42772 | openssl-provider-legacy | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: openssl: Denial of Service via inefficient QUIC stream reassembly |
| MEDIUM | | 5.9 | | CVE-2026-54872 | openssl-provider-legacy | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: OpenSSL: Private key recovery via timing side-channel in generic elliptic curve operations |
| MEDIUM | | 5.3 | | CVE-2026-54873 | openssl-provider-legacy | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: openssl: Denial of Service via excessive QUIC packet buffer retention |
| MEDIUM | | 4.7 | | CVE-2026-54875 | openssl-provider-legacy | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: openssl: information disclosure via non-constant-time SM2 scalar multiplication on ARM64 and RISC-V |
| MEDIUM | | 7.5 | | CVE-2026-63072 | openssl-provider-legacy | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: heap buffer overflow in CMS key unwrapping |
| MEDIUM | | 7.5 | | CVE-2026-63076 | openssl-provider-legacy | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: invalid pointer dereference in CMP server via crafted protectionAlg |
| MEDIUM | | 5.9 | | CVE-2026-72897 | openssl-provider-legacy | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: openssl: Denial of Service via out-of-bounds write during TLS context switch |
| MEDIUM | | 5.3 | | CVE-2026-75804 | openssl-provider-legacy | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: OpenSSL: Denial of Service via unenforced QUIC connection flow control |
| MEDIUM | | 5.9 | | CVE-2026-75805 | openssl-provider-legacy | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: openssl: Denial of Service via crafted CMP certificate revocation response |
| MEDIUM | | 5.3 | | CVE-2026-75806 | openssl-provider-legacy | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: OpenSSL: Denial of Service via undersized DTLS record |
| MEDIUM | | 5.9 | | CVE-2026-77696 | openssl-provider-legacy | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: OpenSSL: Private key recovery via SM2 timing side-channel |
| MEDIUM | | 5.3 | | CVE-2026-84784 | openssl-provider-legacy | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: OpenSSL: Denial of Service via unbounded QUIC connection identifier backlog |
| MEDIUM | | 7.5 | | CVE-2026-18798 | openssl | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: QUIC server may trigger double free when processing INITIAL packet |
| MEDIUM | | 5.3 | | CVE-2026-42772 | openssl | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: openssl: Denial of Service via inefficient QUIC stream reassembly |
| MEDIUM | | 5.9 | | CVE-2026-54872 | openssl | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: OpenSSL: Private key recovery via timing side-channel in generic elliptic curve operations |
| MEDIUM | | 5.3 | | CVE-2026-54873 | openssl | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: openssl: Denial of Service via excessive QUIC packet buffer retention |
| MEDIUM | | 4.7 | | CVE-2026-54875 | openssl | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: openssl: information disclosure via non-constant-time SM2 scalar multiplication on ARM64 and RISC-V |
| MEDIUM | | 7.5 | | CVE-2026-63072 | openssl | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: heap buffer overflow in CMS key unwrapping |
| MEDIUM | | 7.5 | | CVE-2026-63076 | openssl | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: invalid pointer dereference in CMP server via crafted protectionAlg |
| MEDIUM | | 5.9 | | CVE-2026-72897 | openssl | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: openssl: Denial of Service via out-of-bounds write during TLS context switch |
| MEDIUM | | 5.3 | | CVE-2026-75804 | openssl | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: OpenSSL: Denial of Service via unenforced QUIC connection flow control |
| MEDIUM | | 5.9 | | CVE-2026-75805 | openssl | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: openssl: Denial of Service via crafted CMP certificate revocation response |
| MEDIUM | | 5.3 | | CVE-2026-75806 | openssl | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: OpenSSL: Denial of Service via undersized DTLS record |
| MEDIUM | | 5.9 | | CVE-2026-77696 | openssl | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: OpenSSL: Private key recovery via SM2 timing side-channel |
| MEDIUM | | 5.3 | | CVE-2026-84784 | openssl | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: OpenSSL: Denial of Service via unbounded QUIC connection identifier backlog |
| MEDIUM | | 6.6 | | CVE-2026-89085 | parted | 3.6-5 | | parted: parted: Heap-based buffer overflow via crafted FAT32 filesystem image |
| MEDIUM | | 5.5 | | CVE-2026-89088 | parted | 3.6-5 | | parted: parted: Denial of Service via heap buffer overflow during FAT16 resize |
| MEDIUM | | 5.5 | | CVE-2026-115207 | patch | 2.8-2 | | patch: Filename validation bypass in reversal fallback allows file creation outside the working directory |
| MEDIUM | | 6.5 | | CVE-2025-15649 | perl-base | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-IO-Compress: perl-IO-Compress: Denial of Service via malformed DOS date in zip header |
| MEDIUM | | 5.3 | | CVE-2026-12087 | perl-base | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-Socket: perl-Socket: Information Disclosure due to Out-of-Bounds Read |
| MEDIUM | | 5.7 | | CVE-2026-15534 | perl-base | 5.40.1-6 | | perl: Perl: Arbitrary code execution via out-of-bounds memory access in regular expression engine. |
| MEDIUM | | 6.5 | | CVE-2026-19487 | perl-base | 5.40.1-6 | 5.40.1-6+deb13u1 | perl: Perl: Incorrect regular expression matching can lead to wrong access or filtering decisions. |
| MEDIUM | | 5 | | CVE-2026-48959 | perl-base | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-IO-Compress: perl-IO-Compress: CPU exhaustion via per-byte read loop in fastForward |
| MEDIUM | | 5 | | CVE-2026-48961 | perl-base | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-IO-Compress: IO::Compress: Denial of Service in zipdetails CLI tool via malformed Info-ZIP Unix Extra Field |
| MEDIUM | | | | CVE-2026-7010 | perl-base | 5.40.1-6 | 5.40.1-6+deb13u1 | HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP ... |
| MEDIUM | | | | CVE-2026-7017 | perl-base | 5.40.1-6 | 5.40.1-6+deb13u1 | HTTP::Tiny versions before 0.095 for Perl forward credential headers t ... |
| MEDIUM | | 6.5 | | CVE-2025-15649 | perl-modules-5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-IO-Compress: perl-IO-Compress: Denial of Service via malformed DOS date in zip header |
| MEDIUM | | 5.3 | | CVE-2026-12087 | perl-modules-5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-Socket: perl-Socket: Information Disclosure due to Out-of-Bounds Read |
| MEDIUM | | 5.7 | | CVE-2026-15534 | perl-modules-5.40 | 5.40.1-6 | | perl: Perl: Arbitrary code execution via out-of-bounds memory access in regular expression engine. |
| MEDIUM | | 6.5 | | CVE-2026-19487 | perl-modules-5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | perl: Perl: Incorrect regular expression matching can lead to wrong access or filtering decisions. |
| MEDIUM | | 5 | | CVE-2026-48959 | perl-modules-5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-IO-Compress: perl-IO-Compress: CPU exhaustion via per-byte read loop in fastForward |
| MEDIUM | | 5 | | CVE-2026-48961 | perl-modules-5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-IO-Compress: IO::Compress: Denial of Service in zipdetails CLI tool via malformed Info-ZIP Unix Extra Field |
| MEDIUM | | | | CVE-2026-7010 | perl-modules-5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP ... |
| MEDIUM | | | | CVE-2026-7017 | perl-modules-5.40 | 5.40.1-6 | 5.40.1-6+deb13u1 | HTTP::Tiny versions before 0.095 for Perl forward credential headers t ... |
| MEDIUM | | 6.5 | | CVE-2025-15649 | perl | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-IO-Compress: perl-IO-Compress: Denial of Service via malformed DOS date in zip header |
| MEDIUM | | 5.3 | | CVE-2026-12087 | perl | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-Socket: perl-Socket: Information Disclosure due to Out-of-Bounds Read |
| MEDIUM | | 5.7 | | CVE-2026-15534 | perl | 5.40.1-6 | | perl: Perl: Arbitrary code execution via out-of-bounds memory access in regular expression engine. |
| MEDIUM | | 6.5 | | CVE-2026-19487 | perl | 5.40.1-6 | 5.40.1-6+deb13u1 | perl: Perl: Incorrect regular expression matching can lead to wrong access or filtering decisions. |
| MEDIUM | | 5 | | CVE-2026-48959 | perl | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-IO-Compress: perl-IO-Compress: CPU exhaustion via per-byte read loop in fastForward |
| MEDIUM | | 5 | | CVE-2026-48961 | perl | 5.40.1-6 | 5.40.1-6+deb13u1 | perl-IO-Compress: IO::Compress: Denial of Service in zipdetails CLI tool via malformed Info-ZIP Unix Extra Field |
| MEDIUM | | | | CVE-2026-7010 | perl | 5.40.1-6 | 5.40.1-6+deb13u1 | HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP ... |
| MEDIUM | | | | CVE-2026-7017 | perl | 5.40.1-6 | 5.40.1-6+deb13u1 | HTTP::Tiny versions before 0.095 for Perl forward credential headers t ... |
| MEDIUM | | 5.5 | | CVE-2026-4897 | polkitd | 126-2 | | polkit: Polkit: Denial of Service via unbounded input processing through standard input |
| MEDIUM | | 5.5 | | CVE-2025-6966 | python-apt-common | 3.0.0 | | python-apt: python-apt: NULL pointer dereference leads to local denial of service |
| MEDIUM | | 5.5 | | CVE-2025-6966 | python3-apt | 3.0.0 | | python-apt: python-apt: NULL pointer dereference leads to local denial of service |
| MEDIUM | | 5.3 | | CVE-2026-34073 | python3-cryptography | 43.0.0-3+deb13u1 | | python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation |
| MEDIUM | | 7.4 | | CVE-2026-69248 | python3-cryptography | 43.0.0-3+deb13u1 | | python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from p |
| MEDIUM | | 5.3 | | CVE-2026-45409 | python3-idna | 3.10-1 | 3.10-1+deb13u1 | python-idna: idna: Denial of Service via specially crafted long inputs |
| MEDIUM | | 5.3 | | CVE-2026-102265 | python3-jwt | 2.10.1-2+deb13u1 | | pyjwt: pyjwt: Denial of Service via deeply nested token headers |
| MEDIUM | | 5.4 | | CVE-2026-102269 | python3-jwt | 2.10.1-2+deb13u1 | | pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding |
| MEDIUM | | 4.9 | | CVE-2026-102270 | python3-jwt | 2.10.1-2+deb13u1 | | pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format |
| MEDIUM | | 4.2 | | CVE-2026-48522 | python3-jwt | 2.10.1-2+deb13u1 | | python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient |
| MEDIUM | | 5.4 | | CVE-2026-48523 | python3-jwt | 2.10.1-2+deb13u1 | | python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access |
| MEDIUM | | 5.9 | | CVE-2026-48524 | python3-jwt | 2.10.1-2+deb13u1 | | python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs |
| MEDIUM | | 5.3 | | CVE-2026-48525 | python3-jwt | 2.10.1-2+deb13u1 | | python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens |
| MEDIUM | | 6.1 | | CVE-2026-49264 | python3-oauthlib | 3.2.2-3 | | oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generatio |
| MEDIUM | | 6.8 | | CVE-2026-49265 | python3-oauthlib | 3.2.2-3 | | oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization cod |
| MEDIUM | | 5.3 | | CVE-2025-8869 | python3-pip-whl | 25.1.1+dfsg-1+rpt1 | | pip: pip missing checks on symbolic link extraction |
| MEDIUM | | 6.5 | | CVE-2026-13346 | python3-pip-whl | 25.1.1+dfsg-1+rpt1 | | pip: pip: Arbitrary file installation via malicious package indexes |
| MEDIUM | | 5 | | CVE-2026-3219 | python3-pip-whl | 25.1.1+dfsg-1+rpt1 | | pip: pip: Incorrect file installation due to improper archive handling |
| MEDIUM | | 5.8 | | CVE-2026-6357 | python3-pip-whl | 25.1.1+dfsg-1+rpt1 | | pip: pip: Arbitrary code execution or information disclosure via malicious wheel package installation |
| MEDIUM | | 8 | | CVE-2026-8643 | python3-pip-whl | 25.1.1+dfsg-1+rpt1 | | python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite |
| MEDIUM | | 5.5 | | CVE-2026-25645 | python3-requests | 2.32.3+dfsg-5+deb13u1 | | requests: Requests: Security bypass due to predictable temporary file creation |
| MEDIUM | | 5.9 | | CVE-2026-44431 | python3-urllib3 | 2.3.0-3+deb13u1 | 2.3.0-3+deb13u2 | urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers |
| MEDIUM | | 5.3 | | CVE-2025-12781 | python3.13-minimal | 3.13.5-2+deb13u2 | | cpython: base64.b64decode() always accepts "+/" characters, despite setting altchars |
| MEDIUM | | 7.1 | | CVE-2025-15366 | python3.13-minimal | 3.13.5-2+deb13u2 | | cpython: IMAP command injection in user-controlled commands |
| MEDIUM | | 7.1 | | CVE-2025-15367 | python3.13-minimal | 3.13.5-2+deb13u2 | | cpython: POP3 command injection in user-controlled commands |
| MEDIUM | | 5.5 | | CVE-2026-0864 | python3.13-minimal | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: cpython: Python configparser: Configuration injection via crafted multi-line input |
| MEDIUM | | 6.5 | | CVE-2026-11972 | python3.13-minimal | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: Python tarfile module: Denial of Service via improper EOF handling in streaming mode |
| MEDIUM | | 6.3 | | CVE-2026-12345 | python3.13-minimal | 3.13.5-2+deb13u2 | | python: python: Arbitrary file deletion via race condition during temporary directory cleanup |
| MEDIUM | | 4.5 | | CVE-2026-1502 | python3.13-minimal | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python: HTTP header injection via CR/LF in proxy tunnel headers |
| MEDIUM | | 6.5 | | CVE-2026-15310 | python3.13-minimal | 3.13.5-2+deb13u2 | | python: Python: Denial of Service via crafted zip file memory pre-allocation |
| MEDIUM | | 5.3 | | CVE-2026-15806 | python3.13-minimal | 3.13.5-2+deb13u2 | | python: Python: Information disclosure due to incorrect URL scheme matching |
| MEDIUM | | 6.5 | | CVE-2026-17084 | python3.13-minimal | 3.13.5-2+deb13u2 | | python: Python stringprep module: Incorrect domain name processing breaks IDNA interoperability |
| MEDIUM | | 5.3 | | CVE-2026-19672 | python3.13-minimal | 3.13.5-2+deb13u2 | | python: Python tarfile module: Directory traversal allows creation of empty directories outside extraction destination |
| MEDIUM | | 5.3 | | CVE-2026-3276 | python3.13-minimal | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python unicodedata: Denial of Service due to excessive CPU consumption |
| MEDIUM | | 5.3 | | CVE-2026-4360 | python3.13-minimal | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: Python Tarfile: Unexpected file ownership when extracting hardlinks |
| MEDIUM | | 6.5 | | CVE-2026-7774 | python3.13-minimal | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: CPython: Python tarfile: Arbitrary file write via crafted link entries |
| MEDIUM | | 5.7 | | CVE-2026-87910 | python3.13-minimal | 3.13.5-2+deb13u2 | | python: Python tarfile module: Security filter bypass allows arbitrary file write |
| MEDIUM | | 5.9 | | CVE-2026-9669 | python3.13-minimal | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python: Denial of Service via out-of-bounds write in BZ2 decompression |
| MEDIUM | | 5.3 | | CVE-2025-12781 | python3.13-venv | 3.13.5-2+deb13u2 | | cpython: base64.b64decode() always accepts "+/" characters, despite setting altchars |
| MEDIUM | | 7.1 | | CVE-2025-15366 | python3.13-venv | 3.13.5-2+deb13u2 | | cpython: IMAP command injection in user-controlled commands |
| MEDIUM | | 7.1 | | CVE-2025-15367 | python3.13-venv | 3.13.5-2+deb13u2 | | cpython: POP3 command injection in user-controlled commands |
| MEDIUM | | 5.5 | | CVE-2026-0864 | python3.13-venv | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: cpython: Python configparser: Configuration injection via crafted multi-line input |
| MEDIUM | | 6.5 | | CVE-2026-11972 | python3.13-venv | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: Python tarfile module: Denial of Service via improper EOF handling in streaming mode |
| MEDIUM | | 6.3 | | CVE-2026-12345 | python3.13-venv | 3.13.5-2+deb13u2 | | python: python: Arbitrary file deletion via race condition during temporary directory cleanup |
| MEDIUM | | 4.5 | | CVE-2026-1502 | python3.13-venv | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python: HTTP header injection via CR/LF in proxy tunnel headers |
| MEDIUM | | 6.5 | | CVE-2026-15310 | python3.13-venv | 3.13.5-2+deb13u2 | | python: Python: Denial of Service via crafted zip file memory pre-allocation |
| MEDIUM | | 5.3 | | CVE-2026-15806 | python3.13-venv | 3.13.5-2+deb13u2 | | python: Python: Information disclosure due to incorrect URL scheme matching |
| MEDIUM | | 6.5 | | CVE-2026-17084 | python3.13-venv | 3.13.5-2+deb13u2 | | python: Python stringprep module: Incorrect domain name processing breaks IDNA interoperability |
| MEDIUM | | 5.3 | | CVE-2026-19672 | python3.13-venv | 3.13.5-2+deb13u2 | | python: Python tarfile module: Directory traversal allows creation of empty directories outside extraction destination |
| MEDIUM | | 5.3 | | CVE-2026-3276 | python3.13-venv | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python unicodedata: Denial of Service due to excessive CPU consumption |
| MEDIUM | | 5.3 | | CVE-2026-4360 | python3.13-venv | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: Python Tarfile: Unexpected file ownership when extracting hardlinks |
| MEDIUM | | 6.5 | | CVE-2026-7774 | python3.13-venv | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: CPython: Python tarfile: Arbitrary file write via crafted link entries |
| MEDIUM | | 5.7 | | CVE-2026-87910 | python3.13-venv | 3.13.5-2+deb13u2 | | python: Python tarfile module: Security filter bypass allows arbitrary file write |
| MEDIUM | | 5.9 | | CVE-2026-9669 | python3.13-venv | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python: Denial of Service via out-of-bounds write in BZ2 decompression |
| MEDIUM | | 5.3 | | CVE-2025-12781 | python3.13 | 3.13.5-2+deb13u2 | | cpython: base64.b64decode() always accepts "+/" characters, despite setting altchars |
| MEDIUM | | 7.1 | | CVE-2025-15366 | python3.13 | 3.13.5-2+deb13u2 | | cpython: IMAP command injection in user-controlled commands |
| MEDIUM | | 7.1 | | CVE-2025-15367 | python3.13 | 3.13.5-2+deb13u2 | | cpython: POP3 command injection in user-controlled commands |
| MEDIUM | | 5.5 | | CVE-2026-0864 | python3.13 | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: cpython: Python configparser: Configuration injection via crafted multi-line input |
| MEDIUM | | 6.5 | | CVE-2026-11972 | python3.13 | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: Python tarfile module: Denial of Service via improper EOF handling in streaming mode |
| MEDIUM | | 6.3 | | CVE-2026-12345 | python3.13 | 3.13.5-2+deb13u2 | | python: python: Arbitrary file deletion via race condition during temporary directory cleanup |
| MEDIUM | | 4.5 | | CVE-2026-1502 | python3.13 | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python: HTTP header injection via CR/LF in proxy tunnel headers |
| MEDIUM | | 6.5 | | CVE-2026-15310 | python3.13 | 3.13.5-2+deb13u2 | | python: Python: Denial of Service via crafted zip file memory pre-allocation |
| MEDIUM | | 5.3 | | CVE-2026-15806 | python3.13 | 3.13.5-2+deb13u2 | | python: Python: Information disclosure due to incorrect URL scheme matching |
| MEDIUM | | 6.5 | | CVE-2026-17084 | python3.13 | 3.13.5-2+deb13u2 | | python: Python stringprep module: Incorrect domain name processing breaks IDNA interoperability |
| MEDIUM | | 5.3 | | CVE-2026-19672 | python3.13 | 3.13.5-2+deb13u2 | | python: Python tarfile module: Directory traversal allows creation of empty directories outside extraction destination |
| MEDIUM | | 5.3 | | CVE-2026-3276 | python3.13 | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python unicodedata: Denial of Service due to excessive CPU consumption |
| MEDIUM | | 5.3 | | CVE-2026-4360 | python3.13 | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: Python Tarfile: Unexpected file ownership when extracting hardlinks |
| MEDIUM | | 6.5 | | CVE-2026-7774 | python3.13 | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: CPython: Python tarfile: Arbitrary file write via crafted link entries |
| MEDIUM | | 5.7 | | CVE-2026-87910 | python3.13 | 3.13.5-2+deb13u2 | | python: Python tarfile module: Security filter bypass allows arbitrary file write |
| MEDIUM | | 5.9 | | CVE-2026-9669 | python3.13 | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u3 | python: Python: Denial of Service via out-of-bounds write in BZ2 decompression |
| MEDIUM | | 6.8 | | CVE-2026-13595 | rfkill | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: heap use-after-free in libblkid nested partition probing |
| MEDIUM | | 4.7 | | CVE-2026-27456 | rfkill | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: TOCTOU in the mount program when setting up loop devices |
| MEDIUM | | 5.3 | | CVE-2026-3184 | rfkill | 2.41-5 | | util-linux: util-linux: Access control bypass due to improper hostname canonicalization |
| MEDIUM | | 6.5 | | CVE-2026-53786 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Information disclosure via filter rule bypass using malicious merge directives |
| MEDIUM | | 4.8 | | CVE-2026-53788 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: Rsync: Newline Injection via uid/gid mapping leads to data corruption |
| MEDIUM | | 6.5 | | CVE-2026-53792 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Denial of Service via out-of-bounds read with crafted checksum block |
| MEDIUM | | 5.3 | | CVE-2026-53794 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Denial of Service via --max-alloc=0 logic error |
| MEDIUM | | 6.3 | | CVE-2026-53796 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Arbitrary file write via TOCTOU race condition in destination directory handling |
| MEDIUM | | 4.7 | | CVE-2026-53797 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Information Disclosure via Symlink Race Condition |
| MEDIUM | | 5.3 | | CVE-2026-53798 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Privilege escalation via name-converter uid/gid mapping confusion |
| MEDIUM | | 6.3 | | CVE-2026-53799 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Local Privilege Escalation via Symlink Race Condition |
| MEDIUM | | 4.7 | | CVE-2026-53800 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: Rsync: Arbitrary file deletion via symlink race condition in --remove-source-files |
| MEDIUM | | 5.9 | | CVE-2026-53801 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Information disclosure via symlink race condition |
| MEDIUM | | 6.5 | | CVE-2026-70453 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Denial of Service via Algorithmic Complexity |
| MEDIUM | | 6.8 | | CVE-2026-70454 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions |
| MEDIUM | | 5.3 | | CVE-2026-70459 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Daemon crash via malformed file list entry |
| MEDIUM | | 6.5 | | CVE-2026-70462 | rsync | 3.4.1+ds1-5+deb13u3 | 3.5.0+ds1-0+deb13u1 | rsync: rsync: Denial of Service via signed integer overflow in I/O timeout |
| MEDIUM | | 6.5 | | CVE-2026-106552 | ssh | 1:10.0p1-7+deb13u4 | | openssh: openssh: Arbitrary file write via directory traversal during sftp recursive copy |
| MEDIUM | | 6.5 | | CVE-2026-106585 | ssh | 1:10.0p1-7+deb13u4 | | openssh: openssh: Denial of service via oversized decompressed packets |
| MEDIUM | | 4.3 | | CVE-2026-106586 | ssh | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Security restriction bypass via unenforced restrict directive in tunnel forwarding |
| MEDIUM | | 5.4 | | CVE-2026-59995 | ssh | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: sftp client allows attacker to control downloaded file location |
| MEDIUM | | 5.4 | | CVE-2026-59996 | ssh | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy |
| MEDIUM | | 5.4 | | CVE-2026-59997 | ssh | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw |
| MEDIUM | | 6.5 | | CVE-2026-59998 | ssh | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory |
| MEDIUM | | 6.5 | | CVE-2026-60001 | ssh | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay |
| MEDIUM | | 5.6 | | CVE-2026-73282 | ssh | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client |
| MEDIUM | | 5.4 | | CVE-2026-73283 | ssh | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Tunnel forwarding restriction bypass |
| MEDIUM | | 5.5 | | CVE-2026-15059 | systemd-sysv | 257.13-1~deb13u1 | | systemd: systemd-oomd: Unprivileged users can terminate arbitrary processes via IPC API |
| MEDIUM | | 5.5 | | CVE-2026-15059 | systemd-timesyncd | 257.13-1~deb13u1 | | systemd: systemd-oomd: Unprivileged users can terminate arbitrary processes via IPC API |
| MEDIUM | | 5.5 | | CVE-2026-15059 | systemd | 257.13-1~deb13u1 | | systemd: systemd-oomd: Unprivileged users can terminate arbitrary processes via IPC API |
| MEDIUM | | 4.4 | | CVE-2026-18477 | tar | 1.35+dfsg-3.1 | | tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape |
| MEDIUM | | 4.4 | | CVE-2026-18508 | tar | 1.35+dfsg-3.1 | | tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite |
| MEDIUM | | 5.5 | | CVE-2026-5704 | tar | 1.35+dfsg-3.1 | | tar: tar: Hidden file injection via crafted archives |
| MEDIUM | | 5.5 | | CVE-2026-15059 | udev | 257.13-1~deb13u1 | | systemd: systemd-oomd: Unprivileged users can terminate arbitrary processes via IPC API |
| MEDIUM | | 6.8 | | CVE-2026-13595 | util-linux | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: util-linux: heap use-after-free in libblkid nested partition probing |
| MEDIUM | | 4.7 | | CVE-2026-27456 | util-linux | 2.41-5 | 2.41.5-0+deb13u1 | util-linux: TOCTOU in the mount program when setting up loop devices |
| MEDIUM | | 5.3 | | CVE-2026-3184 | util-linux | 2.41-5 | | util-linux: util-linux: Access control bypass due to improper hostname canonicalization |
| MEDIUM | | 4.1 | | CVE-2025-53905 | vim-common | 2:9.1.1230-2 | | vim: Vim path traversial |
| MEDIUM | | 4.1 | | CVE-2025-53906 | vim-common | 2:9.1.1230-2 | | vim: Vim path traversal |
| MEDIUM | | 7.3 | | CVE-2026-25749 | vim-common | 2:9.1.1230-2 | | vim: Vim: Arbitrary code execution via 'helpfile' option processing |
| MEDIUM | | 5.5 | | CVE-2026-28418 | vim-common | 2:9.1.1230-2 | | vim: Vim: Information disclosure via heap-based buffer overflow in Emacs-style tags file parsing |
| MEDIUM | | 4.4 | | CVE-2026-28420 | vim-common | 2:9.1.1230-2 | | vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator |
| MEDIUM | | 7.3 | | CVE-2026-41411 | vim-common | 2:9.1.1230-2 | | vim: Command injection allows arbitrary code execution via malicious tag files |
| MEDIUM | | 4.4 | | CVE-2026-42307 | vim-common | 2:9.1.1230-2 | | Vim: Vim: Arbitrary code execution via OS command injection in netrw plugin |
| MEDIUM | | 5.3 | | CVE-2026-44656 | vim-common | 2:9.1.1230-2 | | vim: Vim: Arbitrary command execution via :find command-line completion |
| MEDIUM | | 6.6 | | CVE-2026-45130 | vim-common | 2:9.1.1230-2 | | vim: Vim: Heap buffer overflow allows arbitrary code execution or denial of service |
| MEDIUM | | 7.3 | | CVE-2026-47167 | vim-common | 2:9.1.1230-2 | | vim: Vim: Arbitrary code execution via crafted step-definition patterns |
| MEDIUM | | 5.5 | | CVE-2026-55892 | vim-common | 2:9.1.1230-2 | | vim: Vim: Denial of Service via crafted spell file |
| MEDIUM | | 4.7 | | CVE-2026-57452 | vim-common | 2:9.1.1230-2 | | vim: Vim: Out-of-bounds Read with libsodium-encrypted Files |
| MEDIUM | | 5.5 | | CVE-2026-59857 | vim-common | 2:9.1.1230-2 | | vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding |
| MEDIUM | | 5.5 | | CVE-2026-73070 | vim-common | 2:9.1.1230-2 | | vim: Vim: Stack Buffer Overflow via unbounded socket connections |
| MEDIUM | | 6.7 | | CVE-2026-73074 | vim-common | 2:9.1.1230-2 | | vim: Vim: Heap buffer overflow via integer wraparound in text property handling |
| MEDIUM | | 4.1 | | CVE-2025-53905 | vim-tiny | 2:9.1.1230-2 | | vim: Vim path traversial |
| MEDIUM | | 4.1 | | CVE-2025-53906 | vim-tiny | 2:9.1.1230-2 | | vim: Vim path traversal |
| MEDIUM | | 7.3 | | CVE-2026-25749 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Arbitrary code execution via 'helpfile' option processing |
| MEDIUM | | 5.5 | | CVE-2026-28418 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Information disclosure via heap-based buffer overflow in Emacs-style tags file parsing |
| MEDIUM | | 4.4 | | CVE-2026-28420 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator |
| MEDIUM | | 7.3 | | CVE-2026-41411 | vim-tiny | 2:9.1.1230-2 | | vim: Command injection allows arbitrary code execution via malicious tag files |
| MEDIUM | | 4.4 | | CVE-2026-42307 | vim-tiny | 2:9.1.1230-2 | | Vim: Vim: Arbitrary code execution via OS command injection in netrw plugin |
| MEDIUM | | 5.3 | | CVE-2026-44656 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Arbitrary command execution via :find command-line completion |
| MEDIUM | | 6.6 | | CVE-2026-45130 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Heap buffer overflow allows arbitrary code execution or denial of service |
| MEDIUM | | 7.3 | | CVE-2026-47167 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Arbitrary code execution via crafted step-definition patterns |
| MEDIUM | | 5.5 | | CVE-2026-55892 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Denial of Service via crafted spell file |
| MEDIUM | | 4.7 | | CVE-2026-57452 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Out-of-bounds Read with libsodium-encrypted Files |
| MEDIUM | | 5.5 | | CVE-2026-59857 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding |
| MEDIUM | | 5.5 | | CVE-2026-73070 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Stack Buffer Overflow via unbounded socket connections |
| MEDIUM | | 6.7 | | CVE-2026-73074 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Heap buffer overflow via integer wraparound in text property handling |
| MEDIUM | | 6.5 | | CVE-2021-31879 | wget | 1.25.0-2 | | wget: authorization header disclosure on redirect |
| MEDIUM | | 5.9 | | CVE-2026-15146 | wget | 1.25.0-2 | | wget: Wget: Server-Side Request Forgery via FTP PASV response IP address validation bypass |
| MEDIUM | | 7.5 | | CVE-2026-58469 | wget | 1.25.0-2 | | wget: GNU Wget: Memory corruption via crafted Metalink URL |
| MEDIUM | | 5.3 | | CVE-2026-58470 | wget | 1.25.0-2 | | wget: GNU Wget: Integer overflow in Content-Range header parsing causes download desynchronization |
| MEDIUM | | 5.3 | | CVE-2026-34743 | xz-utils | 5.8.1-1 | 5.8.1-1+deb13u1 | xz: XZ Utils: Denial of Service via buffer overflow in index decoding |
| MEDIUM | | 5.5 | | CVE-2026-27171 | zlib1g | 1:1.3.dfsg+really1.3.1-1+b1 | | zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions |
| MEDIUM | | | | CVE-2026-85091 | zlib1g | 1:1.3.dfsg+really1.3.1-1+b1 | | zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vul ... |
| MEDIUM | | 5.3 | | CVE-2026-56855 | golang.org/x/crypto | v0.53.0 | 0.56.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages |
| MEDIUM | | 5.3 | | CVE-2026-78662 | golang.org/x/crypto | v0.53.0 | 0.56.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via channel request flooding |
| MEDIUM | | 7.5 | | CVE-2026-78659 | golang.org/x/net | v0.55.0 | 0.60.0 | net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion |
| MEDIUM | | 7.5 | | CVE-2026-78660 | golang.org/x/net | v0.55.0 | 0.60.0 | net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers |
| MEDIUM | | 9.1 | | CVE-2026-78663 | golang.org/x/net | v0.55.0 | 0.60.0 | net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund i |
| MEDIUM | | 7.5 | | CVE-2026-97032 | golang.org/x/net | v0.55.0 | 0.60.0 | net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK enco |
| MEDIUM | | 5.3 | | CVE-2026-42505 | stdlib | 1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client Hello |
| MEDIUM | | 7.5 | | CVE-2026-56866 | stdlib | 1.26.4 | 1.26.9, 1.27.2 | net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections |
| MEDIUM | | 7.5 | | CVE-2026-78659 | stdlib | 1.26.4 | 1.26.9, 1.27.2 | net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion |
| MEDIUM | | 7.5 | | CVE-2026-78660 | stdlib | 1.26.4 | 1.26.9, 1.27.2 | net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers |
| MEDIUM | | 9.1 | | CVE-2026-78663 | stdlib | 1.26.4 | 1.26.9, 1.27.2 | net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund i |
| MEDIUM | | 7.5 | | CVE-2026-94439 | stdlib | 1.26.4 | 1.26.9, 1.27.2 | net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses |
| MEDIUM | | 7.5 | | CVE-2026-94440 | stdlib | 1.26.4 | 1.26.9, 1.27.2 | net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing |
| MEDIUM | | 6.1 | | CVE-2026-94448 | stdlib | 1.26.4 | 1.26.9, 1.27.2 | html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals |
| MEDIUM | | 6.1 | | CVE-2026-97030 | stdlib | 1.26.4 | 1.26.9, 1.27.2 | html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword |
| MEDIUM | | 7.5 | | CVE-2026-97032 | stdlib | 1.26.4 | 1.26.9, 1.27.2 | net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK enco |
| MEDIUM | | | | GHSA-h4gh-qq45-vh27 | cryptography | 43.0.0 | 43.0.1 | pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels |
| MEDIUM | | 5.3 | | CVE-2026-45409 | idna | 3.10 | 3.15 | python-idna: idna: Denial of Service via specially crafted long inputs |
| MEDIUM | | 6.1 | | CVE-2026-49264 | oauthlib | 3.2.2 | 4.0.0 | oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generatio |
| MEDIUM | | 6.8 | | CVE-2026-49265 | oauthlib | 3.2.2 | 4.0.0 | oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization cod |
| MEDIUM | | 5.3 | | CVE-2025-8869 | pip | 25.1.1 | 25.3 | pip: pip missing checks on symbolic link extraction |
| MEDIUM | | 6.5 | | CVE-2026-13346 | pip | 25.1.1 | 26.2.0 | pip: pip: Arbitrary file installation via malicious package indexes |
| MEDIUM | | 5 | | CVE-2026-3219 | pip | 25.1.1 | 26.1 | pip: pip: Incorrect file installation due to improper archive handling |
| MEDIUM | | 5.8 | | CVE-2026-6357 | pip | 25.1.1 | 26.1 | pip: pip: Arbitrary code execution or information disclosure via malicious wheel package installation |
| MEDIUM | | 8 | | CVE-2026-8643 | pip | 25.1.1 | 26.1.2 | python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite |
| MEDIUM | | 7.5 | | CVE-2026-101917 | pyjwt | 2.10.1 | 2.14.0 | pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers |
| MEDIUM | | 7.5 | | CVE-2026-101918 | pyjwt | 2.10.1 | 2.15.0 | pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload |
| MEDIUM | | 5.4 | | CVE-2026-102269 | pyjwt | 2.10.1 | 2.14.0 | pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding |
| MEDIUM | | 4.9 | | CVE-2026-102270 | pyjwt | 2.10.1 | 2.14.0 | pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format |
| MEDIUM | | 7.5 | | CVE-2026-102274 | pyjwt | 2.10.1 | 2.14.0 | pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set |
| MEDIUM | | 8.2 | | CVE-2026-102275 | pyjwt | 2.10.1 | 2.15.0 | pyjwt: PyJWT: Token verification bypass via mismatched OKP key components |
| MEDIUM | | 4.2 | | CVE-2026-48522 | pyjwt | 2.10.1 | 2.13.0 | python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient |
| MEDIUM | | 5.4 | | CVE-2026-48523 | pyjwt | 2.10.1 | 2.13.0 | python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access |
| MEDIUM | | 5.3 | | CVE-2026-48525 | pyjwt | 2.10.1 | 2.13.0 | python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens |
| MEDIUM | | 5.3 | | CVE-2024-47081 | requests | 2.32.3 | 2.32.4 | requests: Requests vulnerable to .netrc credentials leak via malicious URLs |
| MEDIUM | | 5.5 | | CVE-2026-25645 | requests | 2.32.3 | 2.33.0 | requests: Requests: Security bypass due to predictable temporary file creation |
| MEDIUM | | 6.1 | | CVE-2026-59890 | setuptools | 78.1.1 | 83.0.0 | setuptools: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) |
| MEDIUM | | 6.1 | | CVE-2025-50181 | urllib3 | 2.3.0 | 2.5.0 | urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation |
| MEDIUM | | 6.1 | | CVE-2025-50182 | urllib3 | 2.3.0 | 2.5.0 | urllib3: urllib3 does not control redirects in browsers and Node.js |
| LOW | | 3.3 | | CVE-2022-47111 | 7zip | 25.01+dfsg-1~deb13u2 | | 7-Zip 22.01 does not report an error for certain invalid xz files, inv ... |
| LOW | | 3.3 | | CVE-2022-47112 | 7zip | 25.01+dfsg-1~deb13u2 | | 7-Zip 22.01 does not report an error for certain invalid xz files, inv ... |
| LOW | | | | CVE-2026-104086 | 7zip | 25.01+dfsg-1~deb13u2 | | 7-Zip before 26.03 contains an uninitialized memory disclosure vulnera ... |
| LOW | | 8.1 | | CVE-2026-48092 | 7zip | 25.01+dfsg-1~deb13u2 | | 7-Zip is a file archiver with a high compression ratio. Versions 9.34 ... |
| LOW | | | | CVE-2026-48101 | 7zip | 25.01+dfsg-1~deb13u2 | | 7-Zip is a file archiver with a high compression ratio. Versions 9.21 ... |
| LOW | | 4.3 | | CVE-2026-48102 | 7zip | 25.01+dfsg-1~deb13u2 | | 7-Zip is a file archiver with a high compression ratio. Versions 9.11 ... |
| LOW | | 7.1 | | CVE-2026-48103 | 7zip | 25.01+dfsg-1~deb13u2 | | 7-Zip is a file archiver with a high compression ratio. Versions 9.34 ... |
| LOW | | | | CVE-2026-48104 | 7zip | 25.01+dfsg-1~deb13u2 | | 7-Zip is a file archiver with a high compression ratio. Versions 9.18 ... |
| LOW | | 7.1 | | CVE-2026-48111 | 7zip | 25.01+dfsg-1~deb13u2 | | 7-Zip is a file archiver with a high compression ratio. Versions 9.21 ... |
| LOW | | 3.7 | | CVE-2011-3374 | apt-utils | 3.0.3 | | It was found that apt-key in apt, all versions, do not correctly valid ... |
| LOW | | 3.7 | | CVE-2011-3374 | apt | 3.0.3 | | It was found that apt-key in apt, all versions, do not correctly valid ... |
| LOW | | 7.8 | | CVE-2018-7738 | bash-completion | 1:2.16.0-7 | | util-linux: Shell command injection in unescaped bash-completed mount point names |
| LOW | | | | TEMP-0841856-B18BAF | bash | 5.2.37-2+b9 | | [Privilege escalation possible to other user than root] |
| LOW | | 5.5 | | CVE-2017-13716 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: Memory leak with the C++ symbol demangler routine in libiberty |
| LOW | | 5.5 | | CVE-2018-20673 | binutils-aarch64-linux-gnu | 2.44-3 | | libiberty: Integer overflow in demangle_template() function |
| LOW | | 6.5 | | CVE-2018-20712 | binutils-aarch64-linux-gnu | 2.44-3 | | libiberty: heap-based buffer over-read in d_expression_1 |
| LOW | | 5.5 | | CVE-2018-9996 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: Stack-overflow in libiberty/cplus-dem.c causes crash |
| LOW | | 6.5 | | CVE-2021-32256 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: stack-overflow issue in demangle_type in rust-demangle.c. |
| LOW | | 5.5 | | CVE-2025-11081 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils out-of-bounds read |
| LOW | | 7.8 | | CVE-2025-11082 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 7.8 | | CVE-2025-11083 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 5.5 | | CVE-2025-11412 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils Linker elflink.c bfd_elf_gc_record_vtentry out-of-bounds |
| LOW | | 5.5 | | CVE-2025-11413 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds |
| LOW | | 5.5 | | CVE-2025-11414 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils Linker elflink.c get_link_hash_entry out-of-bounds |
| LOW | | 5.3 | | CVE-2025-1147 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils nm nm.c internal_strlen buffer overflow |
| LOW | | 3.1 | | CVE-2025-1148 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils ld ldelfgen.c link_order_scan memory leak |
| LOW | | 3.1 | | CVE-2025-1149 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils ld xmalloc.c xstrdup memory leak |
| LOW | | 5.5 | | CVE-2025-11494 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils Linker out-of-bounds read |
| LOW | | 5.5 | | CVE-2025-11495 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 3.1 | | CVE-2025-1150 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils ld libbfd.c bfd_malloc memory leak |
| LOW | | 3.1 | | CVE-2025-1151 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils ld xmemdup.c xmemdup memory leak |
| LOW | | 3.7 | | CVE-2025-1152 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils ld xstrdup.c xstrdup memory leak |
| LOW | | 5.9 | | CVE-2025-1153 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils format.c bfd_set_format memory corruption |
| LOW | | 5 | | CVE-2025-1176 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec heap-based overflow |
| LOW | | 5.6 | | CVE-2025-1178 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils ld libbfd.c bfd_putl64 memory corruption |
| LOW | | 3.1 | | CVE-2025-1180 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils ld elf-eh-frame.c _bfd_elf_write_section_eh_frame memory corruption |
| LOW | | 5 | | CVE-2025-1181 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec memory corruption |
| LOW | | 5 | | CVE-2025-1182 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils ld elflink.c bfd_elf_reloc_symbol_deleted_p memory corruption |
| LOW | | 5.5 | | CVE-2025-11839 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils prdbg.c tg_tag_type return value |
| LOW | | 5.5 | | CVE-2025-11840 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils out-of-bounds read |
| LOW | | 5.5 | | CVE-2025-3198 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils objdump bucomm.c display_info memory leak |
| LOW | | 7.8 | | CVE-2025-5244 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils ld elflink.c elf_gc_sweep memory corruption |
| LOW | | 7.8 | | CVE-2025-5245 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils objdump debug.c debug_type_samep memory corruption |
| LOW | | 3.3 | | CVE-2025-66861 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: out-of-bounds read in d_unqualified_name() in cp-demangle.c |
| LOW | | 3.3 | | CVE-2025-66862 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: heap-based buffer over-read in gnu_special() in cplus-dem.c |
| LOW | | 3.3 | | CVE-2025-66863 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: BinUtils: Denial of Service via crafted PE file |
| LOW | | 7.5 | | CVE-2025-66864 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: NULL pointer dereference in d_print_comp_inner() in cp-demangle.c |
| LOW | | 3.3 | | CVE-2025-66865 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: stack overflow in d_print_comp_inner() in cp-demangle.c |
| LOW | | 7.5 | | CVE-2025-66866 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: BinUtils: Denial of Service via crafted PE file |
| LOW | | 2.8 | | CVE-2025-69644 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: Binutils: Denial of Service via crafted binary with malformed DWARF debug information |
| LOW | | 2.8 | | CVE-2025-69645 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: Binutils objdump: Denial of Service via crafted DWARF debug information |
| LOW | | 2.8 | | CVE-2025-69646 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: Binutils: Denial of Service via malformed DWARF debug_rnglists data |
| LOW | | 3.3 | | CVE-2025-69647 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: infinite loop in readelf via crafted binary with malformed DWARF loclists data |
| LOW | | 3.3 | | CVE-2025-69648 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: infinite loop in readelf via crafted binary with malformed DWARF .debug_rnglists data |
| LOW | | 7.5 | | CVE-2025-69649 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: NULL pointer dereference in readelf via crafted ELF binary with malformed header fields |
| LOW | | 7.5 | | CVE-2025-69650 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: double free in readelf via crafted ELF binary with malformed relocation data |
| LOW | | 5.5 | | CVE-2025-69651 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: Binutils: Denial of Service via crafted ELF binary processing |
| LOW | | 3.3 | | CVE-2025-69652 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: abort in readelf via crafted ELF binary with malformed DWARF abbrev or debug information |
| LOW | | 7.8 | | CVE-2025-7545 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: Binutils: Heap Buffer Overflow |
| LOW | | 7.8 | | CVE-2025-7546 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: Binutils: Out-of-bounds Write Vulnerability |
| LOW | | 3.3 | | CVE-2025-8225 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: Binutils DWARF Section Handler Memory Leak |
| LOW | | 5.6 | | CVE-2026-15003 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils: Heap-buffer-overflow in linker leads to information disclosure and denial of service |
| LOW | | 7.8 | | CVE-2026-18220 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: binutils: Out-of-bounds write in BFD DLX ELF backend relocation processing |
| LOW | | 5.5 | | CVE-2026-19548 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: binutils: Multiple Use-After-Free in add_archive_element via LTO plugin processing |
| LOW | | 7.1 | | CVE-2026-3441 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils: Information disclosure via specially crafted XCOFF object file |
| LOW | | 7.1 | | CVE-2026-3442 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils: Information disclosure or denial of service via out-of-bounds read in bfd linker |
| LOW | | 6.1 | | CVE-2026-4647 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: Out-of-Bounds Read in XCOFF Relocation Processing in GNU Binutils BFD Library |
| LOW | | 5.5 | | CVE-2026-6844 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: Binutils: Denial of Service vulnerabilities in readelf via crafted ELF files |
| LOW | | 5 | | CVE-2026-6845 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: Binutils: Denial of Service via crafted ELF file |
| LOW | | 7.8 | | CVE-2026-6846 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: Binutils: Arbitrary code execution via malformed XCOFF object file processing |
| LOW | | 6.6 | | CVE-2026-90801 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils ld: Buffer overflow in cache_bwrite via nbytes manipulation |
| LOW | | 5 | | CVE-2026-90802 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils: Denial of service via null pointer dereference in ld component |
| LOW | | 6.8 | | CVE-2026-90803 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils ld: Buffer Overflow via Malformed Relocation |
| LOW | | 6.1 | | CVE-2026-90804 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils: Buffer overflow in Eh Frame Section Handler can lead to denial of service |
| LOW | | 6.6 | | CVE-2026-90828 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils: Null pointer dereference via elf_orphan_compatible function |
| LOW | | 6.6 | | CVE-2026-90829 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils: Null pointer dereference via SHT_GROUP Section manipulation |
| LOW | | 5.5 | | CVE-2026-90830 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils: Local denial of service via null pointer dereference in Section Merge |
| LOW | | 6.6 | | CVE-2026-90831 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils: Memory corruption via local manipulation of ELF String Table |
| LOW | | 5.5 | | CVE-2026-91779 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils: Denial of Service via null pointer dereference |
| LOW | | 5 | | CVE-2026-91780 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils: Local denial of service via null pointer dereference |
| LOW | | 3.3 | | CVE-2026-91781 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils: Local denial of service vulnerability |
| LOW | | 5.5 | | CVE-2026-91782 | binutils-aarch64-linux-gnu | 2.44-3 | | binutils: GNU Binutils: Denial of Service via null pointer dereference |
| LOW | | 5.5 | | CVE-2017-13716 | binutils-common | 2.44-3 | | binutils: Memory leak with the C++ symbol demangler routine in libiberty |
| LOW | | 5.5 | | CVE-2018-20673 | binutils-common | 2.44-3 | | libiberty: Integer overflow in demangle_template() function |
| LOW | | 6.5 | | CVE-2018-20712 | binutils-common | 2.44-3 | | libiberty: heap-based buffer over-read in d_expression_1 |
| LOW | | 5.5 | | CVE-2018-9996 | binutils-common | 2.44-3 | | binutils: Stack-overflow in libiberty/cplus-dem.c causes crash |
| LOW | | 6.5 | | CVE-2021-32256 | binutils-common | 2.44-3 | | binutils: stack-overflow issue in demangle_type in rust-demangle.c. |
| LOW | | 5.5 | | CVE-2025-11081 | binutils-common | 2.44-3 | | binutils: GNU Binutils out-of-bounds read |
| LOW | | 7.8 | | CVE-2025-11082 | binutils-common | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 7.8 | | CVE-2025-11083 | binutils-common | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 5.5 | | CVE-2025-11412 | binutils-common | 2.44-3 | | binutils: GNU Binutils Linker elflink.c bfd_elf_gc_record_vtentry out-of-bounds |
| LOW | | 5.5 | | CVE-2025-11413 | binutils-common | 2.44-3 | | binutils: GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds |
| LOW | | 5.5 | | CVE-2025-11414 | binutils-common | 2.44-3 | | binutils: GNU Binutils Linker elflink.c get_link_hash_entry out-of-bounds |
| LOW | | 5.3 | | CVE-2025-1147 | binutils-common | 2.44-3 | | binutils: GNU Binutils nm nm.c internal_strlen buffer overflow |
| LOW | | 3.1 | | CVE-2025-1148 | binutils-common | 2.44-3 | | binutils: GNU Binutils ld ldelfgen.c link_order_scan memory leak |
| LOW | | 3.1 | | CVE-2025-1149 | binutils-common | 2.44-3 | | binutils: GNU Binutils ld xmalloc.c xstrdup memory leak |
| LOW | | 5.5 | | CVE-2025-11494 | binutils-common | 2.44-3 | | binutils: GNU Binutils Linker out-of-bounds read |
| LOW | | 5.5 | | CVE-2025-11495 | binutils-common | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 3.1 | | CVE-2025-1150 | binutils-common | 2.44-3 | | binutils: GNU Binutils ld libbfd.c bfd_malloc memory leak |
| LOW | | 3.1 | | CVE-2025-1151 | binutils-common | 2.44-3 | | binutils: GNU Binutils ld xmemdup.c xmemdup memory leak |
| LOW | | 3.7 | | CVE-2025-1152 | binutils-common | 2.44-3 | | binutils: GNU Binutils ld xstrdup.c xstrdup memory leak |
| LOW | | 5.9 | | CVE-2025-1153 | binutils-common | 2.44-3 | | binutils: GNU Binutils format.c bfd_set_format memory corruption |
| LOW | | 5 | | CVE-2025-1176 | binutils-common | 2.44-3 | | binutils: GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec heap-based overflow |
| LOW | | 5.6 | | CVE-2025-1178 | binutils-common | 2.44-3 | | binutils: GNU Binutils ld libbfd.c bfd_putl64 memory corruption |
| LOW | | 3.1 | | CVE-2025-1180 | binutils-common | 2.44-3 | | binutils: GNU Binutils ld elf-eh-frame.c _bfd_elf_write_section_eh_frame memory corruption |
| LOW | | 5 | | CVE-2025-1181 | binutils-common | 2.44-3 | | binutils: GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec memory corruption |
| LOW | | 5 | | CVE-2025-1182 | binutils-common | 2.44-3 | | binutils: GNU Binutils ld elflink.c bfd_elf_reloc_symbol_deleted_p memory corruption |
| LOW | | 5.5 | | CVE-2025-11839 | binutils-common | 2.44-3 | | binutils: GNU Binutils prdbg.c tg_tag_type return value |
| LOW | | 5.5 | | CVE-2025-11840 | binutils-common | 2.44-3 | | binutils: GNU Binutils out-of-bounds read |
| LOW | | 5.5 | | CVE-2025-3198 | binutils-common | 2.44-3 | | binutils: GNU Binutils objdump bucomm.c display_info memory leak |
| LOW | | 7.8 | | CVE-2025-5244 | binutils-common | 2.44-3 | | binutils: GNU Binutils ld elflink.c elf_gc_sweep memory corruption |
| LOW | | 7.8 | | CVE-2025-5245 | binutils-common | 2.44-3 | | binutils: GNU Binutils objdump debug.c debug_type_samep memory corruption |
| LOW | | 3.3 | | CVE-2025-66861 | binutils-common | 2.44-3 | | binutils: out-of-bounds read in d_unqualified_name() in cp-demangle.c |
| LOW | | 3.3 | | CVE-2025-66862 | binutils-common | 2.44-3 | | binutils: heap-based buffer over-read in gnu_special() in cplus-dem.c |
| LOW | | 3.3 | | CVE-2025-66863 | binutils-common | 2.44-3 | | binutils: BinUtils: Denial of Service via crafted PE file |
| LOW | | 7.5 | | CVE-2025-66864 | binutils-common | 2.44-3 | | binutils: NULL pointer dereference in d_print_comp_inner() in cp-demangle.c |
| LOW | | 3.3 | | CVE-2025-66865 | binutils-common | 2.44-3 | | binutils: stack overflow in d_print_comp_inner() in cp-demangle.c |
| LOW | | 7.5 | | CVE-2025-66866 | binutils-common | 2.44-3 | | binutils: BinUtils: Denial of Service via crafted PE file |
| LOW | | 2.8 | | CVE-2025-69644 | binutils-common | 2.44-3 | | binutils: Binutils: Denial of Service via crafted binary with malformed DWARF debug information |
| LOW | | 2.8 | | CVE-2025-69645 | binutils-common | 2.44-3 | | binutils: Binutils objdump: Denial of Service via crafted DWARF debug information |
| LOW | | 2.8 | | CVE-2025-69646 | binutils-common | 2.44-3 | | binutils: Binutils: Denial of Service via malformed DWARF debug_rnglists data |
| LOW | | 3.3 | | CVE-2025-69647 | binutils-common | 2.44-3 | | binutils: infinite loop in readelf via crafted binary with malformed DWARF loclists data |
| LOW | | 3.3 | | CVE-2025-69648 | binutils-common | 2.44-3 | | binutils: infinite loop in readelf via crafted binary with malformed DWARF .debug_rnglists data |
| LOW | | 7.5 | | CVE-2025-69649 | binutils-common | 2.44-3 | | binutils: NULL pointer dereference in readelf via crafted ELF binary with malformed header fields |
| LOW | | 7.5 | | CVE-2025-69650 | binutils-common | 2.44-3 | | binutils: double free in readelf via crafted ELF binary with malformed relocation data |
| LOW | | 5.5 | | CVE-2025-69651 | binutils-common | 2.44-3 | | binutils: Binutils: Denial of Service via crafted ELF binary processing |
| LOW | | 3.3 | | CVE-2025-69652 | binutils-common | 2.44-3 | | binutils: abort in readelf via crafted ELF binary with malformed DWARF abbrev or debug information |
| LOW | | 7.8 | | CVE-2025-7545 | binutils-common | 2.44-3 | | binutils: Binutils: Heap Buffer Overflow |
| LOW | | 7.8 | | CVE-2025-7546 | binutils-common | 2.44-3 | | binutils: Binutils: Out-of-bounds Write Vulnerability |
| LOW | | 3.3 | | CVE-2025-8225 | binutils-common | 2.44-3 | | binutils: Binutils DWARF Section Handler Memory Leak |
| LOW | | 5.6 | | CVE-2026-15003 | binutils-common | 2.44-3 | | binutils: GNU Binutils: Heap-buffer-overflow in linker leads to information disclosure and denial of service |
| LOW | | 7.8 | | CVE-2026-18220 | binutils-common | 2.44-3 | | binutils: binutils: Out-of-bounds write in BFD DLX ELF backend relocation processing |
| LOW | | 5.5 | | CVE-2026-19548 | binutils-common | 2.44-3 | | binutils: binutils: Multiple Use-After-Free in add_archive_element via LTO plugin processing |
| LOW | | 7.1 | | CVE-2026-3441 | binutils-common | 2.44-3 | | binutils: GNU Binutils: Information disclosure via specially crafted XCOFF object file |
| LOW | | 7.1 | | CVE-2026-3442 | binutils-common | 2.44-3 | | binutils: GNU Binutils: Information disclosure or denial of service via out-of-bounds read in bfd linker |
| LOW | | 6.1 | | CVE-2026-4647 | binutils-common | 2.44-3 | | binutils: Out-of-Bounds Read in XCOFF Relocation Processing in GNU Binutils BFD Library |
| LOW | | 5.5 | | CVE-2026-6844 | binutils-common | 2.44-3 | | binutils: Binutils: Denial of Service vulnerabilities in readelf via crafted ELF files |
| LOW | | 5 | | CVE-2026-6845 | binutils-common | 2.44-3 | | binutils: Binutils: Denial of Service via crafted ELF file |
| LOW | | 7.8 | | CVE-2026-6846 | binutils-common | 2.44-3 | | binutils: Binutils: Arbitrary code execution via malformed XCOFF object file processing |
| LOW | | 6.6 | | CVE-2026-90801 | binutils-common | 2.44-3 | | binutils: GNU Binutils ld: Buffer overflow in cache_bwrite via nbytes manipulation |
| LOW | | 5 | | CVE-2026-90802 | binutils-common | 2.44-3 | | binutils: GNU Binutils: Denial of service via null pointer dereference in ld component |
| LOW | | 6.8 | | CVE-2026-90803 | binutils-common | 2.44-3 | | binutils: GNU Binutils ld: Buffer Overflow via Malformed Relocation |
| LOW | | 6.1 | | CVE-2026-90804 | binutils-common | 2.44-3 | | binutils: GNU Binutils: Buffer overflow in Eh Frame Section Handler can lead to denial of service |
| LOW | | 6.6 | | CVE-2026-90828 | binutils-common | 2.44-3 | | binutils: GNU Binutils: Null pointer dereference via elf_orphan_compatible function |
| LOW | | 6.6 | | CVE-2026-90829 | binutils-common | 2.44-3 | | binutils: GNU Binutils: Null pointer dereference via SHT_GROUP Section manipulation |
| LOW | | 5.5 | | CVE-2026-90830 | binutils-common | 2.44-3 | | binutils: GNU Binutils: Local denial of service via null pointer dereference in Section Merge |
| LOW | | 6.6 | | CVE-2026-90831 | binutils-common | 2.44-3 | | binutils: GNU Binutils: Memory corruption via local manipulation of ELF String Table |
| LOW | | 5.5 | | CVE-2026-91779 | binutils-common | 2.44-3 | | binutils: GNU Binutils: Denial of Service via null pointer dereference |
| LOW | | 5 | | CVE-2026-91780 | binutils-common | 2.44-3 | | binutils: GNU Binutils: Local denial of service via null pointer dereference |
| LOW | | 3.3 | | CVE-2026-91781 | binutils-common | 2.44-3 | | binutils: GNU Binutils: Local denial of service vulnerability |
| LOW | | 5.5 | | CVE-2026-91782 | binutils-common | 2.44-3 | | binutils: GNU Binutils: Denial of Service via null pointer dereference |
| LOW | | 5.5 | | CVE-2017-13716 | binutils | 2.44-3 | | binutils: Memory leak with the C++ symbol demangler routine in libiberty |
| LOW | | 5.5 | | CVE-2018-20673 | binutils | 2.44-3 | | libiberty: Integer overflow in demangle_template() function |
| LOW | | 6.5 | | CVE-2018-20712 | binutils | 2.44-3 | | libiberty: heap-based buffer over-read in d_expression_1 |
| LOW | | 5.5 | | CVE-2018-9996 | binutils | 2.44-3 | | binutils: Stack-overflow in libiberty/cplus-dem.c causes crash |
| LOW | | 6.5 | | CVE-2021-32256 | binutils | 2.44-3 | | binutils: stack-overflow issue in demangle_type in rust-demangle.c. |
| LOW | | 5.5 | | CVE-2025-11081 | binutils | 2.44-3 | | binutils: GNU Binutils out-of-bounds read |
| LOW | | 7.8 | | CVE-2025-11082 | binutils | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 7.8 | | CVE-2025-11083 | binutils | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 5.5 | | CVE-2025-11412 | binutils | 2.44-3 | | binutils: GNU Binutils Linker elflink.c bfd_elf_gc_record_vtentry out-of-bounds |
| LOW | | 5.5 | | CVE-2025-11413 | binutils | 2.44-3 | | binutils: GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds |
| LOW | | 5.5 | | CVE-2025-11414 | binutils | 2.44-3 | | binutils: GNU Binutils Linker elflink.c get_link_hash_entry out-of-bounds |
| LOW | | 5.3 | | CVE-2025-1147 | binutils | 2.44-3 | | binutils: GNU Binutils nm nm.c internal_strlen buffer overflow |
| LOW | | 3.1 | | CVE-2025-1148 | binutils | 2.44-3 | | binutils: GNU Binutils ld ldelfgen.c link_order_scan memory leak |
| LOW | | 3.1 | | CVE-2025-1149 | binutils | 2.44-3 | | binutils: GNU Binutils ld xmalloc.c xstrdup memory leak |
| LOW | | 5.5 | | CVE-2025-11494 | binutils | 2.44-3 | | binutils: GNU Binutils Linker out-of-bounds read |
| LOW | | 5.5 | | CVE-2025-11495 | binutils | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 3.1 | | CVE-2025-1150 | binutils | 2.44-3 | | binutils: GNU Binutils ld libbfd.c bfd_malloc memory leak |
| LOW | | 3.1 | | CVE-2025-1151 | binutils | 2.44-3 | | binutils: GNU Binutils ld xmemdup.c xmemdup memory leak |
| LOW | | 3.7 | | CVE-2025-1152 | binutils | 2.44-3 | | binutils: GNU Binutils ld xstrdup.c xstrdup memory leak |
| LOW | | 5.9 | | CVE-2025-1153 | binutils | 2.44-3 | | binutils: GNU Binutils format.c bfd_set_format memory corruption |
| LOW | | 5 | | CVE-2025-1176 | binutils | 2.44-3 | | binutils: GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec heap-based overflow |
| LOW | | 5.6 | | CVE-2025-1178 | binutils | 2.44-3 | | binutils: GNU Binutils ld libbfd.c bfd_putl64 memory corruption |
| LOW | | 3.1 | | CVE-2025-1180 | binutils | 2.44-3 | | binutils: GNU Binutils ld elf-eh-frame.c _bfd_elf_write_section_eh_frame memory corruption |
| LOW | | 5 | | CVE-2025-1181 | binutils | 2.44-3 | | binutils: GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec memory corruption |
| LOW | | 5 | | CVE-2025-1182 | binutils | 2.44-3 | | binutils: GNU Binutils ld elflink.c bfd_elf_reloc_symbol_deleted_p memory corruption |
| LOW | | 5.5 | | CVE-2025-11839 | binutils | 2.44-3 | | binutils: GNU Binutils prdbg.c tg_tag_type return value |
| LOW | | 5.5 | | CVE-2025-11840 | binutils | 2.44-3 | | binutils: GNU Binutils out-of-bounds read |
| LOW | | 5.5 | | CVE-2025-3198 | binutils | 2.44-3 | | binutils: GNU Binutils objdump bucomm.c display_info memory leak |
| LOW | | 7.8 | | CVE-2025-5244 | binutils | 2.44-3 | | binutils: GNU Binutils ld elflink.c elf_gc_sweep memory corruption |
| LOW | | 7.8 | | CVE-2025-5245 | binutils | 2.44-3 | | binutils: GNU Binutils objdump debug.c debug_type_samep memory corruption |
| LOW | | 3.3 | | CVE-2025-66861 | binutils | 2.44-3 | | binutils: out-of-bounds read in d_unqualified_name() in cp-demangle.c |
| LOW | | 3.3 | | CVE-2025-66862 | binutils | 2.44-3 | | binutils: heap-based buffer over-read in gnu_special() in cplus-dem.c |
| LOW | | 3.3 | | CVE-2025-66863 | binutils | 2.44-3 | | binutils: BinUtils: Denial of Service via crafted PE file |
| LOW | | 7.5 | | CVE-2025-66864 | binutils | 2.44-3 | | binutils: NULL pointer dereference in d_print_comp_inner() in cp-demangle.c |
| LOW | | 3.3 | | CVE-2025-66865 | binutils | 2.44-3 | | binutils: stack overflow in d_print_comp_inner() in cp-demangle.c |
| LOW | | 7.5 | | CVE-2025-66866 | binutils | 2.44-3 | | binutils: BinUtils: Denial of Service via crafted PE file |
| LOW | | 2.8 | | CVE-2025-69644 | binutils | 2.44-3 | | binutils: Binutils: Denial of Service via crafted binary with malformed DWARF debug information |
| LOW | | 2.8 | | CVE-2025-69645 | binutils | 2.44-3 | | binutils: Binutils objdump: Denial of Service via crafted DWARF debug information |
| LOW | | 2.8 | | CVE-2025-69646 | binutils | 2.44-3 | | binutils: Binutils: Denial of Service via malformed DWARF debug_rnglists data |
| LOW | | 3.3 | | CVE-2025-69647 | binutils | 2.44-3 | | binutils: infinite loop in readelf via crafted binary with malformed DWARF loclists data |
| LOW | | 3.3 | | CVE-2025-69648 | binutils | 2.44-3 | | binutils: infinite loop in readelf via crafted binary with malformed DWARF .debug_rnglists data |
| LOW | | 7.5 | | CVE-2025-69649 | binutils | 2.44-3 | | binutils: NULL pointer dereference in readelf via crafted ELF binary with malformed header fields |
| LOW | | 7.5 | | CVE-2025-69650 | binutils | 2.44-3 | | binutils: double free in readelf via crafted ELF binary with malformed relocation data |
| LOW | | 5.5 | | CVE-2025-69651 | binutils | 2.44-3 | | binutils: Binutils: Denial of Service via crafted ELF binary processing |
| LOW | | 3.3 | | CVE-2025-69652 | binutils | 2.44-3 | | binutils: abort in readelf via crafted ELF binary with malformed DWARF abbrev or debug information |
| LOW | | 7.8 | | CVE-2025-7545 | binutils | 2.44-3 | | binutils: Binutils: Heap Buffer Overflow |
| LOW | | 7.8 | | CVE-2025-7546 | binutils | 2.44-3 | | binutils: Binutils: Out-of-bounds Write Vulnerability |
| LOW | | 3.3 | | CVE-2025-8225 | binutils | 2.44-3 | | binutils: Binutils DWARF Section Handler Memory Leak |
| LOW | | 5.6 | | CVE-2026-15003 | binutils | 2.44-3 | | binutils: GNU Binutils: Heap-buffer-overflow in linker leads to information disclosure and denial of service |
| LOW | | 7.8 | | CVE-2026-18220 | binutils | 2.44-3 | | binutils: binutils: Out-of-bounds write in BFD DLX ELF backend relocation processing |
| LOW | | 5.5 | | CVE-2026-19548 | binutils | 2.44-3 | | binutils: binutils: Multiple Use-After-Free in add_archive_element via LTO plugin processing |
| LOW | | 7.1 | | CVE-2026-3441 | binutils | 2.44-3 | | binutils: GNU Binutils: Information disclosure via specially crafted XCOFF object file |
| LOW | | 7.1 | | CVE-2026-3442 | binutils | 2.44-3 | | binutils: GNU Binutils: Information disclosure or denial of service via out-of-bounds read in bfd linker |
| LOW | | 6.1 | | CVE-2026-4647 | binutils | 2.44-3 | | binutils: Out-of-Bounds Read in XCOFF Relocation Processing in GNU Binutils BFD Library |
| LOW | | 5.5 | | CVE-2026-6844 | binutils | 2.44-3 | | binutils: Binutils: Denial of Service vulnerabilities in readelf via crafted ELF files |
| LOW | | 5 | | CVE-2026-6845 | binutils | 2.44-3 | | binutils: Binutils: Denial of Service via crafted ELF file |
| LOW | | 7.8 | | CVE-2026-6846 | binutils | 2.44-3 | | binutils: Binutils: Arbitrary code execution via malformed XCOFF object file processing |
| LOW | | 6.6 | | CVE-2026-90801 | binutils | 2.44-3 | | binutils: GNU Binutils ld: Buffer overflow in cache_bwrite via nbytes manipulation |
| LOW | | 5 | | CVE-2026-90802 | binutils | 2.44-3 | | binutils: GNU Binutils: Denial of service via null pointer dereference in ld component |
| LOW | | 6.8 | | CVE-2026-90803 | binutils | 2.44-3 | | binutils: GNU Binutils ld: Buffer Overflow via Malformed Relocation |
| LOW | | 6.1 | | CVE-2026-90804 | binutils | 2.44-3 | | binutils: GNU Binutils: Buffer overflow in Eh Frame Section Handler can lead to denial of service |
| LOW | | 6.6 | | CVE-2026-90828 | binutils | 2.44-3 | | binutils: GNU Binutils: Null pointer dereference via elf_orphan_compatible function |
| LOW | | 6.6 | | CVE-2026-90829 | binutils | 2.44-3 | | binutils: GNU Binutils: Null pointer dereference via SHT_GROUP Section manipulation |
| LOW | | 5.5 | | CVE-2026-90830 | binutils | 2.44-3 | | binutils: GNU Binutils: Local denial of service via null pointer dereference in Section Merge |
| LOW | | 6.6 | | CVE-2026-90831 | binutils | 2.44-3 | | binutils: GNU Binutils: Memory corruption via local manipulation of ELF String Table |
| LOW | | 5.5 | | CVE-2026-91779 | binutils | 2.44-3 | | binutils: GNU Binutils: Denial of Service via null pointer dereference |
| LOW | | 5 | | CVE-2026-91780 | binutils | 2.44-3 | | binutils: GNU Binutils: Local denial of service via null pointer dereference |
| LOW | | 3.3 | | CVE-2026-91781 | binutils | 2.44-3 | | binutils: GNU Binutils: Local denial of service vulnerability |
| LOW | | 5.5 | | CVE-2026-91782 | binutils | 2.44-3 | | binutils: GNU Binutils: Denial of Service via null pointer dereference |
| LOW | | 5.3 | | CVE-2016-9797 | bluez | 5.82-1.1+rpt1 | | bluez: buffer over-read in l2cap_dump() |
| LOW | | 5.3 | | CVE-2016-9798 | bluez | 5.82-1.1+rpt1 | | bluez: use-after-free in conf_opt() |
| LOW | | 5.3 | | CVE-2016-9799 | bluez | 5.82-1.1+rpt1 | | bluez: buffer overflow in pklg_read_hci() |
| LOW | | 5.3 | | CVE-2016-9800 | bluez | 5.82-1.1+rpt1 | | bluez: buffer overflow in pin_code_reply_dump() |
| LOW | | 5.3 | | CVE-2016-9801 | bluez | 5.82-1.1+rpt1 | | bluez: buffer overflow in set_ext_ctrl() |
| LOW | | 5.3 | | CVE-2016-9802 | bluez | 5.82-1.1+rpt1 | | bluez: buffer over-read in l2cap_packet() |
| LOW | | 5.3 | | CVE-2016-9803 | bluez | 5.82-1.1+rpt1 | | bluez: out-of-bounds read in le_meta_ev_dump() |
| LOW | | 5.3 | | CVE-2016-9804 | bluez | 5.82-1.1+rpt1 | | bluez: buffer overflow in commands_dump() |
| LOW | | 7.5 | | CVE-2016-9917 | bluez | 5.82-1.1+rpt1 | | bluez: Heap-based buffer overflow vulnerability in read_n() |
| LOW | | 7.5 | | CVE-2016-9918 | bluez | 5.82-1.1+rpt1 | | bluez: Out of bounds stack read in packet_hexdump() |
| LOW | | 5.5 | | CVE-2026-105460 | bluez | 5.82-1.1+rpt1 | | bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt() |
| LOW | | 5.5 | | CVE-2022-0563 | bsdextrautils | 2.41-5 | | util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline |
| LOW | | 6.1 | | CVE-2025-14104 | bsdextrautils | 2.41-5 | 2.41.3-1 | util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames |
| LOW | | 5.5 | | CVE-2022-0563 | bsdutils | 1:2.41-5 | | util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline |
| LOW | | 6.1 | | CVE-2025-14104 | bsdutils | 1:2.41-5 | 2.41.3-1 | util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames |
| LOW | | 8.1 | | CVE-2018-1000500 | busybox | 1:1.37.0-6+b8 | | busybox: wget: Missing SSL certificate validation |
| LOW | | 3.3 | | CVE-2025-46394 | busybox | 1:1.37.0-6+b8 | | In tar in BusyBox through 1.37.0, a TAR archive can have filenames hid ... |
| LOW | | 5.4 | | CVE-2025-60876 | busybox | 1:1.37.0-6+b8 | | busybox: BusyBox wget: HTTP request-target allows header injection |
| LOW | | 5.5 | | CVE-2026-76014 | busybox | 1:1.37.0-6+b8 | | busybox: BusyBox: Denial of Service via null pointer dereference in wget.c |
| LOW | | 3.7 | | CVE-2026-88834 | busybox | 1:1.37.0-6+b8 | | busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds |
| LOW | | 6.1 | | CVE-2026-88835 | busybox | 1:1.37.0-6+b8 | | busybox: busybox: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb pack |
| LOW | | 3.3 | | CVE-2026-88841 | busybox | 1:1.37.0-6+b8 | | busybox: busybox: dpkg write_status_file() stale cursor causes out-of-bounds read and status file corruption |
| LOW | | 3.3 | | CVE-2026-88842 | busybox | 1:1.37.0-6+b8 | | busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption |
| LOW | | 10 | | CVE-2014-2830 | cifs-utils | 2:7.4-1 | | cifs-utils: stack-based buffer overflow flaw in pam_cifscreds |
| LOW | | 4.7 | | CVE-2017-18018 | coreutils | 9.7-3 | | coreutils: race condition vulnerability in chown and chgrp |
| LOW | | 4.4 | | CVE-2025-5278 | coreutils | 9.7-3 | | coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification |
| LOW | | 6.1 | | CVE-2026-56391 | coreutils | 9.7-3 | | coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input |
| LOW | | 6.1 | | CVE-2026-56392 | coreutils | 9.7-3 | | coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values |
| LOW | | 3.3 | | CVE-2026-66484 | cpio | 2.15+dfsg-2 | | cpio: GNU cpio: Path Traversal allows creating hard links outside intended directory via malicious tar archives. |
| LOW | | 5.9 | | CVE-2025-10966 | curl | 8.14.1-2+deb13u3 | | curl: Curl missing SFTP host verification with wolfSSH backend |
| LOW | | 6.3 | | CVE-2025-14017 | curl | 8.14.1-2+deb13u3 | | curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers |
| LOW | | 6.5 | | CVE-2025-14524 | curl | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: Information disclosure via cross-protocol redirect with OAuth2 bearer token |
| LOW | | 6.8 | | CVE-2025-14819 | curl | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: libcurl: Improper certificate validation due to cached TLS settings reuse |
| LOW | | 8.1 | | CVE-2025-15079 | curl | 8.14.1-2+deb13u3 | | curl: Host verification bypass during SSH transfers |
| LOW | | 4.7 | | CVE-2025-15224 | curl | 8.14.1-2+deb13u3 | | curl: libssh key passphrase bypass without agent set |
| LOW | | 4.8 | | CVE-2026-107928 | curl | 8.14.1-2+deb13u3 | | curl: curl: info leak uploading over WebSockets with GnuTLS |
| LOW | | 3.7 | | CVE-2026-107929 | curl | 8.14.1-2+deb13u3 | | curl: curl: local interface connection reuse mixup |
| LOW | | 3.7 | | CVE-2026-13608 | curl | 8.14.1-2+deb13u3 | | curl: curl: Authentication bypass in OpenLDAP SASL negotiation via Man-in-the-Middle (MITM) attack |
| LOW | | 3.7 | | CVE-2026-18924 | curl | 8.14.1-2+deb13u3 | | curl: libcurl: Use-after-free in HTTP/2 Server Push with shared connections |
| LOW | | 3.7 | | CVE-2026-80229 | curl | 8.14.1-2+deb13u3 | | curl: libcurl: Memory corruption vulnerability via OpenSSL 3 provider use-after-free |
| LOW | | 3.7 | | CVE-2026-80230 | curl | 8.14.1-2+deb13u3 | | curl: curl: Public key pinning bypass allows unauthenticated connections |
| LOW | | 3.7 | | CVE-2026-80255 | curl | 8.14.1-2+deb13u3 | | curl: curl: Information disclosure due to secure cookie attribute bypass |
| LOW | | 4.8 | | CVE-2026-82208 | curl | 8.14.1-2+deb13u3 | | curl: libcurl: Improper certificate validation when using wolfSSL CA cache |
| LOW | | 3.1 | | CVE-2026-82209 | curl | 8.14.1-2+deb13u3 | | curl: libcurl: Information disclosure via improper Public Suffix List boundary check |
| LOW | | 5.3 | | CVE-2026-86409 | curl | 8.14.1-2+deb13u3 | | curl: curl: stale SigV4 headers sent unintended |
| LOW | | 6.8 | | CVE-2026-86410 | curl | 8.14.1-2+deb13u3 | | curl: curl: redirect to SFTP or SCP bypasses host verification |
| LOW | | 6.5 | | CVE-2026-86414 | curl | 8.14.1-2+deb13u3 | | curl: curl: leaking host credentials to HTTP proxy |
| LOW | | 3.7 | | CVE-2026-87862 | curl | 8.14.1-2+deb13u3 | | curl: curl: HSTS cache import drops longer-lived child |
| LOW | | 3.7 | | CVE-2026-87863 | curl | 8.14.1-2+deb13u3 | | curl: curl: Hsts Response Erases Persisted Entries |
| LOW | | 3.7 | | CVE-2026-87864 | curl | 8.14.1-2+deb13u3 | | curl: IMAP APPEND plus CRLF conversion command injection |
| LOW | | 3.7 | | CVE-2026-87865 | curl | 8.14.1-2+deb13u3 | | curl: curl: knownhost callback mismatches key as missing |
| LOW | | 3.7 | | CVE-2026-87866 | curl | 8.14.1-2+deb13u3 | | curl: curl: wolfSSL public-key pinning bypass |
| LOW | | 4.3 | | CVE-2026-92386 | curl | 8.14.1-2+deb13u3 | | curl: curl: server-set cookie aborts cookie jar load |
| LOW | | 3.7 | | CVE-2026-92387 | curl | 8.14.1-2+deb13u3 | | curl: curl: never-ending loop via server response omission |
| LOW | | 3.7 | | CVE-2026-92389 | curl | 8.14.1-2+deb13u3 | | curl: curl: TFTP direction confusion |
| LOW | | 6.5 | | CVE-2026-92390 | curl | 8.14.1-2+deb13u3 | | curl: curl: -J no-clobber guarantee bypassed with 103 early hints |
| LOW | | 3.7 | | CVE-2026-92391 | curl | 8.14.1-2+deb13u3 | | curl: curl: curl_mime_free stack overflow by recursion |
| LOW | | 3.3 | | CVE-2026-94266 | curl | 8.14.1-2+deb13u3 | | curl: curl: password leak in CURLINFO_EFFECTIVE_URL |
| LOW | | 7.4 | | CVE-2026-9547 | curl | 8.14.1-2+deb13u3 | | curl: curl: Man-in-the-middle attack via SSH host key bypass |
| LOW | | 5.5 | | CVE-2026-102473 | dash | 0.5.12-12 | | dash: dash: Super-polynomial backtracking in pmatch when libc fnmatch is disabled |
| LOW | | 4 | | CVE-2026-102474 | dash | 0.5.12-12 | | dash: dash: Heap out-of-bounds write in conv_escape via undersized Unicode escape reservation |
| LOW | | 5.3 | | CVE-2026-53910 | diffutils | 1:3.10-4 | | diffutils: heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations |
| LOW | | 6.2 | | CVE-2022-3219 | dirmngr | 2.4.7-21+deb13u1+b3 | | gnupg: denial of service issue (resource consumption) using compressed packets |
| LOW | | 3.6 | | CVE-2026-105712 | dirmngr | 2.4.7-21+deb13u1+b3 | | gnupg2: gnupg: Arbitrary file overwrite via symlink traversal in gpgtar |
| LOW | | 2.9 | | CVE-2026-57062 | dirmngr | 2.4.7-21+deb13u1+b3 | | GnuPG: Incorrect cryptographic message parsing |
| LOW | | 5.5 | | CVE-2026-19617 | dmsetup | 2:1.02.205-2 | | libdm: lvm2: libdm: Denial of Service via uncontrolled recursion in config parser |
| LOW | | 5.3 | | CVE-2026-12969 | dnsmasq-base | 2.91-1+deb13u1 | 2.91-1+deb13u2 | dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation |
| LOW | | 4.4 | | CVE-2026-13002 | dnsmasq-base | 2.91-1+deb13u1 | | dnsmasq: Infinite loop DoS in DNSSEC NSEC/NSEC3 type bitmap parsing |
| LOW | | 5.5 | | CVE-2022-0563 | eject | 2.41-5 | | util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline |
| LOW | | 6.1 | | CVE-2025-14104 | eject | 2.41-5 | 2.41.3-1 | util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames |
| LOW | | 5.5 | | CVE-2022-0563 | fdisk | 2.41-5 | | util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline |
| LOW | | 6.1 | | CVE-2025-14104 | fdisk | 2.41-5 | 2.41.3-1 | util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames |
| LOW | | 7.5 | | CVE-2014-8501 | gdb | 16.3-1 | | binutils: out-of-bounds write when parsing specially crafted PE executable |
| LOW | | 5.5 | | CVE-2023-39128 | gdb | 16.3-1 | | gdb: dynamic-stack-buffer-overflow in ada_decode[abi:cxx11](char const*, bool, bool) |
| LOW | | 5.5 | | CVE-2023-39129 | gdb | 16.3-1 | | gdb: heap-use-after-free /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:137:27 |
| LOW | | 5.5 | | CVE-2023-39130 | gdb | 16.3-1 | | gdb: heap-buffer-overflow in pe_as16(void*) |
| LOW | | 7 | | CVE-2026-13732 | gdb | 16.3-1 | | gdb: gdb: Out-of-bounds write in STABS parser read_member_functions() via crafted ELF |
| LOW | | 6.2 | | CVE-2022-3219 | gnupg-l10n | 2.4.7-21+deb13u1 | | gnupg: denial of service issue (resource consumption) using compressed packets |
| LOW | | 3.6 | | CVE-2026-105712 | gnupg-l10n | 2.4.7-21+deb13u1 | | gnupg2: gnupg: Arbitrary file overwrite via symlink traversal in gpgtar |
| LOW | | 2.9 | | CVE-2026-57062 | gnupg-l10n | 2.4.7-21+deb13u1 | | GnuPG: Incorrect cryptographic message parsing |
| LOW | | 6.2 | | CVE-2022-3219 | gnupg-utils | 2.4.7-21+deb13u1+b3 | | gnupg: denial of service issue (resource consumption) using compressed packets |
| LOW | | 3.6 | | CVE-2026-105712 | gnupg-utils | 2.4.7-21+deb13u1+b3 | | gnupg2: gnupg: Arbitrary file overwrite via symlink traversal in gpgtar |
| LOW | | 2.9 | | CVE-2026-57062 | gnupg-utils | 2.4.7-21+deb13u1+b3 | | GnuPG: Incorrect cryptographic message parsing |
| LOW | | 6.2 | | CVE-2022-3219 | gnupg | 2.4.7-21+deb13u1 | | gnupg: denial of service issue (resource consumption) using compressed packets |
| LOW | | 3.6 | | CVE-2026-105712 | gnupg | 2.4.7-21+deb13u1 | | gnupg2: gnupg: Arbitrary file overwrite via symlink traversal in gpgtar |
| LOW | | 2.9 | | CVE-2026-57062 | gnupg | 2.4.7-21+deb13u1 | | GnuPG: Incorrect cryptographic message parsing |
| LOW | | 6.2 | | CVE-2022-3219 | gpg-agent | 2.4.7-21+deb13u1+b3 | | gnupg: denial of service issue (resource consumption) using compressed packets |
| LOW | | 3.6 | | CVE-2026-105712 | gpg-agent | 2.4.7-21+deb13u1+b3 | | gnupg2: gnupg: Arbitrary file overwrite via symlink traversal in gpgtar |
| LOW | | 2.9 | | CVE-2026-57062 | gpg-agent | 2.4.7-21+deb13u1+b3 | | GnuPG: Incorrect cryptographic message parsing |
| LOW | | 6.2 | | CVE-2022-3219 | gpg-wks-client | 2.4.7-21+deb13u1+b3 | | gnupg: denial of service issue (resource consumption) using compressed packets |
| LOW | | 3.6 | | CVE-2026-105712 | gpg-wks-client | 2.4.7-21+deb13u1+b3 | | gnupg2: gnupg: Arbitrary file overwrite via symlink traversal in gpgtar |
| LOW | | 2.9 | | CVE-2026-57062 | gpg-wks-client | 2.4.7-21+deb13u1+b3 | | GnuPG: Incorrect cryptographic message parsing |
| LOW | | 6.2 | | CVE-2022-3219 | gpg | 2.4.7-21+deb13u1+b3 | | gnupg: denial of service issue (resource consumption) using compressed packets |
| LOW | | 3.6 | | CVE-2026-105712 | gpg | 2.4.7-21+deb13u1+b3 | | gnupg2: gnupg: Arbitrary file overwrite via symlink traversal in gpgtar |
| LOW | | 2.9 | | CVE-2026-57062 | gpg | 2.4.7-21+deb13u1+b3 | | GnuPG: Incorrect cryptographic message parsing |
| LOW | | 6.2 | | CVE-2022-3219 | gpgconf | 2.4.7-21+deb13u1+b3 | | gnupg: denial of service issue (resource consumption) using compressed packets |
| LOW | | 3.6 | | CVE-2026-105712 | gpgconf | 2.4.7-21+deb13u1+b3 | | gnupg2: gnupg: Arbitrary file overwrite via symlink traversal in gpgtar |
| LOW | | 2.9 | | CVE-2026-57062 | gpgconf | 2.4.7-21+deb13u1+b3 | | GnuPG: Incorrect cryptographic message parsing |
| LOW | | 6.2 | | CVE-2022-3219 | gpgsm | 2.4.7-21+deb13u1+b3 | | gnupg: denial of service issue (resource consumption) using compressed packets |
| LOW | | 3.6 | | CVE-2026-105712 | gpgsm | 2.4.7-21+deb13u1+b3 | | gnupg2: gnupg: Arbitrary file overwrite via symlink traversal in gpgtar |
| LOW | | 2.9 | | CVE-2026-57062 | gpgsm | 2.4.7-21+deb13u1+b3 | | GnuPG: Incorrect cryptographic message parsing |
| LOW | | 6.2 | | CVE-2022-3219 | gpgv | 2.4.7-21+deb13u1+b3 | | gnupg: denial of service issue (resource consumption) using compressed packets |
| LOW | | 3.6 | | CVE-2026-105712 | gpgv | 2.4.7-21+deb13u1+b3 | | gnupg2: gnupg: Arbitrary file overwrite via symlink traversal in gpgtar |
| LOW | | 2.9 | | CVE-2026-57062 | gpgv | 2.4.7-21+deb13u1+b3 | | GnuPG: Incorrect cryptographic message parsing |
| LOW | | 6.9 | | CVE-2008-4996 | initramfs-tools-bin | 0.148.4+rpt2 | | init in initramfs-tools 0.92f allows local users to overwrite arbitrar ... |
| LOW | | 6.9 | | CVE-2008-4996 | initramfs-tools-core | 0.148.4+rpt2 | | init in initramfs-tools 0.92f allows local users to overwrite arbitrar ... |
| LOW | | 6.9 | | CVE-2008-4996 | initramfs-tools | 0.148.4+rpt2 | | init in initramfs-tools 0.92f allows local users to overwrite arbitrar ... |
| LOW | | 6.5 | | CVE-2025-47268 | iputils-arping | 3:20240905-3 | | iputils: Signed Integer Overflow in Timestamp Multiplication in iputils ping |
| LOW | | 6.5 | | CVE-2025-47268 | iputils-ping | 3:20240905-3 | | iputils: Signed Integer Overflow in Timestamp Multiplication in iputils ping |
| LOW | | 3.7 | | CVE-2011-3374 | libapt-pkg7.0 | 3.0.3 | | It was found that apt-key in apt, all versions, do not correctly valid ... |
| LOW | | 6.8 | | CVE-2026-56109 | libasound2-data | 1.2.14-1+rpt1 | | alsa-lib: ALSA library: Double-free vulnerability leading to memory corruption |
| LOW | | 6.8 | | CVE-2026-56109 | libasound2t64 | 1.2.14-1+rpt1 | | alsa-lib: ALSA library: Double-free vulnerability leading to memory corruption |
| LOW | | 6.8 | | CVE-2026-56109 | libatopology2t64 | 1.2.14-1+rpt1 | | alsa-lib: ALSA library: Double-free vulnerability leading to memory corruption |
| LOW | | 5.5 | | CVE-2017-13716 | libbinutils | 2.44-3 | | binutils: Memory leak with the C++ symbol demangler routine in libiberty |
| LOW | | 5.5 | | CVE-2018-20673 | libbinutils | 2.44-3 | | libiberty: Integer overflow in demangle_template() function |
| LOW | | 6.5 | | CVE-2018-20712 | libbinutils | 2.44-3 | | libiberty: heap-based buffer over-read in d_expression_1 |
| LOW | | 5.5 | | CVE-2018-9996 | libbinutils | 2.44-3 | | binutils: Stack-overflow in libiberty/cplus-dem.c causes crash |
| LOW | | 6.5 | | CVE-2021-32256 | libbinutils | 2.44-3 | | binutils: stack-overflow issue in demangle_type in rust-demangle.c. |
| LOW | | 5.5 | | CVE-2025-11081 | libbinutils | 2.44-3 | | binutils: GNU Binutils out-of-bounds read |
| LOW | | 7.8 | | CVE-2025-11082 | libbinutils | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 7.8 | | CVE-2025-11083 | libbinutils | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 5.5 | | CVE-2025-11412 | libbinutils | 2.44-3 | | binutils: GNU Binutils Linker elflink.c bfd_elf_gc_record_vtentry out-of-bounds |
| LOW | | 5.5 | | CVE-2025-11413 | libbinutils | 2.44-3 | | binutils: GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds |
| LOW | | 5.5 | | CVE-2025-11414 | libbinutils | 2.44-3 | | binutils: GNU Binutils Linker elflink.c get_link_hash_entry out-of-bounds |
| LOW | | 5.3 | | CVE-2025-1147 | libbinutils | 2.44-3 | | binutils: GNU Binutils nm nm.c internal_strlen buffer overflow |
| LOW | | 3.1 | | CVE-2025-1148 | libbinutils | 2.44-3 | | binutils: GNU Binutils ld ldelfgen.c link_order_scan memory leak |
| LOW | | 3.1 | | CVE-2025-1149 | libbinutils | 2.44-3 | | binutils: GNU Binutils ld xmalloc.c xstrdup memory leak |
| LOW | | 5.5 | | CVE-2025-11494 | libbinutils | 2.44-3 | | binutils: GNU Binutils Linker out-of-bounds read |
| LOW | | 5.5 | | CVE-2025-11495 | libbinutils | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 3.1 | | CVE-2025-1150 | libbinutils | 2.44-3 | | binutils: GNU Binutils ld libbfd.c bfd_malloc memory leak |
| LOW | | 3.1 | | CVE-2025-1151 | libbinutils | 2.44-3 | | binutils: GNU Binutils ld xmemdup.c xmemdup memory leak |
| LOW | | 3.7 | | CVE-2025-1152 | libbinutils | 2.44-3 | | binutils: GNU Binutils ld xstrdup.c xstrdup memory leak |
| LOW | | 5.9 | | CVE-2025-1153 | libbinutils | 2.44-3 | | binutils: GNU Binutils format.c bfd_set_format memory corruption |
| LOW | | 5 | | CVE-2025-1176 | libbinutils | 2.44-3 | | binutils: GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec heap-based overflow |
| LOW | | 5.6 | | CVE-2025-1178 | libbinutils | 2.44-3 | | binutils: GNU Binutils ld libbfd.c bfd_putl64 memory corruption |
| LOW | | 3.1 | | CVE-2025-1180 | libbinutils | 2.44-3 | | binutils: GNU Binutils ld elf-eh-frame.c _bfd_elf_write_section_eh_frame memory corruption |
| LOW | | 5 | | CVE-2025-1181 | libbinutils | 2.44-3 | | binutils: GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec memory corruption |
| LOW | | 5 | | CVE-2025-1182 | libbinutils | 2.44-3 | | binutils: GNU Binutils ld elflink.c bfd_elf_reloc_symbol_deleted_p memory corruption |
| LOW | | 5.5 | | CVE-2025-11839 | libbinutils | 2.44-3 | | binutils: GNU Binutils prdbg.c tg_tag_type return value |
| LOW | | 5.5 | | CVE-2025-11840 | libbinutils | 2.44-3 | | binutils: GNU Binutils out-of-bounds read |
| LOW | | 5.5 | | CVE-2025-3198 | libbinutils | 2.44-3 | | binutils: GNU Binutils objdump bucomm.c display_info memory leak |
| LOW | | 7.8 | | CVE-2025-5244 | libbinutils | 2.44-3 | | binutils: GNU Binutils ld elflink.c elf_gc_sweep memory corruption |
| LOW | | 7.8 | | CVE-2025-5245 | libbinutils | 2.44-3 | | binutils: GNU Binutils objdump debug.c debug_type_samep memory corruption |
| LOW | | 3.3 | | CVE-2025-66861 | libbinutils | 2.44-3 | | binutils: out-of-bounds read in d_unqualified_name() in cp-demangle.c |
| LOW | | 3.3 | | CVE-2025-66862 | libbinutils | 2.44-3 | | binutils: heap-based buffer over-read in gnu_special() in cplus-dem.c |
| LOW | | 3.3 | | CVE-2025-66863 | libbinutils | 2.44-3 | | binutils: BinUtils: Denial of Service via crafted PE file |
| LOW | | 7.5 | | CVE-2025-66864 | libbinutils | 2.44-3 | | binutils: NULL pointer dereference in d_print_comp_inner() in cp-demangle.c |
| LOW | | 3.3 | | CVE-2025-66865 | libbinutils | 2.44-3 | | binutils: stack overflow in d_print_comp_inner() in cp-demangle.c |
| LOW | | 7.5 | | CVE-2025-66866 | libbinutils | 2.44-3 | | binutils: BinUtils: Denial of Service via crafted PE file |
| LOW | | 2.8 | | CVE-2025-69644 | libbinutils | 2.44-3 | | binutils: Binutils: Denial of Service via crafted binary with malformed DWARF debug information |
| LOW | | 2.8 | | CVE-2025-69645 | libbinutils | 2.44-3 | | binutils: Binutils objdump: Denial of Service via crafted DWARF debug information |
| LOW | | 2.8 | | CVE-2025-69646 | libbinutils | 2.44-3 | | binutils: Binutils: Denial of Service via malformed DWARF debug_rnglists data |
| LOW | | 3.3 | | CVE-2025-69647 | libbinutils | 2.44-3 | | binutils: infinite loop in readelf via crafted binary with malformed DWARF loclists data |
| LOW | | 3.3 | | CVE-2025-69648 | libbinutils | 2.44-3 | | binutils: infinite loop in readelf via crafted binary with malformed DWARF .debug_rnglists data |
| LOW | | 7.5 | | CVE-2025-69649 | libbinutils | 2.44-3 | | binutils: NULL pointer dereference in readelf via crafted ELF binary with malformed header fields |
| LOW | | 7.5 | | CVE-2025-69650 | libbinutils | 2.44-3 | | binutils: double free in readelf via crafted ELF binary with malformed relocation data |
| LOW | | 5.5 | | CVE-2025-69651 | libbinutils | 2.44-3 | | binutils: Binutils: Denial of Service via crafted ELF binary processing |
| LOW | | 3.3 | | CVE-2025-69652 | libbinutils | 2.44-3 | | binutils: abort in readelf via crafted ELF binary with malformed DWARF abbrev or debug information |
| LOW | | 7.8 | | CVE-2025-7545 | libbinutils | 2.44-3 | | binutils: Binutils: Heap Buffer Overflow |
| LOW | | 7.8 | | CVE-2025-7546 | libbinutils | 2.44-3 | | binutils: Binutils: Out-of-bounds Write Vulnerability |
| LOW | | 3.3 | | CVE-2025-8225 | libbinutils | 2.44-3 | | binutils: Binutils DWARF Section Handler Memory Leak |
| LOW | | 5.6 | | CVE-2026-15003 | libbinutils | 2.44-3 | | binutils: GNU Binutils: Heap-buffer-overflow in linker leads to information disclosure and denial of service |
| LOW | | 7.8 | | CVE-2026-18220 | libbinutils | 2.44-3 | | binutils: binutils: Out-of-bounds write in BFD DLX ELF backend relocation processing |
| LOW | | 5.5 | | CVE-2026-19548 | libbinutils | 2.44-3 | | binutils: binutils: Multiple Use-After-Free in add_archive_element via LTO plugin processing |
| LOW | | 7.1 | | CVE-2026-3441 | libbinutils | 2.44-3 | | binutils: GNU Binutils: Information disclosure via specially crafted XCOFF object file |
| LOW | | 7.1 | | CVE-2026-3442 | libbinutils | 2.44-3 | | binutils: GNU Binutils: Information disclosure or denial of service via out-of-bounds read in bfd linker |
| LOW | | 6.1 | | CVE-2026-4647 | libbinutils | 2.44-3 | | binutils: Out-of-Bounds Read in XCOFF Relocation Processing in GNU Binutils BFD Library |
| LOW | | 5.5 | | CVE-2026-6844 | libbinutils | 2.44-3 | | binutils: Binutils: Denial of Service vulnerabilities in readelf via crafted ELF files |
| LOW | | 5 | | CVE-2026-6845 | libbinutils | 2.44-3 | | binutils: Binutils: Denial of Service via crafted ELF file |
| LOW | | 7.8 | | CVE-2026-6846 | libbinutils | 2.44-3 | | binutils: Binutils: Arbitrary code execution via malformed XCOFF object file processing |
| LOW | | 6.6 | | CVE-2026-90801 | libbinutils | 2.44-3 | | binutils: GNU Binutils ld: Buffer overflow in cache_bwrite via nbytes manipulation |
| LOW | | 5 | | CVE-2026-90802 | libbinutils | 2.44-3 | | binutils: GNU Binutils: Denial of service via null pointer dereference in ld component |
| LOW | | 6.8 | | CVE-2026-90803 | libbinutils | 2.44-3 | | binutils: GNU Binutils ld: Buffer Overflow via Malformed Relocation |
| LOW | | 6.1 | | CVE-2026-90804 | libbinutils | 2.44-3 | | binutils: GNU Binutils: Buffer overflow in Eh Frame Section Handler can lead to denial of service |
| LOW | | 6.6 | | CVE-2026-90828 | libbinutils | 2.44-3 | | binutils: GNU Binutils: Null pointer dereference via elf_orphan_compatible function |
| LOW | | 6.6 | | CVE-2026-90829 | libbinutils | 2.44-3 | | binutils: GNU Binutils: Null pointer dereference via SHT_GROUP Section manipulation |
| LOW | | 5.5 | | CVE-2026-90830 | libbinutils | 2.44-3 | | binutils: GNU Binutils: Local denial of service via null pointer dereference in Section Merge |
| LOW | | 6.6 | | CVE-2026-90831 | libbinutils | 2.44-3 | | binutils: GNU Binutils: Memory corruption via local manipulation of ELF String Table |
| LOW | | 5.5 | | CVE-2026-91779 | libbinutils | 2.44-3 | | binutils: GNU Binutils: Denial of Service via null pointer dereference |
| LOW | | 5 | | CVE-2026-91780 | libbinutils | 2.44-3 | | binutils: GNU Binutils: Local denial of service via null pointer dereference |
| LOW | | 3.3 | | CVE-2026-91781 | libbinutils | 2.44-3 | | binutils: GNU Binutils: Local denial of service vulnerability |
| LOW | | 5.5 | | CVE-2026-91782 | libbinutils | 2.44-3 | | binutils: GNU Binutils: Denial of Service via null pointer dereference |
| LOW | | 5.5 | | CVE-2022-0563 | libblkid1 | 2.41-5 | | util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline |
| LOW | | 6.1 | | CVE-2025-14104 | libblkid1 | 2.41-5 | 2.41.3-1 | util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames |
| LOW | | 3.3 | | CVE-2026-111581 | libblockdev-crypto3 | 3.3.0-2.1 | | libblockdev: libblockdev: argument injection in NTFS/VFAT label-setting helpers via udisks2 SetLabel() D-Bus method |
| LOW | | 3.3 | | CVE-2026-111581 | libblockdev-fs3 | 3.3.0-2.1 | | libblockdev: libblockdev: argument injection in NTFS/VFAT label-setting helpers via udisks2 SetLabel() D-Bus method |
| LOW | | 3.3 | | CVE-2026-111581 | libblockdev-loop3 | 3.3.0-2.1 | | libblockdev: libblockdev: argument injection in NTFS/VFAT label-setting helpers via udisks2 SetLabel() D-Bus method |
| LOW | | 3.3 | | CVE-2026-111581 | libblockdev-mdraid3 | 3.3.0-2.1 | | libblockdev: libblockdev: argument injection in NTFS/VFAT label-setting helpers via udisks2 SetLabel() D-Bus method |
| LOW | | 3.3 | | CVE-2026-111581 | libblockdev-nvme3 | 3.3.0-2.1 | | libblockdev: libblockdev: argument injection in NTFS/VFAT label-setting helpers via udisks2 SetLabel() D-Bus method |
| LOW | | 3.3 | | CVE-2026-111581 | libblockdev-part3 | 3.3.0-2.1 | | libblockdev: libblockdev: argument injection in NTFS/VFAT label-setting helpers via udisks2 SetLabel() D-Bus method |
| LOW | | 3.3 | | CVE-2026-111581 | libblockdev-swap3 | 3.3.0-2.1 | | libblockdev: libblockdev: argument injection in NTFS/VFAT label-setting helpers via udisks2 SetLabel() D-Bus method |
| LOW | | 3.3 | | CVE-2026-111581 | libblockdev-utils3 | 3.3.0-2.1 | | libblockdev: libblockdev: argument injection in NTFS/VFAT label-setting helpers via udisks2 SetLabel() D-Bus method |
| LOW | | 3.3 | | CVE-2026-111581 | libblockdev3 | 3.3.0-2.1 | | libblockdev: libblockdev: argument injection in NTFS/VFAT label-setting helpers via udisks2 SetLabel() D-Bus method |
| LOW | | 5.3 | | CVE-2016-9797 | libbluetooth3 | 5.82-1.1+rpt1 | | bluez: buffer over-read in l2cap_dump() |
| LOW | | 5.3 | | CVE-2016-9798 | libbluetooth3 | 5.82-1.1+rpt1 | | bluez: use-after-free in conf_opt() |
| LOW | | 5.3 | | CVE-2016-9799 | libbluetooth3 | 5.82-1.1+rpt1 | | bluez: buffer overflow in pklg_read_hci() |
| LOW | | 5.3 | | CVE-2016-9800 | libbluetooth3 | 5.82-1.1+rpt1 | | bluez: buffer overflow in pin_code_reply_dump() |
| LOW | | 5.3 | | CVE-2016-9801 | libbluetooth3 | 5.82-1.1+rpt1 | | bluez: buffer overflow in set_ext_ctrl() |
| LOW | | 5.3 | | CVE-2016-9802 | libbluetooth3 | 5.82-1.1+rpt1 | | bluez: buffer over-read in l2cap_packet() |
| LOW | | 5.3 | | CVE-2016-9803 | libbluetooth3 | 5.82-1.1+rpt1 | | bluez: out-of-bounds read in le_meta_ev_dump() |
| LOW | | 5.3 | | CVE-2016-9804 | libbluetooth3 | 5.82-1.1+rpt1 | | bluez: buffer overflow in commands_dump() |
| LOW | | 7.5 | | CVE-2016-9917 | libbluetooth3 | 5.82-1.1+rpt1 | | bluez: Heap-based buffer overflow vulnerability in read_n() |
| LOW | | 7.5 | | CVE-2016-9918 | libbluetooth3 | 5.82-1.1+rpt1 | | bluez: Out of bounds stack read in packet_hexdump() |
| LOW | | 5.5 | | CVE-2026-105460 | libbluetooth3 | 5.82-1.1+rpt1 | | bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt() |
| LOW | | 5 | | CVE-2010-4756 | libc-bin | 2.41-12+rpt1+deb13u3 | | glibc: glob implementation can cause excessive CPU and memory consumption due to crafted glob expressions |
| LOW | | 7.5 | | CVE-2018-20796 | libc-bin | 2.41-12+rpt1+deb13u3 | | glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c |
| LOW | | 9.8 | | CVE-2019-1010022 | libc-bin | 2.41-12+rpt1+deb13u3 | | glibc: stack guard protection bypass |
| LOW | | 8.8 | | CVE-2019-1010023 | libc-bin | 2.41-12+rpt1+deb13u3 | | glibc: running ldd on malicious ELF leads to code execution because of wrong size computation |
| LOW | | 5.3 | | CVE-2019-1010024 | libc-bin | 2.41-12+rpt1+deb13u3 | | glibc: ASLR bypass using cache of thread stack and heap |
| LOW | | 5.3 | | CVE-2019-1010025 | libc-bin | 2.41-12+rpt1+deb13u3 | | glibc: information disclosure of heap addresses of pthread_created thread |
| LOW | | 7.5 | | CVE-2019-9192 | libc-bin | 2.41-12+rpt1+deb13u3 | | glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c |
| LOW | | 3.7 | | CVE-2026-97399 | libc-bin | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp |
| LOW | | 5 | | CVE-2010-4756 | libc-dev-bin | 2.41-12+rpt1+deb13u3 | | glibc: glob implementation can cause excessive CPU and memory consumption due to crafted glob expressions |
| LOW | | 7.5 | | CVE-2018-20796 | libc-dev-bin | 2.41-12+rpt1+deb13u3 | | glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c |
| LOW | | 9.8 | | CVE-2019-1010022 | libc-dev-bin | 2.41-12+rpt1+deb13u3 | | glibc: stack guard protection bypass |
| LOW | | 8.8 | | CVE-2019-1010023 | libc-dev-bin | 2.41-12+rpt1+deb13u3 | | glibc: running ldd on malicious ELF leads to code execution because of wrong size computation |
| LOW | | 5.3 | | CVE-2019-1010024 | libc-dev-bin | 2.41-12+rpt1+deb13u3 | | glibc: ASLR bypass using cache of thread stack and heap |
| LOW | | 5.3 | | CVE-2019-1010025 | libc-dev-bin | 2.41-12+rpt1+deb13u3 | | glibc: information disclosure of heap addresses of pthread_created thread |
| LOW | | 7.5 | | CVE-2019-9192 | libc-dev-bin | 2.41-12+rpt1+deb13u3 | | glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c |
| LOW | | 3.7 | | CVE-2026-97399 | libc-dev-bin | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp |
| LOW | | 5 | | CVE-2010-4756 | libc-l10n | 2.41-12+rpt1+deb13u3 | | glibc: glob implementation can cause excessive CPU and memory consumption due to crafted glob expressions |
| LOW | | 7.5 | | CVE-2018-20796 | libc-l10n | 2.41-12+rpt1+deb13u3 | | glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c |
| LOW | | 9.8 | | CVE-2019-1010022 | libc-l10n | 2.41-12+rpt1+deb13u3 | | glibc: stack guard protection bypass |
| LOW | | 8.8 | | CVE-2019-1010023 | libc-l10n | 2.41-12+rpt1+deb13u3 | | glibc: running ldd on malicious ELF leads to code execution because of wrong size computation |
| LOW | | 5.3 | | CVE-2019-1010024 | libc-l10n | 2.41-12+rpt1+deb13u3 | | glibc: ASLR bypass using cache of thread stack and heap |
| LOW | | 5.3 | | CVE-2019-1010025 | libc-l10n | 2.41-12+rpt1+deb13u3 | | glibc: information disclosure of heap addresses of pthread_created thread |
| LOW | | 7.5 | | CVE-2019-9192 | libc-l10n | 2.41-12+rpt1+deb13u3 | | glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c |
| LOW | | 3.7 | | CVE-2026-97399 | libc-l10n | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp |
| LOW | | 5 | | CVE-2010-4756 | libc6-dev | 2.41-12+rpt1+deb13u3 | | glibc: glob implementation can cause excessive CPU and memory consumption due to crafted glob expressions |
| LOW | | 7.5 | | CVE-2018-20796 | libc6-dev | 2.41-12+rpt1+deb13u3 | | glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c |
| LOW | | 9.8 | | CVE-2019-1010022 | libc6-dev | 2.41-12+rpt1+deb13u3 | | glibc: stack guard protection bypass |
| LOW | | 8.8 | | CVE-2019-1010023 | libc6-dev | 2.41-12+rpt1+deb13u3 | | glibc: running ldd on malicious ELF leads to code execution because of wrong size computation |
| LOW | | 5.3 | | CVE-2019-1010024 | libc6-dev | 2.41-12+rpt1+deb13u3 | | glibc: ASLR bypass using cache of thread stack and heap |
| LOW | | 5.3 | | CVE-2019-1010025 | libc6-dev | 2.41-12+rpt1+deb13u3 | | glibc: information disclosure of heap addresses of pthread_created thread |
| LOW | | 7.5 | | CVE-2019-9192 | libc6-dev | 2.41-12+rpt1+deb13u3 | | glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c |
| LOW | | 3.7 | | CVE-2026-97399 | libc6-dev | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp |
| LOW | | 5 | | CVE-2010-4756 | libc6 | 2.41-12+rpt1+deb13u3 | | glibc: glob implementation can cause excessive CPU and memory consumption due to crafted glob expressions |
| LOW | | 7.5 | | CVE-2018-20796 | libc6 | 2.41-12+rpt1+deb13u3 | | glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c |
| LOW | | 9.8 | | CVE-2019-1010022 | libc6 | 2.41-12+rpt1+deb13u3 | | glibc: stack guard protection bypass |
| LOW | | 8.8 | | CVE-2019-1010023 | libc6 | 2.41-12+rpt1+deb13u3 | | glibc: running ldd on malicious ELF leads to code execution because of wrong size computation |
| LOW | | 5.3 | | CVE-2019-1010024 | libc6 | 2.41-12+rpt1+deb13u3 | | glibc: ASLR bypass using cache of thread stack and heap |
| LOW | | 5.3 | | CVE-2019-1010025 | libc6 | 2.41-12+rpt1+deb13u3 | | glibc: information disclosure of heap addresses of pthread_created thread |
| LOW | | 7.5 | | CVE-2019-9192 | libc6 | 2.41-12+rpt1+deb13u3 | | glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c |
| LOW | | 3.7 | | CVE-2026-97399 | libc6 | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp |
| LOW | | 5.5 | | CVE-2017-13716 | libctf-nobfd0 | 2.44-3 | | binutils: Memory leak with the C++ symbol demangler routine in libiberty |
| LOW | | 5.5 | | CVE-2018-20673 | libctf-nobfd0 | 2.44-3 | | libiberty: Integer overflow in demangle_template() function |
| LOW | | 6.5 | | CVE-2018-20712 | libctf-nobfd0 | 2.44-3 | | libiberty: heap-based buffer over-read in d_expression_1 |
| LOW | | 5.5 | | CVE-2018-9996 | libctf-nobfd0 | 2.44-3 | | binutils: Stack-overflow in libiberty/cplus-dem.c causes crash |
| LOW | | 6.5 | | CVE-2021-32256 | libctf-nobfd0 | 2.44-3 | | binutils: stack-overflow issue in demangle_type in rust-demangle.c. |
| LOW | | 5.5 | | CVE-2025-11081 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils out-of-bounds read |
| LOW | | 7.8 | | CVE-2025-11082 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 7.8 | | CVE-2025-11083 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 5.5 | | CVE-2025-11412 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils Linker elflink.c bfd_elf_gc_record_vtentry out-of-bounds |
| LOW | | 5.5 | | CVE-2025-11413 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds |
| LOW | | 5.5 | | CVE-2025-11414 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils Linker elflink.c get_link_hash_entry out-of-bounds |
| LOW | | 5.3 | | CVE-2025-1147 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils nm nm.c internal_strlen buffer overflow |
| LOW | | 3.1 | | CVE-2025-1148 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils ld ldelfgen.c link_order_scan memory leak |
| LOW | | 3.1 | | CVE-2025-1149 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils ld xmalloc.c xstrdup memory leak |
| LOW | | 5.5 | | CVE-2025-11494 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils Linker out-of-bounds read |
| LOW | | 5.5 | | CVE-2025-11495 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 3.1 | | CVE-2025-1150 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils ld libbfd.c bfd_malloc memory leak |
| LOW | | 3.1 | | CVE-2025-1151 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils ld xmemdup.c xmemdup memory leak |
| LOW | | 3.7 | | CVE-2025-1152 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils ld xstrdup.c xstrdup memory leak |
| LOW | | 5.9 | | CVE-2025-1153 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils format.c bfd_set_format memory corruption |
| LOW | | 5 | | CVE-2025-1176 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec heap-based overflow |
| LOW | | 5.6 | | CVE-2025-1178 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils ld libbfd.c bfd_putl64 memory corruption |
| LOW | | 3.1 | | CVE-2025-1180 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils ld elf-eh-frame.c _bfd_elf_write_section_eh_frame memory corruption |
| LOW | | 5 | | CVE-2025-1181 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec memory corruption |
| LOW | | 5 | | CVE-2025-1182 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils ld elflink.c bfd_elf_reloc_symbol_deleted_p memory corruption |
| LOW | | 5.5 | | CVE-2025-11839 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils prdbg.c tg_tag_type return value |
| LOW | | 5.5 | | CVE-2025-11840 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils out-of-bounds read |
| LOW | | 5.5 | | CVE-2025-3198 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils objdump bucomm.c display_info memory leak |
| LOW | | 7.8 | | CVE-2025-5244 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils ld elflink.c elf_gc_sweep memory corruption |
| LOW | | 7.8 | | CVE-2025-5245 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils objdump debug.c debug_type_samep memory corruption |
| LOW | | 3.3 | | CVE-2025-66861 | libctf-nobfd0 | 2.44-3 | | binutils: out-of-bounds read in d_unqualified_name() in cp-demangle.c |
| LOW | | 3.3 | | CVE-2025-66862 | libctf-nobfd0 | 2.44-3 | | binutils: heap-based buffer over-read in gnu_special() in cplus-dem.c |
| LOW | | 3.3 | | CVE-2025-66863 | libctf-nobfd0 | 2.44-3 | | binutils: BinUtils: Denial of Service via crafted PE file |
| LOW | | 7.5 | | CVE-2025-66864 | libctf-nobfd0 | 2.44-3 | | binutils: NULL pointer dereference in d_print_comp_inner() in cp-demangle.c |
| LOW | | 3.3 | | CVE-2025-66865 | libctf-nobfd0 | 2.44-3 | | binutils: stack overflow in d_print_comp_inner() in cp-demangle.c |
| LOW | | 7.5 | | CVE-2025-66866 | libctf-nobfd0 | 2.44-3 | | binutils: BinUtils: Denial of Service via crafted PE file |
| LOW | | 2.8 | | CVE-2025-69644 | libctf-nobfd0 | 2.44-3 | | binutils: Binutils: Denial of Service via crafted binary with malformed DWARF debug information |
| LOW | | 2.8 | | CVE-2025-69645 | libctf-nobfd0 | 2.44-3 | | binutils: Binutils objdump: Denial of Service via crafted DWARF debug information |
| LOW | | 2.8 | | CVE-2025-69646 | libctf-nobfd0 | 2.44-3 | | binutils: Binutils: Denial of Service via malformed DWARF debug_rnglists data |
| LOW | | 3.3 | | CVE-2025-69647 | libctf-nobfd0 | 2.44-3 | | binutils: infinite loop in readelf via crafted binary with malformed DWARF loclists data |
| LOW | | 3.3 | | CVE-2025-69648 | libctf-nobfd0 | 2.44-3 | | binutils: infinite loop in readelf via crafted binary with malformed DWARF .debug_rnglists data |
| LOW | | 7.5 | | CVE-2025-69649 | libctf-nobfd0 | 2.44-3 | | binutils: NULL pointer dereference in readelf via crafted ELF binary with malformed header fields |
| LOW | | 7.5 | | CVE-2025-69650 | libctf-nobfd0 | 2.44-3 | | binutils: double free in readelf via crafted ELF binary with malformed relocation data |
| LOW | | 5.5 | | CVE-2025-69651 | libctf-nobfd0 | 2.44-3 | | binutils: Binutils: Denial of Service via crafted ELF binary processing |
| LOW | | 3.3 | | CVE-2025-69652 | libctf-nobfd0 | 2.44-3 | | binutils: abort in readelf via crafted ELF binary with malformed DWARF abbrev or debug information |
| LOW | | 7.8 | | CVE-2025-7545 | libctf-nobfd0 | 2.44-3 | | binutils: Binutils: Heap Buffer Overflow |
| LOW | | 7.8 | | CVE-2025-7546 | libctf-nobfd0 | 2.44-3 | | binutils: Binutils: Out-of-bounds Write Vulnerability |
| LOW | | 3.3 | | CVE-2025-8225 | libctf-nobfd0 | 2.44-3 | | binutils: Binutils DWARF Section Handler Memory Leak |
| LOW | | 5.6 | | CVE-2026-15003 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils: Heap-buffer-overflow in linker leads to information disclosure and denial of service |
| LOW | | 7.8 | | CVE-2026-18220 | libctf-nobfd0 | 2.44-3 | | binutils: binutils: Out-of-bounds write in BFD DLX ELF backend relocation processing |
| LOW | | 5.5 | | CVE-2026-19548 | libctf-nobfd0 | 2.44-3 | | binutils: binutils: Multiple Use-After-Free in add_archive_element via LTO plugin processing |
| LOW | | 7.1 | | CVE-2026-3441 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils: Information disclosure via specially crafted XCOFF object file |
| LOW | | 7.1 | | CVE-2026-3442 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils: Information disclosure or denial of service via out-of-bounds read in bfd linker |
| LOW | | 6.1 | | CVE-2026-4647 | libctf-nobfd0 | 2.44-3 | | binutils: Out-of-Bounds Read in XCOFF Relocation Processing in GNU Binutils BFD Library |
| LOW | | 5.5 | | CVE-2026-6844 | libctf-nobfd0 | 2.44-3 | | binutils: Binutils: Denial of Service vulnerabilities in readelf via crafted ELF files |
| LOW | | 5 | | CVE-2026-6845 | libctf-nobfd0 | 2.44-3 | | binutils: Binutils: Denial of Service via crafted ELF file |
| LOW | | 7.8 | | CVE-2026-6846 | libctf-nobfd0 | 2.44-3 | | binutils: Binutils: Arbitrary code execution via malformed XCOFF object file processing |
| LOW | | 6.6 | | CVE-2026-90801 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils ld: Buffer overflow in cache_bwrite via nbytes manipulation |
| LOW | | 5 | | CVE-2026-90802 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils: Denial of service via null pointer dereference in ld component |
| LOW | | 6.8 | | CVE-2026-90803 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils ld: Buffer Overflow via Malformed Relocation |
| LOW | | 6.1 | | CVE-2026-90804 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils: Buffer overflow in Eh Frame Section Handler can lead to denial of service |
| LOW | | 6.6 | | CVE-2026-90828 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils: Null pointer dereference via elf_orphan_compatible function |
| LOW | | 6.6 | | CVE-2026-90829 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils: Null pointer dereference via SHT_GROUP Section manipulation |
| LOW | | 5.5 | | CVE-2026-90830 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils: Local denial of service via null pointer dereference in Section Merge |
| LOW | | 6.6 | | CVE-2026-90831 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils: Memory corruption via local manipulation of ELF String Table |
| LOW | | 5.5 | | CVE-2026-91779 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils: Denial of Service via null pointer dereference |
| LOW | | 5 | | CVE-2026-91780 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils: Local denial of service via null pointer dereference |
| LOW | | 3.3 | | CVE-2026-91781 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils: Local denial of service vulnerability |
| LOW | | 5.5 | | CVE-2026-91782 | libctf-nobfd0 | 2.44-3 | | binutils: GNU Binutils: Denial of Service via null pointer dereference |
| LOW | | 5.5 | | CVE-2017-13716 | libctf0 | 2.44-3 | | binutils: Memory leak with the C++ symbol demangler routine in libiberty |
| LOW | | 5.5 | | CVE-2018-20673 | libctf0 | 2.44-3 | | libiberty: Integer overflow in demangle_template() function |
| LOW | | 6.5 | | CVE-2018-20712 | libctf0 | 2.44-3 | | libiberty: heap-based buffer over-read in d_expression_1 |
| LOW | | 5.5 | | CVE-2018-9996 | libctf0 | 2.44-3 | | binutils: Stack-overflow in libiberty/cplus-dem.c causes crash |
| LOW | | 6.5 | | CVE-2021-32256 | libctf0 | 2.44-3 | | binutils: stack-overflow issue in demangle_type in rust-demangle.c. |
| LOW | | 5.5 | | CVE-2025-11081 | libctf0 | 2.44-3 | | binutils: GNU Binutils out-of-bounds read |
| LOW | | 7.8 | | CVE-2025-11082 | libctf0 | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 7.8 | | CVE-2025-11083 | libctf0 | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 5.5 | | CVE-2025-11412 | libctf0 | 2.44-3 | | binutils: GNU Binutils Linker elflink.c bfd_elf_gc_record_vtentry out-of-bounds |
| LOW | | 5.5 | | CVE-2025-11413 | libctf0 | 2.44-3 | | binutils: GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds |
| LOW | | 5.5 | | CVE-2025-11414 | libctf0 | 2.44-3 | | binutils: GNU Binutils Linker elflink.c get_link_hash_entry out-of-bounds |
| LOW | | 5.3 | | CVE-2025-1147 | libctf0 | 2.44-3 | | binutils: GNU Binutils nm nm.c internal_strlen buffer overflow |
| LOW | | 3.1 | | CVE-2025-1148 | libctf0 | 2.44-3 | | binutils: GNU Binutils ld ldelfgen.c link_order_scan memory leak |
| LOW | | 3.1 | | CVE-2025-1149 | libctf0 | 2.44-3 | | binutils: GNU Binutils ld xmalloc.c xstrdup memory leak |
| LOW | | 5.5 | | CVE-2025-11494 | libctf0 | 2.44-3 | | binutils: GNU Binutils Linker out-of-bounds read |
| LOW | | 5.5 | | CVE-2025-11495 | libctf0 | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 3.1 | | CVE-2025-1150 | libctf0 | 2.44-3 | | binutils: GNU Binutils ld libbfd.c bfd_malloc memory leak |
| LOW | | 3.1 | | CVE-2025-1151 | libctf0 | 2.44-3 | | binutils: GNU Binutils ld xmemdup.c xmemdup memory leak |
| LOW | | 3.7 | | CVE-2025-1152 | libctf0 | 2.44-3 | | binutils: GNU Binutils ld xstrdup.c xstrdup memory leak |
| LOW | | 5.9 | | CVE-2025-1153 | libctf0 | 2.44-3 | | binutils: GNU Binutils format.c bfd_set_format memory corruption |
| LOW | | 5 | | CVE-2025-1176 | libctf0 | 2.44-3 | | binutils: GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec heap-based overflow |
| LOW | | 5.6 | | CVE-2025-1178 | libctf0 | 2.44-3 | | binutils: GNU Binutils ld libbfd.c bfd_putl64 memory corruption |
| LOW | | 3.1 | | CVE-2025-1180 | libctf0 | 2.44-3 | | binutils: GNU Binutils ld elf-eh-frame.c _bfd_elf_write_section_eh_frame memory corruption |
| LOW | | 5 | | CVE-2025-1181 | libctf0 | 2.44-3 | | binutils: GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec memory corruption |
| LOW | | 5 | | CVE-2025-1182 | libctf0 | 2.44-3 | | binutils: GNU Binutils ld elflink.c bfd_elf_reloc_symbol_deleted_p memory corruption |
| LOW | | 5.5 | | CVE-2025-11839 | libctf0 | 2.44-3 | | binutils: GNU Binutils prdbg.c tg_tag_type return value |
| LOW | | 5.5 | | CVE-2025-11840 | libctf0 | 2.44-3 | | binutils: GNU Binutils out-of-bounds read |
| LOW | | 5.5 | | CVE-2025-3198 | libctf0 | 2.44-3 | | binutils: GNU Binutils objdump bucomm.c display_info memory leak |
| LOW | | 7.8 | | CVE-2025-5244 | libctf0 | 2.44-3 | | binutils: GNU Binutils ld elflink.c elf_gc_sweep memory corruption |
| LOW | | 7.8 | | CVE-2025-5245 | libctf0 | 2.44-3 | | binutils: GNU Binutils objdump debug.c debug_type_samep memory corruption |
| LOW | | 3.3 | | CVE-2025-66861 | libctf0 | 2.44-3 | | binutils: out-of-bounds read in d_unqualified_name() in cp-demangle.c |
| LOW | | 3.3 | | CVE-2025-66862 | libctf0 | 2.44-3 | | binutils: heap-based buffer over-read in gnu_special() in cplus-dem.c |
| LOW | | 3.3 | | CVE-2025-66863 | libctf0 | 2.44-3 | | binutils: BinUtils: Denial of Service via crafted PE file |
| LOW | | 7.5 | | CVE-2025-66864 | libctf0 | 2.44-3 | | binutils: NULL pointer dereference in d_print_comp_inner() in cp-demangle.c |
| LOW | | 3.3 | | CVE-2025-66865 | libctf0 | 2.44-3 | | binutils: stack overflow in d_print_comp_inner() in cp-demangle.c |
| LOW | | 7.5 | | CVE-2025-66866 | libctf0 | 2.44-3 | | binutils: BinUtils: Denial of Service via crafted PE file |
| LOW | | 2.8 | | CVE-2025-69644 | libctf0 | 2.44-3 | | binutils: Binutils: Denial of Service via crafted binary with malformed DWARF debug information |
| LOW | | 2.8 | | CVE-2025-69645 | libctf0 | 2.44-3 | | binutils: Binutils objdump: Denial of Service via crafted DWARF debug information |
| LOW | | 2.8 | | CVE-2025-69646 | libctf0 | 2.44-3 | | binutils: Binutils: Denial of Service via malformed DWARF debug_rnglists data |
| LOW | | 3.3 | | CVE-2025-69647 | libctf0 | 2.44-3 | | binutils: infinite loop in readelf via crafted binary with malformed DWARF loclists data |
| LOW | | 3.3 | | CVE-2025-69648 | libctf0 | 2.44-3 | | binutils: infinite loop in readelf via crafted binary with malformed DWARF .debug_rnglists data |
| LOW | | 7.5 | | CVE-2025-69649 | libctf0 | 2.44-3 | | binutils: NULL pointer dereference in readelf via crafted ELF binary with malformed header fields |
| LOW | | 7.5 | | CVE-2025-69650 | libctf0 | 2.44-3 | | binutils: double free in readelf via crafted ELF binary with malformed relocation data |
| LOW | | 5.5 | | CVE-2025-69651 | libctf0 | 2.44-3 | | binutils: Binutils: Denial of Service via crafted ELF binary processing |
| LOW | | 3.3 | | CVE-2025-69652 | libctf0 | 2.44-3 | | binutils: abort in readelf via crafted ELF binary with malformed DWARF abbrev or debug information |
| LOW | | 7.8 | | CVE-2025-7545 | libctf0 | 2.44-3 | | binutils: Binutils: Heap Buffer Overflow |
| LOW | | 7.8 | | CVE-2025-7546 | libctf0 | 2.44-3 | | binutils: Binutils: Out-of-bounds Write Vulnerability |
| LOW | | 3.3 | | CVE-2025-8225 | libctf0 | 2.44-3 | | binutils: Binutils DWARF Section Handler Memory Leak |
| LOW | | 5.6 | | CVE-2026-15003 | libctf0 | 2.44-3 | | binutils: GNU Binutils: Heap-buffer-overflow in linker leads to information disclosure and denial of service |
| LOW | | 7.8 | | CVE-2026-18220 | libctf0 | 2.44-3 | | binutils: binutils: Out-of-bounds write in BFD DLX ELF backend relocation processing |
| LOW | | 5.5 | | CVE-2026-19548 | libctf0 | 2.44-3 | | binutils: binutils: Multiple Use-After-Free in add_archive_element via LTO plugin processing |
| LOW | | 7.1 | | CVE-2026-3441 | libctf0 | 2.44-3 | | binutils: GNU Binutils: Information disclosure via specially crafted XCOFF object file |
| LOW | | 7.1 | | CVE-2026-3442 | libctf0 | 2.44-3 | | binutils: GNU Binutils: Information disclosure or denial of service via out-of-bounds read in bfd linker |
| LOW | | 6.1 | | CVE-2026-4647 | libctf0 | 2.44-3 | | binutils: Out-of-Bounds Read in XCOFF Relocation Processing in GNU Binutils BFD Library |
| LOW | | 5.5 | | CVE-2026-6844 | libctf0 | 2.44-3 | | binutils: Binutils: Denial of Service vulnerabilities in readelf via crafted ELF files |
| LOW | | 5 | | CVE-2026-6845 | libctf0 | 2.44-3 | | binutils: Binutils: Denial of Service via crafted ELF file |
| LOW | | 7.8 | | CVE-2026-6846 | libctf0 | 2.44-3 | | binutils: Binutils: Arbitrary code execution via malformed XCOFF object file processing |
| LOW | | 6.6 | | CVE-2026-90801 | libctf0 | 2.44-3 | | binutils: GNU Binutils ld: Buffer overflow in cache_bwrite via nbytes manipulation |
| LOW | | 5 | | CVE-2026-90802 | libctf0 | 2.44-3 | | binutils: GNU Binutils: Denial of service via null pointer dereference in ld component |
| LOW | | 6.8 | | CVE-2026-90803 | libctf0 | 2.44-3 | | binutils: GNU Binutils ld: Buffer Overflow via Malformed Relocation |
| LOW | | 6.1 | | CVE-2026-90804 | libctf0 | 2.44-3 | | binutils: GNU Binutils: Buffer overflow in Eh Frame Section Handler can lead to denial of service |
| LOW | | 6.6 | | CVE-2026-90828 | libctf0 | 2.44-3 | | binutils: GNU Binutils: Null pointer dereference via elf_orphan_compatible function |
| LOW | | 6.6 | | CVE-2026-90829 | libctf0 | 2.44-3 | | binutils: GNU Binutils: Null pointer dereference via SHT_GROUP Section manipulation |
| LOW | | 5.5 | | CVE-2026-90830 | libctf0 | 2.44-3 | | binutils: GNU Binutils: Local denial of service via null pointer dereference in Section Merge |
| LOW | | 6.6 | | CVE-2026-90831 | libctf0 | 2.44-3 | | binutils: GNU Binutils: Memory corruption via local manipulation of ELF String Table |
| LOW | | 5.5 | | CVE-2026-91779 | libctf0 | 2.44-3 | | binutils: GNU Binutils: Denial of Service via null pointer dereference |
| LOW | | 5 | | CVE-2026-91780 | libctf0 | 2.44-3 | | binutils: GNU Binutils: Local denial of service via null pointer dereference |
| LOW | | 3.3 | | CVE-2026-91781 | libctf0 | 2.44-3 | | binutils: GNU Binutils: Local denial of service vulnerability |
| LOW | | 5.5 | | CVE-2026-91782 | libctf0 | 2.44-3 | | binutils: GNU Binutils: Denial of Service via null pointer dereference |
| LOW | | 5.9 | | CVE-2025-10966 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: Curl missing SFTP host verification with wolfSSH backend |
| LOW | | 6.3 | | CVE-2025-14017 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers |
| LOW | | 6.5 | | CVE-2025-14524 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: Information disclosure via cross-protocol redirect with OAuth2 bearer token |
| LOW | | 6.8 | | CVE-2025-14819 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: libcurl: Improper certificate validation due to cached TLS settings reuse |
| LOW | | 8.1 | | CVE-2025-15079 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: Host verification bypass during SSH transfers |
| LOW | | 4.7 | | CVE-2025-15224 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: libssh key passphrase bypass without agent set |
| LOW | | 4.8 | | CVE-2026-107928 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: info leak uploading over WebSockets with GnuTLS |
| LOW | | 3.7 | | CVE-2026-107929 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: local interface connection reuse mixup |
| LOW | | 3.7 | | CVE-2026-13608 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: Authentication bypass in OpenLDAP SASL negotiation via Man-in-the-Middle (MITM) attack |
| LOW | | 3.7 | | CVE-2026-18924 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: libcurl: Use-after-free in HTTP/2 Server Push with shared connections |
| LOW | | 3.7 | | CVE-2026-80229 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: libcurl: Memory corruption vulnerability via OpenSSL 3 provider use-after-free |
| LOW | | 3.7 | | CVE-2026-80230 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: Public key pinning bypass allows unauthenticated connections |
| LOW | | 3.7 | | CVE-2026-80255 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: Information disclosure due to secure cookie attribute bypass |
| LOW | | 4.8 | | CVE-2026-82208 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: libcurl: Improper certificate validation when using wolfSSL CA cache |
| LOW | | 3.1 | | CVE-2026-82209 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: libcurl: Information disclosure via improper Public Suffix List boundary check |
| LOW | | 5.3 | | CVE-2026-86409 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: stale SigV4 headers sent unintended |
| LOW | | 6.8 | | CVE-2026-86410 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: redirect to SFTP or SCP bypasses host verification |
| LOW | | 6.5 | | CVE-2026-86414 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: leaking host credentials to HTTP proxy |
| LOW | | 3.7 | | CVE-2026-87862 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: HSTS cache import drops longer-lived child |
| LOW | | 3.7 | | CVE-2026-87863 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: Hsts Response Erases Persisted Entries |
| LOW | | 3.7 | | CVE-2026-87864 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: IMAP APPEND plus CRLF conversion command injection |
| LOW | | 3.7 | | CVE-2026-87865 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: knownhost callback mismatches key as missing |
| LOW | | 3.7 | | CVE-2026-87866 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: wolfSSL public-key pinning bypass |
| LOW | | 4.3 | | CVE-2026-92386 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: server-set cookie aborts cookie jar load |
| LOW | | 3.7 | | CVE-2026-92387 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: never-ending loop via server response omission |
| LOW | | 3.7 | | CVE-2026-92389 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: TFTP direction confusion |
| LOW | | 6.5 | | CVE-2026-92390 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: -J no-clobber guarantee bypassed with 103 early hints |
| LOW | | 3.7 | | CVE-2026-92391 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: curl_mime_free stack overflow by recursion |
| LOW | | 3.3 | | CVE-2026-94266 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: password leak in CURLINFO_EFFECTIVE_URL |
| LOW | | 7.4 | | CVE-2026-9547 | libcurl3t64-gnutls | 8.14.1-2+deb13u3 | | curl: curl: Man-in-the-middle attack via SSH host key bypass |
| LOW | | 5.9 | | CVE-2025-10966 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: Curl missing SFTP host verification with wolfSSH backend |
| LOW | | 6.3 | | CVE-2025-14017 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers |
| LOW | | 6.5 | | CVE-2025-14524 | libcurl4t64 | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: Information disclosure via cross-protocol redirect with OAuth2 bearer token |
| LOW | | 6.8 | | CVE-2025-14819 | libcurl4t64 | 8.14.1-2+deb13u3 | 8.14.1-2+deb13u4 | curl: libcurl: Improper certificate validation due to cached TLS settings reuse |
| LOW | | 8.1 | | CVE-2025-15079 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: Host verification bypass during SSH transfers |
| LOW | | 4.7 | | CVE-2025-15224 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: libssh key passphrase bypass without agent set |
| LOW | | 4.8 | | CVE-2026-107928 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: info leak uploading over WebSockets with GnuTLS |
| LOW | | 3.7 | | CVE-2026-107929 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: local interface connection reuse mixup |
| LOW | | 3.7 | | CVE-2026-13608 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: Authentication bypass in OpenLDAP SASL negotiation via Man-in-the-Middle (MITM) attack |
| LOW | | 3.7 | | CVE-2026-18924 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: libcurl: Use-after-free in HTTP/2 Server Push with shared connections |
| LOW | | 3.7 | | CVE-2026-80229 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: libcurl: Memory corruption vulnerability via OpenSSL 3 provider use-after-free |
| LOW | | 3.7 | | CVE-2026-80230 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: Public key pinning bypass allows unauthenticated connections |
| LOW | | 3.7 | | CVE-2026-80255 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: Information disclosure due to secure cookie attribute bypass |
| LOW | | 4.8 | | CVE-2026-82208 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: libcurl: Improper certificate validation when using wolfSSL CA cache |
| LOW | | 3.1 | | CVE-2026-82209 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: libcurl: Information disclosure via improper Public Suffix List boundary check |
| LOW | | 5.3 | | CVE-2026-86409 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: stale SigV4 headers sent unintended |
| LOW | | 6.8 | | CVE-2026-86410 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: redirect to SFTP or SCP bypasses host verification |
| LOW | | 6.5 | | CVE-2026-86414 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: leaking host credentials to HTTP proxy |
| LOW | | 3.7 | | CVE-2026-87862 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: HSTS cache import drops longer-lived child |
| LOW | | 3.7 | | CVE-2026-87863 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: Hsts Response Erases Persisted Entries |
| LOW | | 3.7 | | CVE-2026-87864 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: IMAP APPEND plus CRLF conversion command injection |
| LOW | | 3.7 | | CVE-2026-87865 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: knownhost callback mismatches key as missing |
| LOW | | 3.7 | | CVE-2026-87866 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: wolfSSL public-key pinning bypass |
| LOW | | 4.3 | | CVE-2026-92386 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: server-set cookie aborts cookie jar load |
| LOW | | 3.7 | | CVE-2026-92387 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: never-ending loop via server response omission |
| LOW | | 3.7 | | CVE-2026-92389 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: TFTP direction confusion |
| LOW | | 6.5 | | CVE-2026-92390 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: -J no-clobber guarantee bypassed with 103 early hints |
| LOW | | 3.7 | | CVE-2026-92391 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: curl_mime_free stack overflow by recursion |
| LOW | | 3.3 | | CVE-2026-94266 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: password leak in CURLINFO_EFFECTIVE_URL |
| LOW | | 7.4 | | CVE-2026-9547 | libcurl4t64 | 8.14.1-2+deb13u3 | | curl: curl: Man-in-the-middle attack via SSH host key bypass |
| LOW | | 4 | | CVE-2024-25260 | libdebuginfod-common | 0.192-4 | | elfutils: global-buffer-overflow exists in the function ebl_machine_flag_name in eblmachineflagname.c |
| LOW | | 7.5 | | CVE-2025-1352 | libdebuginfod-common | 0.192-4 | | elfutils: GNU elfutils eu-readelf libdw_alloc.c __libdw_thread_tail memory corruption |
| LOW | | 7.8 | | CVE-2025-1365 | libdebuginfod-common | 0.192-4 | | elfutils: GNU elfutils eu-readelf readelf.c process_symtab buffer overflow |
| LOW | | 5.5 | | CVE-2025-1371 | libdebuginfod-common | 0.192-4 | | elfutils: GNU elfutils eu-read readelf.c handle_dynamic_symtab null pointer dereference |
| LOW | | 7.8 | | CVE-2025-1372 | libdebuginfod-common | 0.192-4 | | elfutils: GNU elfutils eu-readelf readelf.c print_string_section buffer overflow |
| LOW | | 4.7 | | CVE-2025-1376 | libdebuginfod-common | 0.192-4 | | elfutils: GNU elfutils eu-strip elf_strptr.c elf_strptr denial of service |
| LOW | | 5.5 | | CVE-2025-1377 | libdebuginfod-common | 0.192-4 | | elfutils: GNU elfutils eu-strip strip.c gelf_getsymshndx denial of service |
| LOW | | 4 | | CVE-2024-25260 | libdebuginfod1t64 | 0.192-4 | | elfutils: global-buffer-overflow exists in the function ebl_machine_flag_name in eblmachineflagname.c |
| LOW | | 7.5 | | CVE-2025-1352 | libdebuginfod1t64 | 0.192-4 | | elfutils: GNU elfutils eu-readelf libdw_alloc.c __libdw_thread_tail memory corruption |
| LOW | | 7.8 | | CVE-2025-1365 | libdebuginfod1t64 | 0.192-4 | | elfutils: GNU elfutils eu-readelf readelf.c process_symtab buffer overflow |
| LOW | | 5.5 | | CVE-2025-1371 | libdebuginfod1t64 | 0.192-4 | | elfutils: GNU elfutils eu-read readelf.c handle_dynamic_symtab null pointer dereference |
| LOW | | 7.8 | | CVE-2025-1372 | libdebuginfod1t64 | 0.192-4 | | elfutils: GNU elfutils eu-readelf readelf.c print_string_section buffer overflow |
| LOW | | 4.7 | | CVE-2025-1376 | libdebuginfod1t64 | 0.192-4 | | elfutils: GNU elfutils eu-strip elf_strptr.c elf_strptr denial of service |
| LOW | | 5.5 | | CVE-2025-1377 | libdebuginfod1t64 | 0.192-4 | | elfutils: GNU elfutils eu-strip strip.c gelf_getsymshndx denial of service |
| LOW | | 5.5 | | CVE-2026-19617 | libdevmapper1.02.1 | 2:1.02.205-2 | | libdm: lvm2: libdm: Denial of Service via uncontrolled recursion in config parser |
| LOW | | 4 | | CVE-2024-25260 | libdw1t64 | 0.192-4 | | elfutils: global-buffer-overflow exists in the function ebl_machine_flag_name in eblmachineflagname.c |
| LOW | | 7.5 | | CVE-2025-1352 | libdw1t64 | 0.192-4 | | elfutils: GNU elfutils eu-readelf libdw_alloc.c __libdw_thread_tail memory corruption |
| LOW | | 7.8 | | CVE-2025-1365 | libdw1t64 | 0.192-4 | | elfutils: GNU elfutils eu-readelf readelf.c process_symtab buffer overflow |
| LOW | | 5.5 | | CVE-2025-1371 | libdw1t64 | 0.192-4 | | elfutils: GNU elfutils eu-read readelf.c handle_dynamic_symtab null pointer dereference |
| LOW | | 7.8 | | CVE-2025-1372 | libdw1t64 | 0.192-4 | | elfutils: GNU elfutils eu-readelf readelf.c print_string_section buffer overflow |
| LOW | | 4.7 | | CVE-2025-1376 | libdw1t64 | 0.192-4 | | elfutils: GNU elfutils eu-strip elf_strptr.c elf_strptr denial of service |
| LOW | | 5.5 | | CVE-2025-1377 | libdw1t64 | 0.192-4 | | elfutils: GNU elfutils eu-strip strip.c gelf_getsymshndx denial of service |
| LOW | | 4 | | CVE-2024-25260 | libelf1t64 | 0.192-4 | | elfutils: global-buffer-overflow exists in the function ebl_machine_flag_name in eblmachineflagname.c |
| LOW | | 7.5 | | CVE-2025-1352 | libelf1t64 | 0.192-4 | | elfutils: GNU elfutils eu-readelf libdw_alloc.c __libdw_thread_tail memory corruption |
| LOW | | 7.8 | | CVE-2025-1365 | libelf1t64 | 0.192-4 | | elfutils: GNU elfutils eu-readelf readelf.c process_symtab buffer overflow |
| LOW | | 5.5 | | CVE-2025-1371 | libelf1t64 | 0.192-4 | | elfutils: GNU elfutils eu-read readelf.c handle_dynamic_symtab null pointer dereference |
| LOW | | 7.8 | | CVE-2025-1372 | libelf1t64 | 0.192-4 | | elfutils: GNU elfutils eu-readelf readelf.c print_string_section buffer overflow |
| LOW | | 4.7 | | CVE-2025-1376 | libelf1t64 | 0.192-4 | | elfutils: GNU elfutils eu-strip elf_strptr.c elf_strptr denial of service |
| LOW | | 5.5 | | CVE-2025-1377 | libelf1t64 | 0.192-4 | | elfutils: GNU elfutils eu-strip strip.c gelf_getsymshndx denial of service |
| LOW | | 2.9 | | CVE-2026-24515 | libexpat1 | 2.7.1-2 | 2.8.2-1~deb13u1 | libexpat: libexpat null pointer dereference |
| LOW | | 3.7 | | CVE-2026-41080 | libexpat1 | 2.7.1-2 | 2.8.2-1~deb13u1 | libexpat: expat: libexpat: Denial of Service via hash flooding with crafted XML |
| LOW | | 5.5 | | CVE-2022-0563 | libfdisk1 | 2.41-5 | | util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline |
| LOW | | 6.1 | | CVE-2025-14104 | libfdisk1 | 2.41-5 | 2.41.3-1 | util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames |
| LOW | | 7.5 | | CVE-2018-6829 | libgcrypt20 | 1.11.0-7+deb13u1 | | libgcrypt: ElGamal implementation doesn't have semantic security due to incorrectly encoded plaintexts possibly allowing |
| LOW | | 5.9 | | CVE-2024-2236 | libgcrypt20 | 1.11.0-7+deb13u1 | | libgcrypt: vulnerable to Marvin Attack |
| LOW | | 5 | | CVE-2012-0039 | libglib2.0-0t64 | 2.84.4-3~deb13u3 | | glib2: hash table collisions CPU usage DoS |
| LOW | | 5 | | CVE-2012-0039 | libglib2.0-data | 2.84.4-3~deb13u3 | | glib2: hash table collisions CPU usage DoS |
| LOW | | 4.3 | | CVE-2011-3389 | libgnutls30t64 | 3.8.9-3+deb13u4 | | HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST) |
| LOW | | 5.9 | | CVE-2026-67693 | libgnutls30t64 | 3.8.9-3+deb13u4 | | gnutls: gnutls: Information disclosure via contradictory Key Usage and Extended Key Usage extensions |
| LOW | | 7.4 | | CVE-2026-88647 | libgnutls30t64 | 3.8.9-3+deb13u4 | | gnutls: gnutls: Information disclosure via hostname verification bypass |
| LOW | | 7.4 | | CVE-2026-88648 | libgnutls30t64 | 3.8.9-3+deb13u4 | | gnutls: gnutls: Cross-domain certificate restriction bypass via incomplete X.509 validation |
| LOW | | 5.3 | | CVE-2026-95184 | libgnutls30t64 | 3.8.9-3+deb13u4 | | gnutls: gnutls: legitimate user certificates incorrectly rejected causing denial of service |
| LOW | | | | CVE-2026-95209 | libgnutls30t64 | 3.8.9-3+deb13u4 | | gnutls: gnutls: legitimate CA certificates incorrectly rejected causing denial of service |
| LOW | | | | CVE-2026-95210 | libgnutls30t64 | 3.8.9-3+deb13u4 | | gnutls: gnutls: certificates with invalid extensions incorrectly accepted |
| LOW | | 5.5 | | CVE-2017-13716 | libgprofng0 | 2.44-3 | | binutils: Memory leak with the C++ symbol demangler routine in libiberty |
| LOW | | 5.5 | | CVE-2018-20673 | libgprofng0 | 2.44-3 | | libiberty: Integer overflow in demangle_template() function |
| LOW | | 6.5 | | CVE-2018-20712 | libgprofng0 | 2.44-3 | | libiberty: heap-based buffer over-read in d_expression_1 |
| LOW | | 5.5 | | CVE-2018-9996 | libgprofng0 | 2.44-3 | | binutils: Stack-overflow in libiberty/cplus-dem.c causes crash |
| LOW | | 6.5 | | CVE-2021-32256 | libgprofng0 | 2.44-3 | | binutils: stack-overflow issue in demangle_type in rust-demangle.c. |
| LOW | | 5.5 | | CVE-2025-11081 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils out-of-bounds read |
| LOW | | 7.8 | | CVE-2025-11082 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 7.8 | | CVE-2025-11083 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 5.5 | | CVE-2025-11412 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils Linker elflink.c bfd_elf_gc_record_vtentry out-of-bounds |
| LOW | | 5.5 | | CVE-2025-11413 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds |
| LOW | | 5.5 | | CVE-2025-11414 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils Linker elflink.c get_link_hash_entry out-of-bounds |
| LOW | | 5.3 | | CVE-2025-1147 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils nm nm.c internal_strlen buffer overflow |
| LOW | | 3.1 | | CVE-2025-1148 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils ld ldelfgen.c link_order_scan memory leak |
| LOW | | 3.1 | | CVE-2025-1149 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils ld xmalloc.c xstrdup memory leak |
| LOW | | 5.5 | | CVE-2025-11494 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils Linker out-of-bounds read |
| LOW | | 5.5 | | CVE-2025-11495 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 3.1 | | CVE-2025-1150 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils ld libbfd.c bfd_malloc memory leak |
| LOW | | 3.1 | | CVE-2025-1151 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils ld xmemdup.c xmemdup memory leak |
| LOW | | 3.7 | | CVE-2025-1152 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils ld xstrdup.c xstrdup memory leak |
| LOW | | 5.9 | | CVE-2025-1153 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils format.c bfd_set_format memory corruption |
| LOW | | 5 | | CVE-2025-1176 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec heap-based overflow |
| LOW | | 5.6 | | CVE-2025-1178 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils ld libbfd.c bfd_putl64 memory corruption |
| LOW | | 3.1 | | CVE-2025-1180 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils ld elf-eh-frame.c _bfd_elf_write_section_eh_frame memory corruption |
| LOW | | 5 | | CVE-2025-1181 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec memory corruption |
| LOW | | 5 | | CVE-2025-1182 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils ld elflink.c bfd_elf_reloc_symbol_deleted_p memory corruption |
| LOW | | 5.5 | | CVE-2025-11839 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils prdbg.c tg_tag_type return value |
| LOW | | 5.5 | | CVE-2025-11840 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils out-of-bounds read |
| LOW | | 5.5 | | CVE-2025-3198 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils objdump bucomm.c display_info memory leak |
| LOW | | 7.8 | | CVE-2025-5244 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils ld elflink.c elf_gc_sweep memory corruption |
| LOW | | 7.8 | | CVE-2025-5245 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils objdump debug.c debug_type_samep memory corruption |
| LOW | | 3.3 | | CVE-2025-66861 | libgprofng0 | 2.44-3 | | binutils: out-of-bounds read in d_unqualified_name() in cp-demangle.c |
| LOW | | 3.3 | | CVE-2025-66862 | libgprofng0 | 2.44-3 | | binutils: heap-based buffer over-read in gnu_special() in cplus-dem.c |
| LOW | | 3.3 | | CVE-2025-66863 | libgprofng0 | 2.44-3 | | binutils: BinUtils: Denial of Service via crafted PE file |
| LOW | | 7.5 | | CVE-2025-66864 | libgprofng0 | 2.44-3 | | binutils: NULL pointer dereference in d_print_comp_inner() in cp-demangle.c |
| LOW | | 3.3 | | CVE-2025-66865 | libgprofng0 | 2.44-3 | | binutils: stack overflow in d_print_comp_inner() in cp-demangle.c |
| LOW | | 7.5 | | CVE-2025-66866 | libgprofng0 | 2.44-3 | | binutils: BinUtils: Denial of Service via crafted PE file |
| LOW | | 2.8 | | CVE-2025-69644 | libgprofng0 | 2.44-3 | | binutils: Binutils: Denial of Service via crafted binary with malformed DWARF debug information |
| LOW | | 2.8 | | CVE-2025-69645 | libgprofng0 | 2.44-3 | | binutils: Binutils objdump: Denial of Service via crafted DWARF debug information |
| LOW | | 2.8 | | CVE-2025-69646 | libgprofng0 | 2.44-3 | | binutils: Binutils: Denial of Service via malformed DWARF debug_rnglists data |
| LOW | | 3.3 | | CVE-2025-69647 | libgprofng0 | 2.44-3 | | binutils: infinite loop in readelf via crafted binary with malformed DWARF loclists data |
| LOW | | 3.3 | | CVE-2025-69648 | libgprofng0 | 2.44-3 | | binutils: infinite loop in readelf via crafted binary with malformed DWARF .debug_rnglists data |
| LOW | | 7.5 | | CVE-2025-69649 | libgprofng0 | 2.44-3 | | binutils: NULL pointer dereference in readelf via crafted ELF binary with malformed header fields |
| LOW | | 7.5 | | CVE-2025-69650 | libgprofng0 | 2.44-3 | | binutils: double free in readelf via crafted ELF binary with malformed relocation data |
| LOW | | 5.5 | | CVE-2025-69651 | libgprofng0 | 2.44-3 | | binutils: Binutils: Denial of Service via crafted ELF binary processing |
| LOW | | 3.3 | | CVE-2025-69652 | libgprofng0 | 2.44-3 | | binutils: abort in readelf via crafted ELF binary with malformed DWARF abbrev or debug information |
| LOW | | 7.8 | | CVE-2025-7545 | libgprofng0 | 2.44-3 | | binutils: Binutils: Heap Buffer Overflow |
| LOW | | 7.8 | | CVE-2025-7546 | libgprofng0 | 2.44-3 | | binutils: Binutils: Out-of-bounds Write Vulnerability |
| LOW | | 3.3 | | CVE-2025-8225 | libgprofng0 | 2.44-3 | | binutils: Binutils DWARF Section Handler Memory Leak |
| LOW | | 5.6 | | CVE-2026-15003 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils: Heap-buffer-overflow in linker leads to information disclosure and denial of service |
| LOW | | 7.8 | | CVE-2026-18220 | libgprofng0 | 2.44-3 | | binutils: binutils: Out-of-bounds write in BFD DLX ELF backend relocation processing |
| LOW | | 5.5 | | CVE-2026-19548 | libgprofng0 | 2.44-3 | | binutils: binutils: Multiple Use-After-Free in add_archive_element via LTO plugin processing |
| LOW | | 7.1 | | CVE-2026-3441 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils: Information disclosure via specially crafted XCOFF object file |
| LOW | | 7.1 | | CVE-2026-3442 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils: Information disclosure or denial of service via out-of-bounds read in bfd linker |
| LOW | | 6.1 | | CVE-2026-4647 | libgprofng0 | 2.44-3 | | binutils: Out-of-Bounds Read in XCOFF Relocation Processing in GNU Binutils BFD Library |
| LOW | | 5.5 | | CVE-2026-6844 | libgprofng0 | 2.44-3 | | binutils: Binutils: Denial of Service vulnerabilities in readelf via crafted ELF files |
| LOW | | 5 | | CVE-2026-6845 | libgprofng0 | 2.44-3 | | binutils: Binutils: Denial of Service via crafted ELF file |
| LOW | | 7.8 | | CVE-2026-6846 | libgprofng0 | 2.44-3 | | binutils: Binutils: Arbitrary code execution via malformed XCOFF object file processing |
| LOW | | 6.6 | | CVE-2026-90801 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils ld: Buffer overflow in cache_bwrite via nbytes manipulation |
| LOW | | 5 | | CVE-2026-90802 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils: Denial of service via null pointer dereference in ld component |
| LOW | | 6.8 | | CVE-2026-90803 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils ld: Buffer Overflow via Malformed Relocation |
| LOW | | 6.1 | | CVE-2026-90804 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils: Buffer overflow in Eh Frame Section Handler can lead to denial of service |
| LOW | | 6.6 | | CVE-2026-90828 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils: Null pointer dereference via elf_orphan_compatible function |
| LOW | | 6.6 | | CVE-2026-90829 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils: Null pointer dereference via SHT_GROUP Section manipulation |
| LOW | | 5.5 | | CVE-2026-90830 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils: Local denial of service via null pointer dereference in Section Merge |
| LOW | | 6.6 | | CVE-2026-90831 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils: Memory corruption via local manipulation of ELF String Table |
| LOW | | 5.5 | | CVE-2026-91779 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils: Denial of Service via null pointer dereference |
| LOW | | 5 | | CVE-2026-91780 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils: Local denial of service via null pointer dereference |
| LOW | | 3.3 | | CVE-2026-91781 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils: Local denial of service vulnerability |
| LOW | | 5.5 | | CVE-2026-91782 | libgprofng0 | 2.44-3 | | binutils: GNU Binutils: Denial of Service via null pointer dereference |
| LOW | | 7.5 | | CVE-2018-5709 | libgssapi-krb5-2 | 1.21.3-5+deb13u1 | | krb5: integer overflow in dbentry->n_key_data in kadmin/dbutil/dump.c |
| LOW | | 5.9 | | CVE-2024-26458 | libgssapi-krb5-2 | 1.21.3-5+deb13u1 | | krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.c |
| LOW | | 5.9 | | CVE-2024-26461 | libgssapi-krb5-2 | 1.21.3-5+deb13u1 | | krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.c |
| LOW | | 5 | | CVE-2026-11850 | libgssapi-krb5-2 | 1.21.3-5+deb13u1 | | krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read |
| LOW | | 6.5 | | CVE-2017-9937 | libjbig0 | 2.1-6.1+b2 | | libtiff: memory malloc failure in tif_jbig.c could cause DOS. |
| LOW | | 7.5 | | CVE-2018-5709 | libk5crypto3 | 1.21.3-5+deb13u1 | | krb5: integer overflow in dbentry->n_key_data in kadmin/dbutil/dump.c |
| LOW | | 5.9 | | CVE-2024-26458 | libk5crypto3 | 1.21.3-5+deb13u1 | | krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.c |
| LOW | | 5.9 | | CVE-2024-26461 | libk5crypto3 | 1.21.3-5+deb13u1 | | krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.c |
| LOW | | 5 | | CVE-2026-11850 | libk5crypto3 | 1.21.3-5+deb13u1 | | krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read |
| LOW | | 7.5 | | CVE-2018-5709 | libkrb5-3 | 1.21.3-5+deb13u1 | | krb5: integer overflow in dbentry->n_key_data in kadmin/dbutil/dump.c |
| LOW | | 5.9 | | CVE-2024-26458 | libkrb5-3 | 1.21.3-5+deb13u1 | | krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.c |
| LOW | | 5.9 | | CVE-2024-26461 | libkrb5-3 | 1.21.3-5+deb13u1 | | krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.c |
| LOW | | 5 | | CVE-2026-11850 | libkrb5-3 | 1.21.3-5+deb13u1 | | krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read |
| LOW | | 7.5 | | CVE-2018-5709 | libkrb5support0 | 1.21.3-5+deb13u1 | | krb5: integer overflow in dbentry->n_key_data in kadmin/dbutil/dump.c |
| LOW | | 5.9 | | CVE-2024-26458 | libkrb5support0 | 1.21.3-5+deb13u1 | | krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.c |
| LOW | | 5.9 | | CVE-2024-26461 | libkrb5support0 | 1.21.3-5+deb13u1 | | krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.c |
| LOW | | 5 | | CVE-2026-11850 | libkrb5support0 | 1.21.3-5+deb13u1 | | krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read |
| LOW | | 5.5 | | CVE-2022-0563 | liblastlog2-2 | 2.41-5 | | util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline |
| LOW | | 6.1 | | CVE-2025-14104 | liblastlog2-2 | 2.41-5 | 2.41.3-1 | util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames |
| LOW | | 7.5 | | CVE-2015-3276 | libldap-common | 2.6.10+dfsg-1 | | openldap: incorrect multi-keyword mode cipherstring parsing |
| LOW | | 4.7 | | CVE-2017-14159 | libldap-common | 2.6.10+dfsg-1 | | openldap: Privilege escalation via PID file manipulation |
| LOW | | 7.5 | | CVE-2017-17740 | libldap-common | 2.6.10+dfsg-1 | | openldap: contrib/slapd-modules/nops/nops.c attempts to free stack buffer allowing remote attackers to cause a denial of |
| LOW | | 4.2 | | CVE-2020-15719 | libldap-common | 2.6.10+dfsg-1 | | openldap: Certificate validation incorrectly matches name against CN-ID |
| LOW | | 6.8 | | CVE-2026-22185 | libldap-common | 2.6.10+dfsg-1 | | OpenLDAP: OpenLDAP LMDB: Denial of Service and Information Disclosure via Heap Buffer Underflow |
| LOW | | 7.5 | | CVE-2015-3276 | libldap2 | 2.6.10+dfsg-1 | | openldap: incorrect multi-keyword mode cipherstring parsing |
| LOW | | 4.7 | | CVE-2017-14159 | libldap2 | 2.6.10+dfsg-1 | | openldap: Privilege escalation via PID file manipulation |
| LOW | | 7.5 | | CVE-2017-17740 | libldap2 | 2.6.10+dfsg-1 | | openldap: contrib/slapd-modules/nops/nops.c attempts to free stack buffer allowing remote attackers to cause a denial of |
| LOW | | 4.2 | | CVE-2020-15719 | libldap2 | 2.6.10+dfsg-1 | | openldap: Certificate validation incorrectly matches name against CN-ID |
| LOW | | 6.8 | | CVE-2026-22185 | libldap2 | 2.6.10+dfsg-1 | | OpenLDAP: OpenLDAP LMDB: Denial of Service and Information Disclosure via Heap Buffer Underflow |
| LOW | | 5.5 | | CVE-2022-0563 | libmount1 | 2.41-5 | | util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline |
| LOW | | 6.1 | | CVE-2025-14104 | libmount1 | 2.41-5 | 2.41.3-1 | util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames |
| LOW | | 3.3 | | CVE-2025-6141 | libncursesw6 | 6.5+20250216-2 | | gnu-ncurses: ncurses Stack Buffer Overflow |
| LOW | | 3.3 | | CVE-2025-9615 | libnm0 | 1.52.1-1+rpt4 | | NetworkManager: NetworkManager File Access |
| LOW | | 7.8 | | CVE-2017-11695 | libnss3 | 2:3.110-1+deb13u2 | | nss: Heap-buffer-overflow in alloc_segs |
| LOW | | 7.8 | | CVE-2017-11696 | libnss3 | 2:3.110-1+deb13u2 | | nss: Heap-buffer-overflow in __hash_open |
| LOW | | 7.8 | | CVE-2017-11697 | libnss3 | 2:3.110-1+deb13u2 | | nss: Floating Point Exception in __hash_open |
| LOW | | 7.8 | | CVE-2017-11698 | libnss3 | 2:3.110-1+deb13u2 | | nss: Heap-buffer-overflow in __get_page |
| LOW | | 3.4 | | CVE-2026-12318 | libnss3 | 2:3.110-1+deb13u2 | 2:3.110-1+deb13u3 | firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS |
| LOW | | 3.3 | | CVE-2013-4392 | libpam-systemd | 257.13-1~deb13u1 | | systemd: TOCTOU race condition when updating file permissions and SELinux security contexts |
| LOW | | 5.3 | | CVE-2023-31437 | libpam-systemd | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can modify a seale ... |
| LOW | | 5.3 | | CVE-2023-31438 | libpam-systemd | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can truncate a sea ... |
| LOW | | 5.3 | | CVE-2023-31439 | libpam-systemd | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can modify the con ... |
| LOW | | 3.3 | | CVE-2026-40228 | libpam-systemd | 257.13-1~deb13u1 | | systemd: systemd-journald: Unintended output to user terminals via logger command |
| LOW | | 1.9 | | CVE-2025-11961 | libpcap0.8t64 | 1.10.5-2 | | libpcap: libpcap: Memory corruption via malformed MAC-48 address input |
| LOW | | 5 | | CVE-2026-18238 | libpcap0.8t64 | 1.10.5-2 | | libpcap: libpcap: Information disclosure via out-of-bounds read in rpcap client |
| LOW | | 4.3 | | CVE-2026-18313 | libpcap0.8t64 | 1.10.5-2 | | libpcap: libpcap: Denial of Service via memory leak in rpcapd |
| LOW | | 3.3 | | CVE-2026-89162 | libpcre2-16-0 | 10.46-1~deb13u1 | 10.46-1~deb13u2 | pcre2: PCRE2: Information disclosure via pcre2_serialize_encode |
| LOW | | 3.3 | | CVE-2026-89162 | libpcre2-8-0 | 10.46-1~deb13u1 | 10.46-1~deb13u2 | pcre2: PCRE2: Information disclosure via pcre2_serialize_encode |
| LOW | | 3.3 | | CVE-2011-4116 | libperl5.40 | 5.40.1-6 | | perl: File:: Temp insecure temporary file handling |
| LOW | | 5.5 | | CVE-2021-4214 | libpng16-16t64 | 1.6.48-1+deb13u5 | | libpng: hardcoded value leads to heap-overflow |
| LOW | | 5.3 | | CVE-2026-3713 | libpng16-16t64 | 1.6.48-1+deb13u5 | | libpng: libpng: Heap-based buffer overflow in pnm2png allows information disclosure and denial of service |
| LOW | | 6.7 | | CVE-2025-7519 | libpolkit-agent-1-0 | 126-2 | | polkit: XML policy file with a large number of nested elements may lead to out-of-bounds write |
| LOW | | 6.7 | | CVE-2025-7519 | libpolkit-gobject-1-0 | 126-2 | | polkit: XML policy file with a large number of nested elements may lead to out-of-bounds write |
| LOW | | 2.5 | | CVE-2026-18739 | libpopt0 | 1.19+dfsg-2 | | popt-devel: popt-static: Off-by-one in poptStuffArgs |
| LOW | | 2.5 | | CVE-2026-18743 | libpopt0 | 1.19+dfsg-2 | | popt-devel: popt-static: Short realloc in poptConfigFileToString |
| LOW | | 2.2 | | CVE-2026-18839 | libpopt0 | 1.19+dfsg-2 | | popt-devel: popt-static: size_t underflow in singleOptionHelp |
| LOW | | | | CVE-2026-115557 | libpython3.13-minimal | 3.13.5-2+deb13u2 | | Python has added a denylist for known compromised certificates to the ... |
| LOW | | 7.8 | | CVE-2026-12003 | libpython3.13-minimal | 3.13.5-2+deb13u2 | | python: Python: Privilege escalation due to insecure VPATH handling in Windows legacy installers |
| LOW | | 2.8 | | CVE-2026-18503 | libpython3.13-minimal | 3.13.5-2+deb13u2 | | python: Python: Denial of Service via super-linear regular expression work in csv.Sniffer.sniff() |
| LOW | | 3.3 | | CVE-2026-3479 | libpython3.13-minimal | 3.13.5-2+deb13u2 | | python: Python pkgutil.get_data(): Path Traversal via improper resource argument validation |
| LOW | | 2.2 | | CVE-2026-6879 | libpython3.13-minimal | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: Python: Performance degradation in XML processing due to quadratic time complexity |
| LOW | | | | CVE-2026-115557 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | | Python has added a denylist for known compromised certificates to the ... |
| LOW | | 7.8 | | CVE-2026-12003 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | | python: Python: Privilege escalation due to insecure VPATH handling in Windows legacy installers |
| LOW | | 2.8 | | CVE-2026-18503 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | | python: Python: Denial of Service via super-linear regular expression work in csv.Sniffer.sniff() |
| LOW | | 3.3 | | CVE-2026-3479 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | | python: Python pkgutil.get_data(): Path Traversal via improper resource argument validation |
| LOW | | 2.2 | | CVE-2026-6879 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: Python: Performance degradation in XML processing due to quadratic time complexity |
| LOW | | | | CVE-2026-115557 | libpython3.13 | 3.13.5-2+deb13u2 | | Python has added a denylist for known compromised certificates to the ... |
| LOW | | 7.8 | | CVE-2026-12003 | libpython3.13 | 3.13.5-2+deb13u2 | | python: Python: Privilege escalation due to insecure VPATH handling in Windows legacy installers |
| LOW | | 2.8 | | CVE-2026-18503 | libpython3.13 | 3.13.5-2+deb13u2 | | python: Python: Denial of Service via super-linear regular expression work in csv.Sniffer.sniff() |
| LOW | | 3.3 | | CVE-2026-3479 | libpython3.13 | 3.13.5-2+deb13u2 | | python: Python pkgutil.get_data(): Path Traversal via improper resource argument validation |
| LOW | | 2.2 | | CVE-2026-6879 | libpython3.13 | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: Python: Performance degradation in XML processing due to quadratic time complexity |
| LOW | | | | CVE-2023-45935 | libqt6core6t64 | 6.8.2+dfsg-9+deb13u2 | | Qt 6 through 6.6 was discovered to contain a NULL pointer dereference ... |
| LOW | | 5.5 | | CVE-2017-13716 | libsframe1 | 2.44-3 | | binutils: Memory leak with the C++ symbol demangler routine in libiberty |
| LOW | | 5.5 | | CVE-2018-20673 | libsframe1 | 2.44-3 | | libiberty: Integer overflow in demangle_template() function |
| LOW | | 6.5 | | CVE-2018-20712 | libsframe1 | 2.44-3 | | libiberty: heap-based buffer over-read in d_expression_1 |
| LOW | | 5.5 | | CVE-2018-9996 | libsframe1 | 2.44-3 | | binutils: Stack-overflow in libiberty/cplus-dem.c causes crash |
| LOW | | 6.5 | | CVE-2021-32256 | libsframe1 | 2.44-3 | | binutils: stack-overflow issue in demangle_type in rust-demangle.c. |
| LOW | | 5.5 | | CVE-2025-11081 | libsframe1 | 2.44-3 | | binutils: GNU Binutils out-of-bounds read |
| LOW | | 7.8 | | CVE-2025-11082 | libsframe1 | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 7.8 | | CVE-2025-11083 | libsframe1 | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 5.5 | | CVE-2025-11412 | libsframe1 | 2.44-3 | | binutils: GNU Binutils Linker elflink.c bfd_elf_gc_record_vtentry out-of-bounds |
| LOW | | 5.5 | | CVE-2025-11413 | libsframe1 | 2.44-3 | | binutils: GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds |
| LOW | | 5.5 | | CVE-2025-11414 | libsframe1 | 2.44-3 | | binutils: GNU Binutils Linker elflink.c get_link_hash_entry out-of-bounds |
| LOW | | 5.3 | | CVE-2025-1147 | libsframe1 | 2.44-3 | | binutils: GNU Binutils nm nm.c internal_strlen buffer overflow |
| LOW | | 3.1 | | CVE-2025-1148 | libsframe1 | 2.44-3 | | binutils: GNU Binutils ld ldelfgen.c link_order_scan memory leak |
| LOW | | 3.1 | | CVE-2025-1149 | libsframe1 | 2.44-3 | | binutils: GNU Binutils ld xmalloc.c xstrdup memory leak |
| LOW | | 5.5 | | CVE-2025-11494 | libsframe1 | 2.44-3 | | binutils: GNU Binutils Linker out-of-bounds read |
| LOW | | 5.5 | | CVE-2025-11495 | libsframe1 | 2.44-3 | | binutils: GNU Binutils Linker heap-based overflow |
| LOW | | 3.1 | | CVE-2025-1150 | libsframe1 | 2.44-3 | | binutils: GNU Binutils ld libbfd.c bfd_malloc memory leak |
| LOW | | 3.1 | | CVE-2025-1151 | libsframe1 | 2.44-3 | | binutils: GNU Binutils ld xmemdup.c xmemdup memory leak |
| LOW | | 3.7 | | CVE-2025-1152 | libsframe1 | 2.44-3 | | binutils: GNU Binutils ld xstrdup.c xstrdup memory leak |
| LOW | | 5.9 | | CVE-2025-1153 | libsframe1 | 2.44-3 | | binutils: GNU Binutils format.c bfd_set_format memory corruption |
| LOW | | 5 | | CVE-2025-1176 | libsframe1 | 2.44-3 | | binutils: GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec heap-based overflow |
| LOW | | 5.6 | | CVE-2025-1178 | libsframe1 | 2.44-3 | | binutils: GNU Binutils ld libbfd.c bfd_putl64 memory corruption |
| LOW | | 3.1 | | CVE-2025-1180 | libsframe1 | 2.44-3 | | binutils: GNU Binutils ld elf-eh-frame.c _bfd_elf_write_section_eh_frame memory corruption |
| LOW | | 5 | | CVE-2025-1181 | libsframe1 | 2.44-3 | | binutils: GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec memory corruption |
| LOW | | 5 | | CVE-2025-1182 | libsframe1 | 2.44-3 | | binutils: GNU Binutils ld elflink.c bfd_elf_reloc_symbol_deleted_p memory corruption |
| LOW | | 5.5 | | CVE-2025-11839 | libsframe1 | 2.44-3 | | binutils: GNU Binutils prdbg.c tg_tag_type return value |
| LOW | | 5.5 | | CVE-2025-11840 | libsframe1 | 2.44-3 | | binutils: GNU Binutils out-of-bounds read |
| LOW | | 5.5 | | CVE-2025-3198 | libsframe1 | 2.44-3 | | binutils: GNU Binutils objdump bucomm.c display_info memory leak |
| LOW | | 7.8 | | CVE-2025-5244 | libsframe1 | 2.44-3 | | binutils: GNU Binutils ld elflink.c elf_gc_sweep memory corruption |
| LOW | | 7.8 | | CVE-2025-5245 | libsframe1 | 2.44-3 | | binutils: GNU Binutils objdump debug.c debug_type_samep memory corruption |
| LOW | | 3.3 | | CVE-2025-66861 | libsframe1 | 2.44-3 | | binutils: out-of-bounds read in d_unqualified_name() in cp-demangle.c |
| LOW | | 3.3 | | CVE-2025-66862 | libsframe1 | 2.44-3 | | binutils: heap-based buffer over-read in gnu_special() in cplus-dem.c |
| LOW | | 3.3 | | CVE-2025-66863 | libsframe1 | 2.44-3 | | binutils: BinUtils: Denial of Service via crafted PE file |
| LOW | | 7.5 | | CVE-2025-66864 | libsframe1 | 2.44-3 | | binutils: NULL pointer dereference in d_print_comp_inner() in cp-demangle.c |
| LOW | | 3.3 | | CVE-2025-66865 | libsframe1 | 2.44-3 | | binutils: stack overflow in d_print_comp_inner() in cp-demangle.c |
| LOW | | 7.5 | | CVE-2025-66866 | libsframe1 | 2.44-3 | | binutils: BinUtils: Denial of Service via crafted PE file |
| LOW | | 2.8 | | CVE-2025-69644 | libsframe1 | 2.44-3 | | binutils: Binutils: Denial of Service via crafted binary with malformed DWARF debug information |
| LOW | | 2.8 | | CVE-2025-69645 | libsframe1 | 2.44-3 | | binutils: Binutils objdump: Denial of Service via crafted DWARF debug information |
| LOW | | 2.8 | | CVE-2025-69646 | libsframe1 | 2.44-3 | | binutils: Binutils: Denial of Service via malformed DWARF debug_rnglists data |
| LOW | | 3.3 | | CVE-2025-69647 | libsframe1 | 2.44-3 | | binutils: infinite loop in readelf via crafted binary with malformed DWARF loclists data |
| LOW | | 3.3 | | CVE-2025-69648 | libsframe1 | 2.44-3 | | binutils: infinite loop in readelf via crafted binary with malformed DWARF .debug_rnglists data |
| LOW | | 7.5 | | CVE-2025-69649 | libsframe1 | 2.44-3 | | binutils: NULL pointer dereference in readelf via crafted ELF binary with malformed header fields |
| LOW | | 7.5 | | CVE-2025-69650 | libsframe1 | 2.44-3 | | binutils: double free in readelf via crafted ELF binary with malformed relocation data |
| LOW | | 5.5 | | CVE-2025-69651 | libsframe1 | 2.44-3 | | binutils: Binutils: Denial of Service via crafted ELF binary processing |
| LOW | | 3.3 | | CVE-2025-69652 | libsframe1 | 2.44-3 | | binutils: abort in readelf via crafted ELF binary with malformed DWARF abbrev or debug information |
| LOW | | 7.8 | | CVE-2025-7545 | libsframe1 | 2.44-3 | | binutils: Binutils: Heap Buffer Overflow |
| LOW | | 7.8 | | CVE-2025-7546 | libsframe1 | 2.44-3 | | binutils: Binutils: Out-of-bounds Write Vulnerability |
| LOW | | 3.3 | | CVE-2025-8225 | libsframe1 | 2.44-3 | | binutils: Binutils DWARF Section Handler Memory Leak |
| LOW | | 5.6 | | CVE-2026-15003 | libsframe1 | 2.44-3 | | binutils: GNU Binutils: Heap-buffer-overflow in linker leads to information disclosure and denial of service |
| LOW | | 7.8 | | CVE-2026-18220 | libsframe1 | 2.44-3 | | binutils: binutils: Out-of-bounds write in BFD DLX ELF backend relocation processing |
| LOW | | 5.5 | | CVE-2026-19548 | libsframe1 | 2.44-3 | | binutils: binutils: Multiple Use-After-Free in add_archive_element via LTO plugin processing |
| LOW | | 7.1 | | CVE-2026-3441 | libsframe1 | 2.44-3 | | binutils: GNU Binutils: Information disclosure via specially crafted XCOFF object file |
| LOW | | 7.1 | | CVE-2026-3442 | libsframe1 | 2.44-3 | | binutils: GNU Binutils: Information disclosure or denial of service via out-of-bounds read in bfd linker |
| LOW | | 6.1 | | CVE-2026-4647 | libsframe1 | 2.44-3 | | binutils: Out-of-Bounds Read in XCOFF Relocation Processing in GNU Binutils BFD Library |
| LOW | | 5.5 | | CVE-2026-6844 | libsframe1 | 2.44-3 | | binutils: Binutils: Denial of Service vulnerabilities in readelf via crafted ELF files |
| LOW | | 5 | | CVE-2026-6845 | libsframe1 | 2.44-3 | | binutils: Binutils: Denial of Service via crafted ELF file |
| LOW | | 7.8 | | CVE-2026-6846 | libsframe1 | 2.44-3 | | binutils: Binutils: Arbitrary code execution via malformed XCOFF object file processing |
| LOW | | 6.6 | | CVE-2026-90801 | libsframe1 | 2.44-3 | | binutils: GNU Binutils ld: Buffer overflow in cache_bwrite via nbytes manipulation |
| LOW | | 5 | | CVE-2026-90802 | libsframe1 | 2.44-3 | | binutils: GNU Binutils: Denial of service via null pointer dereference in ld component |
| LOW | | 6.8 | | CVE-2026-90803 | libsframe1 | 2.44-3 | | binutils: GNU Binutils ld: Buffer Overflow via Malformed Relocation |
| LOW | | 6.1 | | CVE-2026-90804 | libsframe1 | 2.44-3 | | binutils: GNU Binutils: Buffer overflow in Eh Frame Section Handler can lead to denial of service |
| LOW | | 6.6 | | CVE-2026-90828 | libsframe1 | 2.44-3 | | binutils: GNU Binutils: Null pointer dereference via elf_orphan_compatible function |
| LOW | | 6.6 | | CVE-2026-90829 | libsframe1 | 2.44-3 | | binutils: GNU Binutils: Null pointer dereference via SHT_GROUP Section manipulation |
| LOW | | 5.5 | | CVE-2026-90830 | libsframe1 | 2.44-3 | | binutils: GNU Binutils: Local denial of service via null pointer dereference in Section Merge |
| LOW | | 6.6 | | CVE-2026-90831 | libsframe1 | 2.44-3 | | binutils: GNU Binutils: Memory corruption via local manipulation of ELF String Table |
| LOW | | 5.5 | | CVE-2026-91779 | libsframe1 | 2.44-3 | | binutils: GNU Binutils: Denial of Service via null pointer dereference |
| LOW | | 5 | | CVE-2026-91780 | libsframe1 | 2.44-3 | | binutils: GNU Binutils: Local denial of service via null pointer dereference |
| LOW | | 3.3 | | CVE-2026-91781 | libsframe1 | 2.44-3 | | binutils: GNU Binutils: Local denial of service vulnerability |
| LOW | | 5.5 | | CVE-2026-91782 | libsframe1 | 2.44-3 | | binutils: GNU Binutils: Denial of Service via null pointer dereference |
| LOW | | | | CVE-2023-45927 | libslang2 | 2.3.3-5+b2 | | S-Lang 2.3.2 was discovered to contain an arithmetic exception via the ... |
| LOW | | | | CVE-2023-45929 | libslang2 | 2.3.3-5+b2 | | S-Lang 2.3.2 was discovered to contain a segmentation fault via the fu ... |
| LOW | | 5.5 | | CVE-2022-0563 | libsmartcols1 | 2.41-5 | | util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline |
| LOW | | 6.1 | | CVE-2025-14104 | libsmartcols1 | 2.41-5 | 2.41.3-1 | util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames |
| LOW | | 4.3 | | CVE-2021-45346 | libsqlite3-0 | 3.46.1-7+deb13u1 | | sqlite: crafted SQL query allows a malicious user to obtain sensitive information |
| LOW | | 7.5 | | CVE-2025-70873 | libsqlite3-0 | 3.46.1-7+deb13u1 | | sqlite: SQLite: Information Disclosure via Crafted ZIP File |
| LOW | | 7.5 | | CVE-2026-14457 | libssl3t64 | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: RPK server signature algorithm selection can dereference a missing certificate |
| LOW | | 3.7 | | CVE-2026-35189 | libssl3t64 | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: openssl: Denial of Service via excessive memory allocation in CRL distribution point processing |
| LOW | | 3.7 | | CVE-2026-35191 | libssl3t64 | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: openssl: Traffic amplification Denial of Service via QUIC packet over-accounting |
| LOW | | 7.5 | | CVE-2026-54874 | libssl3t64 | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: excessive memory use buffering DTLS records for a future epoch |
| LOW | | 5.9 | | CVE-2026-63073 | libssl3t64 | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: untrusted sender DN used as format string in CMP response validation |
| LOW | | 7.5 | | CVE-2026-63074 | libssl3t64 | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: CMP indefinite cache growth of ExtraCerts |
| LOW | | 7.5 | | CVE-2026-63075 | libssl3t64 | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: QUIC ACK-only packet retention can cause memory exhaustion |
| LOW | | 3.7 | | CVE-2026-75803 | libssl3t64 | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher() |
| LOW | | 3.3 | | CVE-2013-4392 | libsystemd-shared | 257.13-1~deb13u1 | | systemd: TOCTOU race condition when updating file permissions and SELinux security contexts |
| LOW | | 5.3 | | CVE-2023-31437 | libsystemd-shared | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can modify a seale ... |
| LOW | | 5.3 | | CVE-2023-31438 | libsystemd-shared | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can truncate a sea ... |
| LOW | | 5.3 | | CVE-2023-31439 | libsystemd-shared | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can modify the con ... |
| LOW | | 3.3 | | CVE-2026-40228 | libsystemd-shared | 257.13-1~deb13u1 | | systemd: systemd-journald: Unintended output to user terminals via logger command |
| LOW | | 3.3 | | CVE-2013-4392 | libsystemd0 | 257.13-1~deb13u1 | | systemd: TOCTOU race condition when updating file permissions and SELinux security contexts |
| LOW | | 5.3 | | CVE-2023-31437 | libsystemd0 | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can modify a seale ... |
| LOW | | 5.3 | | CVE-2023-31438 | libsystemd0 | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can truncate a sea ... |
| LOW | | 5.3 | | CVE-2023-31439 | libsystemd0 | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can modify the con ... |
| LOW | | 3.3 | | CVE-2026-40228 | libsystemd0 | 257.13-1~deb13u1 | | systemd: systemd-journald: Unintended output to user terminals via logger command |
| LOW | | 5.9 | | CVE-2025-13151 | libtasn1-6 | 4.20.0-2 | 4.20.0-2+deb13u1 | libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_string |
| LOW | | 7.5 | | CVE-2017-16232 | libtiff6 | 4.7.0-3+deb13u2 | | libtiff: Memory leaks in tif_open.c, tif_lzw.c, and tif_aux.c |
| LOW | | 6.5 | | CVE-2018-10126 | libtiff6 | 4.7.0-3+deb13u2 | | libtiff: NULL pointer dereference in the jpeg_fdct_16x16 function in jfdctint.c |
| LOW | | 6.5 | | CVE-2022-1210 | libtiff6 | 4.7.0-3+deb13u2 | | tiff: Malicious file leads to a denial of service in TIFF File Handler |
| LOW | | 5.5 | | CVE-2025-61143 | libtiff6 | 4.7.0-3+deb13u2 | | libtiff: libtiff: Denial of Service via NULL pointer dereference in tif_open.c |
| LOW | | 7.3 | | CVE-2025-61144 | libtiff6 | 4.7.0-3+deb13u2 | | libtiff: libtiff: Denial of Service via buffer overflow |
| LOW | | 5 | | CVE-2025-61145 | libtiff6 | 4.7.0-3+deb13u2 | | libtiff: libtiff: Denial of service via double free in tiffcrop.c |
| LOW | | 7.8 | | CVE-2025-8176 | libtiff6 | 4.7.0-3+deb13u2 | | libtiff: LibTIFF Use-After-Free Vulnerability |
| LOW | | 7.8 | | CVE-2025-8177 | libtiff6 | 4.7.0-3+deb13u2 | | libtiff: LibTIFF Buffer Overflow |
| LOW | | 2.5 | | CVE-2025-8534 | libtiff6 | 4.7.0-3+deb13u2 | | libtiff: Libtiff Null Pointer Dereference Vulnerability |
| LOW | | 7.3 | | CVE-2026-52491 | libtiff6 | 4.7.0-3+deb13u2 | | libtiff: libtiff: Arbitrary code execution via thumbnail.c: main() component |
| LOW | | 7.3 | | CVE-2026-52492 | libtiff6 | 4.7.0-3+deb13u2 | | libtiff: libtiff: Arbitrary code execution via crafted TIFF image |
| LOW | | 3.3 | | CVE-2025-6141 | libtinfo6 | 6.5+20250216-2 | | gnu-ncurses: ncurses Stack Buffer Overflow |
| LOW | | 3.3 | | CVE-2013-4392 | libudev1 | 257.13-1~deb13u1 | | systemd: TOCTOU race condition when updating file permissions and SELinux security contexts |
| LOW | | 5.3 | | CVE-2023-31437 | libudev1 | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can modify a seale ... |
| LOW | | 5.3 | | CVE-2023-31438 | libudev1 | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can truncate a sea ... |
| LOW | | 5.3 | | CVE-2023-31439 | libudev1 | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can modify the con ... |
| LOW | | 3.3 | | CVE-2026-40228 | libudev1 | 257.13-1~deb13u1 | | systemd: systemd-journald: Unintended output to user terminals via logger command |
| LOW | | 5.5 | | CVE-2022-0563 | libuuid1 | 2.41-5 | | util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline |
| LOW | | 6.1 | | CVE-2025-14104 | libuuid1 | 2.41-5 | 2.41.3-1 | util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames |
| LOW | | 3.3 | | CVE-2025-8732 | libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | libxml2: libxml2: Uncontrolled Recursion Vulnerability |
| LOW | | 3.7 | | CVE-2026-0989 | libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | libxml2: Unbounded RelaxNG Include Recursion Leading to Stack Overflow |
| LOW | | 2.9 | | CVE-2026-0992 | libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | libxml2: libxml2: Denial of Service via crafted XML catalogs |
| LOW | | 7.8 | | CVE-2026-11979 | libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | | libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow |
| LOW | | 6.2 | | CVE-2026-1757 | libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | libxml2: Memory Leak Leading to Local Denial of Service in xmllint Interactive Shell |
| LOW | | 3.3 | | CVE-2026-86141 | libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | | libxml2: libxml2: Denial of Service due to NULL pointer dereference in xmlRegNewParserCtxt |
| LOW | | 7.5 | | CVE-2012-2663 | libxtables12 | 1.8.11-2 | | iptables: --syn flag bypass |
| LOW | | 5 | | CVE-2004-0230 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | TCP, when using a large Window Size, makes it easier for remote attack ... |
| LOW | | 4.9 | | CVE-2005-3660 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | Linux kernel 2.4 and 2.6 allows attackers to cause a denial of service ... |
| LOW | | 2.1 | | CVE-2007-3719 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: secretly Monopolizing the CPU Without Superuser Privileges |
| LOW | | 5.5 | | CVE-2008-2544 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mounting proc readonly on a different mount point silently mounts it rw if the /proc mount is rw |
| LOW | | 7.1 | | CVE-2008-4609 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: TCP protocol vulnerabilities from Outpost24 |
| LOW | | 5 | | CVE-2010-4563 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv6: sniffer detection |
| LOW | | 4.3 | | CVE-2010-5321 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: v4l: videobuf: hotfix a bug on multiple calls to mmap() |
| LOW | | 5.5 | | CVE-2011-4915 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | fs/proc/base.c in the Linux kernel through 3.1 allows local users to o ... |
| LOW | | 5.5 | | CVE-2011-4916 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | Linux kernel through 3.1 allows local users to obtain sensitive keystr ... |
| LOW | | 5.5 | | CVE-2011-4917 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel through 3.1 there is an information disclosure iss ... |
| LOW | | 4.9 | | CVE-2012-4542 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: block: default SCSI command filter does not accomodate commands overlap across device classes |
| LOW | | 5.5 | | CVE-2014-9892 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | The snd_compr_tstamp function in sound/core/compress_offload.c in the ... |
| LOW | | 7.5 | | CVE-2014-9900 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Info leak in uninitialized structure ethtool_wolinfo in ethtool_get_wol() |
| LOW | | 3.3 | | CVE-2015-2877 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: Cross-VM ASL INtrospection (CAIN) |
| LOW | | 5.5 | | CVE-2016-10723 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel through 4.17.2. Since the ... |
| LOW | | 5.5 | | CVE-2016-8660 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: local DoS due to a page lock order bug in the XFS seek hole/data implementation |
| LOW | | 4.7 | | CVE-2017-0630 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Information disclosure vulnerability in kernel trace subsystem |
| LOW | | 5.5 | | CVE-2017-13693 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ACPI operand cache leak in dsutils.c |
| LOW | | 5.5 | | CVE-2017-13694 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ACPI node and node_ext cache leak |
| LOW | | 5.9 | | CVE-2018-1121 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | procps: process hiding through race condition enumerating /proc |
| LOW | | 5.5 | | CVE-2018-12928 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NULL pointer dereference in hfs_ext_read_extent in hfs.ko |
| LOW | | 4.9 | | CVE-2018-17977 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Mishandled interactions among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets resulting in a d |
| LOW | | 2.5 | | CVE-2019-11191 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: race condition in load_aout_binary() allows local users to bypass ASLR on setuid a.out programs |
| LOW | | 5.7 | | CVE-2019-12378 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip6_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12379 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory leak in con_insert_unipair in drivers/tty/vt/consolemap.c |
| LOW | | 6.2 | | CVE-2019-12380 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory allocation failure in the efi subsystem leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12381 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12382 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12455 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c causing denial of service |
| LOW | | 7.8 | | CVE-2019-12456 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: double fetch in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c |
| LOW | | 4.1 | | CVE-2019-16229 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c |
| LOW | | 4.7 | | CVE-2019-16230 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/radeon/radeon_display.c |
| LOW | | 4.1 | | CVE-2019-16231 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c |
| LOW | | 4.1 | | CVE-2019-16232 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/wireless/marvell/libertas/if_sdio.c |
| LOW | | 4.1 | | CVE-2019-16233 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c |
| LOW | | 4.7 | | CVE-2019-16234 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/net/wireless/intel/iwlwifi/pcie/trans.c |
| LOW | | 7.5 | | CVE-2019-19070 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: A memory leak in the spi_gpio_probe() function in drivers/spi/spi-gpio.c allows for a DoS |
| LOW | | 7.8 | | CVE-2019-19378 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in index_rbio_pages in fs/btrfs/raid56.c |
| LOW | | 7.8 | | CVE-2020-11725 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: improper handling of private_size*count multiplication due to count=info->owner typo |
| LOW | | 3.4 | | CVE-2020-35501 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: audit not logging access to syscall open_by_handle_at for users with CAP_DAC_READ_SEARCH capability |
| LOW | | 7.8 | | CVE-2021-26934 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel 4.18 through 5.10.16, as u ... |
| LOW | | 5.9 | | CVE-2021-3714 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Remote Page Deduplication Attacks |
| LOW | | 7.5 | | CVE-2022-0400 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Out of bounds read in the smc protocol stack |
| LOW | | 7.8 | | CVE-2022-1247 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: A race condition bug in rose_connect() |
| LOW | | 7.8 | | CVE-2022-25265 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Executable Space Protection Bypass |
| LOW | | 7 | | CVE-2022-2961 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: race condition in rose_bind() |
| LOW | | 7.8 | | CVE-2022-3238 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs3 local privledge escalation if NTFS character set and remount and umount called simultaneously |
| LOW | | 4.2 | | CVE-2022-41848 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Race condition between mgslpc_ioctl and mgslpc_detach |
| LOW | | 6.4 | | CVE-2022-44032 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: Race between cmm_open() and cm4000_detach() result in UAF |
| LOW | | 6.4 | | CVE-2022-44033 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: A race condition between cm4040_open() and reader_detach() may result in UAF |
| LOW | | 5.5 | | CVE-2022-4543 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KASLR Prefetch Bypass Breaks KPTI |
| LOW | | 7 | | CVE-2022-45884 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_register_device() |
| LOW | | 7 | | CVE-2022-45885 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_frontend.c |
| LOW | | 6.4 | | CVE-2023-23039 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tty: vcc: race condition leading to use-after-free in vcc_open() |
| LOW | | 7.8 | | CVE-2023-26242 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: kernel: fpga: dfl-afu: integer overflow in afu_mmio_region_get_by_offset() |
| LOW | | 5.5 | | CVE-2023-31081 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | An issue was discovered in drivers/media/test-drivers/vidtv/vidtv_brid ... |
| LOW | | 5.5 | | CVE-2023-31085 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: divide-by-zero error in ctrl_cdev_ioctl when do_div happens and erasesize is 0 |
| LOW | | 7.8 | | CVE-2023-3640 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and pref |
| LOW | | 6.5 | | CVE-2024-0564 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: max page sharing of Kernel Samepage Merging (KSM) may cause memory deduplication |
| LOW | | | | CVE-2025-40065 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Write hgatp register with valid mode bits |
| LOW | | 5.5 | | CVE-2025-40086 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds |
| LOW | | | | CVE-2025-40136 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: crypto: hisilicon/qm - request reserved interrupt for virtual function |
| LOW | | 5.5 | | CVE-2025-68193 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Add devm release action to safely tear down CT |
| LOW | | 5.5 | | CVE-2025-68359 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix double free of qgroup record after failure to add delayed ref head |
| LOW | | | | CVE-2025-68376 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: ETR: Fix ETR buffer use-after-free issue |
| LOW | | 3.3 | | CVE-2025-68751 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/fpu: Fix false-positive kmsan report in fpu_vstl() |
| LOW | | | | CVE-2025-68755 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: staging: most: remove broken i2c driver |
| LOW | | | | CVE-2026-31536 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: server: let send_done handle a completion without IB_SEND_SIGNALED |
| LOW | | | | CVE-2026-43263 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix Null reference while testing fluster |
| LOW | | | | CVE-2026-45956 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() |
| LOW | | | | CVE-2026-46175 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by FGGC of node block |
| LOW | | | | CVE-2026-52983 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: fix BQL imbalance in TX path |
| LOW | | | | CVE-2026-53024 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free if write is called after disconnect |
| LOW | | | | CVE-2026-53025 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free on cdev close |
| LOW | | 5.5 | | CVE-2026-53284 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: only release the dirty pages io tree after successful writes |
| LOW | | | | CVE-2026-53368 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage |
| LOW | | | | CVE-2026-63825 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gcov: use atomic counter updates to fix concurrent access crashes |
| LOW | | 5.5 | | CVE-2026-64388 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix chown/chgrp with SMB3 POSIX Extensions |
| LOW | | 5.5 | | CVE-2026-64513 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Unconditionally recompute CR8 intercept on PPR update |
| LOW | | 4.7 | | CVE-2026-68081 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state |
| LOW | | 5.5 | | CVE-2026-68105 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Fix kernel panic during driver load failure |
| LOW | | 5.5 | | CVE-2026-68238 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Release VFCT ACPI table reference |
| LOW | | 5.5 | | CVE-2026-68241 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/mst: limit DP MST ESI service loop |
| LOW | | 5.5 | | CVE-2026-68375 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Handle partially initialized auxiliary devices |
| LOW | | 5.5 | | CVE-2026-68412 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() |
| LOW | | 5.5 | | CVE-2026-68418 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Prevent user-triggered null deref on QP create |
| LOW | | 5.5 | | CVE-2026-68436 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: use kvzalloc to allocate struct dc |
| LOW | | 5.5 | | CVE-2026-72009 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI |
| LOW | | 5.5 | | CVE-2026-72031 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD |
| LOW | | 5.5 | | CVE-2026-72321 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() |
| LOW | | 5.5 | | CVE-2026-72366 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_create_write_req() to handle async cache object creation |
| LOW | | 5.5 | | CVE-2026-72439 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid10: fix writes_pending leak on write request failures |
| LOW | | 5.5 | | CVE-2026-72494 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Replace waitqueue and flag with completion |
| LOW | | 5.5 | | CVE-2026-72497 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Add a max slot check for SQ |
| LOW | | 5.5 | | CVE-2026-74261 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: avoid stale FIFO cells during resize |
| LOW | | 5.5 | | CVE-2026-74338 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject sleepable BPF_LSM_CGROUP programs at load time |
| LOW | | 5.5 | | CVE-2026-74373 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix bio accounting for split md cloned bios |
| LOW | | 5.5 | | CVE-2026-74374 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix error-path detection with md_cloned_bio() |
| LOW | | 5.5 | | CVE-2026-74375 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix deadlock in read error recovery path |
| LOW | | 5.5 | | CVE-2026-74558 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: reclaim invalid Tx descriptors in ZC batch path |
| LOW | | 5.5 | | CVE-2026-74559 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: drain continuation descs after overflow in xsk_build_skb() |
| LOW | | 5.5 | | CVE-2026-74560 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx |
| LOW | | 5.5 | | CVE-2026-74571 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: skip global block reserve accounting for rescue mounts |
| LOW | | | | CVE-2026-74690 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| LOW | | 5.5 | | CVE-2026-74728 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: handle NULL b_addr in xfs_buf_free |
| LOW | | 5.5 | | CVE-2026-74733 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock |
| LOW | | 5.5 | | CVE-2026-74734 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firewire: ohci: fix NULL pointer dereference in ar_context_release |
| LOW | | 5.5 | | CVE-2026-74754 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: core: pair EH runtime PM get and put |
| LOW | | 5.5 | | CVE-2026-80581 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout |
| LOW | | 5.5 | | CVE-2026-80607 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg |
| LOW | | 5.5 | | CVE-2026-80616 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() |
| LOW | | 5.5 | | CVE-2026-80643 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: EDAC/igen6: Fix call trace due to missing release() |
| LOW | | 5.5 | | CVE-2026-80653 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: hisi_sas: Add slave_destroy interface for v3 hw |
| LOW | | 5.5 | | CVE-2026-80705 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: check if dml21_add_phantom_plane() is successful |
| LOW | | | | CVE-2026-80738 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| LOW | | | | CVE-2026-80747 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| LOW | | | | CVE-2026-80785 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| LOW | | 5.5 | | CVE-2026-80786 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: Wrap user-invoked calls to fb_set_var() in helper |
| LOW | | 5.5 | | CVE-2026-80866 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tipc: avoid busy looping in tipc_exit_net() |
| LOW | | | | CVE-2026-80872 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | 5.5 | | CVE-2026-80884 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntb: Store original DMA address for future release |
| LOW | | | | CVE-2026-80899 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: e ... |
| LOW | | 5.5 | | CVE-2026-80948 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() |
| LOW | | 5.5 | | CVE-2026-89601 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext2: Fix lost inode updates for IS_SYNC inodes |
| LOW | | 5.5 | | CVE-2026-89808 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram |
| LOW | | 5.5 | | CVE-2026-89812 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the MES ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89813 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the KIQ ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89862 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Fix BSG job leak on validate flash image error path |
| LOW | | 5.5 | | CVE-2026-90084 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-vf: fix workqueue and netdev race in probe/remove |
| LOW | | 5.4 | | CVE-2026-90086 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: honor XDP_TX_METADATA in zero-copy path |
| LOW | | 5.5 | | CVE-2026-90097 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition |
| LOW | | 5.5 | | CVE-2026-90144 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dpll: fix NULL deref in dpll_device_ops() during teardown race |
| LOW | | 5.5 | | CVE-2026-90182 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-iocost: clear delay state when freeing policy data |
| LOW | | 5.5 | | CVE-2026-90183 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-iolatency: clear delay state when freeing policy data |
| LOW | | 6.1 | | CVE-2026-90211 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf, s390: Clear fetch destination on faulting arena atomic |
| LOW | | 5.5 | | CVE-2026-90261 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: flush active metadata block group at btree_writepages() start |
| LOW | | 5.5 | | CVE-2026-90267 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails |
| LOW | | 5.5 | | CVE-2026-90306 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ARM: 9481/2: breakpoint: CFI breakpoints only on demand |
| LOW | | 5.5 | | CVE-2026-90311 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: thermal: hwmon: Remove hwmon class device along with its parent |
| LOW | | 5.5 | | CVE-2026-90330 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: HID: logitech-hidpp: Fix FF device cleanup on init failure |
| LOW | | 5.5 | | CVE-2026-90335 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tty: skip cdev_del() when no cdev is registered |
| LOW | | 5.5 | | CVE-2026-90346 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: nl80211: clean up color-change beacon data on errors |
| LOW | | 5.5 | | CVE-2026-90424 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path |
| LOW | | 5.5 | | CVE-2026-92493 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active |
| LOW | | 5.5 | | CVE-2026-93116 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: asus-wmi: fix resource leaks on probe failure |
| LOW | | 6.7 | | CVE-2026-93125 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max |
| LOW | | 5.5 | | CVE-2026-93129 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: dell-wmi-base: Fix handling of ultra performance key |
| LOW | | 6.7 | | CVE-2026-93144 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject writes through untrusted BTF pointers |
| LOW | | 5.5 | | CVE-2026-93146 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: time/namespace: Validate nanosecond field in proc_timens_set_offset() |
| LOW | | 5.5 | | CVE-2026-93181 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel/uncore: Fix uncore_box ref/unref ordering |
| LOW | | 5.5 | | CVE-2026-93202 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: Fix recursive locking during device registration |
| LOW | | 5.5 | | CVE-2026-93216 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() |
| LOW | | 5.5 | | CVE-2026-93230 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier |
| LOW | | | | CVE-2026-93237 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| LOW | | | | CVE-2026-93251 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | | | CVE-2026-93260 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| LOW | | 5.5 | | CVE-2026-97424 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq |
| LOW | | 5.5 | | CVE-2026-97477 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() |
| LOW | | 5.5 | | CVE-2026-97479 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: driver core: Avoid warning when removing a device while its supplier is unbinding |
| LOW | | 5.5 | | CVE-2026-97480 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tty: serial: 8250: protect against NULL uart->port.dev in register |
| LOW | | 5.5 | | CVE-2026-97501 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction |
| LOW | | 5.5 | | CVE-2026-97503 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: genirq/proc: Size interrupt directory names for 10-digit interrupt numbers |
| LOW | | 5.5 | | CVE-2026-97928 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip the VMID 0 flush for VRAM |
| LOW | | 5.5 | | CVE-2026-97989 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vduse: validate virtqueue alignment |
| LOW | | 5.5 | | CVE-2026-97997 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio_ring: fix stale descriptor flags after a failed packed add |
| LOW | | 5.5 | | CVE-2026-98003 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/amd: Do not reallocate GA log buffers on resume |
| LOW | | 5.5 | | CVE-2026-98038 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Keep refcount_acquire nullable for borrowed RCU kptrs |
| LOW | | 5.5 | | CVE-2026-98044 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject legacy packet loads from callbacks |
| LOW | | 5.5 | | CVE-2026-98058 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark syscall helpers as sleepable |
| LOW | | 5.5 | | CVE-2026-98067 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: erofs: disable LZ4 rolling decompression for now |
| LOW | | 5.5 | | CVE-2026-98073 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: Remove conflicting altnames for dying netns in __dev_change_net_namespace() |
| LOW | | 5.5 | | CVE-2026-98079 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zstd: fix lost wakeup when waiting for a workspace |
| LOW | | 5.5 | | CVE-2026-98087 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate |
| LOW | | 5.5 | | CVE-2026-98119 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: break unbuffered write when netfs_alloc_subrequest() fails |
| LOW | | 5.5 | | CVE-2026-98147 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: printk: Don't WARN on kthread_run failure |
| LOW | | 5.5 | | CVE-2026-98148 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/gud: validate GUD_ROTATION_0 is present in supported rotations |
| LOW | | 7 | | CVE-2026-98176 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| LOW | | 5.5 | | CVE-2026-98177 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow in EOP ring size calculation |
| LOW | | 5.5 | | CVE-2026-98285 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| LOW | | 5.5 | | CVE-2026-98289 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: af_unix: Unify scc_index when finalising SCC in __unix_walk_scc() |
| LOW | | 5.5 | | CVE-2026-98304 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: bcmgenet: restore the hardware filters on open |
| LOW | | 5.5 | | CVE-2026-98317 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS |
| LOW | | 5.5 | | CVE-2026-98321 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_nat: unregister and release hooks on error |
| LOW | | 5.5 | | CVE-2026-98332 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: only operate on TDLS peers in the TDLS code |
| LOW | | 5.5 | | CVE-2026-98338 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: ibss: ref BSS entry for joined event |
| LOW | | 5.5 | | CVE-2026-98389 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip gfx switch_power_profile during GPU reset |
| LOW | | 5.5 | | CVE-2026-98393 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU |
| LOW | | 5.5 | | CVE-2026-98424 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: undo netns switch if renaming the wiphy fails |
| LOW | | 5.5 | | CVE-2026-98427 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: codel: bound the dropping loop per dequeue call |
| LOW | | 5.5 | | CVE-2026-98431 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency |
| LOW | | 3.3 | | CVE-2026-98551 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/core: Fill branch entries with a single assignment |
| LOW | | 2.3 | | CVE-2026-98628 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Make post-verification instruction rewrites killable |
| LOW | | 2.5 | | CVE-2026-98682 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: drain and invalidate before server-side copy/clone |
| LOW | | 2.5 | | CVE-2026-98683 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush dirty data before zeroing a range |
| LOW | | 2.5 | | CVE-2026-98684 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush and commit data before querying allocated ranges |
| LOW | | 3.3 | | CVE-2026-98685 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: discard post-EOF pagecache when extending a file via clone range |
| LOW | | 3.7 | | CVE-2026-98802 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: seg6: ensure packet data is writable before modifying SRH and IPv6 DA |
| LOW | | | | TEMP-0000000-F7A20F | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | [Kernel: Unprivileged user can freeze journald] |
| LOW | | 5 | | CVE-2004-0230 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | TCP, when using a large Window Size, makes it easier for remote attack ... |
| LOW | | 4.9 | | CVE-2005-3660 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | Linux kernel 2.4 and 2.6 allows attackers to cause a denial of service ... |
| LOW | | 2.1 | | CVE-2007-3719 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: secretly Monopolizing the CPU Without Superuser Privileges |
| LOW | | 5.5 | | CVE-2008-2544 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mounting proc readonly on a different mount point silently mounts it rw if the /proc mount is rw |
| LOW | | 7.1 | | CVE-2008-4609 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: TCP protocol vulnerabilities from Outpost24 |
| LOW | | 5 | | CVE-2010-4563 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv6: sniffer detection |
| LOW | | 4.3 | | CVE-2010-5321 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: v4l: videobuf: hotfix a bug on multiple calls to mmap() |
| LOW | | 5.5 | | CVE-2011-4915 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | fs/proc/base.c in the Linux kernel through 3.1 allows local users to o ... |
| LOW | | 5.5 | | CVE-2011-4916 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | Linux kernel through 3.1 allows local users to obtain sensitive keystr ... |
| LOW | | 5.5 | | CVE-2011-4917 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel through 3.1 there is an information disclosure iss ... |
| LOW | | 4.9 | | CVE-2012-4542 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: block: default SCSI command filter does not accomodate commands overlap across device classes |
| LOW | | 5.5 | | CVE-2014-9892 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | The snd_compr_tstamp function in sound/core/compress_offload.c in the ... |
| LOW | | 7.5 | | CVE-2014-9900 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Info leak in uninitialized structure ethtool_wolinfo in ethtool_get_wol() |
| LOW | | 3.3 | | CVE-2015-2877 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: Cross-VM ASL INtrospection (CAIN) |
| LOW | | 5.5 | | CVE-2016-10723 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel through 4.17.2. Since the ... |
| LOW | | 5.5 | | CVE-2016-8660 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: local DoS due to a page lock order bug in the XFS seek hole/data implementation |
| LOW | | 4.7 | | CVE-2017-0630 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Information disclosure vulnerability in kernel trace subsystem |
| LOW | | 5.5 | | CVE-2017-13693 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ACPI operand cache leak in dsutils.c |
| LOW | | 5.5 | | CVE-2017-13694 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ACPI node and node_ext cache leak |
| LOW | | 5.9 | | CVE-2018-1121 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | procps: process hiding through race condition enumerating /proc |
| LOW | | 5.5 | | CVE-2018-12928 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NULL pointer dereference in hfs_ext_read_extent in hfs.ko |
| LOW | | 4.9 | | CVE-2018-17977 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Mishandled interactions among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets resulting in a d |
| LOW | | 2.5 | | CVE-2019-11191 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: race condition in load_aout_binary() allows local users to bypass ASLR on setuid a.out programs |
| LOW | | 5.7 | | CVE-2019-12378 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip6_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12379 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory leak in con_insert_unipair in drivers/tty/vt/consolemap.c |
| LOW | | 6.2 | | CVE-2019-12380 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory allocation failure in the efi subsystem leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12381 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12382 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12455 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c causing denial of service |
| LOW | | 7.8 | | CVE-2019-12456 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: double fetch in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c |
| LOW | | 4.1 | | CVE-2019-16229 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c |
| LOW | | 4.7 | | CVE-2019-16230 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/radeon/radeon_display.c |
| LOW | | 4.1 | | CVE-2019-16231 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c |
| LOW | | 4.1 | | CVE-2019-16232 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/wireless/marvell/libertas/if_sdio.c |
| LOW | | 4.1 | | CVE-2019-16233 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c |
| LOW | | 4.7 | | CVE-2019-16234 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/net/wireless/intel/iwlwifi/pcie/trans.c |
| LOW | | 7.5 | | CVE-2019-19070 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: A memory leak in the spi_gpio_probe() function in drivers/spi/spi-gpio.c allows for a DoS |
| LOW | | 7.8 | | CVE-2019-19378 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in index_rbio_pages in fs/btrfs/raid56.c |
| LOW | | 7.8 | | CVE-2020-11725 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: improper handling of private_size*count multiplication due to count=info->owner typo |
| LOW | | 3.4 | | CVE-2020-35501 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: audit not logging access to syscall open_by_handle_at for users with CAP_DAC_READ_SEARCH capability |
| LOW | | 7.8 | | CVE-2021-26934 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel 4.18 through 5.10.16, as u ... |
| LOW | | 5.9 | | CVE-2021-3714 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Remote Page Deduplication Attacks |
| LOW | | 7.5 | | CVE-2022-0400 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Out of bounds read in the smc protocol stack |
| LOW | | 7.8 | | CVE-2022-1247 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: A race condition bug in rose_connect() |
| LOW | | 7.8 | | CVE-2022-25265 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Executable Space Protection Bypass |
| LOW | | 7 | | CVE-2022-2961 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: race condition in rose_bind() |
| LOW | | 7.8 | | CVE-2022-3238 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs3 local privledge escalation if NTFS character set and remount and umount called simultaneously |
| LOW | | 4.2 | | CVE-2022-41848 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Race condition between mgslpc_ioctl and mgslpc_detach |
| LOW | | 6.4 | | CVE-2022-44032 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: Race between cmm_open() and cm4000_detach() result in UAF |
| LOW | | 6.4 | | CVE-2022-44033 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: A race condition between cm4040_open() and reader_detach() may result in UAF |
| LOW | | 5.5 | | CVE-2022-4543 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KASLR Prefetch Bypass Breaks KPTI |
| LOW | | 7 | | CVE-2022-45884 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_register_device() |
| LOW | | 7 | | CVE-2022-45885 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_frontend.c |
| LOW | | 6.4 | | CVE-2023-23039 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tty: vcc: race condition leading to use-after-free in vcc_open() |
| LOW | | 7.8 | | CVE-2023-26242 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: kernel: fpga: dfl-afu: integer overflow in afu_mmio_region_get_by_offset() |
| LOW | | 5.5 | | CVE-2023-31081 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | An issue was discovered in drivers/media/test-drivers/vidtv/vidtv_brid ... |
| LOW | | 5.5 | | CVE-2023-31085 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: divide-by-zero error in ctrl_cdev_ioctl when do_div happens and erasesize is 0 |
| LOW | | 7.8 | | CVE-2023-3640 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and pref |
| LOW | | 6.5 | | CVE-2024-0564 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: max page sharing of Kernel Samepage Merging (KSM) may cause memory deduplication |
| LOW | | | | CVE-2025-40065 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Write hgatp register with valid mode bits |
| LOW | | 5.5 | | CVE-2025-40086 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds |
| LOW | | | | CVE-2025-40136 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: crypto: hisilicon/qm - request reserved interrupt for virtual function |
| LOW | | 5.5 | | CVE-2025-68193 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Add devm release action to safely tear down CT |
| LOW | | 5.5 | | CVE-2025-68359 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix double free of qgroup record after failure to add delayed ref head |
| LOW | | | | CVE-2025-68376 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: ETR: Fix ETR buffer use-after-free issue |
| LOW | | 3.3 | | CVE-2025-68751 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/fpu: Fix false-positive kmsan report in fpu_vstl() |
| LOW | | | | CVE-2025-68755 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: staging: most: remove broken i2c driver |
| LOW | | | | CVE-2026-31536 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: server: let send_done handle a completion without IB_SEND_SIGNALED |
| LOW | | | | CVE-2026-43263 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix Null reference while testing fluster |
| LOW | | | | CVE-2026-45956 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() |
| LOW | | | | CVE-2026-46175 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by FGGC of node block |
| LOW | | | | CVE-2026-52983 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: fix BQL imbalance in TX path |
| LOW | | | | CVE-2026-53024 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free if write is called after disconnect |
| LOW | | | | CVE-2026-53025 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free on cdev close |
| LOW | | 5.5 | | CVE-2026-53284 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: only release the dirty pages io tree after successful writes |
| LOW | | | | CVE-2026-53368 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage |
| LOW | | | | CVE-2026-63825 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gcov: use atomic counter updates to fix concurrent access crashes |
| LOW | | 5.5 | | CVE-2026-64388 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix chown/chgrp with SMB3 POSIX Extensions |
| LOW | | 5.5 | | CVE-2026-64513 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Unconditionally recompute CR8 intercept on PPR update |
| LOW | | 4.7 | | CVE-2026-68081 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state |
| LOW | | 5.5 | | CVE-2026-68105 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Fix kernel panic during driver load failure |
| LOW | | 5.5 | | CVE-2026-68238 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Release VFCT ACPI table reference |
| LOW | | 5.5 | | CVE-2026-68241 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/mst: limit DP MST ESI service loop |
| LOW | | 5.5 | | CVE-2026-68375 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Handle partially initialized auxiliary devices |
| LOW | | 5.5 | | CVE-2026-68412 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() |
| LOW | | 5.5 | | CVE-2026-68418 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Prevent user-triggered null deref on QP create |
| LOW | | 5.5 | | CVE-2026-68436 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: use kvzalloc to allocate struct dc |
| LOW | | 5.5 | | CVE-2026-72009 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI |
| LOW | | 5.5 | | CVE-2026-72031 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD |
| LOW | | 5.5 | | CVE-2026-72321 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() |
| LOW | | 5.5 | | CVE-2026-72366 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_create_write_req() to handle async cache object creation |
| LOW | | 5.5 | | CVE-2026-72439 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid10: fix writes_pending leak on write request failures |
| LOW | | 5.5 | | CVE-2026-72494 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Replace waitqueue and flag with completion |
| LOW | | 5.5 | | CVE-2026-72497 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Add a max slot check for SQ |
| LOW | | 5.5 | | CVE-2026-74261 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: avoid stale FIFO cells during resize |
| LOW | | 5.5 | | CVE-2026-74338 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject sleepable BPF_LSM_CGROUP programs at load time |
| LOW | | 5.5 | | CVE-2026-74373 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix bio accounting for split md cloned bios |
| LOW | | 5.5 | | CVE-2026-74374 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix error-path detection with md_cloned_bio() |
| LOW | | 5.5 | | CVE-2026-74375 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix deadlock in read error recovery path |
| LOW | | 5.5 | | CVE-2026-74558 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: reclaim invalid Tx descriptors in ZC batch path |
| LOW | | 5.5 | | CVE-2026-74559 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: drain continuation descs after overflow in xsk_build_skb() |
| LOW | | 5.5 | | CVE-2026-74560 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx |
| LOW | | 5.5 | | CVE-2026-74571 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: skip global block reserve accounting for rescue mounts |
| LOW | | | | CVE-2026-74690 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| LOW | | 5.5 | | CVE-2026-74728 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: handle NULL b_addr in xfs_buf_free |
| LOW | | 5.5 | | CVE-2026-74733 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock |
| LOW | | 5.5 | | CVE-2026-74734 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firewire: ohci: fix NULL pointer dereference in ar_context_release |
| LOW | | 5.5 | | CVE-2026-74754 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: core: pair EH runtime PM get and put |
| LOW | | 5.5 | | CVE-2026-80581 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout |
| LOW | | 5.5 | | CVE-2026-80607 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg |
| LOW | | 5.5 | | CVE-2026-80616 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() |
| LOW | | 5.5 | | CVE-2026-80643 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: EDAC/igen6: Fix call trace due to missing release() |
| LOW | | 5.5 | | CVE-2026-80653 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: hisi_sas: Add slave_destroy interface for v3 hw |
| LOW | | 5.5 | | CVE-2026-80705 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: check if dml21_add_phantom_plane() is successful |
| LOW | | | | CVE-2026-80738 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| LOW | | | | CVE-2026-80747 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| LOW | | | | CVE-2026-80785 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| LOW | | 5.5 | | CVE-2026-80786 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: Wrap user-invoked calls to fb_set_var() in helper |
| LOW | | 5.5 | | CVE-2026-80866 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tipc: avoid busy looping in tipc_exit_net() |
| LOW | | | | CVE-2026-80872 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | 5.5 | | CVE-2026-80884 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntb: Store original DMA address for future release |
| LOW | | | | CVE-2026-80899 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: e ... |
| LOW | | 5.5 | | CVE-2026-80948 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() |
| LOW | | 5.5 | | CVE-2026-89601 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext2: Fix lost inode updates for IS_SYNC inodes |
| LOW | | 5.5 | | CVE-2026-89808 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram |
| LOW | | 5.5 | | CVE-2026-89812 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the MES ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89813 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the KIQ ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89862 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Fix BSG job leak on validate flash image error path |
| LOW | | 5.5 | | CVE-2026-90084 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-vf: fix workqueue and netdev race in probe/remove |
| LOW | | 5.4 | | CVE-2026-90086 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: honor XDP_TX_METADATA in zero-copy path |
| LOW | | 5.5 | | CVE-2026-90097 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition |
| LOW | | 5.5 | | CVE-2026-90144 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dpll: fix NULL deref in dpll_device_ops() during teardown race |
| LOW | | 5.5 | | CVE-2026-90182 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-iocost: clear delay state when freeing policy data |
| LOW | | 5.5 | | CVE-2026-90183 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-iolatency: clear delay state when freeing policy data |
| LOW | | 6.1 | | CVE-2026-90211 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf, s390: Clear fetch destination on faulting arena atomic |
| LOW | | 5.5 | | CVE-2026-90261 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: flush active metadata block group at btree_writepages() start |
| LOW | | 5.5 | | CVE-2026-90267 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails |
| LOW | | 5.5 | | CVE-2026-90306 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ARM: 9481/2: breakpoint: CFI breakpoints only on demand |
| LOW | | 5.5 | | CVE-2026-90311 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: thermal: hwmon: Remove hwmon class device along with its parent |
| LOW | | 5.5 | | CVE-2026-90330 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: HID: logitech-hidpp: Fix FF device cleanup on init failure |
| LOW | | 5.5 | | CVE-2026-90335 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tty: skip cdev_del() when no cdev is registered |
| LOW | | 5.5 | | CVE-2026-90346 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: nl80211: clean up color-change beacon data on errors |
| LOW | | 5.5 | | CVE-2026-90424 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path |
| LOW | | 5.5 | | CVE-2026-92493 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active |
| LOW | | 5.5 | | CVE-2026-93116 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: asus-wmi: fix resource leaks on probe failure |
| LOW | | 6.7 | | CVE-2026-93125 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max |
| LOW | | 5.5 | | CVE-2026-93129 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: dell-wmi-base: Fix handling of ultra performance key |
| LOW | | 6.7 | | CVE-2026-93144 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject writes through untrusted BTF pointers |
| LOW | | 5.5 | | CVE-2026-93146 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: time/namespace: Validate nanosecond field in proc_timens_set_offset() |
| LOW | | 5.5 | | CVE-2026-93181 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel/uncore: Fix uncore_box ref/unref ordering |
| LOW | | 5.5 | | CVE-2026-93202 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: Fix recursive locking during device registration |
| LOW | | 5.5 | | CVE-2026-93216 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() |
| LOW | | 5.5 | | CVE-2026-93230 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier |
| LOW | | | | CVE-2026-93237 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| LOW | | | | CVE-2026-93251 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | | | CVE-2026-93260 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| LOW | | 5.5 | | CVE-2026-97424 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq |
| LOW | | 5.5 | | CVE-2026-97477 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() |
| LOW | | 5.5 | | CVE-2026-97479 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: driver core: Avoid warning when removing a device while its supplier is unbinding |
| LOW | | 5.5 | | CVE-2026-97480 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tty: serial: 8250: protect against NULL uart->port.dev in register |
| LOW | | 5.5 | | CVE-2026-97501 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction |
| LOW | | 5.5 | | CVE-2026-97503 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: genirq/proc: Size interrupt directory names for 10-digit interrupt numbers |
| LOW | | 5.5 | | CVE-2026-97928 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip the VMID 0 flush for VRAM |
| LOW | | 5.5 | | CVE-2026-97989 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vduse: validate virtqueue alignment |
| LOW | | 5.5 | | CVE-2026-97997 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio_ring: fix stale descriptor flags after a failed packed add |
| LOW | | 5.5 | | CVE-2026-98003 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/amd: Do not reallocate GA log buffers on resume |
| LOW | | 5.5 | | CVE-2026-98038 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Keep refcount_acquire nullable for borrowed RCU kptrs |
| LOW | | 5.5 | | CVE-2026-98044 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject legacy packet loads from callbacks |
| LOW | | 5.5 | | CVE-2026-98058 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark syscall helpers as sleepable |
| LOW | | 5.5 | | CVE-2026-98067 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: erofs: disable LZ4 rolling decompression for now |
| LOW | | 5.5 | | CVE-2026-98073 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: Remove conflicting altnames for dying netns in __dev_change_net_namespace() |
| LOW | | 5.5 | | CVE-2026-98079 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zstd: fix lost wakeup when waiting for a workspace |
| LOW | | 5.5 | | CVE-2026-98087 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate |
| LOW | | 5.5 | | CVE-2026-98119 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: break unbuffered write when netfs_alloc_subrequest() fails |
| LOW | | 5.5 | | CVE-2026-98147 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: printk: Don't WARN on kthread_run failure |
| LOW | | 5.5 | | CVE-2026-98148 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/gud: validate GUD_ROTATION_0 is present in supported rotations |
| LOW | | 7 | | CVE-2026-98176 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| LOW | | 5.5 | | CVE-2026-98177 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow in EOP ring size calculation |
| LOW | | 5.5 | | CVE-2026-98285 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| LOW | | 5.5 | | CVE-2026-98289 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: af_unix: Unify scc_index when finalising SCC in __unix_walk_scc() |
| LOW | | 5.5 | | CVE-2026-98304 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: bcmgenet: restore the hardware filters on open |
| LOW | | 5.5 | | CVE-2026-98317 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS |
| LOW | | 5.5 | | CVE-2026-98321 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_nat: unregister and release hooks on error |
| LOW | | 5.5 | | CVE-2026-98332 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: only operate on TDLS peers in the TDLS code |
| LOW | | 5.5 | | CVE-2026-98338 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: ibss: ref BSS entry for joined event |
| LOW | | 5.5 | | CVE-2026-98389 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip gfx switch_power_profile during GPU reset |
| LOW | | 5.5 | | CVE-2026-98393 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU |
| LOW | | 5.5 | | CVE-2026-98424 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: undo netns switch if renaming the wiphy fails |
| LOW | | 5.5 | | CVE-2026-98427 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: codel: bound the dropping loop per dequeue call |
| LOW | | 5.5 | | CVE-2026-98431 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency |
| LOW | | 3.3 | | CVE-2026-98551 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/core: Fill branch entries with a single assignment |
| LOW | | 2.3 | | CVE-2026-98628 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Make post-verification instruction rewrites killable |
| LOW | | 2.5 | | CVE-2026-98682 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: drain and invalidate before server-side copy/clone |
| LOW | | 2.5 | | CVE-2026-98683 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush dirty data before zeroing a range |
| LOW | | 2.5 | | CVE-2026-98684 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush and commit data before querying allocated ranges |
| LOW | | 3.3 | | CVE-2026-98685 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: discard post-EOF pagecache when extending a file via clone range |
| LOW | | 3.7 | | CVE-2026-98802 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: seg6: ensure packet data is writable before modifying SRH and IPv6 DA |
| LOW | | | | TEMP-0000000-F7A20F | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | [Kernel: Unprivileged user can freeze journald] |
| LOW | | 5 | | CVE-2004-0230 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | TCP, when using a large Window Size, makes it easier for remote attack ... |
| LOW | | 4.9 | | CVE-2005-3660 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | Linux kernel 2.4 and 2.6 allows attackers to cause a denial of service ... |
| LOW | | 2.1 | | CVE-2007-3719 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: secretly Monopolizing the CPU Without Superuser Privileges |
| LOW | | 5.5 | | CVE-2008-2544 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mounting proc readonly on a different mount point silently mounts it rw if the /proc mount is rw |
| LOW | | 7.1 | | CVE-2008-4609 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: TCP protocol vulnerabilities from Outpost24 |
| LOW | | 5 | | CVE-2010-4563 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv6: sniffer detection |
| LOW | | 4.3 | | CVE-2010-5321 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: v4l: videobuf: hotfix a bug on multiple calls to mmap() |
| LOW | | 5.5 | | CVE-2011-4915 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | fs/proc/base.c in the Linux kernel through 3.1 allows local users to o ... |
| LOW | | 5.5 | | CVE-2011-4916 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | Linux kernel through 3.1 allows local users to obtain sensitive keystr ... |
| LOW | | 5.5 | | CVE-2011-4917 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel through 3.1 there is an information disclosure iss ... |
| LOW | | 4.9 | | CVE-2012-4542 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: block: default SCSI command filter does not accomodate commands overlap across device classes |
| LOW | | 5.5 | | CVE-2014-9892 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | The snd_compr_tstamp function in sound/core/compress_offload.c in the ... |
| LOW | | 7.5 | | CVE-2014-9900 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Info leak in uninitialized structure ethtool_wolinfo in ethtool_get_wol() |
| LOW | | 3.3 | | CVE-2015-2877 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: Cross-VM ASL INtrospection (CAIN) |
| LOW | | 5.5 | | CVE-2016-10723 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel through 4.17.2. Since the ... |
| LOW | | 5.5 | | CVE-2016-8660 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: local DoS due to a page lock order bug in the XFS seek hole/data implementation |
| LOW | | 4.7 | | CVE-2017-0630 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Information disclosure vulnerability in kernel trace subsystem |
| LOW | | 5.5 | | CVE-2017-13693 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ACPI operand cache leak in dsutils.c |
| LOW | | 5.5 | | CVE-2017-13694 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ACPI node and node_ext cache leak |
| LOW | | 5.9 | | CVE-2018-1121 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | procps: process hiding through race condition enumerating /proc |
| LOW | | 5.5 | | CVE-2018-12928 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NULL pointer dereference in hfs_ext_read_extent in hfs.ko |
| LOW | | 4.9 | | CVE-2018-17977 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Mishandled interactions among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets resulting in a d |
| LOW | | 2.5 | | CVE-2019-11191 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: race condition in load_aout_binary() allows local users to bypass ASLR on setuid a.out programs |
| LOW | | 5.7 | | CVE-2019-12378 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip6_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12379 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory leak in con_insert_unipair in drivers/tty/vt/consolemap.c |
| LOW | | 6.2 | | CVE-2019-12380 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory allocation failure in the efi subsystem leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12381 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12382 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12455 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c causing denial of service |
| LOW | | 7.8 | | CVE-2019-12456 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: double fetch in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c |
| LOW | | 4.1 | | CVE-2019-16229 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c |
| LOW | | 4.7 | | CVE-2019-16230 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/radeon/radeon_display.c |
| LOW | | 4.1 | | CVE-2019-16231 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c |
| LOW | | 4.1 | | CVE-2019-16232 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/wireless/marvell/libertas/if_sdio.c |
| LOW | | 4.1 | | CVE-2019-16233 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c |
| LOW | | 4.7 | | CVE-2019-16234 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/net/wireless/intel/iwlwifi/pcie/trans.c |
| LOW | | 7.5 | | CVE-2019-19070 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: A memory leak in the spi_gpio_probe() function in drivers/spi/spi-gpio.c allows for a DoS |
| LOW | | 7.8 | | CVE-2019-19378 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in index_rbio_pages in fs/btrfs/raid56.c |
| LOW | | 7.8 | | CVE-2020-11725 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: improper handling of private_size*count multiplication due to count=info->owner typo |
| LOW | | 3.4 | | CVE-2020-35501 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: audit not logging access to syscall open_by_handle_at for users with CAP_DAC_READ_SEARCH capability |
| LOW | | 7.8 | | CVE-2021-26934 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel 4.18 through 5.10.16, as u ... |
| LOW | | 5.9 | | CVE-2021-3714 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Remote Page Deduplication Attacks |
| LOW | | 7.5 | | CVE-2022-0400 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Out of bounds read in the smc protocol stack |
| LOW | | 7.8 | | CVE-2022-1247 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: A race condition bug in rose_connect() |
| LOW | | 7.8 | | CVE-2022-25265 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Executable Space Protection Bypass |
| LOW | | 7 | | CVE-2022-2961 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: race condition in rose_bind() |
| LOW | | 7.8 | | CVE-2022-3238 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs3 local privledge escalation if NTFS character set and remount and umount called simultaneously |
| LOW | | 4.2 | | CVE-2022-41848 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Race condition between mgslpc_ioctl and mgslpc_detach |
| LOW | | 6.4 | | CVE-2022-44032 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: Race between cmm_open() and cm4000_detach() result in UAF |
| LOW | | 6.4 | | CVE-2022-44033 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: A race condition between cm4040_open() and reader_detach() may result in UAF |
| LOW | | 5.5 | | CVE-2022-4543 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KASLR Prefetch Bypass Breaks KPTI |
| LOW | | 7 | | CVE-2022-45884 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_register_device() |
| LOW | | 7 | | CVE-2022-45885 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_frontend.c |
| LOW | | 6.4 | | CVE-2023-23039 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tty: vcc: race condition leading to use-after-free in vcc_open() |
| LOW | | 7.8 | | CVE-2023-26242 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: kernel: fpga: dfl-afu: integer overflow in afu_mmio_region_get_by_offset() |
| LOW | | 5.5 | | CVE-2023-31081 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | An issue was discovered in drivers/media/test-drivers/vidtv/vidtv_brid ... |
| LOW | | 5.5 | | CVE-2023-31085 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: divide-by-zero error in ctrl_cdev_ioctl when do_div happens and erasesize is 0 |
| LOW | | 7.8 | | CVE-2023-3640 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and pref |
| LOW | | 6.5 | | CVE-2024-0564 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: max page sharing of Kernel Samepage Merging (KSM) may cause memory deduplication |
| LOW | | | | CVE-2025-40065 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Write hgatp register with valid mode bits |
| LOW | | 5.5 | | CVE-2025-40086 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds |
| LOW | | | | CVE-2025-40136 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: crypto: hisilicon/qm - request reserved interrupt for virtual function |
| LOW | | 5.5 | | CVE-2025-68193 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Add devm release action to safely tear down CT |
| LOW | | 5.5 | | CVE-2025-68359 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix double free of qgroup record after failure to add delayed ref head |
| LOW | | | | CVE-2025-68376 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: ETR: Fix ETR buffer use-after-free issue |
| LOW | | 3.3 | | CVE-2025-68751 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/fpu: Fix false-positive kmsan report in fpu_vstl() |
| LOW | | | | CVE-2025-68755 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: staging: most: remove broken i2c driver |
| LOW | | | | CVE-2026-31536 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: server: let send_done handle a completion without IB_SEND_SIGNALED |
| LOW | | | | CVE-2026-43263 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix Null reference while testing fluster |
| LOW | | | | CVE-2026-45956 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() |
| LOW | | | | CVE-2026-46175 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by FGGC of node block |
| LOW | | | | CVE-2026-52983 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: fix BQL imbalance in TX path |
| LOW | | | | CVE-2026-53024 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free if write is called after disconnect |
| LOW | | | | CVE-2026-53025 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free on cdev close |
| LOW | | 5.5 | | CVE-2026-53284 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: only release the dirty pages io tree after successful writes |
| LOW | | | | CVE-2026-53368 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage |
| LOW | | | | CVE-2026-63825 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gcov: use atomic counter updates to fix concurrent access crashes |
| LOW | | 5.5 | | CVE-2026-64388 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix chown/chgrp with SMB3 POSIX Extensions |
| LOW | | 5.5 | | CVE-2026-64513 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Unconditionally recompute CR8 intercept on PPR update |
| LOW | | 4.7 | | CVE-2026-68081 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state |
| LOW | | 5.5 | | CVE-2026-68105 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Fix kernel panic during driver load failure |
| LOW | | 5.5 | | CVE-2026-68238 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Release VFCT ACPI table reference |
| LOW | | 5.5 | | CVE-2026-68241 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/mst: limit DP MST ESI service loop |
| LOW | | 5.5 | | CVE-2026-68375 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Handle partially initialized auxiliary devices |
| LOW | | 5.5 | | CVE-2026-68412 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() |
| LOW | | 5.5 | | CVE-2026-68418 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Prevent user-triggered null deref on QP create |
| LOW | | 5.5 | | CVE-2026-68436 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: use kvzalloc to allocate struct dc |
| LOW | | 5.5 | | CVE-2026-72009 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI |
| LOW | | 5.5 | | CVE-2026-72031 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD |
| LOW | | 5.5 | | CVE-2026-72321 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() |
| LOW | | 5.5 | | CVE-2026-72366 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_create_write_req() to handle async cache object creation |
| LOW | | 5.5 | | CVE-2026-72439 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid10: fix writes_pending leak on write request failures |
| LOW | | 5.5 | | CVE-2026-72494 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Replace waitqueue and flag with completion |
| LOW | | 5.5 | | CVE-2026-72497 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Add a max slot check for SQ |
| LOW | | 5.5 | | CVE-2026-74261 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: avoid stale FIFO cells during resize |
| LOW | | 5.5 | | CVE-2026-74338 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject sleepable BPF_LSM_CGROUP programs at load time |
| LOW | | 5.5 | | CVE-2026-74373 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix bio accounting for split md cloned bios |
| LOW | | 5.5 | | CVE-2026-74374 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix error-path detection with md_cloned_bio() |
| LOW | | 5.5 | | CVE-2026-74375 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix deadlock in read error recovery path |
| LOW | | 5.5 | | CVE-2026-74558 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: reclaim invalid Tx descriptors in ZC batch path |
| LOW | | 5.5 | | CVE-2026-74559 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: drain continuation descs after overflow in xsk_build_skb() |
| LOW | | 5.5 | | CVE-2026-74560 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx |
| LOW | | 5.5 | | CVE-2026-74571 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: skip global block reserve accounting for rescue mounts |
| LOW | | | | CVE-2026-74690 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| LOW | | 5.5 | | CVE-2026-74728 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: handle NULL b_addr in xfs_buf_free |
| LOW | | 5.5 | | CVE-2026-74733 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock |
| LOW | | 5.5 | | CVE-2026-74734 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firewire: ohci: fix NULL pointer dereference in ar_context_release |
| LOW | | 5.5 | | CVE-2026-74754 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: core: pair EH runtime PM get and put |
| LOW | | 5.5 | | CVE-2026-80581 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout |
| LOW | | 5.5 | | CVE-2026-80607 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg |
| LOW | | 5.5 | | CVE-2026-80616 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() |
| LOW | | 5.5 | | CVE-2026-80643 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: EDAC/igen6: Fix call trace due to missing release() |
| LOW | | 5.5 | | CVE-2026-80653 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: hisi_sas: Add slave_destroy interface for v3 hw |
| LOW | | 5.5 | | CVE-2026-80705 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: check if dml21_add_phantom_plane() is successful |
| LOW | | | | CVE-2026-80738 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| LOW | | | | CVE-2026-80747 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| LOW | | | | CVE-2026-80785 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| LOW | | 5.5 | | CVE-2026-80786 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: Wrap user-invoked calls to fb_set_var() in helper |
| LOW | | 5.5 | | CVE-2026-80866 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tipc: avoid busy looping in tipc_exit_net() |
| LOW | | | | CVE-2026-80872 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | 5.5 | | CVE-2026-80884 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntb: Store original DMA address for future release |
| LOW | | | | CVE-2026-80899 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: e ... |
| LOW | | 5.5 | | CVE-2026-80948 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() |
| LOW | | 5.5 | | CVE-2026-89601 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext2: Fix lost inode updates for IS_SYNC inodes |
| LOW | | 5.5 | | CVE-2026-89808 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram |
| LOW | | 5.5 | | CVE-2026-89812 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the MES ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89813 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the KIQ ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89862 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Fix BSG job leak on validate flash image error path |
| LOW | | 5.5 | | CVE-2026-90084 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-vf: fix workqueue and netdev race in probe/remove |
| LOW | | 5.4 | | CVE-2026-90086 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: honor XDP_TX_METADATA in zero-copy path |
| LOW | | 5.5 | | CVE-2026-90097 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition |
| LOW | | 5.5 | | CVE-2026-90144 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dpll: fix NULL deref in dpll_device_ops() during teardown race |
| LOW | | 5.5 | | CVE-2026-90182 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-iocost: clear delay state when freeing policy data |
| LOW | | 5.5 | | CVE-2026-90183 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-iolatency: clear delay state when freeing policy data |
| LOW | | 6.1 | | CVE-2026-90211 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf, s390: Clear fetch destination on faulting arena atomic |
| LOW | | 5.5 | | CVE-2026-90261 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: flush active metadata block group at btree_writepages() start |
| LOW | | 5.5 | | CVE-2026-90267 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails |
| LOW | | 5.5 | | CVE-2026-90306 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ARM: 9481/2: breakpoint: CFI breakpoints only on demand |
| LOW | | 5.5 | | CVE-2026-90311 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: thermal: hwmon: Remove hwmon class device along with its parent |
| LOW | | 5.5 | | CVE-2026-90330 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: HID: logitech-hidpp: Fix FF device cleanup on init failure |
| LOW | | 5.5 | | CVE-2026-90335 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tty: skip cdev_del() when no cdev is registered |
| LOW | | 5.5 | | CVE-2026-90346 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: nl80211: clean up color-change beacon data on errors |
| LOW | | 5.5 | | CVE-2026-90424 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path |
| LOW | | 5.5 | | CVE-2026-92493 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active |
| LOW | | 5.5 | | CVE-2026-93116 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: asus-wmi: fix resource leaks on probe failure |
| LOW | | 6.7 | | CVE-2026-93125 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max |
| LOW | | 5.5 | | CVE-2026-93129 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: dell-wmi-base: Fix handling of ultra performance key |
| LOW | | 6.7 | | CVE-2026-93144 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject writes through untrusted BTF pointers |
| LOW | | 5.5 | | CVE-2026-93146 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: time/namespace: Validate nanosecond field in proc_timens_set_offset() |
| LOW | | 5.5 | | CVE-2026-93181 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel/uncore: Fix uncore_box ref/unref ordering |
| LOW | | 5.5 | | CVE-2026-93202 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: Fix recursive locking during device registration |
| LOW | | 5.5 | | CVE-2026-93216 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() |
| LOW | | 5.5 | | CVE-2026-93230 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier |
| LOW | | | | CVE-2026-93237 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| LOW | | | | CVE-2026-93251 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | | | CVE-2026-93260 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| LOW | | 5.5 | | CVE-2026-97424 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq |
| LOW | | 5.5 | | CVE-2026-97477 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() |
| LOW | | 5.5 | | CVE-2026-97479 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: driver core: Avoid warning when removing a device while its supplier is unbinding |
| LOW | | 5.5 | | CVE-2026-97480 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tty: serial: 8250: protect against NULL uart->port.dev in register |
| LOW | | 5.5 | | CVE-2026-97501 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction |
| LOW | | 5.5 | | CVE-2026-97503 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: genirq/proc: Size interrupt directory names for 10-digit interrupt numbers |
| LOW | | 5.5 | | CVE-2026-97928 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip the VMID 0 flush for VRAM |
| LOW | | 5.5 | | CVE-2026-97989 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vduse: validate virtqueue alignment |
| LOW | | 5.5 | | CVE-2026-97997 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio_ring: fix stale descriptor flags after a failed packed add |
| LOW | | 5.5 | | CVE-2026-98003 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/amd: Do not reallocate GA log buffers on resume |
| LOW | | 5.5 | | CVE-2026-98038 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Keep refcount_acquire nullable for borrowed RCU kptrs |
| LOW | | 5.5 | | CVE-2026-98044 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject legacy packet loads from callbacks |
| LOW | | 5.5 | | CVE-2026-98058 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark syscall helpers as sleepable |
| LOW | | 5.5 | | CVE-2026-98067 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: erofs: disable LZ4 rolling decompression for now |
| LOW | | 5.5 | | CVE-2026-98073 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: Remove conflicting altnames for dying netns in __dev_change_net_namespace() |
| LOW | | 5.5 | | CVE-2026-98079 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zstd: fix lost wakeup when waiting for a workspace |
| LOW | | 5.5 | | CVE-2026-98087 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate |
| LOW | | 5.5 | | CVE-2026-98119 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: break unbuffered write when netfs_alloc_subrequest() fails |
| LOW | | 5.5 | | CVE-2026-98147 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: printk: Don't WARN on kthread_run failure |
| LOW | | 5.5 | | CVE-2026-98148 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/gud: validate GUD_ROTATION_0 is present in supported rotations |
| LOW | | 7 | | CVE-2026-98176 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| LOW | | 5.5 | | CVE-2026-98177 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow in EOP ring size calculation |
| LOW | | 5.5 | | CVE-2026-98285 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| LOW | | 5.5 | | CVE-2026-98289 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: af_unix: Unify scc_index when finalising SCC in __unix_walk_scc() |
| LOW | | 5.5 | | CVE-2026-98304 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: bcmgenet: restore the hardware filters on open |
| LOW | | 5.5 | | CVE-2026-98317 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS |
| LOW | | 5.5 | | CVE-2026-98321 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_nat: unregister and release hooks on error |
| LOW | | 5.5 | | CVE-2026-98332 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: only operate on TDLS peers in the TDLS code |
| LOW | | 5.5 | | CVE-2026-98338 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: ibss: ref BSS entry for joined event |
| LOW | | 5.5 | | CVE-2026-98389 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip gfx switch_power_profile during GPU reset |
| LOW | | 5.5 | | CVE-2026-98393 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU |
| LOW | | 5.5 | | CVE-2026-98424 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: undo netns switch if renaming the wiphy fails |
| LOW | | 5.5 | | CVE-2026-98427 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: codel: bound the dropping loop per dequeue call |
| LOW | | 5.5 | | CVE-2026-98431 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency |
| LOW | | 3.3 | | CVE-2026-98551 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/core: Fill branch entries with a single assignment |
| LOW | | 2.3 | | CVE-2026-98628 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Make post-verification instruction rewrites killable |
| LOW | | 2.5 | | CVE-2026-98682 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: drain and invalidate before server-side copy/clone |
| LOW | | 2.5 | | CVE-2026-98683 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush dirty data before zeroing a range |
| LOW | | 2.5 | | CVE-2026-98684 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush and commit data before querying allocated ranges |
| LOW | | 3.3 | | CVE-2026-98685 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: discard post-EOF pagecache when extending a file via clone range |
| LOW | | 3.7 | | CVE-2026-98802 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: seg6: ensure packet data is writable before modifying SRH and IPv6 DA |
| LOW | | | | TEMP-0000000-F7A20F | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | [Kernel: Unprivileged user can freeze journald] |
| LOW | | 5 | | CVE-2004-0230 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | TCP, when using a large Window Size, makes it easier for remote attack ... |
| LOW | | 4.9 | | CVE-2005-3660 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | Linux kernel 2.4 and 2.6 allows attackers to cause a denial of service ... |
| LOW | | 2.1 | | CVE-2007-3719 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: secretly Monopolizing the CPU Without Superuser Privileges |
| LOW | | 5.5 | | CVE-2008-2544 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mounting proc readonly on a different mount point silently mounts it rw if the /proc mount is rw |
| LOW | | 7.1 | | CVE-2008-4609 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: TCP protocol vulnerabilities from Outpost24 |
| LOW | | 5 | | CVE-2010-4563 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv6: sniffer detection |
| LOW | | 4.3 | | CVE-2010-5321 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: v4l: videobuf: hotfix a bug on multiple calls to mmap() |
| LOW | | 5.5 | | CVE-2011-4915 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | fs/proc/base.c in the Linux kernel through 3.1 allows local users to o ... |
| LOW | | 5.5 | | CVE-2011-4916 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | Linux kernel through 3.1 allows local users to obtain sensitive keystr ... |
| LOW | | 5.5 | | CVE-2011-4917 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel through 3.1 there is an information disclosure iss ... |
| LOW | | 4.9 | | CVE-2012-4542 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: block: default SCSI command filter does not accomodate commands overlap across device classes |
| LOW | | 5.5 | | CVE-2014-9892 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | The snd_compr_tstamp function in sound/core/compress_offload.c in the ... |
| LOW | | 7.5 | | CVE-2014-9900 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Info leak in uninitialized structure ethtool_wolinfo in ethtool_get_wol() |
| LOW | | 3.3 | | CVE-2015-2877 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: Cross-VM ASL INtrospection (CAIN) |
| LOW | | 5.5 | | CVE-2016-10723 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel through 4.17.2. Since the ... |
| LOW | | 5.5 | | CVE-2016-8660 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: local DoS due to a page lock order bug in the XFS seek hole/data implementation |
| LOW | | 4.7 | | CVE-2017-0630 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Information disclosure vulnerability in kernel trace subsystem |
| LOW | | 5.5 | | CVE-2017-13693 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ACPI operand cache leak in dsutils.c |
| LOW | | 5.5 | | CVE-2017-13694 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ACPI node and node_ext cache leak |
| LOW | | 5.9 | | CVE-2018-1121 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | procps: process hiding through race condition enumerating /proc |
| LOW | | 5.5 | | CVE-2018-12928 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NULL pointer dereference in hfs_ext_read_extent in hfs.ko |
| LOW | | 4.9 | | CVE-2018-17977 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Mishandled interactions among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets resulting in a d |
| LOW | | 2.5 | | CVE-2019-11191 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: race condition in load_aout_binary() allows local users to bypass ASLR on setuid a.out programs |
| LOW | | 5.7 | | CVE-2019-12378 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip6_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12379 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory leak in con_insert_unipair in drivers/tty/vt/consolemap.c |
| LOW | | 6.2 | | CVE-2019-12380 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory allocation failure in the efi subsystem leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12381 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12382 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12455 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c causing denial of service |
| LOW | | 7.8 | | CVE-2019-12456 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: double fetch in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c |
| LOW | | 4.1 | | CVE-2019-16229 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c |
| LOW | | 4.7 | | CVE-2019-16230 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/radeon/radeon_display.c |
| LOW | | 4.1 | | CVE-2019-16231 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c |
| LOW | | 4.1 | | CVE-2019-16232 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/wireless/marvell/libertas/if_sdio.c |
| LOW | | 4.1 | | CVE-2019-16233 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c |
| LOW | | 4.7 | | CVE-2019-16234 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/net/wireless/intel/iwlwifi/pcie/trans.c |
| LOW | | 7.5 | | CVE-2019-19070 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: A memory leak in the spi_gpio_probe() function in drivers/spi/spi-gpio.c allows for a DoS |
| LOW | | 7.8 | | CVE-2019-19378 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in index_rbio_pages in fs/btrfs/raid56.c |
| LOW | | 7.8 | | CVE-2020-11725 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: improper handling of private_size*count multiplication due to count=info->owner typo |
| LOW | | 3.4 | | CVE-2020-35501 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: audit not logging access to syscall open_by_handle_at for users with CAP_DAC_READ_SEARCH capability |
| LOW | | 7.8 | | CVE-2021-26934 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel 4.18 through 5.10.16, as u ... |
| LOW | | 5.9 | | CVE-2021-3714 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Remote Page Deduplication Attacks |
| LOW | | 7.5 | | CVE-2022-0400 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Out of bounds read in the smc protocol stack |
| LOW | | 7.8 | | CVE-2022-1247 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: A race condition bug in rose_connect() |
| LOW | | 7.8 | | CVE-2022-25265 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Executable Space Protection Bypass |
| LOW | | 7 | | CVE-2022-2961 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: race condition in rose_bind() |
| LOW | | 7.8 | | CVE-2022-3238 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs3 local privledge escalation if NTFS character set and remount and umount called simultaneously |
| LOW | | 4.2 | | CVE-2022-41848 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Race condition between mgslpc_ioctl and mgslpc_detach |
| LOW | | 6.4 | | CVE-2022-44032 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: Race between cmm_open() and cm4000_detach() result in UAF |
| LOW | | 6.4 | | CVE-2022-44033 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: A race condition between cm4040_open() and reader_detach() may result in UAF |
| LOW | | 5.5 | | CVE-2022-4543 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KASLR Prefetch Bypass Breaks KPTI |
| LOW | | 7 | | CVE-2022-45884 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_register_device() |
| LOW | | 7 | | CVE-2022-45885 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_frontend.c |
| LOW | | 6.4 | | CVE-2023-23039 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tty: vcc: race condition leading to use-after-free in vcc_open() |
| LOW | | 7.8 | | CVE-2023-26242 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: kernel: fpga: dfl-afu: integer overflow in afu_mmio_region_get_by_offset() |
| LOW | | 5.5 | | CVE-2023-31081 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | An issue was discovered in drivers/media/test-drivers/vidtv/vidtv_brid ... |
| LOW | | 5.5 | | CVE-2023-31085 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: divide-by-zero error in ctrl_cdev_ioctl when do_div happens and erasesize is 0 |
| LOW | | 7.8 | | CVE-2023-3640 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and pref |
| LOW | | 6.5 | | CVE-2024-0564 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: max page sharing of Kernel Samepage Merging (KSM) may cause memory deduplication |
| LOW | | | | CVE-2025-40065 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Write hgatp register with valid mode bits |
| LOW | | 5.5 | | CVE-2025-40086 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds |
| LOW | | | | CVE-2025-40136 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: crypto: hisilicon/qm - request reserved interrupt for virtual function |
| LOW | | 5.5 | | CVE-2025-68193 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Add devm release action to safely tear down CT |
| LOW | | 5.5 | | CVE-2025-68359 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix double free of qgroup record after failure to add delayed ref head |
| LOW | | | | CVE-2025-68376 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: ETR: Fix ETR buffer use-after-free issue |
| LOW | | 3.3 | | CVE-2025-68751 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/fpu: Fix false-positive kmsan report in fpu_vstl() |
| LOW | | | | CVE-2025-68755 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: staging: most: remove broken i2c driver |
| LOW | | | | CVE-2026-31536 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: server: let send_done handle a completion without IB_SEND_SIGNALED |
| LOW | | | | CVE-2026-43263 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix Null reference while testing fluster |
| LOW | | | | CVE-2026-45956 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() |
| LOW | | | | CVE-2026-46175 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by FGGC of node block |
| LOW | | | | CVE-2026-52983 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: fix BQL imbalance in TX path |
| LOW | | | | CVE-2026-53024 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free if write is called after disconnect |
| LOW | | | | CVE-2026-53025 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free on cdev close |
| LOW | | 5.5 | | CVE-2026-53284 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: only release the dirty pages io tree after successful writes |
| LOW | | | | CVE-2026-53368 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage |
| LOW | | | | CVE-2026-63825 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gcov: use atomic counter updates to fix concurrent access crashes |
| LOW | | 5.5 | | CVE-2026-64388 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix chown/chgrp with SMB3 POSIX Extensions |
| LOW | | 5.5 | | CVE-2026-64513 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Unconditionally recompute CR8 intercept on PPR update |
| LOW | | 4.7 | | CVE-2026-68081 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state |
| LOW | | 5.5 | | CVE-2026-68105 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Fix kernel panic during driver load failure |
| LOW | | 5.5 | | CVE-2026-68238 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Release VFCT ACPI table reference |
| LOW | | 5.5 | | CVE-2026-68241 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/mst: limit DP MST ESI service loop |
| LOW | | 5.5 | | CVE-2026-68375 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Handle partially initialized auxiliary devices |
| LOW | | 5.5 | | CVE-2026-68412 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() |
| LOW | | 5.5 | | CVE-2026-68418 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Prevent user-triggered null deref on QP create |
| LOW | | 5.5 | | CVE-2026-68436 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: use kvzalloc to allocate struct dc |
| LOW | | 5.5 | | CVE-2026-72009 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI |
| LOW | | 5.5 | | CVE-2026-72031 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD |
| LOW | | 5.5 | | CVE-2026-72321 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() |
| LOW | | 5.5 | | CVE-2026-72366 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_create_write_req() to handle async cache object creation |
| LOW | | 5.5 | | CVE-2026-72439 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid10: fix writes_pending leak on write request failures |
| LOW | | 5.5 | | CVE-2026-72494 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Replace waitqueue and flag with completion |
| LOW | | 5.5 | | CVE-2026-72497 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Add a max slot check for SQ |
| LOW | | 5.5 | | CVE-2026-74261 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: avoid stale FIFO cells during resize |
| LOW | | 5.5 | | CVE-2026-74338 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject sleepable BPF_LSM_CGROUP programs at load time |
| LOW | | 5.5 | | CVE-2026-74373 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix bio accounting for split md cloned bios |
| LOW | | 5.5 | | CVE-2026-74374 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix error-path detection with md_cloned_bio() |
| LOW | | 5.5 | | CVE-2026-74375 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix deadlock in read error recovery path |
| LOW | | 5.5 | | CVE-2026-74558 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: reclaim invalid Tx descriptors in ZC batch path |
| LOW | | 5.5 | | CVE-2026-74559 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: drain continuation descs after overflow in xsk_build_skb() |
| LOW | | 5.5 | | CVE-2026-74560 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx |
| LOW | | 5.5 | | CVE-2026-74571 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: skip global block reserve accounting for rescue mounts |
| LOW | | | | CVE-2026-74690 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| LOW | | 5.5 | | CVE-2026-74728 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: handle NULL b_addr in xfs_buf_free |
| LOW | | 5.5 | | CVE-2026-74733 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock |
| LOW | | 5.5 | | CVE-2026-74734 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firewire: ohci: fix NULL pointer dereference in ar_context_release |
| LOW | | 5.5 | | CVE-2026-74754 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: core: pair EH runtime PM get and put |
| LOW | | 5.5 | | CVE-2026-80581 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout |
| LOW | | 5.5 | | CVE-2026-80607 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg |
| LOW | | 5.5 | | CVE-2026-80616 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() |
| LOW | | 5.5 | | CVE-2026-80643 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: EDAC/igen6: Fix call trace due to missing release() |
| LOW | | 5.5 | | CVE-2026-80653 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: hisi_sas: Add slave_destroy interface for v3 hw |
| LOW | | 5.5 | | CVE-2026-80705 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: check if dml21_add_phantom_plane() is successful |
| LOW | | | | CVE-2026-80738 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| LOW | | | | CVE-2026-80747 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| LOW | | | | CVE-2026-80785 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| LOW | | 5.5 | | CVE-2026-80786 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: Wrap user-invoked calls to fb_set_var() in helper |
| LOW | | 5.5 | | CVE-2026-80866 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tipc: avoid busy looping in tipc_exit_net() |
| LOW | | | | CVE-2026-80872 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | 5.5 | | CVE-2026-80884 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntb: Store original DMA address for future release |
| LOW | | | | CVE-2026-80899 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: e ... |
| LOW | | 5.5 | | CVE-2026-80948 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() |
| LOW | | 5.5 | | CVE-2026-89601 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext2: Fix lost inode updates for IS_SYNC inodes |
| LOW | | 5.5 | | CVE-2026-89808 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram |
| LOW | | 5.5 | | CVE-2026-89812 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the MES ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89813 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the KIQ ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89862 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Fix BSG job leak on validate flash image error path |
| LOW | | 5.5 | | CVE-2026-90084 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-vf: fix workqueue and netdev race in probe/remove |
| LOW | | 5.4 | | CVE-2026-90086 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: honor XDP_TX_METADATA in zero-copy path |
| LOW | | 5.5 | | CVE-2026-90097 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition |
| LOW | | 5.5 | | CVE-2026-90144 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dpll: fix NULL deref in dpll_device_ops() during teardown race |
| LOW | | 5.5 | | CVE-2026-90182 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-iocost: clear delay state when freeing policy data |
| LOW | | 5.5 | | CVE-2026-90183 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-iolatency: clear delay state when freeing policy data |
| LOW | | 6.1 | | CVE-2026-90211 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf, s390: Clear fetch destination on faulting arena atomic |
| LOW | | 5.5 | | CVE-2026-90261 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: flush active metadata block group at btree_writepages() start |
| LOW | | 5.5 | | CVE-2026-90267 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails |
| LOW | | 5.5 | | CVE-2026-90306 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ARM: 9481/2: breakpoint: CFI breakpoints only on demand |
| LOW | | 5.5 | | CVE-2026-90311 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: thermal: hwmon: Remove hwmon class device along with its parent |
| LOW | | 5.5 | | CVE-2026-90330 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: HID: logitech-hidpp: Fix FF device cleanup on init failure |
| LOW | | 5.5 | | CVE-2026-90335 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tty: skip cdev_del() when no cdev is registered |
| LOW | | 5.5 | | CVE-2026-90346 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: nl80211: clean up color-change beacon data on errors |
| LOW | | 5.5 | | CVE-2026-90424 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path |
| LOW | | 5.5 | | CVE-2026-92493 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active |
| LOW | | 5.5 | | CVE-2026-93116 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: asus-wmi: fix resource leaks on probe failure |
| LOW | | 6.7 | | CVE-2026-93125 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max |
| LOW | | 5.5 | | CVE-2026-93129 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: dell-wmi-base: Fix handling of ultra performance key |
| LOW | | 6.7 | | CVE-2026-93144 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject writes through untrusted BTF pointers |
| LOW | | 5.5 | | CVE-2026-93146 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: time/namespace: Validate nanosecond field in proc_timens_set_offset() |
| LOW | | 5.5 | | CVE-2026-93181 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel/uncore: Fix uncore_box ref/unref ordering |
| LOW | | 5.5 | | CVE-2026-93202 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: Fix recursive locking during device registration |
| LOW | | 5.5 | | CVE-2026-93216 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() |
| LOW | | 5.5 | | CVE-2026-93230 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier |
| LOW | | | | CVE-2026-93237 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| LOW | | | | CVE-2026-93251 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | | | CVE-2026-93260 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| LOW | | 5.5 | | CVE-2026-97424 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq |
| LOW | | 5.5 | | CVE-2026-97477 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() |
| LOW | | 5.5 | | CVE-2026-97479 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: driver core: Avoid warning when removing a device while its supplier is unbinding |
| LOW | | 5.5 | | CVE-2026-97480 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tty: serial: 8250: protect against NULL uart->port.dev in register |
| LOW | | 5.5 | | CVE-2026-97501 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction |
| LOW | | 5.5 | | CVE-2026-97503 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: genirq/proc: Size interrupt directory names for 10-digit interrupt numbers |
| LOW | | 5.5 | | CVE-2026-97928 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip the VMID 0 flush for VRAM |
| LOW | | 5.5 | | CVE-2026-97989 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vduse: validate virtqueue alignment |
| LOW | | 5.5 | | CVE-2026-97997 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio_ring: fix stale descriptor flags after a failed packed add |
| LOW | | 5.5 | | CVE-2026-98003 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/amd: Do not reallocate GA log buffers on resume |
| LOW | | 5.5 | | CVE-2026-98038 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Keep refcount_acquire nullable for borrowed RCU kptrs |
| LOW | | 5.5 | | CVE-2026-98044 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject legacy packet loads from callbacks |
| LOW | | 5.5 | | CVE-2026-98058 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark syscall helpers as sleepable |
| LOW | | 5.5 | | CVE-2026-98067 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: erofs: disable LZ4 rolling decompression for now |
| LOW | | 5.5 | | CVE-2026-98073 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: Remove conflicting altnames for dying netns in __dev_change_net_namespace() |
| LOW | | 5.5 | | CVE-2026-98079 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zstd: fix lost wakeup when waiting for a workspace |
| LOW | | 5.5 | | CVE-2026-98087 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate |
| LOW | | 5.5 | | CVE-2026-98119 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: break unbuffered write when netfs_alloc_subrequest() fails |
| LOW | | 5.5 | | CVE-2026-98147 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: printk: Don't WARN on kthread_run failure |
| LOW | | 5.5 | | CVE-2026-98148 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/gud: validate GUD_ROTATION_0 is present in supported rotations |
| LOW | | 7 | | CVE-2026-98176 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| LOW | | 5.5 | | CVE-2026-98177 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow in EOP ring size calculation |
| LOW | | 5.5 | | CVE-2026-98285 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| LOW | | 5.5 | | CVE-2026-98289 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: af_unix: Unify scc_index when finalising SCC in __unix_walk_scc() |
| LOW | | 5.5 | | CVE-2026-98304 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: bcmgenet: restore the hardware filters on open |
| LOW | | 5.5 | | CVE-2026-98317 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS |
| LOW | | 5.5 | | CVE-2026-98321 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_nat: unregister and release hooks on error |
| LOW | | 5.5 | | CVE-2026-98332 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: only operate on TDLS peers in the TDLS code |
| LOW | | 5.5 | | CVE-2026-98338 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: ibss: ref BSS entry for joined event |
| LOW | | 5.5 | | CVE-2026-98389 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip gfx switch_power_profile during GPU reset |
| LOW | | 5.5 | | CVE-2026-98393 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU |
| LOW | | 5.5 | | CVE-2026-98424 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: undo netns switch if renaming the wiphy fails |
| LOW | | 5.5 | | CVE-2026-98427 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: codel: bound the dropping loop per dequeue call |
| LOW | | 5.5 | | CVE-2026-98431 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency |
| LOW | | 3.3 | | CVE-2026-98551 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/core: Fill branch entries with a single assignment |
| LOW | | 2.3 | | CVE-2026-98628 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Make post-verification instruction rewrites killable |
| LOW | | 2.5 | | CVE-2026-98682 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: drain and invalidate before server-side copy/clone |
| LOW | | 2.5 | | CVE-2026-98683 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush dirty data before zeroing a range |
| LOW | | 2.5 | | CVE-2026-98684 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush and commit data before querying allocated ranges |
| LOW | | 3.3 | | CVE-2026-98685 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: discard post-EOF pagecache when extending a file via clone range |
| LOW | | 3.7 | | CVE-2026-98802 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: seg6: ensure packet data is writable before modifying SRH and IPv6 DA |
| LOW | | | | TEMP-0000000-F7A20F | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | [Kernel: Unprivileged user can freeze journald] |
| LOW | | 5 | | CVE-2004-0230 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | TCP, when using a large Window Size, makes it easier for remote attack ... |
| LOW | | 4.9 | | CVE-2005-3660 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | Linux kernel 2.4 and 2.6 allows attackers to cause a denial of service ... |
| LOW | | 2.1 | | CVE-2007-3719 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: secretly Monopolizing the CPU Without Superuser Privileges |
| LOW | | 5.5 | | CVE-2008-2544 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: mounting proc readonly on a different mount point silently mounts it rw if the /proc mount is rw |
| LOW | | 7.1 | | CVE-2008-4609 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: TCP protocol vulnerabilities from Outpost24 |
| LOW | | 5 | | CVE-2010-4563 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ipv6: sniffer detection |
| LOW | | 4.3 | | CVE-2010-5321 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: v4l: videobuf: hotfix a bug on multiple calls to mmap() |
| LOW | | 5.5 | | CVE-2011-4915 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | fs/proc/base.c in the Linux kernel through 3.1 allows local users to o ... |
| LOW | | 5.5 | | CVE-2011-4916 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | Linux kernel through 3.1 allows local users to obtain sensitive keystr ... |
| LOW | | 5.5 | | CVE-2011-4917 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel through 3.1 there is an information disclosure iss ... |
| LOW | | 4.9 | | CVE-2012-4542 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: block: default SCSI command filter does not accomodate commands overlap across device classes |
| LOW | | 5.5 | | CVE-2014-9892 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | The snd_compr_tstamp function in sound/core/compress_offload.c in the ... |
| LOW | | 7.5 | | CVE-2014-9900 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Info leak in uninitialized structure ethtool_wolinfo in ethtool_get_wol() |
| LOW | | 3.3 | | CVE-2015-2877 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | Kernel: Cross-VM ASL INtrospection (CAIN) |
| LOW | | 5.5 | | CVE-2016-10723 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel through 4.17.2. Since the ... |
| LOW | | 5.5 | | CVE-2016-8660 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: xfs: local DoS due to a page lock order bug in the XFS seek hole/data implementation |
| LOW | | 4.7 | | CVE-2017-0630 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Information disclosure vulnerability in kernel trace subsystem |
| LOW | | 5.5 | | CVE-2017-13693 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ACPI operand cache leak in dsutils.c |
| LOW | | 5.5 | | CVE-2017-13694 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ACPI node and node_ext cache leak |
| LOW | | 5.9 | | CVE-2018-1121 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | procps: process hiding through race condition enumerating /proc |
| LOW | | 5.5 | | CVE-2018-12928 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: NULL pointer dereference in hfs_ext_read_extent in hfs.ko |
| LOW | | 4.9 | | CVE-2018-17977 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Mishandled interactions among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets resulting in a d |
| LOW | | 2.5 | | CVE-2019-11191 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: race condition in load_aout_binary() allows local users to bypass ASLR on setuid a.out programs |
| LOW | | 5.7 | | CVE-2019-12378 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip6_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12379 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: memory leak in con_insert_unipair in drivers/tty/vt/consolemap.c |
| LOW | | 6.2 | | CVE-2019-12380 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: memory allocation failure in the efi subsystem leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12381 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12382 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12455 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c causing denial of service |
| LOW | | 7.8 | | CVE-2019-12456 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: double fetch in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c |
| LOW | | 4.1 | | CVE-2019-16229 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c |
| LOW | | 4.7 | | CVE-2019-16230 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/radeon/radeon_display.c |
| LOW | | 4.1 | | CVE-2019-16231 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c |
| LOW | | 4.1 | | CVE-2019-16232 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/wireless/marvell/libertas/if_sdio.c |
| LOW | | 4.1 | | CVE-2019-16233 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c |
| LOW | | 4.7 | | CVE-2019-16234 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/net/wireless/intel/iwlwifi/pcie/trans.c |
| LOW | | 7.5 | | CVE-2019-19070 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: A memory leak in the spi_gpio_probe() function in drivers/spi/spi-gpio.c allows for a DoS |
| LOW | | 7.8 | | CVE-2019-19378 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in index_rbio_pages in fs/btrfs/raid56.c |
| LOW | | 7.8 | | CVE-2020-11725 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: improper handling of private_size*count multiplication due to count=info->owner typo |
| LOW | | 3.4 | | CVE-2020-35501 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: audit not logging access to syscall open_by_handle_at for users with CAP_DAC_READ_SEARCH capability |
| LOW | | 7.8 | | CVE-2021-26934 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel 4.18 through 5.10.16, as u ... |
| LOW | | 5.9 | | CVE-2021-3714 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Remote Page Deduplication Attacks |
| LOW | | 7.5 | | CVE-2022-0400 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Out of bounds read in the smc protocol stack |
| LOW | | 7.8 | | CVE-2022-1247 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: A race condition bug in rose_connect() |
| LOW | | 7.8 | | CVE-2022-25265 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Executable Space Protection Bypass |
| LOW | | 7 | | CVE-2022-2961 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: race condition in rose_bind() |
| LOW | | 7.8 | | CVE-2022-3238 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ntfs3 local privledge escalation if NTFS character set and remount and umount called simultaneously |
| LOW | | 4.2 | | CVE-2022-41848 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Race condition between mgslpc_ioctl and mgslpc_detach |
| LOW | | 6.4 | | CVE-2022-44032 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | Kernel: Race between cmm_open() and cm4000_detach() result in UAF |
| LOW | | 6.4 | | CVE-2022-44033 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | Kernel: A race condition between cm4040_open() and reader_detach() may result in UAF |
| LOW | | 5.5 | | CVE-2022-4543 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KASLR Prefetch Bypass Breaks KPTI |
| LOW | | 7 | | CVE-2022-45884 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_register_device() |
| LOW | | 7 | | CVE-2022-45885 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_frontend.c |
| LOW | | 6.4 | | CVE-2023-23039 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: tty: vcc: race condition leading to use-after-free in vcc_open() |
| LOW | | 7.8 | | CVE-2023-26242 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: kernel: fpga: dfl-afu: integer overflow in afu_mmio_region_get_by_offset() |
| LOW | | 5.5 | | CVE-2023-31081 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | An issue was discovered in drivers/media/test-drivers/vidtv/vidtv_brid ... |
| LOW | | 5.5 | | CVE-2023-31085 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: divide-by-zero error in ctrl_cdev_ioctl when do_div happens and erasesize is 0 |
| LOW | | 7.8 | | CVE-2023-3640 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and pref |
| LOW | | 6.5 | | CVE-2024-0564 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: max page sharing of Kernel Samepage Merging (KSM) may cause memory deduplication |
| LOW | | | | CVE-2025-40065 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Write hgatp register with valid mode bits |
| LOW | | 5.5 | | CVE-2025-40086 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds |
| LOW | | | | CVE-2025-40136 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: crypto: hisilicon/qm - request reserved interrupt for virtual function |
| LOW | | 5.5 | | CVE-2025-68193 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Add devm release action to safely tear down CT |
| LOW | | 5.5 | | CVE-2025-68359 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix double free of qgroup record after failure to add delayed ref head |
| LOW | | | | CVE-2025-68376 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: coresight: ETR: Fix ETR buffer use-after-free issue |
| LOW | | 3.3 | | CVE-2025-68751 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: s390/fpu: Fix false-positive kmsan report in fpu_vstl() |
| LOW | | | | CVE-2025-68755 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: staging: most: remove broken i2c driver |
| LOW | | | | CVE-2026-31536 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: smb: server: let send_done handle a completion without IB_SEND_SIGNALED |
| LOW | | | | CVE-2026-43263 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix Null reference while testing fluster |
| LOW | | | | CVE-2026-45956 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() |
| LOW | | | | CVE-2026-46175 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by FGGC of node block |
| LOW | | | | CVE-2026-52983 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: airoha: fix BQL imbalance in TX path |
| LOW | | | | CVE-2026-53024 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free if write is called after disconnect |
| LOW | | | | CVE-2026-53025 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free on cdev close |
| LOW | | 5.5 | | CVE-2026-53284 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: btrfs: only release the dirty pages io tree after successful writes |
| LOW | | | | CVE-2026-53368 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage |
| LOW | | | | CVE-2026-63825 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: gcov: use atomic counter updates to fix concurrent access crashes |
| LOW | | 5.5 | | CVE-2026-64388 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix chown/chgrp with SMB3 POSIX Extensions |
| LOW | | 5.5 | | CVE-2026-64513 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Unconditionally recompute CR8 intercept on PPR update |
| LOW | | 4.7 | | CVE-2026-68081 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state |
| LOW | | 5.5 | | CVE-2026-68105 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Fix kernel panic during driver load failure |
| LOW | | 5.5 | | CVE-2026-68238 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Release VFCT ACPI table reference |
| LOW | | 5.5 | | CVE-2026-68241 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/i915/mst: limit DP MST ESI service loop |
| LOW | | 5.5 | | CVE-2026-68375 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Handle partially initialized auxiliary devices |
| LOW | | 5.5 | | CVE-2026-68412 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() |
| LOW | | 5.5 | | CVE-2026-68418 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Prevent user-triggered null deref on QP create |
| LOW | | 5.5 | | CVE-2026-68436 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: use kvzalloc to allocate struct dc |
| LOW | | 5.5 | | CVE-2026-72009 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI |
| LOW | | 5.5 | | CVE-2026-72031 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD |
| LOW | | 5.5 | | CVE-2026-72321 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() |
| LOW | | 5.5 | | CVE-2026-72366 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_create_write_req() to handle async cache object creation |
| LOW | | 5.5 | | CVE-2026-72439 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: md/raid10: fix writes_pending leak on write request failures |
| LOW | | 5.5 | | CVE-2026-72494 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Replace waitqueue and flag with completion |
| LOW | | 5.5 | | CVE-2026-72497 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Add a max slot check for SQ |
| LOW | | 5.5 | | CVE-2026-74261 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: avoid stale FIFO cells during resize |
| LOW | | 5.5 | | CVE-2026-74338 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject sleepable BPF_LSM_CGROUP programs at load time |
| LOW | | 5.5 | | CVE-2026-74373 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix bio accounting for split md cloned bios |
| LOW | | 5.5 | | CVE-2026-74374 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix error-path detection with md_cloned_bio() |
| LOW | | 5.5 | | CVE-2026-74375 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix deadlock in read error recovery path |
| LOW | | 5.5 | | CVE-2026-74558 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: xsk: reclaim invalid Tx descriptors in ZC batch path |
| LOW | | 5.5 | | CVE-2026-74559 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: xsk: drain continuation descs after overflow in xsk_build_skb() |
| LOW | | 5.5 | | CVE-2026-74560 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx |
| LOW | | 5.5 | | CVE-2026-74571 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: btrfs: skip global block reserve accounting for rescue mounts |
| LOW | | | | CVE-2026-74690 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| LOW | | 5.5 | | CVE-2026-74728 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: xfs: handle NULL b_addr in xfs_buf_free |
| LOW | | 5.5 | | CVE-2026-74733 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock |
| LOW | | 5.5 | | CVE-2026-74734 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: firewire: ohci: fix NULL pointer dereference in ar_context_release |
| LOW | | 5.5 | | CVE-2026-74754 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: scsi: core: pair EH runtime PM get and put |
| LOW | | 5.5 | | CVE-2026-80581 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout |
| LOW | | 5.5 | | CVE-2026-80607 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg |
| LOW | | 5.5 | | CVE-2026-80616 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() |
| LOW | | 5.5 | | CVE-2026-80643 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: EDAC/igen6: Fix call trace due to missing release() |
| LOW | | 5.5 | | CVE-2026-80653 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: scsi: hisi_sas: Add slave_destroy interface for v3 hw |
| LOW | | 5.5 | | CVE-2026-80705 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: check if dml21_add_phantom_plane() is successful |
| LOW | | | | CVE-2026-80738 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| LOW | | | | CVE-2026-80747 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| LOW | | | | CVE-2026-80785 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| LOW | | 5.5 | | CVE-2026-80786 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: fbdev: Wrap user-invoked calls to fb_set_var() in helper |
| LOW | | 5.5 | | CVE-2026-80866 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: tipc: avoid busy looping in tipc_exit_net() |
| LOW | | | | CVE-2026-80872 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | 5.5 | | CVE-2026-80884 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ntb: Store original DMA address for future release |
| LOW | | | | CVE-2026-80899 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: e ... |
| LOW | | 5.5 | | CVE-2026-80948 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() |
| LOW | | 5.5 | | CVE-2026-89601 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ext2: Fix lost inode updates for IS_SYNC inodes |
| LOW | | 5.5 | | CVE-2026-89808 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram |
| LOW | | 5.5 | | CVE-2026-89812 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the MES ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89813 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the KIQ ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89862 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Fix BSG job leak on validate flash image error path |
| LOW | | 5.5 | | CVE-2026-90084 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: octeontx2-vf: fix workqueue and netdev race in probe/remove |
| LOW | | 5.4 | | CVE-2026-90086 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: xsk: honor XDP_TX_METADATA in zero-copy path |
| LOW | | 5.5 | | CVE-2026-90097 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition |
| LOW | | 5.5 | | CVE-2026-90144 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: dpll: fix NULL deref in dpll_device_ops() during teardown race |
| LOW | | 5.5 | | CVE-2026-90182 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: blk-iocost: clear delay state when freeing policy data |
| LOW | | 5.5 | | CVE-2026-90183 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: blk-iolatency: clear delay state when freeing policy data |
| LOW | | 6.1 | | CVE-2026-90211 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf, s390: Clear fetch destination on faulting arena atomic |
| LOW | | 5.5 | | CVE-2026-90261 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: flush active metadata block group at btree_writepages() start |
| LOW | | 5.5 | | CVE-2026-90267 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails |
| LOW | | 5.5 | | CVE-2026-90306 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: ARM: 9481/2: breakpoint: CFI breakpoints only on demand |
| LOW | | 5.5 | | CVE-2026-90311 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: thermal: hwmon: Remove hwmon class device along with its parent |
| LOW | | 5.5 | | CVE-2026-90330 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: HID: logitech-hidpp: Fix FF device cleanup on init failure |
| LOW | | 5.5 | | CVE-2026-90335 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: tty: skip cdev_del() when no cdev is registered |
| LOW | | 5.5 | | CVE-2026-90346 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: nl80211: clean up color-change beacon data on errors |
| LOW | | 5.5 | | CVE-2026-90424 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path |
| LOW | | 5.5 | | CVE-2026-92493 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active |
| LOW | | 5.5 | | CVE-2026-93116 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: platform/x86: asus-wmi: fix resource leaks on probe failure |
| LOW | | 6.7 | | CVE-2026-93125 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max |
| LOW | | 5.5 | | CVE-2026-93129 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: platform/x86: dell-wmi-base: Fix handling of ultra performance key |
| LOW | | 6.7 | | CVE-2026-93144 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject writes through untrusted BTF pointers |
| LOW | | 5.5 | | CVE-2026-93146 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: time/namespace: Validate nanosecond field in proc_timens_set_offset() |
| LOW | | 5.5 | | CVE-2026-93181 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel/uncore: Fix uncore_box ref/unref ordering |
| LOW | | 5.5 | | CVE-2026-93202 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: i3c: master: Fix recursive locking during device registration |
| LOW | | 5.5 | | CVE-2026-93216 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() |
| LOW | | 5.5 | | CVE-2026-93230 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier |
| LOW | | | | CVE-2026-93237 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| LOW | | | | CVE-2026-93251 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | | | CVE-2026-93260 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| LOW | | 5.5 | | CVE-2026-97424 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq |
| LOW | | 5.5 | | CVE-2026-97477 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() |
| LOW | | 5.5 | | CVE-2026-97479 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: driver core: Avoid warning when removing a device while its supplier is unbinding |
| LOW | | 5.5 | | CVE-2026-97480 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: tty: serial: 8250: protect against NULL uart->port.dev in register |
| LOW | | 5.5 | | CVE-2026-97501 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction |
| LOW | | 5.5 | | CVE-2026-97503 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: genirq/proc: Size interrupt directory names for 10-digit interrupt numbers |
| LOW | | 5.5 | | CVE-2026-97928 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip the VMID 0 flush for VRAM |
| LOW | | 5.5 | | CVE-2026-97989 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: vduse: validate virtqueue alignment |
| LOW | | 5.5 | | CVE-2026-97997 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: virtio_ring: fix stale descriptor flags after a failed packed add |
| LOW | | 5.5 | | CVE-2026-98003 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: iommu/amd: Do not reallocate GA log buffers on resume |
| LOW | | 5.5 | | CVE-2026-98038 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Keep refcount_acquire nullable for borrowed RCU kptrs |
| LOW | | 5.5 | | CVE-2026-98044 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject legacy packet loads from callbacks |
| LOW | | 5.5 | | CVE-2026-98058 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark syscall helpers as sleepable |
| LOW | | 5.5 | | CVE-2026-98067 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: erofs: disable LZ4 rolling decompression for now |
| LOW | | 5.5 | | CVE-2026-98073 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: Remove conflicting altnames for dying netns in __dev_change_net_namespace() |
| LOW | | 5.5 | | CVE-2026-98079 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: btrfs: zstd: fix lost wakeup when waiting for a workspace |
| LOW | | 5.5 | | CVE-2026-98087 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate |
| LOW | | 5.5 | | CVE-2026-98119 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfs: break unbuffered write when netfs_alloc_subrequest() fails |
| LOW | | 5.5 | | CVE-2026-98147 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: printk: Don't WARN on kthread_run failure |
| LOW | | 5.5 | | CVE-2026-98148 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/gud: validate GUD_ROTATION_0 is present in supported rotations |
| LOW | | 7 | | CVE-2026-98176 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| LOW | | 5.5 | | CVE-2026-98177 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow in EOP ring size calculation |
| LOW | | 5.5 | | CVE-2026-98285 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| LOW | | 5.5 | | CVE-2026-98289 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: af_unix: Unify scc_index when finalising SCC in __unix_walk_scc() |
| LOW | | 5.5 | | CVE-2026-98304 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: bcmgenet: restore the hardware filters on open |
| LOW | | 5.5 | | CVE-2026-98317 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS |
| LOW | | 5.5 | | CVE-2026-98321 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_nat: unregister and release hooks on error |
| LOW | | 5.5 | | CVE-2026-98332 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: only operate on TDLS peers in the TDLS code |
| LOW | | 5.5 | | CVE-2026-98338 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: ibss: ref BSS entry for joined event |
| LOW | | 5.5 | | CVE-2026-98389 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip gfx switch_power_profile during GPU reset |
| LOW | | 5.5 | | CVE-2026-98393 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU |
| LOW | | 5.5 | | CVE-2026-98424 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: undo netns switch if renaming the wiphy fails |
| LOW | | 5.5 | | CVE-2026-98427 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: net/sched: codel: bound the dropping loop per dequeue call |
| LOW | | 5.5 | | CVE-2026-98431 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency |
| LOW | | 3.3 | | CVE-2026-98551 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: perf/core: Fill branch entries with a single assignment |
| LOW | | 2.3 | | CVE-2026-98628 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: bpf: Make post-verification instruction rewrites killable |
| LOW | | 2.5 | | CVE-2026-98682 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: smb: client: drain and invalidate before server-side copy/clone |
| LOW | | 2.5 | | CVE-2026-98683 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush dirty data before zeroing a range |
| LOW | | 2.5 | | CVE-2026-98684 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush and commit data before querying allocated ranges |
| LOW | | 3.3 | | CVE-2026-98685 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: smb: client: discard post-EOF pagecache when extending a file via clone range |
| LOW | | 3.7 | | CVE-2026-98802 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | kernel: seg6: ensure packet data is writable before modifying SRH and IPv6 DA |
| LOW | | | | TEMP-0000000-F7A20F | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | [Kernel: Unprivileged user can freeze journald] |
| LOW | | 5 | | CVE-2004-0230 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | TCP, when using a large Window Size, makes it easier for remote attack ... |
| LOW | | 4.9 | | CVE-2005-3660 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | Linux kernel 2.4 and 2.6 allows attackers to cause a denial of service ... |
| LOW | | 2.1 | | CVE-2007-3719 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: secretly Monopolizing the CPU Without Superuser Privileges |
| LOW | | 5.5 | | CVE-2008-2544 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mounting proc readonly on a different mount point silently mounts it rw if the /proc mount is rw |
| LOW | | 7.1 | | CVE-2008-4609 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: TCP protocol vulnerabilities from Outpost24 |
| LOW | | 5 | | CVE-2010-4563 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv6: sniffer detection |
| LOW | | 4.3 | | CVE-2010-5321 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: v4l: videobuf: hotfix a bug on multiple calls to mmap() |
| LOW | | 5.5 | | CVE-2011-4915 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | fs/proc/base.c in the Linux kernel through 3.1 allows local users to o ... |
| LOW | | 5.5 | | CVE-2011-4916 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | Linux kernel through 3.1 allows local users to obtain sensitive keystr ... |
| LOW | | 5.5 | | CVE-2011-4917 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel through 3.1 there is an information disclosure iss ... |
| LOW | | 4.9 | | CVE-2012-4542 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: block: default SCSI command filter does not accomodate commands overlap across device classes |
| LOW | | 5.5 | | CVE-2014-9892 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | The snd_compr_tstamp function in sound/core/compress_offload.c in the ... |
| LOW | | 7.5 | | CVE-2014-9900 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Info leak in uninitialized structure ethtool_wolinfo in ethtool_get_wol() |
| LOW | | 3.3 | | CVE-2015-2877 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: Cross-VM ASL INtrospection (CAIN) |
| LOW | | 5.5 | | CVE-2016-10723 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel through 4.17.2. Since the ... |
| LOW | | 5.5 | | CVE-2016-8660 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: local DoS due to a page lock order bug in the XFS seek hole/data implementation |
| LOW | | 4.7 | | CVE-2017-0630 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Information disclosure vulnerability in kernel trace subsystem |
| LOW | | 5.5 | | CVE-2017-13693 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ACPI operand cache leak in dsutils.c |
| LOW | | 5.5 | | CVE-2017-13694 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ACPI node and node_ext cache leak |
| LOW | | 5.9 | | CVE-2018-1121 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | procps: process hiding through race condition enumerating /proc |
| LOW | | 5.5 | | CVE-2018-12928 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NULL pointer dereference in hfs_ext_read_extent in hfs.ko |
| LOW | | 4.9 | | CVE-2018-17977 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Mishandled interactions among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets resulting in a d |
| LOW | | 2.5 | | CVE-2019-11191 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: race condition in load_aout_binary() allows local users to bypass ASLR on setuid a.out programs |
| LOW | | 5.7 | | CVE-2019-12378 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip6_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12379 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory leak in con_insert_unipair in drivers/tty/vt/consolemap.c |
| LOW | | 6.2 | | CVE-2019-12380 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory allocation failure in the efi subsystem leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12381 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12382 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12455 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c causing denial of service |
| LOW | | 7.8 | | CVE-2019-12456 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: double fetch in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c |
| LOW | | 4.1 | | CVE-2019-16229 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c |
| LOW | | 4.7 | | CVE-2019-16230 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/radeon/radeon_display.c |
| LOW | | 4.1 | | CVE-2019-16231 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c |
| LOW | | 4.1 | | CVE-2019-16232 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/wireless/marvell/libertas/if_sdio.c |
| LOW | | 4.1 | | CVE-2019-16233 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c |
| LOW | | 4.7 | | CVE-2019-16234 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/net/wireless/intel/iwlwifi/pcie/trans.c |
| LOW | | 7.5 | | CVE-2019-19070 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: A memory leak in the spi_gpio_probe() function in drivers/spi/spi-gpio.c allows for a DoS |
| LOW | | 7.8 | | CVE-2019-19378 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in index_rbio_pages in fs/btrfs/raid56.c |
| LOW | | 7.8 | | CVE-2020-11725 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: improper handling of private_size*count multiplication due to count=info->owner typo |
| LOW | | 3.4 | | CVE-2020-35501 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: audit not logging access to syscall open_by_handle_at for users with CAP_DAC_READ_SEARCH capability |
| LOW | | 7.8 | | CVE-2021-26934 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel 4.18 through 5.10.16, as u ... |
| LOW | | 5.9 | | CVE-2021-3714 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Remote Page Deduplication Attacks |
| LOW | | 7.5 | | CVE-2022-0400 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Out of bounds read in the smc protocol stack |
| LOW | | 7.8 | | CVE-2022-1247 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: A race condition bug in rose_connect() |
| LOW | | 7.8 | | CVE-2022-25265 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Executable Space Protection Bypass |
| LOW | | 7 | | CVE-2022-2961 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: race condition in rose_bind() |
| LOW | | 7.8 | | CVE-2022-3238 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs3 local privledge escalation if NTFS character set and remount and umount called simultaneously |
| LOW | | 4.2 | | CVE-2022-41848 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Race condition between mgslpc_ioctl and mgslpc_detach |
| LOW | | 6.4 | | CVE-2022-44032 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: Race between cmm_open() and cm4000_detach() result in UAF |
| LOW | | 6.4 | | CVE-2022-44033 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: A race condition between cm4040_open() and reader_detach() may result in UAF |
| LOW | | 5.5 | | CVE-2022-4543 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KASLR Prefetch Bypass Breaks KPTI |
| LOW | | 7 | | CVE-2022-45884 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_register_device() |
| LOW | | 7 | | CVE-2022-45885 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_frontend.c |
| LOW | | 6.4 | | CVE-2023-23039 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tty: vcc: race condition leading to use-after-free in vcc_open() |
| LOW | | 7.8 | | CVE-2023-26242 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: kernel: fpga: dfl-afu: integer overflow in afu_mmio_region_get_by_offset() |
| LOW | | 5.5 | | CVE-2023-31081 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | An issue was discovered in drivers/media/test-drivers/vidtv/vidtv_brid ... |
| LOW | | 5.5 | | CVE-2023-31085 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: divide-by-zero error in ctrl_cdev_ioctl when do_div happens and erasesize is 0 |
| LOW | | 7.8 | | CVE-2023-3640 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and pref |
| LOW | | 6.5 | | CVE-2024-0564 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: max page sharing of Kernel Samepage Merging (KSM) may cause memory deduplication |
| LOW | | | | CVE-2025-40065 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Write hgatp register with valid mode bits |
| LOW | | 5.5 | | CVE-2025-40086 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds |
| LOW | | | | CVE-2025-40136 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: crypto: hisilicon/qm - request reserved interrupt for virtual function |
| LOW | | 5.5 | | CVE-2025-68193 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Add devm release action to safely tear down CT |
| LOW | | 5.5 | | CVE-2025-68359 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix double free of qgroup record after failure to add delayed ref head |
| LOW | | | | CVE-2025-68376 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: ETR: Fix ETR buffer use-after-free issue |
| LOW | | 3.3 | | CVE-2025-68751 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/fpu: Fix false-positive kmsan report in fpu_vstl() |
| LOW | | | | CVE-2025-68755 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: staging: most: remove broken i2c driver |
| LOW | | | | CVE-2026-31536 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: server: let send_done handle a completion without IB_SEND_SIGNALED |
| LOW | | | | CVE-2026-43263 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix Null reference while testing fluster |
| LOW | | | | CVE-2026-45956 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() |
| LOW | | | | CVE-2026-46175 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by FGGC of node block |
| LOW | | | | CVE-2026-52983 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: fix BQL imbalance in TX path |
| LOW | | | | CVE-2026-53024 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free if write is called after disconnect |
| LOW | | | | CVE-2026-53025 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free on cdev close |
| LOW | | 5.5 | | CVE-2026-53284 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: only release the dirty pages io tree after successful writes |
| LOW | | | | CVE-2026-53368 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage |
| LOW | | | | CVE-2026-63825 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gcov: use atomic counter updates to fix concurrent access crashes |
| LOW | | 5.5 | | CVE-2026-64388 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix chown/chgrp with SMB3 POSIX Extensions |
| LOW | | 5.5 | | CVE-2026-64513 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Unconditionally recompute CR8 intercept on PPR update |
| LOW | | 4.7 | | CVE-2026-68081 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state |
| LOW | | 5.5 | | CVE-2026-68105 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Fix kernel panic during driver load failure |
| LOW | | 5.5 | | CVE-2026-68238 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Release VFCT ACPI table reference |
| LOW | | 5.5 | | CVE-2026-68241 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/mst: limit DP MST ESI service loop |
| LOW | | 5.5 | | CVE-2026-68375 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Handle partially initialized auxiliary devices |
| LOW | | 5.5 | | CVE-2026-68412 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() |
| LOW | | 5.5 | | CVE-2026-68418 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Prevent user-triggered null deref on QP create |
| LOW | | 5.5 | | CVE-2026-68436 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: use kvzalloc to allocate struct dc |
| LOW | | 5.5 | | CVE-2026-72009 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI |
| LOW | | 5.5 | | CVE-2026-72031 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD |
| LOW | | 5.5 | | CVE-2026-72321 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() |
| LOW | | 5.5 | | CVE-2026-72366 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_create_write_req() to handle async cache object creation |
| LOW | | 5.5 | | CVE-2026-72439 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid10: fix writes_pending leak on write request failures |
| LOW | | 5.5 | | CVE-2026-72494 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Replace waitqueue and flag with completion |
| LOW | | 5.5 | | CVE-2026-72497 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Add a max slot check for SQ |
| LOW | | 5.5 | | CVE-2026-74261 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: avoid stale FIFO cells during resize |
| LOW | | 5.5 | | CVE-2026-74338 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject sleepable BPF_LSM_CGROUP programs at load time |
| LOW | | 5.5 | | CVE-2026-74373 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix bio accounting for split md cloned bios |
| LOW | | 5.5 | | CVE-2026-74374 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix error-path detection with md_cloned_bio() |
| LOW | | 5.5 | | CVE-2026-74375 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix deadlock in read error recovery path |
| LOW | | 5.5 | | CVE-2026-74558 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: reclaim invalid Tx descriptors in ZC batch path |
| LOW | | 5.5 | | CVE-2026-74559 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: drain continuation descs after overflow in xsk_build_skb() |
| LOW | | 5.5 | | CVE-2026-74560 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx |
| LOW | | 5.5 | | CVE-2026-74571 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: skip global block reserve accounting for rescue mounts |
| LOW | | | | CVE-2026-74690 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| LOW | | 5.5 | | CVE-2026-74728 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: handle NULL b_addr in xfs_buf_free |
| LOW | | 5.5 | | CVE-2026-74733 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock |
| LOW | | 5.5 | | CVE-2026-74734 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firewire: ohci: fix NULL pointer dereference in ar_context_release |
| LOW | | 5.5 | | CVE-2026-74754 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: core: pair EH runtime PM get and put |
| LOW | | 5.5 | | CVE-2026-80581 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout |
| LOW | | 5.5 | | CVE-2026-80607 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg |
| LOW | | 5.5 | | CVE-2026-80616 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() |
| LOW | | 5.5 | | CVE-2026-80643 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: EDAC/igen6: Fix call trace due to missing release() |
| LOW | | 5.5 | | CVE-2026-80653 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: hisi_sas: Add slave_destroy interface for v3 hw |
| LOW | | 5.5 | | CVE-2026-80705 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: check if dml21_add_phantom_plane() is successful |
| LOW | | | | CVE-2026-80738 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| LOW | | | | CVE-2026-80747 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| LOW | | | | CVE-2026-80785 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| LOW | | 5.5 | | CVE-2026-80786 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: Wrap user-invoked calls to fb_set_var() in helper |
| LOW | | 5.5 | | CVE-2026-80866 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tipc: avoid busy looping in tipc_exit_net() |
| LOW | | | | CVE-2026-80872 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | 5.5 | | CVE-2026-80884 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntb: Store original DMA address for future release |
| LOW | | | | CVE-2026-80899 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: e ... |
| LOW | | 5.5 | | CVE-2026-80948 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() |
| LOW | | 5.5 | | CVE-2026-89601 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext2: Fix lost inode updates for IS_SYNC inodes |
| LOW | | 5.5 | | CVE-2026-89808 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram |
| LOW | | 5.5 | | CVE-2026-89812 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the MES ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89813 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the KIQ ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89862 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Fix BSG job leak on validate flash image error path |
| LOW | | 5.5 | | CVE-2026-90084 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-vf: fix workqueue and netdev race in probe/remove |
| LOW | | 5.4 | | CVE-2026-90086 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: honor XDP_TX_METADATA in zero-copy path |
| LOW | | 5.5 | | CVE-2026-90097 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition |
| LOW | | 5.5 | | CVE-2026-90144 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dpll: fix NULL deref in dpll_device_ops() during teardown race |
| LOW | | 5.5 | | CVE-2026-90182 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-iocost: clear delay state when freeing policy data |
| LOW | | 5.5 | | CVE-2026-90183 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-iolatency: clear delay state when freeing policy data |
| LOW | | 6.1 | | CVE-2026-90211 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf, s390: Clear fetch destination on faulting arena atomic |
| LOW | | 5.5 | | CVE-2026-90261 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: flush active metadata block group at btree_writepages() start |
| LOW | | 5.5 | | CVE-2026-90267 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails |
| LOW | | 5.5 | | CVE-2026-90306 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ARM: 9481/2: breakpoint: CFI breakpoints only on demand |
| LOW | | 5.5 | | CVE-2026-90311 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: thermal: hwmon: Remove hwmon class device along with its parent |
| LOW | | 5.5 | | CVE-2026-90330 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: HID: logitech-hidpp: Fix FF device cleanup on init failure |
| LOW | | 5.5 | | CVE-2026-90335 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tty: skip cdev_del() when no cdev is registered |
| LOW | | 5.5 | | CVE-2026-90346 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: nl80211: clean up color-change beacon data on errors |
| LOW | | 5.5 | | CVE-2026-90424 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path |
| LOW | | 5.5 | | CVE-2026-92493 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active |
| LOW | | 5.5 | | CVE-2026-93116 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: asus-wmi: fix resource leaks on probe failure |
| LOW | | 6.7 | | CVE-2026-93125 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max |
| LOW | | 5.5 | | CVE-2026-93129 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: dell-wmi-base: Fix handling of ultra performance key |
| LOW | | 6.7 | | CVE-2026-93144 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject writes through untrusted BTF pointers |
| LOW | | 5.5 | | CVE-2026-93146 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: time/namespace: Validate nanosecond field in proc_timens_set_offset() |
| LOW | | 5.5 | | CVE-2026-93181 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel/uncore: Fix uncore_box ref/unref ordering |
| LOW | | 5.5 | | CVE-2026-93202 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: Fix recursive locking during device registration |
| LOW | | 5.5 | | CVE-2026-93216 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() |
| LOW | | 5.5 | | CVE-2026-93230 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier |
| LOW | | | | CVE-2026-93237 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| LOW | | | | CVE-2026-93251 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | | | CVE-2026-93260 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| LOW | | 5.5 | | CVE-2026-97424 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq |
| LOW | | 5.5 | | CVE-2026-97477 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() |
| LOW | | 5.5 | | CVE-2026-97479 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: driver core: Avoid warning when removing a device while its supplier is unbinding |
| LOW | | 5.5 | | CVE-2026-97480 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tty: serial: 8250: protect against NULL uart->port.dev in register |
| LOW | | 5.5 | | CVE-2026-97501 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction |
| LOW | | 5.5 | | CVE-2026-97503 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: genirq/proc: Size interrupt directory names for 10-digit interrupt numbers |
| LOW | | 5.5 | | CVE-2026-97928 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip the VMID 0 flush for VRAM |
| LOW | | 5.5 | | CVE-2026-97989 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vduse: validate virtqueue alignment |
| LOW | | 5.5 | | CVE-2026-97997 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio_ring: fix stale descriptor flags after a failed packed add |
| LOW | | 5.5 | | CVE-2026-98003 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/amd: Do not reallocate GA log buffers on resume |
| LOW | | 5.5 | | CVE-2026-98038 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Keep refcount_acquire nullable for borrowed RCU kptrs |
| LOW | | 5.5 | | CVE-2026-98044 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject legacy packet loads from callbacks |
| LOW | | 5.5 | | CVE-2026-98058 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark syscall helpers as sleepable |
| LOW | | 5.5 | | CVE-2026-98067 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: erofs: disable LZ4 rolling decompression for now |
| LOW | | 5.5 | | CVE-2026-98073 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: Remove conflicting altnames for dying netns in __dev_change_net_namespace() |
| LOW | | 5.5 | | CVE-2026-98079 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zstd: fix lost wakeup when waiting for a workspace |
| LOW | | 5.5 | | CVE-2026-98087 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate |
| LOW | | 5.5 | | CVE-2026-98119 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: break unbuffered write when netfs_alloc_subrequest() fails |
| LOW | | 5.5 | | CVE-2026-98147 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: printk: Don't WARN on kthread_run failure |
| LOW | | 5.5 | | CVE-2026-98148 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/gud: validate GUD_ROTATION_0 is present in supported rotations |
| LOW | | 7 | | CVE-2026-98176 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| LOW | | 5.5 | | CVE-2026-98177 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow in EOP ring size calculation |
| LOW | | 5.5 | | CVE-2026-98285 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| LOW | | 5.5 | | CVE-2026-98289 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: af_unix: Unify scc_index when finalising SCC in __unix_walk_scc() |
| LOW | | 5.5 | | CVE-2026-98304 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: bcmgenet: restore the hardware filters on open |
| LOW | | 5.5 | | CVE-2026-98317 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS |
| LOW | | 5.5 | | CVE-2026-98321 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_nat: unregister and release hooks on error |
| LOW | | 5.5 | | CVE-2026-98332 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: only operate on TDLS peers in the TDLS code |
| LOW | | 5.5 | | CVE-2026-98338 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: ibss: ref BSS entry for joined event |
| LOW | | 5.5 | | CVE-2026-98389 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip gfx switch_power_profile during GPU reset |
| LOW | | 5.5 | | CVE-2026-98393 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU |
| LOW | | 5.5 | | CVE-2026-98424 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: undo netns switch if renaming the wiphy fails |
| LOW | | 5.5 | | CVE-2026-98427 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: codel: bound the dropping loop per dequeue call |
| LOW | | 5.5 | | CVE-2026-98431 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency |
| LOW | | 3.3 | | CVE-2026-98551 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/core: Fill branch entries with a single assignment |
| LOW | | 2.3 | | CVE-2026-98628 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Make post-verification instruction rewrites killable |
| LOW | | 2.5 | | CVE-2026-98682 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: drain and invalidate before server-side copy/clone |
| LOW | | 2.5 | | CVE-2026-98683 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush dirty data before zeroing a range |
| LOW | | 2.5 | | CVE-2026-98684 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush and commit data before querying allocated ranges |
| LOW | | 3.3 | | CVE-2026-98685 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: discard post-EOF pagecache when extending a file via clone range |
| LOW | | 3.7 | | CVE-2026-98802 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: seg6: ensure packet data is writable before modifying SRH and IPv6 DA |
| LOW | | | | TEMP-0000000-F7A20F | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | [Kernel: Unprivileged user can freeze journald] |
| LOW | | 5 | | CVE-2004-0230 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | TCP, when using a large Window Size, makes it easier for remote attack ... |
| LOW | | 4.9 | | CVE-2005-3660 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | Linux kernel 2.4 and 2.6 allows attackers to cause a denial of service ... |
| LOW | | 2.1 | | CVE-2007-3719 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: secretly Monopolizing the CPU Without Superuser Privileges |
| LOW | | 5.5 | | CVE-2008-2544 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mounting proc readonly on a different mount point silently mounts it rw if the /proc mount is rw |
| LOW | | 7.1 | | CVE-2008-4609 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: TCP protocol vulnerabilities from Outpost24 |
| LOW | | 5 | | CVE-2010-4563 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv6: sniffer detection |
| LOW | | 4.3 | | CVE-2010-5321 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: v4l: videobuf: hotfix a bug on multiple calls to mmap() |
| LOW | | 5.5 | | CVE-2011-4915 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | fs/proc/base.c in the Linux kernel through 3.1 allows local users to o ... |
| LOW | | 5.5 | | CVE-2011-4916 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | Linux kernel through 3.1 allows local users to obtain sensitive keystr ... |
| LOW | | 5.5 | | CVE-2011-4917 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel through 3.1 there is an information disclosure iss ... |
| LOW | | 4.9 | | CVE-2012-4542 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: block: default SCSI command filter does not accomodate commands overlap across device classes |
| LOW | | 5.5 | | CVE-2014-9892 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | The snd_compr_tstamp function in sound/core/compress_offload.c in the ... |
| LOW | | 7.5 | | CVE-2014-9900 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Info leak in uninitialized structure ethtool_wolinfo in ethtool_get_wol() |
| LOW | | 3.3 | | CVE-2015-2877 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: Cross-VM ASL INtrospection (CAIN) |
| LOW | | 5.5 | | CVE-2016-10723 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel through 4.17.2. Since the ... |
| LOW | | 5.5 | | CVE-2016-8660 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: local DoS due to a page lock order bug in the XFS seek hole/data implementation |
| LOW | | 4.7 | | CVE-2017-0630 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Information disclosure vulnerability in kernel trace subsystem |
| LOW | | 5.5 | | CVE-2017-13693 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ACPI operand cache leak in dsutils.c |
| LOW | | 5.5 | | CVE-2017-13694 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ACPI node and node_ext cache leak |
| LOW | | 5.9 | | CVE-2018-1121 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | procps: process hiding through race condition enumerating /proc |
| LOW | | 5.5 | | CVE-2018-12928 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NULL pointer dereference in hfs_ext_read_extent in hfs.ko |
| LOW | | 4.9 | | CVE-2018-17977 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Mishandled interactions among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets resulting in a d |
| LOW | | 2.5 | | CVE-2019-11191 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: race condition in load_aout_binary() allows local users to bypass ASLR on setuid a.out programs |
| LOW | | 5.7 | | CVE-2019-12378 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip6_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12379 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory leak in con_insert_unipair in drivers/tty/vt/consolemap.c |
| LOW | | 6.2 | | CVE-2019-12380 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory allocation failure in the efi subsystem leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12381 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12382 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12455 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c causing denial of service |
| LOW | | 7.8 | | CVE-2019-12456 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: double fetch in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c |
| LOW | | 4.1 | | CVE-2019-16229 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c |
| LOW | | 4.7 | | CVE-2019-16230 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/radeon/radeon_display.c |
| LOW | | 4.1 | | CVE-2019-16231 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c |
| LOW | | 4.1 | | CVE-2019-16232 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/wireless/marvell/libertas/if_sdio.c |
| LOW | | 4.1 | | CVE-2019-16233 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c |
| LOW | | 4.7 | | CVE-2019-16234 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/net/wireless/intel/iwlwifi/pcie/trans.c |
| LOW | | 7.5 | | CVE-2019-19070 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: A memory leak in the spi_gpio_probe() function in drivers/spi/spi-gpio.c allows for a DoS |
| LOW | | 7.8 | | CVE-2019-19378 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in index_rbio_pages in fs/btrfs/raid56.c |
| LOW | | 7.8 | | CVE-2020-11725 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: improper handling of private_size*count multiplication due to count=info->owner typo |
| LOW | | 3.4 | | CVE-2020-35501 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: audit not logging access to syscall open_by_handle_at for users with CAP_DAC_READ_SEARCH capability |
| LOW | | 7.8 | | CVE-2021-26934 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel 4.18 through 5.10.16, as u ... |
| LOW | | 5.9 | | CVE-2021-3714 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Remote Page Deduplication Attacks |
| LOW | | 7.5 | | CVE-2022-0400 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Out of bounds read in the smc protocol stack |
| LOW | | 7.8 | | CVE-2022-1247 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: A race condition bug in rose_connect() |
| LOW | | 7.8 | | CVE-2022-25265 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Executable Space Protection Bypass |
| LOW | | 7 | | CVE-2022-2961 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: race condition in rose_bind() |
| LOW | | 7.8 | | CVE-2022-3238 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs3 local privledge escalation if NTFS character set and remount and umount called simultaneously |
| LOW | | 4.2 | | CVE-2022-41848 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Race condition between mgslpc_ioctl and mgslpc_detach |
| LOW | | 6.4 | | CVE-2022-44032 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: Race between cmm_open() and cm4000_detach() result in UAF |
| LOW | | 6.4 | | CVE-2022-44033 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: A race condition between cm4040_open() and reader_detach() may result in UAF |
| LOW | | 5.5 | | CVE-2022-4543 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KASLR Prefetch Bypass Breaks KPTI |
| LOW | | 7 | | CVE-2022-45884 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_register_device() |
| LOW | | 7 | | CVE-2022-45885 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_frontend.c |
| LOW | | 6.4 | | CVE-2023-23039 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tty: vcc: race condition leading to use-after-free in vcc_open() |
| LOW | | 7.8 | | CVE-2023-26242 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: kernel: fpga: dfl-afu: integer overflow in afu_mmio_region_get_by_offset() |
| LOW | | 5.5 | | CVE-2023-31081 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | An issue was discovered in drivers/media/test-drivers/vidtv/vidtv_brid ... |
| LOW | | 5.5 | | CVE-2023-31085 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: divide-by-zero error in ctrl_cdev_ioctl when do_div happens and erasesize is 0 |
| LOW | | 7.8 | | CVE-2023-3640 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and pref |
| LOW | | 6.5 | | CVE-2024-0564 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: max page sharing of Kernel Samepage Merging (KSM) may cause memory deduplication |
| LOW | | | | CVE-2025-40065 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Write hgatp register with valid mode bits |
| LOW | | 5.5 | | CVE-2025-40086 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds |
| LOW | | | | CVE-2025-40136 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: crypto: hisilicon/qm - request reserved interrupt for virtual function |
| LOW | | 5.5 | | CVE-2025-68193 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Add devm release action to safely tear down CT |
| LOW | | 5.5 | | CVE-2025-68359 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix double free of qgroup record after failure to add delayed ref head |
| LOW | | | | CVE-2025-68376 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: ETR: Fix ETR buffer use-after-free issue |
| LOW | | 3.3 | | CVE-2025-68751 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/fpu: Fix false-positive kmsan report in fpu_vstl() |
| LOW | | | | CVE-2025-68755 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: staging: most: remove broken i2c driver |
| LOW | | | | CVE-2026-31536 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: server: let send_done handle a completion without IB_SEND_SIGNALED |
| LOW | | | | CVE-2026-43263 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix Null reference while testing fluster |
| LOW | | | | CVE-2026-45956 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() |
| LOW | | | | CVE-2026-46175 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by FGGC of node block |
| LOW | | | | CVE-2026-52983 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: fix BQL imbalance in TX path |
| LOW | | | | CVE-2026-53024 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free if write is called after disconnect |
| LOW | | | | CVE-2026-53025 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free on cdev close |
| LOW | | 5.5 | | CVE-2026-53284 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: only release the dirty pages io tree after successful writes |
| LOW | | | | CVE-2026-53368 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage |
| LOW | | | | CVE-2026-63825 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gcov: use atomic counter updates to fix concurrent access crashes |
| LOW | | 5.5 | | CVE-2026-64388 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix chown/chgrp with SMB3 POSIX Extensions |
| LOW | | 5.5 | | CVE-2026-64513 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Unconditionally recompute CR8 intercept on PPR update |
| LOW | | 4.7 | | CVE-2026-68081 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state |
| LOW | | 5.5 | | CVE-2026-68105 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Fix kernel panic during driver load failure |
| LOW | | 5.5 | | CVE-2026-68238 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Release VFCT ACPI table reference |
| LOW | | 5.5 | | CVE-2026-68241 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/mst: limit DP MST ESI service loop |
| LOW | | 5.5 | | CVE-2026-68375 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Handle partially initialized auxiliary devices |
| LOW | | 5.5 | | CVE-2026-68412 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() |
| LOW | | 5.5 | | CVE-2026-68418 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Prevent user-triggered null deref on QP create |
| LOW | | 5.5 | | CVE-2026-68436 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: use kvzalloc to allocate struct dc |
| LOW | | 5.5 | | CVE-2026-72009 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI |
| LOW | | 5.5 | | CVE-2026-72031 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD |
| LOW | | 5.5 | | CVE-2026-72321 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() |
| LOW | | 5.5 | | CVE-2026-72366 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_create_write_req() to handle async cache object creation |
| LOW | | 5.5 | | CVE-2026-72439 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid10: fix writes_pending leak on write request failures |
| LOW | | 5.5 | | CVE-2026-72494 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Replace waitqueue and flag with completion |
| LOW | | 5.5 | | CVE-2026-72497 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Add a max slot check for SQ |
| LOW | | 5.5 | | CVE-2026-74261 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: avoid stale FIFO cells during resize |
| LOW | | 5.5 | | CVE-2026-74338 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject sleepable BPF_LSM_CGROUP programs at load time |
| LOW | | 5.5 | | CVE-2026-74373 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix bio accounting for split md cloned bios |
| LOW | | 5.5 | | CVE-2026-74374 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix error-path detection with md_cloned_bio() |
| LOW | | 5.5 | | CVE-2026-74375 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix deadlock in read error recovery path |
| LOW | | 5.5 | | CVE-2026-74558 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: reclaim invalid Tx descriptors in ZC batch path |
| LOW | | 5.5 | | CVE-2026-74559 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: drain continuation descs after overflow in xsk_build_skb() |
| LOW | | 5.5 | | CVE-2026-74560 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx |
| LOW | | 5.5 | | CVE-2026-74571 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: skip global block reserve accounting for rescue mounts |
| LOW | | | | CVE-2026-74690 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| LOW | | 5.5 | | CVE-2026-74728 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: handle NULL b_addr in xfs_buf_free |
| LOW | | 5.5 | | CVE-2026-74733 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock |
| LOW | | 5.5 | | CVE-2026-74734 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firewire: ohci: fix NULL pointer dereference in ar_context_release |
| LOW | | 5.5 | | CVE-2026-74754 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: core: pair EH runtime PM get and put |
| LOW | | 5.5 | | CVE-2026-80581 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout |
| LOW | | 5.5 | | CVE-2026-80607 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg |
| LOW | | 5.5 | | CVE-2026-80616 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() |
| LOW | | 5.5 | | CVE-2026-80643 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: EDAC/igen6: Fix call trace due to missing release() |
| LOW | | 5.5 | | CVE-2026-80653 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: hisi_sas: Add slave_destroy interface for v3 hw |
| LOW | | 5.5 | | CVE-2026-80705 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: check if dml21_add_phantom_plane() is successful |
| LOW | | | | CVE-2026-80738 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| LOW | | | | CVE-2026-80747 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| LOW | | | | CVE-2026-80785 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| LOW | | 5.5 | | CVE-2026-80786 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: Wrap user-invoked calls to fb_set_var() in helper |
| LOW | | 5.5 | | CVE-2026-80866 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tipc: avoid busy looping in tipc_exit_net() |
| LOW | | | | CVE-2026-80872 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | 5.5 | | CVE-2026-80884 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntb: Store original DMA address for future release |
| LOW | | | | CVE-2026-80899 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: e ... |
| LOW | | 5.5 | | CVE-2026-80948 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() |
| LOW | | 5.5 | | CVE-2026-89601 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext2: Fix lost inode updates for IS_SYNC inodes |
| LOW | | 5.5 | | CVE-2026-89808 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram |
| LOW | | 5.5 | | CVE-2026-89812 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the MES ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89813 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the KIQ ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89862 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Fix BSG job leak on validate flash image error path |
| LOW | | 5.5 | | CVE-2026-90084 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-vf: fix workqueue and netdev race in probe/remove |
| LOW | | 5.4 | | CVE-2026-90086 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: honor XDP_TX_METADATA in zero-copy path |
| LOW | | 5.5 | | CVE-2026-90097 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition |
| LOW | | 5.5 | | CVE-2026-90144 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dpll: fix NULL deref in dpll_device_ops() during teardown race |
| LOW | | 5.5 | | CVE-2026-90182 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-iocost: clear delay state when freeing policy data |
| LOW | | 5.5 | | CVE-2026-90183 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-iolatency: clear delay state when freeing policy data |
| LOW | | 6.1 | | CVE-2026-90211 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf, s390: Clear fetch destination on faulting arena atomic |
| LOW | | 5.5 | | CVE-2026-90261 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: flush active metadata block group at btree_writepages() start |
| LOW | | 5.5 | | CVE-2026-90267 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails |
| LOW | | 5.5 | | CVE-2026-90306 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ARM: 9481/2: breakpoint: CFI breakpoints only on demand |
| LOW | | 5.5 | | CVE-2026-90311 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: thermal: hwmon: Remove hwmon class device along with its parent |
| LOW | | 5.5 | | CVE-2026-90330 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: HID: logitech-hidpp: Fix FF device cleanup on init failure |
| LOW | | 5.5 | | CVE-2026-90335 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tty: skip cdev_del() when no cdev is registered |
| LOW | | 5.5 | | CVE-2026-90346 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: nl80211: clean up color-change beacon data on errors |
| LOW | | 5.5 | | CVE-2026-90424 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path |
| LOW | | 5.5 | | CVE-2026-92493 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active |
| LOW | | 5.5 | | CVE-2026-93116 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: asus-wmi: fix resource leaks on probe failure |
| LOW | | 6.7 | | CVE-2026-93125 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max |
| LOW | | 5.5 | | CVE-2026-93129 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: dell-wmi-base: Fix handling of ultra performance key |
| LOW | | 6.7 | | CVE-2026-93144 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject writes through untrusted BTF pointers |
| LOW | | 5.5 | | CVE-2026-93146 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: time/namespace: Validate nanosecond field in proc_timens_set_offset() |
| LOW | | 5.5 | | CVE-2026-93181 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel/uncore: Fix uncore_box ref/unref ordering |
| LOW | | 5.5 | | CVE-2026-93202 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: Fix recursive locking during device registration |
| LOW | | 5.5 | | CVE-2026-93216 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() |
| LOW | | 5.5 | | CVE-2026-93230 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier |
| LOW | | | | CVE-2026-93237 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| LOW | | | | CVE-2026-93251 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | | | CVE-2026-93260 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| LOW | | 5.5 | | CVE-2026-97424 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq |
| LOW | | 5.5 | | CVE-2026-97477 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() |
| LOW | | 5.5 | | CVE-2026-97479 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: driver core: Avoid warning when removing a device while its supplier is unbinding |
| LOW | | 5.5 | | CVE-2026-97480 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tty: serial: 8250: protect against NULL uart->port.dev in register |
| LOW | | 5.5 | | CVE-2026-97501 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction |
| LOW | | 5.5 | | CVE-2026-97503 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: genirq/proc: Size interrupt directory names for 10-digit interrupt numbers |
| LOW | | 5.5 | | CVE-2026-97928 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip the VMID 0 flush for VRAM |
| LOW | | 5.5 | | CVE-2026-97989 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vduse: validate virtqueue alignment |
| LOW | | 5.5 | | CVE-2026-97997 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio_ring: fix stale descriptor flags after a failed packed add |
| LOW | | 5.5 | | CVE-2026-98003 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/amd: Do not reallocate GA log buffers on resume |
| LOW | | 5.5 | | CVE-2026-98038 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Keep refcount_acquire nullable for borrowed RCU kptrs |
| LOW | | 5.5 | | CVE-2026-98044 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject legacy packet loads from callbacks |
| LOW | | 5.5 | | CVE-2026-98058 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark syscall helpers as sleepable |
| LOW | | 5.5 | | CVE-2026-98067 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: erofs: disable LZ4 rolling decompression for now |
| LOW | | 5.5 | | CVE-2026-98073 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: Remove conflicting altnames for dying netns in __dev_change_net_namespace() |
| LOW | | 5.5 | | CVE-2026-98079 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zstd: fix lost wakeup when waiting for a workspace |
| LOW | | 5.5 | | CVE-2026-98087 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate |
| LOW | | 5.5 | | CVE-2026-98119 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: break unbuffered write when netfs_alloc_subrequest() fails |
| LOW | | 5.5 | | CVE-2026-98147 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: printk: Don't WARN on kthread_run failure |
| LOW | | 5.5 | | CVE-2026-98148 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/gud: validate GUD_ROTATION_0 is present in supported rotations |
| LOW | | 7 | | CVE-2026-98176 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| LOW | | 5.5 | | CVE-2026-98177 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow in EOP ring size calculation |
| LOW | | 5.5 | | CVE-2026-98285 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| LOW | | 5.5 | | CVE-2026-98289 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: af_unix: Unify scc_index when finalising SCC in __unix_walk_scc() |
| LOW | | 5.5 | | CVE-2026-98304 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: bcmgenet: restore the hardware filters on open |
| LOW | | 5.5 | | CVE-2026-98317 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS |
| LOW | | 5.5 | | CVE-2026-98321 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_nat: unregister and release hooks on error |
| LOW | | 5.5 | | CVE-2026-98332 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: only operate on TDLS peers in the TDLS code |
| LOW | | 5.5 | | CVE-2026-98338 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: ibss: ref BSS entry for joined event |
| LOW | | 5.5 | | CVE-2026-98389 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip gfx switch_power_profile during GPU reset |
| LOW | | 5.5 | | CVE-2026-98393 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU |
| LOW | | 5.5 | | CVE-2026-98424 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: undo netns switch if renaming the wiphy fails |
| LOW | | 5.5 | | CVE-2026-98427 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: codel: bound the dropping loop per dequeue call |
| LOW | | 5.5 | | CVE-2026-98431 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency |
| LOW | | 3.3 | | CVE-2026-98551 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/core: Fill branch entries with a single assignment |
| LOW | | 2.3 | | CVE-2026-98628 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Make post-verification instruction rewrites killable |
| LOW | | 2.5 | | CVE-2026-98682 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: drain and invalidate before server-side copy/clone |
| LOW | | 2.5 | | CVE-2026-98683 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush dirty data before zeroing a range |
| LOW | | 2.5 | | CVE-2026-98684 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush and commit data before querying allocated ranges |
| LOW | | 3.3 | | CVE-2026-98685 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: discard post-EOF pagecache when extending a file via clone range |
| LOW | | 3.7 | | CVE-2026-98802 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: seg6: ensure packet data is writable before modifying SRH and IPv6 DA |
| LOW | | | | TEMP-0000000-F7A20F | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | [Kernel: Unprivileged user can freeze journald] |
| LOW | | 5 | | CVE-2004-0230 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | TCP, when using a large Window Size, makes it easier for remote attack ... |
| LOW | | 4.9 | | CVE-2005-3660 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | Linux kernel 2.4 and 2.6 allows attackers to cause a denial of service ... |
| LOW | | 2.1 | | CVE-2007-3719 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: secretly Monopolizing the CPU Without Superuser Privileges |
| LOW | | 5.5 | | CVE-2008-2544 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mounting proc readonly on a different mount point silently mounts it rw if the /proc mount is rw |
| LOW | | 7.1 | | CVE-2008-4609 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: TCP protocol vulnerabilities from Outpost24 |
| LOW | | 5 | | CVE-2010-4563 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv6: sniffer detection |
| LOW | | 4.3 | | CVE-2010-5321 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: v4l: videobuf: hotfix a bug on multiple calls to mmap() |
| LOW | | 5.5 | | CVE-2011-4915 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | fs/proc/base.c in the Linux kernel through 3.1 allows local users to o ... |
| LOW | | 5.5 | | CVE-2011-4916 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | Linux kernel through 3.1 allows local users to obtain sensitive keystr ... |
| LOW | | 5.5 | | CVE-2011-4917 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel through 3.1 there is an information disclosure iss ... |
| LOW | | 4.9 | | CVE-2012-4542 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: block: default SCSI command filter does not accomodate commands overlap across device classes |
| LOW | | 5.5 | | CVE-2014-9892 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | The snd_compr_tstamp function in sound/core/compress_offload.c in the ... |
| LOW | | 7.5 | | CVE-2014-9900 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Info leak in uninitialized structure ethtool_wolinfo in ethtool_get_wol() |
| LOW | | 3.3 | | CVE-2015-2877 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: Cross-VM ASL INtrospection (CAIN) |
| LOW | | 5.5 | | CVE-2016-10723 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel through 4.17.2. Since the ... |
| LOW | | 5.5 | | CVE-2016-8660 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: local DoS due to a page lock order bug in the XFS seek hole/data implementation |
| LOW | | 4.7 | | CVE-2017-0630 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Information disclosure vulnerability in kernel trace subsystem |
| LOW | | 5.5 | | CVE-2017-13693 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ACPI operand cache leak in dsutils.c |
| LOW | | 5.5 | | CVE-2017-13694 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ACPI node and node_ext cache leak |
| LOW | | 5.9 | | CVE-2018-1121 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | procps: process hiding through race condition enumerating /proc |
| LOW | | 5.5 | | CVE-2018-12928 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NULL pointer dereference in hfs_ext_read_extent in hfs.ko |
| LOW | | 4.9 | | CVE-2018-17977 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Mishandled interactions among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets resulting in a d |
| LOW | | 2.5 | | CVE-2019-11191 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: race condition in load_aout_binary() allows local users to bypass ASLR on setuid a.out programs |
| LOW | | 5.7 | | CVE-2019-12378 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip6_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12379 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory leak in con_insert_unipair in drivers/tty/vt/consolemap.c |
| LOW | | 6.2 | | CVE-2019-12380 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory allocation failure in the efi subsystem leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12381 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12382 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12455 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c causing denial of service |
| LOW | | 7.8 | | CVE-2019-12456 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: double fetch in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c |
| LOW | | 4.1 | | CVE-2019-16229 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c |
| LOW | | 4.7 | | CVE-2019-16230 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/radeon/radeon_display.c |
| LOW | | 4.1 | | CVE-2019-16231 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c |
| LOW | | 4.1 | | CVE-2019-16232 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/wireless/marvell/libertas/if_sdio.c |
| LOW | | 4.1 | | CVE-2019-16233 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c |
| LOW | | 4.7 | | CVE-2019-16234 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/net/wireless/intel/iwlwifi/pcie/trans.c |
| LOW | | 7.5 | | CVE-2019-19070 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: A memory leak in the spi_gpio_probe() function in drivers/spi/spi-gpio.c allows for a DoS |
| LOW | | 7.8 | | CVE-2019-19378 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in index_rbio_pages in fs/btrfs/raid56.c |
| LOW | | 7.8 | | CVE-2020-11725 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: improper handling of private_size*count multiplication due to count=info->owner typo |
| LOW | | 3.4 | | CVE-2020-35501 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: audit not logging access to syscall open_by_handle_at for users with CAP_DAC_READ_SEARCH capability |
| LOW | | 7.8 | | CVE-2021-26934 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel 4.18 through 5.10.16, as u ... |
| LOW | | 5.9 | | CVE-2021-3714 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Remote Page Deduplication Attacks |
| LOW | | 7.5 | | CVE-2022-0400 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Out of bounds read in the smc protocol stack |
| LOW | | 7.8 | | CVE-2022-1247 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: A race condition bug in rose_connect() |
| LOW | | 7.8 | | CVE-2022-25265 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Executable Space Protection Bypass |
| LOW | | 7 | | CVE-2022-2961 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: race condition in rose_bind() |
| LOW | | 7.8 | | CVE-2022-3238 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs3 local privledge escalation if NTFS character set and remount and umount called simultaneously |
| LOW | | 4.2 | | CVE-2022-41848 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Race condition between mgslpc_ioctl and mgslpc_detach |
| LOW | | 6.4 | | CVE-2022-44032 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: Race between cmm_open() and cm4000_detach() result in UAF |
| LOW | | 6.4 | | CVE-2022-44033 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: A race condition between cm4040_open() and reader_detach() may result in UAF |
| LOW | | 5.5 | | CVE-2022-4543 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KASLR Prefetch Bypass Breaks KPTI |
| LOW | | 7 | | CVE-2022-45884 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_register_device() |
| LOW | | 7 | | CVE-2022-45885 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_frontend.c |
| LOW | | 6.4 | | CVE-2023-23039 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tty: vcc: race condition leading to use-after-free in vcc_open() |
| LOW | | 7.8 | | CVE-2023-26242 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: kernel: fpga: dfl-afu: integer overflow in afu_mmio_region_get_by_offset() |
| LOW | | 5.5 | | CVE-2023-31081 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | An issue was discovered in drivers/media/test-drivers/vidtv/vidtv_brid ... |
| LOW | | 5.5 | | CVE-2023-31085 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: divide-by-zero error in ctrl_cdev_ioctl when do_div happens and erasesize is 0 |
| LOW | | 7.8 | | CVE-2023-3640 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and pref |
| LOW | | 6.5 | | CVE-2024-0564 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: max page sharing of Kernel Samepage Merging (KSM) may cause memory deduplication |
| LOW | | | | CVE-2025-40065 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Write hgatp register with valid mode bits |
| LOW | | 5.5 | | CVE-2025-40086 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds |
| LOW | | | | CVE-2025-40136 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: crypto: hisilicon/qm - request reserved interrupt for virtual function |
| LOW | | 5.5 | | CVE-2025-68193 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Add devm release action to safely tear down CT |
| LOW | | 5.5 | | CVE-2025-68359 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix double free of qgroup record after failure to add delayed ref head |
| LOW | | | | CVE-2025-68376 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: ETR: Fix ETR buffer use-after-free issue |
| LOW | | 3.3 | | CVE-2025-68751 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/fpu: Fix false-positive kmsan report in fpu_vstl() |
| LOW | | | | CVE-2025-68755 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: staging: most: remove broken i2c driver |
| LOW | | | | CVE-2026-31536 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: server: let send_done handle a completion without IB_SEND_SIGNALED |
| LOW | | | | CVE-2026-43263 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix Null reference while testing fluster |
| LOW | | | | CVE-2026-45956 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() |
| LOW | | | | CVE-2026-46175 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by FGGC of node block |
| LOW | | | | CVE-2026-52983 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: fix BQL imbalance in TX path |
| LOW | | | | CVE-2026-53024 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free if write is called after disconnect |
| LOW | | | | CVE-2026-53025 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free on cdev close |
| LOW | | 5.5 | | CVE-2026-53284 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: only release the dirty pages io tree after successful writes |
| LOW | | | | CVE-2026-53368 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage |
| LOW | | | | CVE-2026-63825 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gcov: use atomic counter updates to fix concurrent access crashes |
| LOW | | 5.5 | | CVE-2026-64388 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix chown/chgrp with SMB3 POSIX Extensions |
| LOW | | 5.5 | | CVE-2026-64513 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Unconditionally recompute CR8 intercept on PPR update |
| LOW | | 4.7 | | CVE-2026-68081 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state |
| LOW | | 5.5 | | CVE-2026-68105 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Fix kernel panic during driver load failure |
| LOW | | 5.5 | | CVE-2026-68238 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Release VFCT ACPI table reference |
| LOW | | 5.5 | | CVE-2026-68241 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/mst: limit DP MST ESI service loop |
| LOW | | 5.5 | | CVE-2026-68375 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Handle partially initialized auxiliary devices |
| LOW | | 5.5 | | CVE-2026-68412 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() |
| LOW | | 5.5 | | CVE-2026-68418 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Prevent user-triggered null deref on QP create |
| LOW | | 5.5 | | CVE-2026-68436 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: use kvzalloc to allocate struct dc |
| LOW | | 5.5 | | CVE-2026-72009 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI |
| LOW | | 5.5 | | CVE-2026-72031 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD |
| LOW | | 5.5 | | CVE-2026-72321 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() |
| LOW | | 5.5 | | CVE-2026-72366 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_create_write_req() to handle async cache object creation |
| LOW | | 5.5 | | CVE-2026-72439 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid10: fix writes_pending leak on write request failures |
| LOW | | 5.5 | | CVE-2026-72494 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Replace waitqueue and flag with completion |
| LOW | | 5.5 | | CVE-2026-72497 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Add a max slot check for SQ |
| LOW | | 5.5 | | CVE-2026-74261 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: avoid stale FIFO cells during resize |
| LOW | | 5.5 | | CVE-2026-74338 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject sleepable BPF_LSM_CGROUP programs at load time |
| LOW | | 5.5 | | CVE-2026-74373 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix bio accounting for split md cloned bios |
| LOW | | 5.5 | | CVE-2026-74374 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix error-path detection with md_cloned_bio() |
| LOW | | 5.5 | | CVE-2026-74375 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix deadlock in read error recovery path |
| LOW | | 5.5 | | CVE-2026-74558 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: reclaim invalid Tx descriptors in ZC batch path |
| LOW | | 5.5 | | CVE-2026-74559 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: drain continuation descs after overflow in xsk_build_skb() |
| LOW | | 5.5 | | CVE-2026-74560 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx |
| LOW | | 5.5 | | CVE-2026-74571 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: skip global block reserve accounting for rescue mounts |
| LOW | | | | CVE-2026-74690 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| LOW | | 5.5 | | CVE-2026-74728 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: handle NULL b_addr in xfs_buf_free |
| LOW | | 5.5 | | CVE-2026-74733 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock |
| LOW | | 5.5 | | CVE-2026-74734 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firewire: ohci: fix NULL pointer dereference in ar_context_release |
| LOW | | 5.5 | | CVE-2026-74754 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: core: pair EH runtime PM get and put |
| LOW | | 5.5 | | CVE-2026-80581 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout |
| LOW | | 5.5 | | CVE-2026-80607 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg |
| LOW | | 5.5 | | CVE-2026-80616 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() |
| LOW | | 5.5 | | CVE-2026-80643 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: EDAC/igen6: Fix call trace due to missing release() |
| LOW | | 5.5 | | CVE-2026-80653 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: hisi_sas: Add slave_destroy interface for v3 hw |
| LOW | | 5.5 | | CVE-2026-80705 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: check if dml21_add_phantom_plane() is successful |
| LOW | | | | CVE-2026-80738 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| LOW | | | | CVE-2026-80747 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| LOW | | | | CVE-2026-80785 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| LOW | | 5.5 | | CVE-2026-80786 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: Wrap user-invoked calls to fb_set_var() in helper |
| LOW | | 5.5 | | CVE-2026-80866 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tipc: avoid busy looping in tipc_exit_net() |
| LOW | | | | CVE-2026-80872 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | 5.5 | | CVE-2026-80884 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntb: Store original DMA address for future release |
| LOW | | | | CVE-2026-80899 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: e ... |
| LOW | | 5.5 | | CVE-2026-80948 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() |
| LOW | | 5.5 | | CVE-2026-89601 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext2: Fix lost inode updates for IS_SYNC inodes |
| LOW | | 5.5 | | CVE-2026-89808 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram |
| LOW | | 5.5 | | CVE-2026-89812 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the MES ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89813 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the KIQ ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89862 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Fix BSG job leak on validate flash image error path |
| LOW | | 5.5 | | CVE-2026-90084 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-vf: fix workqueue and netdev race in probe/remove |
| LOW | | 5.4 | | CVE-2026-90086 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: honor XDP_TX_METADATA in zero-copy path |
| LOW | | 5.5 | | CVE-2026-90097 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition |
| LOW | | 5.5 | | CVE-2026-90144 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dpll: fix NULL deref in dpll_device_ops() during teardown race |
| LOW | | 5.5 | | CVE-2026-90182 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-iocost: clear delay state when freeing policy data |
| LOW | | 5.5 | | CVE-2026-90183 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-iolatency: clear delay state when freeing policy data |
| LOW | | 6.1 | | CVE-2026-90211 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf, s390: Clear fetch destination on faulting arena atomic |
| LOW | | 5.5 | | CVE-2026-90261 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: flush active metadata block group at btree_writepages() start |
| LOW | | 5.5 | | CVE-2026-90267 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails |
| LOW | | 5.5 | | CVE-2026-90306 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ARM: 9481/2: breakpoint: CFI breakpoints only on demand |
| LOW | | 5.5 | | CVE-2026-90311 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: thermal: hwmon: Remove hwmon class device along with its parent |
| LOW | | 5.5 | | CVE-2026-90330 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: HID: logitech-hidpp: Fix FF device cleanup on init failure |
| LOW | | 5.5 | | CVE-2026-90335 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tty: skip cdev_del() when no cdev is registered |
| LOW | | 5.5 | | CVE-2026-90346 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: nl80211: clean up color-change beacon data on errors |
| LOW | | 5.5 | | CVE-2026-90424 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path |
| LOW | | 5.5 | | CVE-2026-92493 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active |
| LOW | | 5.5 | | CVE-2026-93116 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: asus-wmi: fix resource leaks on probe failure |
| LOW | | 6.7 | | CVE-2026-93125 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max |
| LOW | | 5.5 | | CVE-2026-93129 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: dell-wmi-base: Fix handling of ultra performance key |
| LOW | | 6.7 | | CVE-2026-93144 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject writes through untrusted BTF pointers |
| LOW | | 5.5 | | CVE-2026-93146 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: time/namespace: Validate nanosecond field in proc_timens_set_offset() |
| LOW | | 5.5 | | CVE-2026-93181 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel/uncore: Fix uncore_box ref/unref ordering |
| LOW | | 5.5 | | CVE-2026-93202 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: Fix recursive locking during device registration |
| LOW | | 5.5 | | CVE-2026-93216 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() |
| LOW | | 5.5 | | CVE-2026-93230 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier |
| LOW | | | | CVE-2026-93237 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| LOW | | | | CVE-2026-93251 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | | | CVE-2026-93260 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| LOW | | 5.5 | | CVE-2026-97424 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq |
| LOW | | 5.5 | | CVE-2026-97477 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() |
| LOW | | 5.5 | | CVE-2026-97479 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: driver core: Avoid warning when removing a device while its supplier is unbinding |
| LOW | | 5.5 | | CVE-2026-97480 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tty: serial: 8250: protect against NULL uart->port.dev in register |
| LOW | | 5.5 | | CVE-2026-97501 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction |
| LOW | | 5.5 | | CVE-2026-97503 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: genirq/proc: Size interrupt directory names for 10-digit interrupt numbers |
| LOW | | 5.5 | | CVE-2026-97928 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip the VMID 0 flush for VRAM |
| LOW | | 5.5 | | CVE-2026-97989 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vduse: validate virtqueue alignment |
| LOW | | 5.5 | | CVE-2026-97997 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio_ring: fix stale descriptor flags after a failed packed add |
| LOW | | 5.5 | | CVE-2026-98003 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/amd: Do not reallocate GA log buffers on resume |
| LOW | | 5.5 | | CVE-2026-98038 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Keep refcount_acquire nullable for borrowed RCU kptrs |
| LOW | | 5.5 | | CVE-2026-98044 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject legacy packet loads from callbacks |
| LOW | | 5.5 | | CVE-2026-98058 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark syscall helpers as sleepable |
| LOW | | 5.5 | | CVE-2026-98067 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: erofs: disable LZ4 rolling decompression for now |
| LOW | | 5.5 | | CVE-2026-98073 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: Remove conflicting altnames for dying netns in __dev_change_net_namespace() |
| LOW | | 5.5 | | CVE-2026-98079 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zstd: fix lost wakeup when waiting for a workspace |
| LOW | | 5.5 | | CVE-2026-98087 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate |
| LOW | | 5.5 | | CVE-2026-98119 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: break unbuffered write when netfs_alloc_subrequest() fails |
| LOW | | 5.5 | | CVE-2026-98147 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: printk: Don't WARN on kthread_run failure |
| LOW | | 5.5 | | CVE-2026-98148 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/gud: validate GUD_ROTATION_0 is present in supported rotations |
| LOW | | 7 | | CVE-2026-98176 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| LOW | | 5.5 | | CVE-2026-98177 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow in EOP ring size calculation |
| LOW | | 5.5 | | CVE-2026-98285 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| LOW | | 5.5 | | CVE-2026-98289 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: af_unix: Unify scc_index when finalising SCC in __unix_walk_scc() |
| LOW | | 5.5 | | CVE-2026-98304 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: bcmgenet: restore the hardware filters on open |
| LOW | | 5.5 | | CVE-2026-98317 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS |
| LOW | | 5.5 | | CVE-2026-98321 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_nat: unregister and release hooks on error |
| LOW | | 5.5 | | CVE-2026-98332 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: only operate on TDLS peers in the TDLS code |
| LOW | | 5.5 | | CVE-2026-98338 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: ibss: ref BSS entry for joined event |
| LOW | | 5.5 | | CVE-2026-98389 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip gfx switch_power_profile during GPU reset |
| LOW | | 5.5 | | CVE-2026-98393 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU |
| LOW | | 5.5 | | CVE-2026-98424 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: undo netns switch if renaming the wiphy fails |
| LOW | | 5.5 | | CVE-2026-98427 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: codel: bound the dropping loop per dequeue call |
| LOW | | 5.5 | | CVE-2026-98431 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency |
| LOW | | 3.3 | | CVE-2026-98551 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/core: Fill branch entries with a single assignment |
| LOW | | 2.3 | | CVE-2026-98628 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Make post-verification instruction rewrites killable |
| LOW | | 2.5 | | CVE-2026-98682 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: drain and invalidate before server-side copy/clone |
| LOW | | 2.5 | | CVE-2026-98683 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush dirty data before zeroing a range |
| LOW | | 2.5 | | CVE-2026-98684 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush and commit data before querying allocated ranges |
| LOW | | 3.3 | | CVE-2026-98685 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: discard post-EOF pagecache when extending a file via clone range |
| LOW | | 3.7 | | CVE-2026-98802 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: seg6: ensure packet data is writable before modifying SRH and IPv6 DA |
| LOW | | | | TEMP-0000000-F7A20F | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | [Kernel: Unprivileged user can freeze journald] |
| LOW | | 5 | | CVE-2004-0230 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | TCP, when using a large Window Size, makes it easier for remote attack ... |
| LOW | | 4.9 | | CVE-2005-3660 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | Linux kernel 2.4 and 2.6 allows attackers to cause a denial of service ... |
| LOW | | 2.1 | | CVE-2007-3719 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: secretly Monopolizing the CPU Without Superuser Privileges |
| LOW | | 5.5 | | CVE-2008-2544 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mounting proc readonly on a different mount point silently mounts it rw if the /proc mount is rw |
| LOW | | 7.1 | | CVE-2008-4609 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: TCP protocol vulnerabilities from Outpost24 |
| LOW | | 5 | | CVE-2010-4563 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv6: sniffer detection |
| LOW | | 4.3 | | CVE-2010-5321 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: v4l: videobuf: hotfix a bug on multiple calls to mmap() |
| LOW | | 5.5 | | CVE-2011-4915 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | fs/proc/base.c in the Linux kernel through 3.1 allows local users to o ... |
| LOW | | 5.5 | | CVE-2011-4916 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | Linux kernel through 3.1 allows local users to obtain sensitive keystr ... |
| LOW | | 5.5 | | CVE-2011-4917 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel through 3.1 there is an information disclosure iss ... |
| LOW | | 4.9 | | CVE-2012-4542 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: block: default SCSI command filter does not accomodate commands overlap across device classes |
| LOW | | 5.5 | | CVE-2014-9892 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | The snd_compr_tstamp function in sound/core/compress_offload.c in the ... |
| LOW | | 7.5 | | CVE-2014-9900 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Info leak in uninitialized structure ethtool_wolinfo in ethtool_get_wol() |
| LOW | | 3.3 | | CVE-2015-2877 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: Cross-VM ASL INtrospection (CAIN) |
| LOW | | 5.5 | | CVE-2016-10723 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel through 4.17.2. Since the ... |
| LOW | | 5.5 | | CVE-2016-8660 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: local DoS due to a page lock order bug in the XFS seek hole/data implementation |
| LOW | | 4.7 | | CVE-2017-0630 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Information disclosure vulnerability in kernel trace subsystem |
| LOW | | 5.5 | | CVE-2017-13693 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ACPI operand cache leak in dsutils.c |
| LOW | | 5.5 | | CVE-2017-13694 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ACPI node and node_ext cache leak |
| LOW | | 5.9 | | CVE-2018-1121 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | procps: process hiding through race condition enumerating /proc |
| LOW | | 5.5 | | CVE-2018-12928 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NULL pointer dereference in hfs_ext_read_extent in hfs.ko |
| LOW | | 4.9 | | CVE-2018-17977 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Mishandled interactions among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets resulting in a d |
| LOW | | 2.5 | | CVE-2019-11191 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: race condition in load_aout_binary() allows local users to bypass ASLR on setuid a.out programs |
| LOW | | 5.7 | | CVE-2019-12378 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip6_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12379 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory leak in con_insert_unipair in drivers/tty/vt/consolemap.c |
| LOW | | 6.2 | | CVE-2019-12380 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory allocation failure in the efi subsystem leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12381 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12382 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12455 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c causing denial of service |
| LOW | | 7.8 | | CVE-2019-12456 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: double fetch in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c |
| LOW | | 4.1 | | CVE-2019-16229 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c |
| LOW | | 4.7 | | CVE-2019-16230 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/radeon/radeon_display.c |
| LOW | | 4.1 | | CVE-2019-16231 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c |
| LOW | | 4.1 | | CVE-2019-16232 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/wireless/marvell/libertas/if_sdio.c |
| LOW | | 4.1 | | CVE-2019-16233 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c |
| LOW | | 4.7 | | CVE-2019-16234 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/net/wireless/intel/iwlwifi/pcie/trans.c |
| LOW | | 7.5 | | CVE-2019-19070 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: A memory leak in the spi_gpio_probe() function in drivers/spi/spi-gpio.c allows for a DoS |
| LOW | | 7.8 | | CVE-2019-19378 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in index_rbio_pages in fs/btrfs/raid56.c |
| LOW | | 7.8 | | CVE-2020-11725 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: improper handling of private_size*count multiplication due to count=info->owner typo |
| LOW | | 3.4 | | CVE-2020-35501 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: audit not logging access to syscall open_by_handle_at for users with CAP_DAC_READ_SEARCH capability |
| LOW | | 7.8 | | CVE-2021-26934 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel 4.18 through 5.10.16, as u ... |
| LOW | | 5.9 | | CVE-2021-3714 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Remote Page Deduplication Attacks |
| LOW | | 7.5 | | CVE-2022-0400 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Out of bounds read in the smc protocol stack |
| LOW | | 7.8 | | CVE-2022-1247 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: A race condition bug in rose_connect() |
| LOW | | 7.8 | | CVE-2022-25265 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Executable Space Protection Bypass |
| LOW | | 7 | | CVE-2022-2961 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: race condition in rose_bind() |
| LOW | | 7.8 | | CVE-2022-3238 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs3 local privledge escalation if NTFS character set and remount and umount called simultaneously |
| LOW | | 4.2 | | CVE-2022-41848 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Race condition between mgslpc_ioctl and mgslpc_detach |
| LOW | | 6.4 | | CVE-2022-44032 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: Race between cmm_open() and cm4000_detach() result in UAF |
| LOW | | 6.4 | | CVE-2022-44033 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: A race condition between cm4040_open() and reader_detach() may result in UAF |
| LOW | | 5.5 | | CVE-2022-4543 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KASLR Prefetch Bypass Breaks KPTI |
| LOW | | 7 | | CVE-2022-45884 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_register_device() |
| LOW | | 7 | | CVE-2022-45885 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_frontend.c |
| LOW | | 6.4 | | CVE-2023-23039 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tty: vcc: race condition leading to use-after-free in vcc_open() |
| LOW | | 7.8 | | CVE-2023-26242 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: kernel: fpga: dfl-afu: integer overflow in afu_mmio_region_get_by_offset() |
| LOW | | 5.5 | | CVE-2023-31081 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | An issue was discovered in drivers/media/test-drivers/vidtv/vidtv_brid ... |
| LOW | | 5.5 | | CVE-2023-31085 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: divide-by-zero error in ctrl_cdev_ioctl when do_div happens and erasesize is 0 |
| LOW | | 7.8 | | CVE-2023-3640 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and pref |
| LOW | | 6.5 | | CVE-2024-0564 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: max page sharing of Kernel Samepage Merging (KSM) may cause memory deduplication |
| LOW | | | | CVE-2025-40065 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Write hgatp register with valid mode bits |
| LOW | | 5.5 | | CVE-2025-40086 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds |
| LOW | | | | CVE-2025-40136 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: crypto: hisilicon/qm - request reserved interrupt for virtual function |
| LOW | | 5.5 | | CVE-2025-68193 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Add devm release action to safely tear down CT |
| LOW | | 5.5 | | CVE-2025-68359 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix double free of qgroup record after failure to add delayed ref head |
| LOW | | | | CVE-2025-68376 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: ETR: Fix ETR buffer use-after-free issue |
| LOW | | 3.3 | | CVE-2025-68751 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/fpu: Fix false-positive kmsan report in fpu_vstl() |
| LOW | | | | CVE-2025-68755 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: staging: most: remove broken i2c driver |
| LOW | | | | CVE-2026-31536 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: server: let send_done handle a completion without IB_SEND_SIGNALED |
| LOW | | | | CVE-2026-43263 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix Null reference while testing fluster |
| LOW | | | | CVE-2026-45956 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() |
| LOW | | | | CVE-2026-46175 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by FGGC of node block |
| LOW | | | | CVE-2026-52983 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: fix BQL imbalance in TX path |
| LOW | | | | CVE-2026-53024 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free if write is called after disconnect |
| LOW | | | | CVE-2026-53025 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free on cdev close |
| LOW | | 5.5 | | CVE-2026-53284 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: only release the dirty pages io tree after successful writes |
| LOW | | | | CVE-2026-53368 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage |
| LOW | | | | CVE-2026-63825 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gcov: use atomic counter updates to fix concurrent access crashes |
| LOW | | 5.5 | | CVE-2026-64388 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix chown/chgrp with SMB3 POSIX Extensions |
| LOW | | 5.5 | | CVE-2026-64513 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Unconditionally recompute CR8 intercept on PPR update |
| LOW | | 4.7 | | CVE-2026-68081 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state |
| LOW | | 5.5 | | CVE-2026-68105 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Fix kernel panic during driver load failure |
| LOW | | 5.5 | | CVE-2026-68238 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Release VFCT ACPI table reference |
| LOW | | 5.5 | | CVE-2026-68241 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/mst: limit DP MST ESI service loop |
| LOW | | 5.5 | | CVE-2026-68375 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Handle partially initialized auxiliary devices |
| LOW | | 5.5 | | CVE-2026-68412 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() |
| LOW | | 5.5 | | CVE-2026-68418 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Prevent user-triggered null deref on QP create |
| LOW | | 5.5 | | CVE-2026-68436 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: use kvzalloc to allocate struct dc |
| LOW | | 5.5 | | CVE-2026-72009 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI |
| LOW | | 5.5 | | CVE-2026-72031 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD |
| LOW | | 5.5 | | CVE-2026-72321 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() |
| LOW | | 5.5 | | CVE-2026-72366 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_create_write_req() to handle async cache object creation |
| LOW | | 5.5 | | CVE-2026-72439 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid10: fix writes_pending leak on write request failures |
| LOW | | 5.5 | | CVE-2026-72494 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Replace waitqueue and flag with completion |
| LOW | | 5.5 | | CVE-2026-72497 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Add a max slot check for SQ |
| LOW | | 5.5 | | CVE-2026-74261 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: avoid stale FIFO cells during resize |
| LOW | | 5.5 | | CVE-2026-74338 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject sleepable BPF_LSM_CGROUP programs at load time |
| LOW | | 5.5 | | CVE-2026-74373 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix bio accounting for split md cloned bios |
| LOW | | 5.5 | | CVE-2026-74374 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix error-path detection with md_cloned_bio() |
| LOW | | 5.5 | | CVE-2026-74375 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix deadlock in read error recovery path |
| LOW | | 5.5 | | CVE-2026-74558 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: reclaim invalid Tx descriptors in ZC batch path |
| LOW | | 5.5 | | CVE-2026-74559 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: drain continuation descs after overflow in xsk_build_skb() |
| LOW | | 5.5 | | CVE-2026-74560 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx |
| LOW | | 5.5 | | CVE-2026-74571 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: skip global block reserve accounting for rescue mounts |
| LOW | | | | CVE-2026-74690 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| LOW | | 5.5 | | CVE-2026-74728 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: handle NULL b_addr in xfs_buf_free |
| LOW | | 5.5 | | CVE-2026-74733 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock |
| LOW | | 5.5 | | CVE-2026-74734 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firewire: ohci: fix NULL pointer dereference in ar_context_release |
| LOW | | 5.5 | | CVE-2026-74754 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: core: pair EH runtime PM get and put |
| LOW | | 5.5 | | CVE-2026-80581 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout |
| LOW | | 5.5 | | CVE-2026-80607 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg |
| LOW | | 5.5 | | CVE-2026-80616 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() |
| LOW | | 5.5 | | CVE-2026-80643 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: EDAC/igen6: Fix call trace due to missing release() |
| LOW | | 5.5 | | CVE-2026-80653 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: hisi_sas: Add slave_destroy interface for v3 hw |
| LOW | | 5.5 | | CVE-2026-80705 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: check if dml21_add_phantom_plane() is successful |
| LOW | | | | CVE-2026-80738 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| LOW | | | | CVE-2026-80747 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| LOW | | | | CVE-2026-80785 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| LOW | | 5.5 | | CVE-2026-80786 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: Wrap user-invoked calls to fb_set_var() in helper |
| LOW | | 5.5 | | CVE-2026-80866 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tipc: avoid busy looping in tipc_exit_net() |
| LOW | | | | CVE-2026-80872 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | 5.5 | | CVE-2026-80884 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntb: Store original DMA address for future release |
| LOW | | | | CVE-2026-80899 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: e ... |
| LOW | | 5.5 | | CVE-2026-80948 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() |
| LOW | | 5.5 | | CVE-2026-89601 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext2: Fix lost inode updates for IS_SYNC inodes |
| LOW | | 5.5 | | CVE-2026-89808 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram |
| LOW | | 5.5 | | CVE-2026-89812 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the MES ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89813 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the KIQ ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89862 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Fix BSG job leak on validate flash image error path |
| LOW | | 5.5 | | CVE-2026-90084 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-vf: fix workqueue and netdev race in probe/remove |
| LOW | | 5.4 | | CVE-2026-90086 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: honor XDP_TX_METADATA in zero-copy path |
| LOW | | 5.5 | | CVE-2026-90097 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition |
| LOW | | 5.5 | | CVE-2026-90144 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dpll: fix NULL deref in dpll_device_ops() during teardown race |
| LOW | | 5.5 | | CVE-2026-90182 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-iocost: clear delay state when freeing policy data |
| LOW | | 5.5 | | CVE-2026-90183 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-iolatency: clear delay state when freeing policy data |
| LOW | | 6.1 | | CVE-2026-90211 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf, s390: Clear fetch destination on faulting arena atomic |
| LOW | | 5.5 | | CVE-2026-90261 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: flush active metadata block group at btree_writepages() start |
| LOW | | 5.5 | | CVE-2026-90267 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails |
| LOW | | 5.5 | | CVE-2026-90306 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ARM: 9481/2: breakpoint: CFI breakpoints only on demand |
| LOW | | 5.5 | | CVE-2026-90311 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: thermal: hwmon: Remove hwmon class device along with its parent |
| LOW | | 5.5 | | CVE-2026-90330 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: HID: logitech-hidpp: Fix FF device cleanup on init failure |
| LOW | | 5.5 | | CVE-2026-90335 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tty: skip cdev_del() when no cdev is registered |
| LOW | | 5.5 | | CVE-2026-90346 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: nl80211: clean up color-change beacon data on errors |
| LOW | | 5.5 | | CVE-2026-90424 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path |
| LOW | | 5.5 | | CVE-2026-92493 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active |
| LOW | | 5.5 | | CVE-2026-93116 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: asus-wmi: fix resource leaks on probe failure |
| LOW | | 6.7 | | CVE-2026-93125 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max |
| LOW | | 5.5 | | CVE-2026-93129 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: dell-wmi-base: Fix handling of ultra performance key |
| LOW | | 6.7 | | CVE-2026-93144 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject writes through untrusted BTF pointers |
| LOW | | 5.5 | | CVE-2026-93146 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: time/namespace: Validate nanosecond field in proc_timens_set_offset() |
| LOW | | 5.5 | | CVE-2026-93181 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel/uncore: Fix uncore_box ref/unref ordering |
| LOW | | 5.5 | | CVE-2026-93202 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: Fix recursive locking during device registration |
| LOW | | 5.5 | | CVE-2026-93216 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() |
| LOW | | 5.5 | | CVE-2026-93230 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier |
| LOW | | | | CVE-2026-93237 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| LOW | | | | CVE-2026-93251 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | | | CVE-2026-93260 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| LOW | | 5.5 | | CVE-2026-97424 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq |
| LOW | | 5.5 | | CVE-2026-97477 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() |
| LOW | | 5.5 | | CVE-2026-97479 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: driver core: Avoid warning when removing a device while its supplier is unbinding |
| LOW | | 5.5 | | CVE-2026-97480 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tty: serial: 8250: protect against NULL uart->port.dev in register |
| LOW | | 5.5 | | CVE-2026-97501 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction |
| LOW | | 5.5 | | CVE-2026-97503 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: genirq/proc: Size interrupt directory names for 10-digit interrupt numbers |
| LOW | | 5.5 | | CVE-2026-97928 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip the VMID 0 flush for VRAM |
| LOW | | 5.5 | | CVE-2026-97989 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vduse: validate virtqueue alignment |
| LOW | | 5.5 | | CVE-2026-97997 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio_ring: fix stale descriptor flags after a failed packed add |
| LOW | | 5.5 | | CVE-2026-98003 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/amd: Do not reallocate GA log buffers on resume |
| LOW | | 5.5 | | CVE-2026-98038 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Keep refcount_acquire nullable for borrowed RCU kptrs |
| LOW | | 5.5 | | CVE-2026-98044 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject legacy packet loads from callbacks |
| LOW | | 5.5 | | CVE-2026-98058 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark syscall helpers as sleepable |
| LOW | | 5.5 | | CVE-2026-98067 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: erofs: disable LZ4 rolling decompression for now |
| LOW | | 5.5 | | CVE-2026-98073 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: Remove conflicting altnames for dying netns in __dev_change_net_namespace() |
| LOW | | 5.5 | | CVE-2026-98079 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zstd: fix lost wakeup when waiting for a workspace |
| LOW | | 5.5 | | CVE-2026-98087 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate |
| LOW | | 5.5 | | CVE-2026-98119 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: break unbuffered write when netfs_alloc_subrequest() fails |
| LOW | | 5.5 | | CVE-2026-98147 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: printk: Don't WARN on kthread_run failure |
| LOW | | 5.5 | | CVE-2026-98148 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/gud: validate GUD_ROTATION_0 is present in supported rotations |
| LOW | | 7 | | CVE-2026-98176 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| LOW | | 5.5 | | CVE-2026-98177 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow in EOP ring size calculation |
| LOW | | 5.5 | | CVE-2026-98285 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| LOW | | 5.5 | | CVE-2026-98289 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: af_unix: Unify scc_index when finalising SCC in __unix_walk_scc() |
| LOW | | 5.5 | | CVE-2026-98304 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: bcmgenet: restore the hardware filters on open |
| LOW | | 5.5 | | CVE-2026-98317 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS |
| LOW | | 5.5 | | CVE-2026-98321 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_nat: unregister and release hooks on error |
| LOW | | 5.5 | | CVE-2026-98332 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: only operate on TDLS peers in the TDLS code |
| LOW | | 5.5 | | CVE-2026-98338 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: ibss: ref BSS entry for joined event |
| LOW | | 5.5 | | CVE-2026-98389 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip gfx switch_power_profile during GPU reset |
| LOW | | 5.5 | | CVE-2026-98393 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU |
| LOW | | 5.5 | | CVE-2026-98424 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: undo netns switch if renaming the wiphy fails |
| LOW | | 5.5 | | CVE-2026-98427 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: codel: bound the dropping loop per dequeue call |
| LOW | | 5.5 | | CVE-2026-98431 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency |
| LOW | | 3.3 | | CVE-2026-98551 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/core: Fill branch entries with a single assignment |
| LOW | | 2.3 | | CVE-2026-98628 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Make post-verification instruction rewrites killable |
| LOW | | 2.5 | | CVE-2026-98682 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: drain and invalidate before server-side copy/clone |
| LOW | | 2.5 | | CVE-2026-98683 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush dirty data before zeroing a range |
| LOW | | 2.5 | | CVE-2026-98684 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush and commit data before querying allocated ranges |
| LOW | | 3.3 | | CVE-2026-98685 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: discard post-EOF pagecache when extending a file via clone range |
| LOW | | 3.7 | | CVE-2026-98802 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: seg6: ensure packet data is writable before modifying SRH and IPv6 DA |
| LOW | | | | TEMP-0000000-F7A20F | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | [Kernel: Unprivileged user can freeze journald] |
| LOW | | 5 | | CVE-2004-0230 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | TCP, when using a large Window Size, makes it easier for remote attack ... |
| LOW | | 4.9 | | CVE-2005-3660 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | Linux kernel 2.4 and 2.6 allows attackers to cause a denial of service ... |
| LOW | | 2.1 | | CVE-2007-3719 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: secretly Monopolizing the CPU Without Superuser Privileges |
| LOW | | 5.5 | | CVE-2008-2544 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mounting proc readonly on a different mount point silently mounts it rw if the /proc mount is rw |
| LOW | | 7.1 | | CVE-2008-4609 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: TCP protocol vulnerabilities from Outpost24 |
| LOW | | 5 | | CVE-2010-4563 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv6: sniffer detection |
| LOW | | 4.3 | | CVE-2010-5321 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: v4l: videobuf: hotfix a bug on multiple calls to mmap() |
| LOW | | 5.5 | | CVE-2011-4915 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | fs/proc/base.c in the Linux kernel through 3.1 allows local users to o ... |
| LOW | | 5.5 | | CVE-2011-4916 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | Linux kernel through 3.1 allows local users to obtain sensitive keystr ... |
| LOW | | 5.5 | | CVE-2011-4917 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel through 3.1 there is an information disclosure iss ... |
| LOW | | 4.9 | | CVE-2012-4542 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: block: default SCSI command filter does not accomodate commands overlap across device classes |
| LOW | | 5.5 | | CVE-2014-9892 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | The snd_compr_tstamp function in sound/core/compress_offload.c in the ... |
| LOW | | 7.5 | | CVE-2014-9900 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Info leak in uninitialized structure ethtool_wolinfo in ethtool_get_wol() |
| LOW | | 3.3 | | CVE-2015-2877 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: Cross-VM ASL INtrospection (CAIN) |
| LOW | | 5.5 | | CVE-2016-10723 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel through 4.17.2. Since the ... |
| LOW | | 5.5 | | CVE-2016-8660 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: local DoS due to a page lock order bug in the XFS seek hole/data implementation |
| LOW | | 4.7 | | CVE-2017-0630 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Information disclosure vulnerability in kernel trace subsystem |
| LOW | | 5.5 | | CVE-2017-13693 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ACPI operand cache leak in dsutils.c |
| LOW | | 5.5 | | CVE-2017-13694 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ACPI node and node_ext cache leak |
| LOW | | 5.9 | | CVE-2018-1121 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | procps: process hiding through race condition enumerating /proc |
| LOW | | 5.5 | | CVE-2018-12928 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NULL pointer dereference in hfs_ext_read_extent in hfs.ko |
| LOW | | 4.9 | | CVE-2018-17977 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Mishandled interactions among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets resulting in a d |
| LOW | | 2.5 | | CVE-2019-11191 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: race condition in load_aout_binary() allows local users to bypass ASLR on setuid a.out programs |
| LOW | | 5.7 | | CVE-2019-12378 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip6_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12379 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory leak in con_insert_unipair in drivers/tty/vt/consolemap.c |
| LOW | | 6.2 | | CVE-2019-12380 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory allocation failure in the efi subsystem leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12381 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12382 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12455 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c causing denial of service |
| LOW | | 7.8 | | CVE-2019-12456 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: double fetch in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c |
| LOW | | 4.1 | | CVE-2019-16229 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c |
| LOW | | 4.7 | | CVE-2019-16230 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/radeon/radeon_display.c |
| LOW | | 4.1 | | CVE-2019-16231 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c |
| LOW | | 4.1 | | CVE-2019-16232 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/wireless/marvell/libertas/if_sdio.c |
| LOW | | 4.1 | | CVE-2019-16233 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c |
| LOW | | 4.7 | | CVE-2019-16234 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/net/wireless/intel/iwlwifi/pcie/trans.c |
| LOW | | 7.5 | | CVE-2019-19070 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: A memory leak in the spi_gpio_probe() function in drivers/spi/spi-gpio.c allows for a DoS |
| LOW | | 7.8 | | CVE-2019-19378 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in index_rbio_pages in fs/btrfs/raid56.c |
| LOW | | 7.8 | | CVE-2020-11725 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: improper handling of private_size*count multiplication due to count=info->owner typo |
| LOW | | 3.4 | | CVE-2020-35501 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: audit not logging access to syscall open_by_handle_at for users with CAP_DAC_READ_SEARCH capability |
| LOW | | 7.8 | | CVE-2021-26934 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel 4.18 through 5.10.16, as u ... |
| LOW | | 5.9 | | CVE-2021-3714 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Remote Page Deduplication Attacks |
| LOW | | 7.5 | | CVE-2022-0400 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Out of bounds read in the smc protocol stack |
| LOW | | 7.8 | | CVE-2022-1247 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: A race condition bug in rose_connect() |
| LOW | | 7.8 | | CVE-2022-25265 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Executable Space Protection Bypass |
| LOW | | 7 | | CVE-2022-2961 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: race condition in rose_bind() |
| LOW | | 7.8 | | CVE-2022-3238 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs3 local privledge escalation if NTFS character set and remount and umount called simultaneously |
| LOW | | 4.2 | | CVE-2022-41848 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Race condition between mgslpc_ioctl and mgslpc_detach |
| LOW | | 6.4 | | CVE-2022-44032 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: Race between cmm_open() and cm4000_detach() result in UAF |
| LOW | | 6.4 | | CVE-2022-44033 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: A race condition between cm4040_open() and reader_detach() may result in UAF |
| LOW | | 5.5 | | CVE-2022-4543 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KASLR Prefetch Bypass Breaks KPTI |
| LOW | | 7 | | CVE-2022-45884 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_register_device() |
| LOW | | 7 | | CVE-2022-45885 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_frontend.c |
| LOW | | 6.4 | | CVE-2023-23039 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tty: vcc: race condition leading to use-after-free in vcc_open() |
| LOW | | 7.8 | | CVE-2023-26242 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: kernel: fpga: dfl-afu: integer overflow in afu_mmio_region_get_by_offset() |
| LOW | | 5.5 | | CVE-2023-31081 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | An issue was discovered in drivers/media/test-drivers/vidtv/vidtv_brid ... |
| LOW | | 5.5 | | CVE-2023-31085 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: divide-by-zero error in ctrl_cdev_ioctl when do_div happens and erasesize is 0 |
| LOW | | 7.8 | | CVE-2023-3640 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and pref |
| LOW | | 6.5 | | CVE-2024-0564 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: max page sharing of Kernel Samepage Merging (KSM) may cause memory deduplication |
| LOW | | | | CVE-2025-40065 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Write hgatp register with valid mode bits |
| LOW | | 5.5 | | CVE-2025-40086 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds |
| LOW | | | | CVE-2025-40136 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: crypto: hisilicon/qm - request reserved interrupt for virtual function |
| LOW | | 5.5 | | CVE-2025-68193 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Add devm release action to safely tear down CT |
| LOW | | 5.5 | | CVE-2025-68359 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix double free of qgroup record after failure to add delayed ref head |
| LOW | | | | CVE-2025-68376 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: ETR: Fix ETR buffer use-after-free issue |
| LOW | | 3.3 | | CVE-2025-68751 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/fpu: Fix false-positive kmsan report in fpu_vstl() |
| LOW | | | | CVE-2025-68755 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: staging: most: remove broken i2c driver |
| LOW | | | | CVE-2026-31536 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: server: let send_done handle a completion without IB_SEND_SIGNALED |
| LOW | | | | CVE-2026-43263 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix Null reference while testing fluster |
| LOW | | | | CVE-2026-45956 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() |
| LOW | | | | CVE-2026-46175 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by FGGC of node block |
| LOW | | | | CVE-2026-52983 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: fix BQL imbalance in TX path |
| LOW | | | | CVE-2026-53024 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free if write is called after disconnect |
| LOW | | | | CVE-2026-53025 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free on cdev close |
| LOW | | 5.5 | | CVE-2026-53284 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: only release the dirty pages io tree after successful writes |
| LOW | | | | CVE-2026-53368 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage |
| LOW | | | | CVE-2026-63825 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gcov: use atomic counter updates to fix concurrent access crashes |
| LOW | | 5.5 | | CVE-2026-64388 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix chown/chgrp with SMB3 POSIX Extensions |
| LOW | | 5.5 | | CVE-2026-64513 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Unconditionally recompute CR8 intercept on PPR update |
| LOW | | 4.7 | | CVE-2026-68081 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state |
| LOW | | 5.5 | | CVE-2026-68105 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Fix kernel panic during driver load failure |
| LOW | | 5.5 | | CVE-2026-68238 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Release VFCT ACPI table reference |
| LOW | | 5.5 | | CVE-2026-68241 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/mst: limit DP MST ESI service loop |
| LOW | | 5.5 | | CVE-2026-68375 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Handle partially initialized auxiliary devices |
| LOW | | 5.5 | | CVE-2026-68412 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() |
| LOW | | 5.5 | | CVE-2026-68418 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Prevent user-triggered null deref on QP create |
| LOW | | 5.5 | | CVE-2026-68436 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: use kvzalloc to allocate struct dc |
| LOW | | 5.5 | | CVE-2026-72009 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI |
| LOW | | 5.5 | | CVE-2026-72031 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD |
| LOW | | 5.5 | | CVE-2026-72321 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() |
| LOW | | 5.5 | | CVE-2026-72366 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_create_write_req() to handle async cache object creation |
| LOW | | 5.5 | | CVE-2026-72439 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid10: fix writes_pending leak on write request failures |
| LOW | | 5.5 | | CVE-2026-72494 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Replace waitqueue and flag with completion |
| LOW | | 5.5 | | CVE-2026-72497 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Add a max slot check for SQ |
| LOW | | 5.5 | | CVE-2026-74261 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: avoid stale FIFO cells during resize |
| LOW | | 5.5 | | CVE-2026-74338 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject sleepable BPF_LSM_CGROUP programs at load time |
| LOW | | 5.5 | | CVE-2026-74373 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix bio accounting for split md cloned bios |
| LOW | | 5.5 | | CVE-2026-74374 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix error-path detection with md_cloned_bio() |
| LOW | | 5.5 | | CVE-2026-74375 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix deadlock in read error recovery path |
| LOW | | 5.5 | | CVE-2026-74558 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: reclaim invalid Tx descriptors in ZC batch path |
| LOW | | 5.5 | | CVE-2026-74559 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: drain continuation descs after overflow in xsk_build_skb() |
| LOW | | 5.5 | | CVE-2026-74560 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx |
| LOW | | 5.5 | | CVE-2026-74571 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: skip global block reserve accounting for rescue mounts |
| LOW | | | | CVE-2026-74690 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| LOW | | 5.5 | | CVE-2026-74728 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: handle NULL b_addr in xfs_buf_free |
| LOW | | 5.5 | | CVE-2026-74733 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock |
| LOW | | 5.5 | | CVE-2026-74734 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firewire: ohci: fix NULL pointer dereference in ar_context_release |
| LOW | | 5.5 | | CVE-2026-74754 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: core: pair EH runtime PM get and put |
| LOW | | 5.5 | | CVE-2026-80581 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout |
| LOW | | 5.5 | | CVE-2026-80607 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg |
| LOW | | 5.5 | | CVE-2026-80616 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() |
| LOW | | 5.5 | | CVE-2026-80643 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: EDAC/igen6: Fix call trace due to missing release() |
| LOW | | 5.5 | | CVE-2026-80653 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: hisi_sas: Add slave_destroy interface for v3 hw |
| LOW | | 5.5 | | CVE-2026-80705 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: check if dml21_add_phantom_plane() is successful |
| LOW | | | | CVE-2026-80738 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| LOW | | | | CVE-2026-80747 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| LOW | | | | CVE-2026-80785 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| LOW | | 5.5 | | CVE-2026-80786 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: Wrap user-invoked calls to fb_set_var() in helper |
| LOW | | 5.5 | | CVE-2026-80866 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tipc: avoid busy looping in tipc_exit_net() |
| LOW | | | | CVE-2026-80872 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | 5.5 | | CVE-2026-80884 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntb: Store original DMA address for future release |
| LOW | | | | CVE-2026-80899 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: e ... |
| LOW | | 5.5 | | CVE-2026-80948 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() |
| LOW | | 5.5 | | CVE-2026-89601 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext2: Fix lost inode updates for IS_SYNC inodes |
| LOW | | 5.5 | | CVE-2026-89808 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram |
| LOW | | 5.5 | | CVE-2026-89812 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the MES ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89813 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the KIQ ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89862 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Fix BSG job leak on validate flash image error path |
| LOW | | 5.5 | | CVE-2026-90084 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-vf: fix workqueue and netdev race in probe/remove |
| LOW | | 5.4 | | CVE-2026-90086 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: honor XDP_TX_METADATA in zero-copy path |
| LOW | | 5.5 | | CVE-2026-90097 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition |
| LOW | | 5.5 | | CVE-2026-90144 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dpll: fix NULL deref in dpll_device_ops() during teardown race |
| LOW | | 5.5 | | CVE-2026-90182 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-iocost: clear delay state when freeing policy data |
| LOW | | 5.5 | | CVE-2026-90183 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-iolatency: clear delay state when freeing policy data |
| LOW | | 6.1 | | CVE-2026-90211 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf, s390: Clear fetch destination on faulting arena atomic |
| LOW | | 5.5 | | CVE-2026-90261 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: flush active metadata block group at btree_writepages() start |
| LOW | | 5.5 | | CVE-2026-90267 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails |
| LOW | | 5.5 | | CVE-2026-90306 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ARM: 9481/2: breakpoint: CFI breakpoints only on demand |
| LOW | | 5.5 | | CVE-2026-90311 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: thermal: hwmon: Remove hwmon class device along with its parent |
| LOW | | 5.5 | | CVE-2026-90330 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: HID: logitech-hidpp: Fix FF device cleanup on init failure |
| LOW | | 5.5 | | CVE-2026-90335 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tty: skip cdev_del() when no cdev is registered |
| LOW | | 5.5 | | CVE-2026-90346 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: nl80211: clean up color-change beacon data on errors |
| LOW | | 5.5 | | CVE-2026-90424 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path |
| LOW | | 5.5 | | CVE-2026-92493 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active |
| LOW | | 5.5 | | CVE-2026-93116 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: asus-wmi: fix resource leaks on probe failure |
| LOW | | 6.7 | | CVE-2026-93125 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max |
| LOW | | 5.5 | | CVE-2026-93129 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: dell-wmi-base: Fix handling of ultra performance key |
| LOW | | 6.7 | | CVE-2026-93144 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject writes through untrusted BTF pointers |
| LOW | | 5.5 | | CVE-2026-93146 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: time/namespace: Validate nanosecond field in proc_timens_set_offset() |
| LOW | | 5.5 | | CVE-2026-93181 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel/uncore: Fix uncore_box ref/unref ordering |
| LOW | | 5.5 | | CVE-2026-93202 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: Fix recursive locking during device registration |
| LOW | | 5.5 | | CVE-2026-93216 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() |
| LOW | | 5.5 | | CVE-2026-93230 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier |
| LOW | | | | CVE-2026-93237 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| LOW | | | | CVE-2026-93251 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | | | CVE-2026-93260 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| LOW | | 5.5 | | CVE-2026-97424 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq |
| LOW | | 5.5 | | CVE-2026-97477 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() |
| LOW | | 5.5 | | CVE-2026-97479 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: driver core: Avoid warning when removing a device while its supplier is unbinding |
| LOW | | 5.5 | | CVE-2026-97480 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tty: serial: 8250: protect against NULL uart->port.dev in register |
| LOW | | 5.5 | | CVE-2026-97501 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction |
| LOW | | 5.5 | | CVE-2026-97503 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: genirq/proc: Size interrupt directory names for 10-digit interrupt numbers |
| LOW | | 5.5 | | CVE-2026-97928 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip the VMID 0 flush for VRAM |
| LOW | | 5.5 | | CVE-2026-97989 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vduse: validate virtqueue alignment |
| LOW | | 5.5 | | CVE-2026-97997 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio_ring: fix stale descriptor flags after a failed packed add |
| LOW | | 5.5 | | CVE-2026-98003 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/amd: Do not reallocate GA log buffers on resume |
| LOW | | 5.5 | | CVE-2026-98038 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Keep refcount_acquire nullable for borrowed RCU kptrs |
| LOW | | 5.5 | | CVE-2026-98044 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject legacy packet loads from callbacks |
| LOW | | 5.5 | | CVE-2026-98058 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark syscall helpers as sleepable |
| LOW | | 5.5 | | CVE-2026-98067 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: erofs: disable LZ4 rolling decompression for now |
| LOW | | 5.5 | | CVE-2026-98073 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: Remove conflicting altnames for dying netns in __dev_change_net_namespace() |
| LOW | | 5.5 | | CVE-2026-98079 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zstd: fix lost wakeup when waiting for a workspace |
| LOW | | 5.5 | | CVE-2026-98087 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate |
| LOW | | 5.5 | | CVE-2026-98119 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: break unbuffered write when netfs_alloc_subrequest() fails |
| LOW | | 5.5 | | CVE-2026-98147 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: printk: Don't WARN on kthread_run failure |
| LOW | | 5.5 | | CVE-2026-98148 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/gud: validate GUD_ROTATION_0 is present in supported rotations |
| LOW | | 7 | | CVE-2026-98176 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| LOW | | 5.5 | | CVE-2026-98177 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow in EOP ring size calculation |
| LOW | | 5.5 | | CVE-2026-98285 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| LOW | | 5.5 | | CVE-2026-98289 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: af_unix: Unify scc_index when finalising SCC in __unix_walk_scc() |
| LOW | | 5.5 | | CVE-2026-98304 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: bcmgenet: restore the hardware filters on open |
| LOW | | 5.5 | | CVE-2026-98317 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS |
| LOW | | 5.5 | | CVE-2026-98321 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_nat: unregister and release hooks on error |
| LOW | | 5.5 | | CVE-2026-98332 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: only operate on TDLS peers in the TDLS code |
| LOW | | 5.5 | | CVE-2026-98338 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: ibss: ref BSS entry for joined event |
| LOW | | 5.5 | | CVE-2026-98389 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip gfx switch_power_profile during GPU reset |
| LOW | | 5.5 | | CVE-2026-98393 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU |
| LOW | | 5.5 | | CVE-2026-98424 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: undo netns switch if renaming the wiphy fails |
| LOW | | 5.5 | | CVE-2026-98427 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: codel: bound the dropping loop per dequeue call |
| LOW | | 5.5 | | CVE-2026-98431 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency |
| LOW | | 3.3 | | CVE-2026-98551 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/core: Fill branch entries with a single assignment |
| LOW | | 2.3 | | CVE-2026-98628 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Make post-verification instruction rewrites killable |
| LOW | | 2.5 | | CVE-2026-98682 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: drain and invalidate before server-side copy/clone |
| LOW | | 2.5 | | CVE-2026-98683 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush dirty data before zeroing a range |
| LOW | | 2.5 | | CVE-2026-98684 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush and commit data before querying allocated ranges |
| LOW | | 3.3 | | CVE-2026-98685 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: discard post-EOF pagecache when extending a file via clone range |
| LOW | | 3.7 | | CVE-2026-98802 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: seg6: ensure packet data is writable before modifying SRH and IPv6 DA |
| LOW | | | | TEMP-0000000-F7A20F | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | [Kernel: Unprivileged user can freeze journald] |
| LOW | | 5 | | CVE-2004-0230 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | TCP, when using a large Window Size, makes it easier for remote attack ... |
| LOW | | 4.9 | | CVE-2005-3660 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | Linux kernel 2.4 and 2.6 allows attackers to cause a denial of service ... |
| LOW | | 2.1 | | CVE-2007-3719 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: secretly Monopolizing the CPU Without Superuser Privileges |
| LOW | | 5.5 | | CVE-2008-2544 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mounting proc readonly on a different mount point silently mounts it rw if the /proc mount is rw |
| LOW | | 7.1 | | CVE-2008-4609 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: TCP protocol vulnerabilities from Outpost24 |
| LOW | | 5 | | CVE-2010-4563 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv6: sniffer detection |
| LOW | | 4.3 | | CVE-2010-5321 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: v4l: videobuf: hotfix a bug on multiple calls to mmap() |
| LOW | | 5.5 | | CVE-2011-4915 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | fs/proc/base.c in the Linux kernel through 3.1 allows local users to o ... |
| LOW | | 5.5 | | CVE-2011-4916 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | Linux kernel through 3.1 allows local users to obtain sensitive keystr ... |
| LOW | | 5.5 | | CVE-2011-4917 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel through 3.1 there is an information disclosure iss ... |
| LOW | | 4.9 | | CVE-2012-4542 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: block: default SCSI command filter does not accomodate commands overlap across device classes |
| LOW | | 5.5 | | CVE-2014-9892 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | The snd_compr_tstamp function in sound/core/compress_offload.c in the ... |
| LOW | | 7.5 | | CVE-2014-9900 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Info leak in uninitialized structure ethtool_wolinfo in ethtool_get_wol() |
| LOW | | 3.3 | | CVE-2015-2877 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: Cross-VM ASL INtrospection (CAIN) |
| LOW | | 5.5 | | CVE-2016-10723 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel through 4.17.2. Since the ... |
| LOW | | 5.5 | | CVE-2016-8660 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: local DoS due to a page lock order bug in the XFS seek hole/data implementation |
| LOW | | 4.7 | | CVE-2017-0630 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Information disclosure vulnerability in kernel trace subsystem |
| LOW | | 5.5 | | CVE-2017-13693 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ACPI operand cache leak in dsutils.c |
| LOW | | 5.5 | | CVE-2017-13694 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ACPI node and node_ext cache leak |
| LOW | | 5.9 | | CVE-2018-1121 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | procps: process hiding through race condition enumerating /proc |
| LOW | | 5.5 | | CVE-2018-12928 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NULL pointer dereference in hfs_ext_read_extent in hfs.ko |
| LOW | | 4.9 | | CVE-2018-17977 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Mishandled interactions among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets resulting in a d |
| LOW | | 2.5 | | CVE-2019-11191 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: race condition in load_aout_binary() allows local users to bypass ASLR on setuid a.out programs |
| LOW | | 5.7 | | CVE-2019-12378 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip6_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12379 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory leak in con_insert_unipair in drivers/tty/vt/consolemap.c |
| LOW | | 6.2 | | CVE-2019-12380 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory allocation failure in the efi subsystem leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12381 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12382 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12455 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c causing denial of service |
| LOW | | 7.8 | | CVE-2019-12456 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: double fetch in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c |
| LOW | | 4.1 | | CVE-2019-16229 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c |
| LOW | | 4.7 | | CVE-2019-16230 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/radeon/radeon_display.c |
| LOW | | 4.1 | | CVE-2019-16231 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c |
| LOW | | 4.1 | | CVE-2019-16232 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/wireless/marvell/libertas/if_sdio.c |
| LOW | | 4.1 | | CVE-2019-16233 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c |
| LOW | | 4.7 | | CVE-2019-16234 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/net/wireless/intel/iwlwifi/pcie/trans.c |
| LOW | | 7.5 | | CVE-2019-19070 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: A memory leak in the spi_gpio_probe() function in drivers/spi/spi-gpio.c allows for a DoS |
| LOW | | 7.8 | | CVE-2019-19378 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in index_rbio_pages in fs/btrfs/raid56.c |
| LOW | | 7.8 | | CVE-2020-11725 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: improper handling of private_size*count multiplication due to count=info->owner typo |
| LOW | | 3.4 | | CVE-2020-35501 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: audit not logging access to syscall open_by_handle_at for users with CAP_DAC_READ_SEARCH capability |
| LOW | | 7.8 | | CVE-2021-26934 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel 4.18 through 5.10.16, as u ... |
| LOW | | 5.9 | | CVE-2021-3714 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Remote Page Deduplication Attacks |
| LOW | | 7.5 | | CVE-2022-0400 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Out of bounds read in the smc protocol stack |
| LOW | | 7.8 | | CVE-2022-1247 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: A race condition bug in rose_connect() |
| LOW | | 7.8 | | CVE-2022-25265 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Executable Space Protection Bypass |
| LOW | | 7 | | CVE-2022-2961 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: race condition in rose_bind() |
| LOW | | 7.8 | | CVE-2022-3238 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs3 local privledge escalation if NTFS character set and remount and umount called simultaneously |
| LOW | | 4.2 | | CVE-2022-41848 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Race condition between mgslpc_ioctl and mgslpc_detach |
| LOW | | 6.4 | | CVE-2022-44032 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: Race between cmm_open() and cm4000_detach() result in UAF |
| LOW | | 6.4 | | CVE-2022-44033 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: A race condition between cm4040_open() and reader_detach() may result in UAF |
| LOW | | 5.5 | | CVE-2022-4543 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KASLR Prefetch Bypass Breaks KPTI |
| LOW | | 7 | | CVE-2022-45884 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_register_device() |
| LOW | | 7 | | CVE-2022-45885 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_frontend.c |
| LOW | | 6.4 | | CVE-2023-23039 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tty: vcc: race condition leading to use-after-free in vcc_open() |
| LOW | | 7.8 | | CVE-2023-26242 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: kernel: fpga: dfl-afu: integer overflow in afu_mmio_region_get_by_offset() |
| LOW | | 5.5 | | CVE-2023-31081 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | An issue was discovered in drivers/media/test-drivers/vidtv/vidtv_brid ... |
| LOW | | 5.5 | | CVE-2023-31085 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: divide-by-zero error in ctrl_cdev_ioctl when do_div happens and erasesize is 0 |
| LOW | | 7.8 | | CVE-2023-3640 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and pref |
| LOW | | 6.5 | | CVE-2024-0564 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: max page sharing of Kernel Samepage Merging (KSM) may cause memory deduplication |
| LOW | | | | CVE-2025-40065 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Write hgatp register with valid mode bits |
| LOW | | 5.5 | | CVE-2025-40086 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds |
| LOW | | | | CVE-2025-40136 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: crypto: hisilicon/qm - request reserved interrupt for virtual function |
| LOW | | 5.5 | | CVE-2025-68193 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Add devm release action to safely tear down CT |
| LOW | | 5.5 | | CVE-2025-68359 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix double free of qgroup record after failure to add delayed ref head |
| LOW | | | | CVE-2025-68376 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: ETR: Fix ETR buffer use-after-free issue |
| LOW | | 3.3 | | CVE-2025-68751 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/fpu: Fix false-positive kmsan report in fpu_vstl() |
| LOW | | | | CVE-2025-68755 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: staging: most: remove broken i2c driver |
| LOW | | | | CVE-2026-31536 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: server: let send_done handle a completion without IB_SEND_SIGNALED |
| LOW | | | | CVE-2026-43263 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix Null reference while testing fluster |
| LOW | | | | CVE-2026-45956 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() |
| LOW | | | | CVE-2026-46175 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by FGGC of node block |
| LOW | | | | CVE-2026-52983 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: fix BQL imbalance in TX path |
| LOW | | | | CVE-2026-53024 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free if write is called after disconnect |
| LOW | | | | CVE-2026-53025 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free on cdev close |
| LOW | | 5.5 | | CVE-2026-53284 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: only release the dirty pages io tree after successful writes |
| LOW | | | | CVE-2026-53368 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage |
| LOW | | | | CVE-2026-63825 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gcov: use atomic counter updates to fix concurrent access crashes |
| LOW | | 5.5 | | CVE-2026-64388 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix chown/chgrp with SMB3 POSIX Extensions |
| LOW | | 5.5 | | CVE-2026-64513 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Unconditionally recompute CR8 intercept on PPR update |
| LOW | | 4.7 | | CVE-2026-68081 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state |
| LOW | | 5.5 | | CVE-2026-68105 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Fix kernel panic during driver load failure |
| LOW | | 5.5 | | CVE-2026-68238 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Release VFCT ACPI table reference |
| LOW | | 5.5 | | CVE-2026-68241 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/mst: limit DP MST ESI service loop |
| LOW | | 5.5 | | CVE-2026-68375 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Handle partially initialized auxiliary devices |
| LOW | | 5.5 | | CVE-2026-68412 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() |
| LOW | | 5.5 | | CVE-2026-68418 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Prevent user-triggered null deref on QP create |
| LOW | | 5.5 | | CVE-2026-68436 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: use kvzalloc to allocate struct dc |
| LOW | | 5.5 | | CVE-2026-72009 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI |
| LOW | | 5.5 | | CVE-2026-72031 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD |
| LOW | | 5.5 | | CVE-2026-72321 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() |
| LOW | | 5.5 | | CVE-2026-72366 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_create_write_req() to handle async cache object creation |
| LOW | | 5.5 | | CVE-2026-72439 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid10: fix writes_pending leak on write request failures |
| LOW | | 5.5 | | CVE-2026-72494 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Replace waitqueue and flag with completion |
| LOW | | 5.5 | | CVE-2026-72497 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Add a max slot check for SQ |
| LOW | | 5.5 | | CVE-2026-74261 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: avoid stale FIFO cells during resize |
| LOW | | 5.5 | | CVE-2026-74338 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject sleepable BPF_LSM_CGROUP programs at load time |
| LOW | | 5.5 | | CVE-2026-74373 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix bio accounting for split md cloned bios |
| LOW | | 5.5 | | CVE-2026-74374 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix error-path detection with md_cloned_bio() |
| LOW | | 5.5 | | CVE-2026-74375 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix deadlock in read error recovery path |
| LOW | | 5.5 | | CVE-2026-74558 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: reclaim invalid Tx descriptors in ZC batch path |
| LOW | | 5.5 | | CVE-2026-74559 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: drain continuation descs after overflow in xsk_build_skb() |
| LOW | | 5.5 | | CVE-2026-74560 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx |
| LOW | | 5.5 | | CVE-2026-74571 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: skip global block reserve accounting for rescue mounts |
| LOW | | | | CVE-2026-74690 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| LOW | | 5.5 | | CVE-2026-74728 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: handle NULL b_addr in xfs_buf_free |
| LOW | | 5.5 | | CVE-2026-74733 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock |
| LOW | | 5.5 | | CVE-2026-74734 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firewire: ohci: fix NULL pointer dereference in ar_context_release |
| LOW | | 5.5 | | CVE-2026-74754 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: core: pair EH runtime PM get and put |
| LOW | | 5.5 | | CVE-2026-80581 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout |
| LOW | | 5.5 | | CVE-2026-80607 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg |
| LOW | | 5.5 | | CVE-2026-80616 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() |
| LOW | | 5.5 | | CVE-2026-80643 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: EDAC/igen6: Fix call trace due to missing release() |
| LOW | | 5.5 | | CVE-2026-80653 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: hisi_sas: Add slave_destroy interface for v3 hw |
| LOW | | 5.5 | | CVE-2026-80705 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: check if dml21_add_phantom_plane() is successful |
| LOW | | | | CVE-2026-80738 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| LOW | | | | CVE-2026-80747 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| LOW | | | | CVE-2026-80785 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| LOW | | 5.5 | | CVE-2026-80786 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: Wrap user-invoked calls to fb_set_var() in helper |
| LOW | | 5.5 | | CVE-2026-80866 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tipc: avoid busy looping in tipc_exit_net() |
| LOW | | | | CVE-2026-80872 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | 5.5 | | CVE-2026-80884 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntb: Store original DMA address for future release |
| LOW | | | | CVE-2026-80899 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: e ... |
| LOW | | 5.5 | | CVE-2026-80948 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() |
| LOW | | 5.5 | | CVE-2026-89601 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext2: Fix lost inode updates for IS_SYNC inodes |
| LOW | | 5.5 | | CVE-2026-89808 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram |
| LOW | | 5.5 | | CVE-2026-89812 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the MES ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89813 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the KIQ ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89862 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Fix BSG job leak on validate flash image error path |
| LOW | | 5.5 | | CVE-2026-90084 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-vf: fix workqueue and netdev race in probe/remove |
| LOW | | 5.4 | | CVE-2026-90086 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: honor XDP_TX_METADATA in zero-copy path |
| LOW | | 5.5 | | CVE-2026-90097 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition |
| LOW | | 5.5 | | CVE-2026-90144 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dpll: fix NULL deref in dpll_device_ops() during teardown race |
| LOW | | 5.5 | | CVE-2026-90182 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-iocost: clear delay state when freeing policy data |
| LOW | | 5.5 | | CVE-2026-90183 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-iolatency: clear delay state when freeing policy data |
| LOW | | 6.1 | | CVE-2026-90211 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf, s390: Clear fetch destination on faulting arena atomic |
| LOW | | 5.5 | | CVE-2026-90261 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: flush active metadata block group at btree_writepages() start |
| LOW | | 5.5 | | CVE-2026-90267 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails |
| LOW | | 5.5 | | CVE-2026-90306 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ARM: 9481/2: breakpoint: CFI breakpoints only on demand |
| LOW | | 5.5 | | CVE-2026-90311 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: thermal: hwmon: Remove hwmon class device along with its parent |
| LOW | | 5.5 | | CVE-2026-90330 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: HID: logitech-hidpp: Fix FF device cleanup on init failure |
| LOW | | 5.5 | | CVE-2026-90335 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tty: skip cdev_del() when no cdev is registered |
| LOW | | 5.5 | | CVE-2026-90346 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: nl80211: clean up color-change beacon data on errors |
| LOW | | 5.5 | | CVE-2026-90424 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path |
| LOW | | 5.5 | | CVE-2026-92493 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active |
| LOW | | 5.5 | | CVE-2026-93116 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: asus-wmi: fix resource leaks on probe failure |
| LOW | | 6.7 | | CVE-2026-93125 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max |
| LOW | | 5.5 | | CVE-2026-93129 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: dell-wmi-base: Fix handling of ultra performance key |
| LOW | | 6.7 | | CVE-2026-93144 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject writes through untrusted BTF pointers |
| LOW | | 5.5 | | CVE-2026-93146 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: time/namespace: Validate nanosecond field in proc_timens_set_offset() |
| LOW | | 5.5 | | CVE-2026-93181 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel/uncore: Fix uncore_box ref/unref ordering |
| LOW | | 5.5 | | CVE-2026-93202 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: Fix recursive locking during device registration |
| LOW | | 5.5 | | CVE-2026-93216 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() |
| LOW | | 5.5 | | CVE-2026-93230 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier |
| LOW | | | | CVE-2026-93237 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| LOW | | | | CVE-2026-93251 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | | | CVE-2026-93260 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| LOW | | 5.5 | | CVE-2026-97424 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq |
| LOW | | 5.5 | | CVE-2026-97477 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() |
| LOW | | 5.5 | | CVE-2026-97479 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: driver core: Avoid warning when removing a device while its supplier is unbinding |
| LOW | | 5.5 | | CVE-2026-97480 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tty: serial: 8250: protect against NULL uart->port.dev in register |
| LOW | | 5.5 | | CVE-2026-97501 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction |
| LOW | | 5.5 | | CVE-2026-97503 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: genirq/proc: Size interrupt directory names for 10-digit interrupt numbers |
| LOW | | 5.5 | | CVE-2026-97928 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip the VMID 0 flush for VRAM |
| LOW | | 5.5 | | CVE-2026-97989 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vduse: validate virtqueue alignment |
| LOW | | 5.5 | | CVE-2026-97997 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio_ring: fix stale descriptor flags after a failed packed add |
| LOW | | 5.5 | | CVE-2026-98003 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/amd: Do not reallocate GA log buffers on resume |
| LOW | | 5.5 | | CVE-2026-98038 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Keep refcount_acquire nullable for borrowed RCU kptrs |
| LOW | | 5.5 | | CVE-2026-98044 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject legacy packet loads from callbacks |
| LOW | | 5.5 | | CVE-2026-98058 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark syscall helpers as sleepable |
| LOW | | 5.5 | | CVE-2026-98067 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: erofs: disable LZ4 rolling decompression for now |
| LOW | | 5.5 | | CVE-2026-98073 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: Remove conflicting altnames for dying netns in __dev_change_net_namespace() |
| LOW | | 5.5 | | CVE-2026-98079 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zstd: fix lost wakeup when waiting for a workspace |
| LOW | | 5.5 | | CVE-2026-98087 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate |
| LOW | | 5.5 | | CVE-2026-98119 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: break unbuffered write when netfs_alloc_subrequest() fails |
| LOW | | 5.5 | | CVE-2026-98147 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: printk: Don't WARN on kthread_run failure |
| LOW | | 5.5 | | CVE-2026-98148 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/gud: validate GUD_ROTATION_0 is present in supported rotations |
| LOW | | 7 | | CVE-2026-98176 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| LOW | | 5.5 | | CVE-2026-98177 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow in EOP ring size calculation |
| LOW | | 5.5 | | CVE-2026-98285 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| LOW | | 5.5 | | CVE-2026-98289 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: af_unix: Unify scc_index when finalising SCC in __unix_walk_scc() |
| LOW | | 5.5 | | CVE-2026-98304 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: bcmgenet: restore the hardware filters on open |
| LOW | | 5.5 | | CVE-2026-98317 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS |
| LOW | | 5.5 | | CVE-2026-98321 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_nat: unregister and release hooks on error |
| LOW | | 5.5 | | CVE-2026-98332 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: only operate on TDLS peers in the TDLS code |
| LOW | | 5.5 | | CVE-2026-98338 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: ibss: ref BSS entry for joined event |
| LOW | | 5.5 | | CVE-2026-98389 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip gfx switch_power_profile during GPU reset |
| LOW | | 5.5 | | CVE-2026-98393 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU |
| LOW | | 5.5 | | CVE-2026-98424 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: undo netns switch if renaming the wiphy fails |
| LOW | | 5.5 | | CVE-2026-98427 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: codel: bound the dropping loop per dequeue call |
| LOW | | 5.5 | | CVE-2026-98431 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency |
| LOW | | 3.3 | | CVE-2026-98551 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/core: Fill branch entries with a single assignment |
| LOW | | 2.3 | | CVE-2026-98628 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Make post-verification instruction rewrites killable |
| LOW | | 2.5 | | CVE-2026-98682 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: drain and invalidate before server-side copy/clone |
| LOW | | 2.5 | | CVE-2026-98683 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush dirty data before zeroing a range |
| LOW | | 2.5 | | CVE-2026-98684 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush and commit data before querying allocated ranges |
| LOW | | 3.3 | | CVE-2026-98685 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: discard post-EOF pagecache when extending a file via clone range |
| LOW | | 3.7 | | CVE-2026-98802 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: seg6: ensure packet data is writable before modifying SRH and IPv6 DA |
| LOW | | | | TEMP-0000000-F7A20F | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | [Kernel: Unprivileged user can freeze journald] |
| LOW | | 5 | | CVE-2004-0230 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | TCP, when using a large Window Size, makes it easier for remote attack ... |
| LOW | | 4.9 | | CVE-2005-3660 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | Linux kernel 2.4 and 2.6 allows attackers to cause a denial of service ... |
| LOW | | 2.1 | | CVE-2007-3719 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: secretly Monopolizing the CPU Without Superuser Privileges |
| LOW | | 5.5 | | CVE-2008-2544 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mounting proc readonly on a different mount point silently mounts it rw if the /proc mount is rw |
| LOW | | 7.1 | | CVE-2008-4609 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: TCP protocol vulnerabilities from Outpost24 |
| LOW | | 5 | | CVE-2010-4563 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv6: sniffer detection |
| LOW | | 4.3 | | CVE-2010-5321 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: v4l: videobuf: hotfix a bug on multiple calls to mmap() |
| LOW | | 5.5 | | CVE-2011-4915 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | fs/proc/base.c in the Linux kernel through 3.1 allows local users to o ... |
| LOW | | 5.5 | | CVE-2011-4916 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | Linux kernel through 3.1 allows local users to obtain sensitive keystr ... |
| LOW | | 5.5 | | CVE-2011-4917 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel through 3.1 there is an information disclosure iss ... |
| LOW | | 4.9 | | CVE-2012-4542 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: block: default SCSI command filter does not accomodate commands overlap across device classes |
| LOW | | 5.5 | | CVE-2014-9892 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | The snd_compr_tstamp function in sound/core/compress_offload.c in the ... |
| LOW | | 7.5 | | CVE-2014-9900 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Info leak in uninitialized structure ethtool_wolinfo in ethtool_get_wol() |
| LOW | | 3.3 | | CVE-2015-2877 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: Cross-VM ASL INtrospection (CAIN) |
| LOW | | 5.5 | | CVE-2016-10723 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel through 4.17.2. Since the ... |
| LOW | | 5.5 | | CVE-2016-8660 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: local DoS due to a page lock order bug in the XFS seek hole/data implementation |
| LOW | | 4.7 | | CVE-2017-0630 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Information disclosure vulnerability in kernel trace subsystem |
| LOW | | 5.5 | | CVE-2017-13693 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ACPI operand cache leak in dsutils.c |
| LOW | | 5.5 | | CVE-2017-13694 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ACPI node and node_ext cache leak |
| LOW | | 5.9 | | CVE-2018-1121 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | procps: process hiding through race condition enumerating /proc |
| LOW | | 5.5 | | CVE-2018-12928 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: NULL pointer dereference in hfs_ext_read_extent in hfs.ko |
| LOW | | 4.9 | | CVE-2018-17977 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Mishandled interactions among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets resulting in a d |
| LOW | | 2.5 | | CVE-2019-11191 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: race condition in load_aout_binary() allows local users to bypass ASLR on setuid a.out programs |
| LOW | | 5.7 | | CVE-2019-12378 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip6_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12379 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory leak in con_insert_unipair in drivers/tty/vt/consolemap.c |
| LOW | | 6.2 | | CVE-2019-12380 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: memory allocation failure in the efi subsystem leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12381 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12382 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12455 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c causing denial of service |
| LOW | | 7.8 | | CVE-2019-12456 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: double fetch in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c |
| LOW | | 4.1 | | CVE-2019-16229 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c |
| LOW | | 4.7 | | CVE-2019-16230 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/radeon/radeon_display.c |
| LOW | | 4.1 | | CVE-2019-16231 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c |
| LOW | | 4.1 | | CVE-2019-16232 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/wireless/marvell/libertas/if_sdio.c |
| LOW | | 4.1 | | CVE-2019-16233 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c |
| LOW | | 4.7 | | CVE-2019-16234 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/net/wireless/intel/iwlwifi/pcie/trans.c |
| LOW | | 7.5 | | CVE-2019-19070 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: A memory leak in the spi_gpio_probe() function in drivers/spi/spi-gpio.c allows for a DoS |
| LOW | | 7.8 | | CVE-2019-19378 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in index_rbio_pages in fs/btrfs/raid56.c |
| LOW | | 7.8 | | CVE-2020-11725 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: improper handling of private_size*count multiplication due to count=info->owner typo |
| LOW | | 3.4 | | CVE-2020-35501 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: audit not logging access to syscall open_by_handle_at for users with CAP_DAC_READ_SEARCH capability |
| LOW | | 7.8 | | CVE-2021-26934 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel 4.18 through 5.10.16, as u ... |
| LOW | | 5.9 | | CVE-2021-3714 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Remote Page Deduplication Attacks |
| LOW | | 7.5 | | CVE-2022-0400 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Out of bounds read in the smc protocol stack |
| LOW | | 7.8 | | CVE-2022-1247 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: A race condition bug in rose_connect() |
| LOW | | 7.8 | | CVE-2022-25265 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Executable Space Protection Bypass |
| LOW | | 7 | | CVE-2022-2961 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: race condition in rose_bind() |
| LOW | | 7.8 | | CVE-2022-3238 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntfs3 local privledge escalation if NTFS character set and remount and umount called simultaneously |
| LOW | | 4.2 | | CVE-2022-41848 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Race condition between mgslpc_ioctl and mgslpc_detach |
| LOW | | 6.4 | | CVE-2022-44032 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: Race between cmm_open() and cm4000_detach() result in UAF |
| LOW | | 6.4 | | CVE-2022-44033 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: A race condition between cm4040_open() and reader_detach() may result in UAF |
| LOW | | 5.5 | | CVE-2022-4543 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KASLR Prefetch Bypass Breaks KPTI |
| LOW | | 7 | | CVE-2022-45884 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_register_device() |
| LOW | | 7 | | CVE-2022-45885 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_frontend.c |
| LOW | | 6.4 | | CVE-2023-23039 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tty: vcc: race condition leading to use-after-free in vcc_open() |
| LOW | | 7.8 | | CVE-2023-26242 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: kernel: fpga: dfl-afu: integer overflow in afu_mmio_region_get_by_offset() |
| LOW | | 5.5 | | CVE-2023-31081 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | An issue was discovered in drivers/media/test-drivers/vidtv/vidtv_brid ... |
| LOW | | 5.5 | | CVE-2023-31085 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: divide-by-zero error in ctrl_cdev_ioctl when do_div happens and erasesize is 0 |
| LOW | | 7.8 | | CVE-2023-3640 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and pref |
| LOW | | 6.5 | | CVE-2024-0564 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: max page sharing of Kernel Samepage Merging (KSM) may cause memory deduplication |
| LOW | | | | CVE-2025-40065 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Write hgatp register with valid mode bits |
| LOW | | 5.5 | | CVE-2025-40086 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds |
| LOW | | | | CVE-2025-40136 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: crypto: hisilicon/qm - request reserved interrupt for virtual function |
| LOW | | 5.5 | | CVE-2025-68193 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Add devm release action to safely tear down CT |
| LOW | | 5.5 | | CVE-2025-68359 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix double free of qgroup record after failure to add delayed ref head |
| LOW | | | | CVE-2025-68376 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: coresight: ETR: Fix ETR buffer use-after-free issue |
| LOW | | 3.3 | | CVE-2025-68751 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: s390/fpu: Fix false-positive kmsan report in fpu_vstl() |
| LOW | | | | CVE-2025-68755 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: staging: most: remove broken i2c driver |
| LOW | | | | CVE-2026-31536 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: server: let send_done handle a completion without IB_SEND_SIGNALED |
| LOW | | | | CVE-2026-43263 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix Null reference while testing fluster |
| LOW | | | | CVE-2026-45956 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() |
| LOW | | | | CVE-2026-46175 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by FGGC of node block |
| LOW | | | | CVE-2026-52983 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: fix BQL imbalance in TX path |
| LOW | | | | CVE-2026-53024 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free if write is called after disconnect |
| LOW | | | | CVE-2026-53025 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free on cdev close |
| LOW | | 5.5 | | CVE-2026-53284 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: only release the dirty pages io tree after successful writes |
| LOW | | | | CVE-2026-53368 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage |
| LOW | | | | CVE-2026-63825 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gcov: use atomic counter updates to fix concurrent access crashes |
| LOW | | 5.5 | | CVE-2026-64388 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix chown/chgrp with SMB3 POSIX Extensions |
| LOW | | 5.5 | | CVE-2026-64513 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Unconditionally recompute CR8 intercept on PPR update |
| LOW | | 4.7 | | CVE-2026-68081 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state |
| LOW | | 5.5 | | CVE-2026-68105 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Fix kernel panic during driver load failure |
| LOW | | 5.5 | | CVE-2026-68238 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Release VFCT ACPI table reference |
| LOW | | 5.5 | | CVE-2026-68241 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/mst: limit DP MST ESI service loop |
| LOW | | 5.5 | | CVE-2026-68375 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Handle partially initialized auxiliary devices |
| LOW | | 5.5 | | CVE-2026-68412 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() |
| LOW | | 5.5 | | CVE-2026-68418 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Prevent user-triggered null deref on QP create |
| LOW | | 5.5 | | CVE-2026-68436 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: use kvzalloc to allocate struct dc |
| LOW | | 5.5 | | CVE-2026-72009 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI |
| LOW | | 5.5 | | CVE-2026-72031 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD |
| LOW | | 5.5 | | CVE-2026-72321 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() |
| LOW | | 5.5 | | CVE-2026-72366 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_create_write_req() to handle async cache object creation |
| LOW | | 5.5 | | CVE-2026-72439 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid10: fix writes_pending leak on write request failures |
| LOW | | 5.5 | | CVE-2026-72494 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Replace waitqueue and flag with completion |
| LOW | | 5.5 | | CVE-2026-72497 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Add a max slot check for SQ |
| LOW | | 5.5 | | CVE-2026-74261 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: avoid stale FIFO cells during resize |
| LOW | | 5.5 | | CVE-2026-74338 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject sleepable BPF_LSM_CGROUP programs at load time |
| LOW | | 5.5 | | CVE-2026-74373 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix bio accounting for split md cloned bios |
| LOW | | 5.5 | | CVE-2026-74374 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix error-path detection with md_cloned_bio() |
| LOW | | 5.5 | | CVE-2026-74375 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix deadlock in read error recovery path |
| LOW | | 5.5 | | CVE-2026-74558 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: reclaim invalid Tx descriptors in ZC batch path |
| LOW | | 5.5 | | CVE-2026-74559 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: drain continuation descs after overflow in xsk_build_skb() |
| LOW | | 5.5 | | CVE-2026-74560 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx |
| LOW | | 5.5 | | CVE-2026-74571 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: skip global block reserve accounting for rescue mounts |
| LOW | | | | CVE-2026-74690 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| LOW | | 5.5 | | CVE-2026-74728 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xfs: handle NULL b_addr in xfs_buf_free |
| LOW | | 5.5 | | CVE-2026-74733 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock |
| LOW | | 5.5 | | CVE-2026-74734 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: firewire: ohci: fix NULL pointer dereference in ar_context_release |
| LOW | | 5.5 | | CVE-2026-74754 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: core: pair EH runtime PM get and put |
| LOW | | 5.5 | | CVE-2026-80581 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout |
| LOW | | 5.5 | | CVE-2026-80607 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg |
| LOW | | 5.5 | | CVE-2026-80616 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() |
| LOW | | 5.5 | | CVE-2026-80643 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: EDAC/igen6: Fix call trace due to missing release() |
| LOW | | 5.5 | | CVE-2026-80653 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: hisi_sas: Add slave_destroy interface for v3 hw |
| LOW | | 5.5 | | CVE-2026-80705 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: check if dml21_add_phantom_plane() is successful |
| LOW | | | | CVE-2026-80738 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| LOW | | | | CVE-2026-80747 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| LOW | | | | CVE-2026-80785 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| LOW | | 5.5 | | CVE-2026-80786 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: fbdev: Wrap user-invoked calls to fb_set_var() in helper |
| LOW | | 5.5 | | CVE-2026-80866 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tipc: avoid busy looping in tipc_exit_net() |
| LOW | | | | CVE-2026-80872 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | 5.5 | | CVE-2026-80884 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ntb: Store original DMA address for future release |
| LOW | | | | CVE-2026-80899 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: e ... |
| LOW | | 5.5 | | CVE-2026-80948 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() |
| LOW | | 5.5 | | CVE-2026-89601 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ext2: Fix lost inode updates for IS_SYNC inodes |
| LOW | | 5.5 | | CVE-2026-89808 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram |
| LOW | | 5.5 | | CVE-2026-89812 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the MES ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89813 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the KIQ ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89862 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Fix BSG job leak on validate flash image error path |
| LOW | | 5.5 | | CVE-2026-90084 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-vf: fix workqueue and netdev race in probe/remove |
| LOW | | 5.4 | | CVE-2026-90086 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: xsk: honor XDP_TX_METADATA in zero-copy path |
| LOW | | 5.5 | | CVE-2026-90097 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition |
| LOW | | 5.5 | | CVE-2026-90144 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: dpll: fix NULL deref in dpll_device_ops() during teardown race |
| LOW | | 5.5 | | CVE-2026-90182 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-iocost: clear delay state when freeing policy data |
| LOW | | 5.5 | | CVE-2026-90183 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: blk-iolatency: clear delay state when freeing policy data |
| LOW | | 6.1 | | CVE-2026-90211 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf, s390: Clear fetch destination on faulting arena atomic |
| LOW | | 5.5 | | CVE-2026-90261 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: flush active metadata block group at btree_writepages() start |
| LOW | | 5.5 | | CVE-2026-90267 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails |
| LOW | | 5.5 | | CVE-2026-90306 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: ARM: 9481/2: breakpoint: CFI breakpoints only on demand |
| LOW | | 5.5 | | CVE-2026-90311 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: thermal: hwmon: Remove hwmon class device along with its parent |
| LOW | | 5.5 | | CVE-2026-90330 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: HID: logitech-hidpp: Fix FF device cleanup on init failure |
| LOW | | 5.5 | | CVE-2026-90335 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tty: skip cdev_del() when no cdev is registered |
| LOW | | 5.5 | | CVE-2026-90346 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: nl80211: clean up color-change beacon data on errors |
| LOW | | 5.5 | | CVE-2026-90424 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path |
| LOW | | 5.5 | | CVE-2026-92493 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active |
| LOW | | 5.5 | | CVE-2026-93116 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: asus-wmi: fix resource leaks on probe failure |
| LOW | | 6.7 | | CVE-2026-93125 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max |
| LOW | | 5.5 | | CVE-2026-93129 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: dell-wmi-base: Fix handling of ultra performance key |
| LOW | | 6.7 | | CVE-2026-93144 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject writes through untrusted BTF pointers |
| LOW | | 5.5 | | CVE-2026-93146 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: time/namespace: Validate nanosecond field in proc_timens_set_offset() |
| LOW | | 5.5 | | CVE-2026-93181 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel/uncore: Fix uncore_box ref/unref ordering |
| LOW | | 5.5 | | CVE-2026-93202 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: Fix recursive locking during device registration |
| LOW | | 5.5 | | CVE-2026-93216 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() |
| LOW | | 5.5 | | CVE-2026-93230 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier |
| LOW | | | | CVE-2026-93237 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| LOW | | | | CVE-2026-93251 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | | | CVE-2026-93260 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| LOW | | 5.5 | | CVE-2026-97424 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq |
| LOW | | 5.5 | | CVE-2026-97477 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() |
| LOW | | 5.5 | | CVE-2026-97479 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: driver core: Avoid warning when removing a device while its supplier is unbinding |
| LOW | | 5.5 | | CVE-2026-97480 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: tty: serial: 8250: protect against NULL uart->port.dev in register |
| LOW | | 5.5 | | CVE-2026-97501 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction |
| LOW | | 5.5 | | CVE-2026-97503 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: genirq/proc: Size interrupt directory names for 10-digit interrupt numbers |
| LOW | | 5.5 | | CVE-2026-97928 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip the VMID 0 flush for VRAM |
| LOW | | 5.5 | | CVE-2026-97989 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: vduse: validate virtqueue alignment |
| LOW | | 5.5 | | CVE-2026-97997 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: virtio_ring: fix stale descriptor flags after a failed packed add |
| LOW | | 5.5 | | CVE-2026-98003 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: iommu/amd: Do not reallocate GA log buffers on resume |
| LOW | | 5.5 | | CVE-2026-98038 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Keep refcount_acquire nullable for borrowed RCU kptrs |
| LOW | | 5.5 | | CVE-2026-98044 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject legacy packet loads from callbacks |
| LOW | | 5.5 | | CVE-2026-98058 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark syscall helpers as sleepable |
| LOW | | 5.5 | | CVE-2026-98067 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: erofs: disable LZ4 rolling decompression for now |
| LOW | | 5.5 | | CVE-2026-98073 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: Remove conflicting altnames for dying netns in __dev_change_net_namespace() |
| LOW | | 5.5 | | CVE-2026-98079 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zstd: fix lost wakeup when waiting for a workspace |
| LOW | | 5.5 | | CVE-2026-98087 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate |
| LOW | | 5.5 | | CVE-2026-98119 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfs: break unbuffered write when netfs_alloc_subrequest() fails |
| LOW | | 5.5 | | CVE-2026-98147 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: printk: Don't WARN on kthread_run failure |
| LOW | | 5.5 | | CVE-2026-98148 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/gud: validate GUD_ROTATION_0 is present in supported rotations |
| LOW | | 7 | | CVE-2026-98176 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| LOW | | 5.5 | | CVE-2026-98177 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow in EOP ring size calculation |
| LOW | | 5.5 | | CVE-2026-98285 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| LOW | | 5.5 | | CVE-2026-98289 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: af_unix: Unify scc_index when finalising SCC in __unix_walk_scc() |
| LOW | | 5.5 | | CVE-2026-98304 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: bcmgenet: restore the hardware filters on open |
| LOW | | 5.5 | | CVE-2026-98317 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS |
| LOW | | 5.5 | | CVE-2026-98321 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_nat: unregister and release hooks on error |
| LOW | | 5.5 | | CVE-2026-98332 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: only operate on TDLS peers in the TDLS code |
| LOW | | 5.5 | | CVE-2026-98338 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: ibss: ref BSS entry for joined event |
| LOW | | 5.5 | | CVE-2026-98389 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip gfx switch_power_profile during GPU reset |
| LOW | | 5.5 | | CVE-2026-98393 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU |
| LOW | | 5.5 | | CVE-2026-98424 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: undo netns switch if renaming the wiphy fails |
| LOW | | 5.5 | | CVE-2026-98427 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: net/sched: codel: bound the dropping loop per dequeue call |
| LOW | | 5.5 | | CVE-2026-98431 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency |
| LOW | | 3.3 | | CVE-2026-98551 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: perf/core: Fill branch entries with a single assignment |
| LOW | | 2.3 | | CVE-2026-98628 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: bpf: Make post-verification instruction rewrites killable |
| LOW | | 2.5 | | CVE-2026-98682 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: drain and invalidate before server-side copy/clone |
| LOW | | 2.5 | | CVE-2026-98683 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush dirty data before zeroing a range |
| LOW | | 2.5 | | CVE-2026-98684 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush and commit data before querying allocated ranges |
| LOW | | 3.3 | | CVE-2026-98685 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: smb: client: discard post-EOF pagecache when extending a file via clone range |
| LOW | | 3.7 | | CVE-2026-98802 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | kernel: seg6: ensure packet data is writable before modifying SRH and IPv6 DA |
| LOW | | | | TEMP-0000000-F7A20F | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | [Kernel: Unprivileged user can freeze journald] |
| LOW | | 5 | | CVE-2004-0230 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | TCP, when using a large Window Size, makes it easier for remote attack ... |
| LOW | | 4.9 | | CVE-2005-3660 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | Linux kernel 2.4 and 2.6 allows attackers to cause a denial of service ... |
| LOW | | 2.1 | | CVE-2007-3719 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: secretly Monopolizing the CPU Without Superuser Privileges |
| LOW | | 5.5 | | CVE-2008-2544 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mounting proc readonly on a different mount point silently mounts it rw if the /proc mount is rw |
| LOW | | 7.1 | | CVE-2008-4609 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: TCP protocol vulnerabilities from Outpost24 |
| LOW | | 5 | | CVE-2010-4563 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv6: sniffer detection |
| LOW | | 4.3 | | CVE-2010-5321 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: v4l: videobuf: hotfix a bug on multiple calls to mmap() |
| LOW | | 5.5 | | CVE-2011-4915 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | fs/proc/base.c in the Linux kernel through 3.1 allows local users to o ... |
| LOW | | 5.5 | | CVE-2011-4916 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | Linux kernel through 3.1 allows local users to obtain sensitive keystr ... |
| LOW | | 5.5 | | CVE-2011-4917 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel through 3.1 there is an information disclosure iss ... |
| LOW | | 4.9 | | CVE-2012-4542 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: block: default SCSI command filter does not accomodate commands overlap across device classes |
| LOW | | 5.5 | | CVE-2014-9892 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | The snd_compr_tstamp function in sound/core/compress_offload.c in the ... |
| LOW | | 7.5 | | CVE-2014-9900 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Info leak in uninitialized structure ethtool_wolinfo in ethtool_get_wol() |
| LOW | | 3.3 | | CVE-2015-2877 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: Cross-VM ASL INtrospection (CAIN) |
| LOW | | 5.5 | | CVE-2016-10723 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel through 4.17.2. Since the ... |
| LOW | | 5.5 | | CVE-2016-8660 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: local DoS due to a page lock order bug in the XFS seek hole/data implementation |
| LOW | | 4.7 | | CVE-2017-0630 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Information disclosure vulnerability in kernel trace subsystem |
| LOW | | 5.5 | | CVE-2017-13693 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ACPI operand cache leak in dsutils.c |
| LOW | | 5.5 | | CVE-2017-13694 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ACPI node and node_ext cache leak |
| LOW | | 5.9 | | CVE-2018-1121 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | procps: process hiding through race condition enumerating /proc |
| LOW | | 5.5 | | CVE-2018-12928 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: NULL pointer dereference in hfs_ext_read_extent in hfs.ko |
| LOW | | 4.9 | | CVE-2018-17977 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Mishandled interactions among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets resulting in a d |
| LOW | | 2.5 | | CVE-2019-11191 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: race condition in load_aout_binary() allows local users to bypass ASLR on setuid a.out programs |
| LOW | | 5.7 | | CVE-2019-12378 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip6_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12379 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory leak in con_insert_unipair in drivers/tty/vt/consolemap.c |
| LOW | | 6.2 | | CVE-2019-12380 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: memory allocation failure in the efi subsystem leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12381 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12382 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12455 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c causing denial of service |
| LOW | | 7.8 | | CVE-2019-12456 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: double fetch in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c |
| LOW | | 4.1 | | CVE-2019-16229 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c |
| LOW | | 4.7 | | CVE-2019-16230 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/radeon/radeon_display.c |
| LOW | | 4.1 | | CVE-2019-16231 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c |
| LOW | | 4.1 | | CVE-2019-16232 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/wireless/marvell/libertas/if_sdio.c |
| LOW | | 4.1 | | CVE-2019-16233 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c |
| LOW | | 4.7 | | CVE-2019-16234 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/net/wireless/intel/iwlwifi/pcie/trans.c |
| LOW | | 7.5 | | CVE-2019-19070 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: A memory leak in the spi_gpio_probe() function in drivers/spi/spi-gpio.c allows for a DoS |
| LOW | | 7.8 | | CVE-2019-19378 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in index_rbio_pages in fs/btrfs/raid56.c |
| LOW | | 7.8 | | CVE-2020-11725 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: improper handling of private_size*count multiplication due to count=info->owner typo |
| LOW | | 3.4 | | CVE-2020-35501 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: audit not logging access to syscall open_by_handle_at for users with CAP_DAC_READ_SEARCH capability |
| LOW | | 7.8 | | CVE-2021-26934 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel 4.18 through 5.10.16, as u ... |
| LOW | | 5.9 | | CVE-2021-3714 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Remote Page Deduplication Attacks |
| LOW | | 7.5 | | CVE-2022-0400 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Out of bounds read in the smc protocol stack |
| LOW | | 7.8 | | CVE-2022-1247 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: A race condition bug in rose_connect() |
| LOW | | 7.8 | | CVE-2022-25265 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Executable Space Protection Bypass |
| LOW | | 7 | | CVE-2022-2961 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: race condition in rose_bind() |
| LOW | | 7.8 | | CVE-2022-3238 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntfs3 local privledge escalation if NTFS character set and remount and umount called simultaneously |
| LOW | | 4.2 | | CVE-2022-41848 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Race condition between mgslpc_ioctl and mgslpc_detach |
| LOW | | 6.4 | | CVE-2022-44032 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: Race between cmm_open() and cm4000_detach() result in UAF |
| LOW | | 6.4 | | CVE-2022-44033 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: A race condition between cm4040_open() and reader_detach() may result in UAF |
| LOW | | 5.5 | | CVE-2022-4543 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KASLR Prefetch Bypass Breaks KPTI |
| LOW | | 7 | | CVE-2022-45884 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_register_device() |
| LOW | | 7 | | CVE-2022-45885 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_frontend.c |
| LOW | | 6.4 | | CVE-2023-23039 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tty: vcc: race condition leading to use-after-free in vcc_open() |
| LOW | | 7.8 | | CVE-2023-26242 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: kernel: fpga: dfl-afu: integer overflow in afu_mmio_region_get_by_offset() |
| LOW | | 5.5 | | CVE-2023-31081 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | An issue was discovered in drivers/media/test-drivers/vidtv/vidtv_brid ... |
| LOW | | 5.5 | | CVE-2023-31085 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: divide-by-zero error in ctrl_cdev_ioctl when do_div happens and erasesize is 0 |
| LOW | | 7.8 | | CVE-2023-3640 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and pref |
| LOW | | 6.5 | | CVE-2024-0564 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: max page sharing of Kernel Samepage Merging (KSM) may cause memory deduplication |
| LOW | | | | CVE-2025-40065 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Write hgatp register with valid mode bits |
| LOW | | 5.5 | | CVE-2025-40086 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds |
| LOW | | | | CVE-2025-40136 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: crypto: hisilicon/qm - request reserved interrupt for virtual function |
| LOW | | 5.5 | | CVE-2025-68193 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Add devm release action to safely tear down CT |
| LOW | | 5.5 | | CVE-2025-68359 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix double free of qgroup record after failure to add delayed ref head |
| LOW | | | | CVE-2025-68376 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: coresight: ETR: Fix ETR buffer use-after-free issue |
| LOW | | 3.3 | | CVE-2025-68751 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: s390/fpu: Fix false-positive kmsan report in fpu_vstl() |
| LOW | | | | CVE-2025-68755 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: staging: most: remove broken i2c driver |
| LOW | | | | CVE-2026-31536 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: server: let send_done handle a completion without IB_SEND_SIGNALED |
| LOW | | | | CVE-2026-43263 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix Null reference while testing fluster |
| LOW | | | | CVE-2026-45956 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() |
| LOW | | | | CVE-2026-46175 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by FGGC of node block |
| LOW | | | | CVE-2026-52983 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: airoha: fix BQL imbalance in TX path |
| LOW | | | | CVE-2026-53024 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free if write is called after disconnect |
| LOW | | | | CVE-2026-53025 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free on cdev close |
| LOW | | 5.5 | | CVE-2026-53284 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: only release the dirty pages io tree after successful writes |
| LOW | | | | CVE-2026-53368 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage |
| LOW | | | | CVE-2026-63825 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gcov: use atomic counter updates to fix concurrent access crashes |
| LOW | | 5.5 | | CVE-2026-64388 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix chown/chgrp with SMB3 POSIX Extensions |
| LOW | | 5.5 | | CVE-2026-64513 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Unconditionally recompute CR8 intercept on PPR update |
| LOW | | 4.7 | | CVE-2026-68081 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state |
| LOW | | 5.5 | | CVE-2026-68105 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Fix kernel panic during driver load failure |
| LOW | | 5.5 | | CVE-2026-68238 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Release VFCT ACPI table reference |
| LOW | | 5.5 | | CVE-2026-68241 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/i915/mst: limit DP MST ESI service loop |
| LOW | | 5.5 | | CVE-2026-68375 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Handle partially initialized auxiliary devices |
| LOW | | 5.5 | | CVE-2026-68412 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() |
| LOW | | 5.5 | | CVE-2026-68418 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Prevent user-triggered null deref on QP create |
| LOW | | 5.5 | | CVE-2026-68436 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: use kvzalloc to allocate struct dc |
| LOW | | 5.5 | | CVE-2026-72009 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI |
| LOW | | 5.5 | | CVE-2026-72031 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD |
| LOW | | 5.5 | | CVE-2026-72321 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() |
| LOW | | 5.5 | | CVE-2026-72366 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_create_write_req() to handle async cache object creation |
| LOW | | 5.5 | | CVE-2026-72439 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid10: fix writes_pending leak on write request failures |
| LOW | | 5.5 | | CVE-2026-72494 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Replace waitqueue and flag with completion |
| LOW | | 5.5 | | CVE-2026-72497 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Add a max slot check for SQ |
| LOW | | 5.5 | | CVE-2026-74261 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: avoid stale FIFO cells during resize |
| LOW | | 5.5 | | CVE-2026-74338 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject sleepable BPF_LSM_CGROUP programs at load time |
| LOW | | 5.5 | | CVE-2026-74373 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix bio accounting for split md cloned bios |
| LOW | | 5.5 | | CVE-2026-74374 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix error-path detection with md_cloned_bio() |
| LOW | | 5.5 | | CVE-2026-74375 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix deadlock in read error recovery path |
| LOW | | 5.5 | | CVE-2026-74558 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: reclaim invalid Tx descriptors in ZC batch path |
| LOW | | 5.5 | | CVE-2026-74559 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: drain continuation descs after overflow in xsk_build_skb() |
| LOW | | 5.5 | | CVE-2026-74560 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx |
| LOW | | 5.5 | | CVE-2026-74571 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: skip global block reserve accounting for rescue mounts |
| LOW | | | | CVE-2026-74690 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| LOW | | 5.5 | | CVE-2026-74728 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xfs: handle NULL b_addr in xfs_buf_free |
| LOW | | 5.5 | | CVE-2026-74733 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock |
| LOW | | 5.5 | | CVE-2026-74734 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: firewire: ohci: fix NULL pointer dereference in ar_context_release |
| LOW | | 5.5 | | CVE-2026-74754 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: core: pair EH runtime PM get and put |
| LOW | | 5.5 | | CVE-2026-80581 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout |
| LOW | | 5.5 | | CVE-2026-80607 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg |
| LOW | | 5.5 | | CVE-2026-80616 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() |
| LOW | | 5.5 | | CVE-2026-80643 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: EDAC/igen6: Fix call trace due to missing release() |
| LOW | | 5.5 | | CVE-2026-80653 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: hisi_sas: Add slave_destroy interface for v3 hw |
| LOW | | 5.5 | | CVE-2026-80705 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: check if dml21_add_phantom_plane() is successful |
| LOW | | | | CVE-2026-80738 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| LOW | | | | CVE-2026-80747 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| LOW | | | | CVE-2026-80785 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| LOW | | 5.5 | | CVE-2026-80786 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: fbdev: Wrap user-invoked calls to fb_set_var() in helper |
| LOW | | 5.5 | | CVE-2026-80866 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tipc: avoid busy looping in tipc_exit_net() |
| LOW | | | | CVE-2026-80872 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | 5.5 | | CVE-2026-80884 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ntb: Store original DMA address for future release |
| LOW | | | | CVE-2026-80899 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: e ... |
| LOW | | 5.5 | | CVE-2026-80948 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() |
| LOW | | 5.5 | | CVE-2026-89601 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ext2: Fix lost inode updates for IS_SYNC inodes |
| LOW | | 5.5 | | CVE-2026-89808 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram |
| LOW | | 5.5 | | CVE-2026-89812 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the MES ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89813 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the KIQ ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89862 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Fix BSG job leak on validate flash image error path |
| LOW | | 5.5 | | CVE-2026-90084 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: octeontx2-vf: fix workqueue and netdev race in probe/remove |
| LOW | | 5.4 | | CVE-2026-90086 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: xsk: honor XDP_TX_METADATA in zero-copy path |
| LOW | | 5.5 | | CVE-2026-90097 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition |
| LOW | | 5.5 | | CVE-2026-90144 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: dpll: fix NULL deref in dpll_device_ops() during teardown race |
| LOW | | 5.5 | | CVE-2026-90182 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-iocost: clear delay state when freeing policy data |
| LOW | | 5.5 | | CVE-2026-90183 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: blk-iolatency: clear delay state when freeing policy data |
| LOW | | 6.1 | | CVE-2026-90211 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf, s390: Clear fetch destination on faulting arena atomic |
| LOW | | 5.5 | | CVE-2026-90261 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: flush active metadata block group at btree_writepages() start |
| LOW | | 5.5 | | CVE-2026-90267 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails |
| LOW | | 5.5 | | CVE-2026-90306 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: ARM: 9481/2: breakpoint: CFI breakpoints only on demand |
| LOW | | 5.5 | | CVE-2026-90311 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: thermal: hwmon: Remove hwmon class device along with its parent |
| LOW | | 5.5 | | CVE-2026-90330 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: HID: logitech-hidpp: Fix FF device cleanup on init failure |
| LOW | | 5.5 | | CVE-2026-90335 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tty: skip cdev_del() when no cdev is registered |
| LOW | | 5.5 | | CVE-2026-90346 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: nl80211: clean up color-change beacon data on errors |
| LOW | | 5.5 | | CVE-2026-90424 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path |
| LOW | | 5.5 | | CVE-2026-92493 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active |
| LOW | | 5.5 | | CVE-2026-93116 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: asus-wmi: fix resource leaks on probe failure |
| LOW | | 6.7 | | CVE-2026-93125 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max |
| LOW | | 5.5 | | CVE-2026-93129 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: platform/x86: dell-wmi-base: Fix handling of ultra performance key |
| LOW | | 6.7 | | CVE-2026-93144 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject writes through untrusted BTF pointers |
| LOW | | 5.5 | | CVE-2026-93146 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: time/namespace: Validate nanosecond field in proc_timens_set_offset() |
| LOW | | 5.5 | | CVE-2026-93181 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel/uncore: Fix uncore_box ref/unref ordering |
| LOW | | 5.5 | | CVE-2026-93202 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: i3c: master: Fix recursive locking during device registration |
| LOW | | 5.5 | | CVE-2026-93216 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() |
| LOW | | 5.5 | | CVE-2026-93230 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier |
| LOW | | | | CVE-2026-93237 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| LOW | | | | CVE-2026-93251 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | | | CVE-2026-93260 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| LOW | | 5.5 | | CVE-2026-97424 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq |
| LOW | | 5.5 | | CVE-2026-97477 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() |
| LOW | | 5.5 | | CVE-2026-97479 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: driver core: Avoid warning when removing a device while its supplier is unbinding |
| LOW | | 5.5 | | CVE-2026-97480 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: tty: serial: 8250: protect against NULL uart->port.dev in register |
| LOW | | 5.5 | | CVE-2026-97501 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction |
| LOW | | 5.5 | | CVE-2026-97503 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: genirq/proc: Size interrupt directory names for 10-digit interrupt numbers |
| LOW | | 5.5 | | CVE-2026-97928 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip the VMID 0 flush for VRAM |
| LOW | | 5.5 | | CVE-2026-97989 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: vduse: validate virtqueue alignment |
| LOW | | 5.5 | | CVE-2026-97997 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: virtio_ring: fix stale descriptor flags after a failed packed add |
| LOW | | 5.5 | | CVE-2026-98003 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: iommu/amd: Do not reallocate GA log buffers on resume |
| LOW | | 5.5 | | CVE-2026-98038 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Keep refcount_acquire nullable for borrowed RCU kptrs |
| LOW | | 5.5 | | CVE-2026-98044 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject legacy packet loads from callbacks |
| LOW | | 5.5 | | CVE-2026-98058 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark syscall helpers as sleepable |
| LOW | | 5.5 | | CVE-2026-98067 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: erofs: disable LZ4 rolling decompression for now |
| LOW | | 5.5 | | CVE-2026-98073 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: Remove conflicting altnames for dying netns in __dev_change_net_namespace() |
| LOW | | 5.5 | | CVE-2026-98079 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: btrfs: zstd: fix lost wakeup when waiting for a workspace |
| LOW | | 5.5 | | CVE-2026-98087 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate |
| LOW | | 5.5 | | CVE-2026-98119 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfs: break unbuffered write when netfs_alloc_subrequest() fails |
| LOW | | 5.5 | | CVE-2026-98147 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: printk: Don't WARN on kthread_run failure |
| LOW | | 5.5 | | CVE-2026-98148 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/gud: validate GUD_ROTATION_0 is present in supported rotations |
| LOW | | 7 | | CVE-2026-98176 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| LOW | | 5.5 | | CVE-2026-98177 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow in EOP ring size calculation |
| LOW | | 5.5 | | CVE-2026-98285 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| LOW | | 5.5 | | CVE-2026-98289 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: af_unix: Unify scc_index when finalising SCC in __unix_walk_scc() |
| LOW | | 5.5 | | CVE-2026-98304 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: bcmgenet: restore the hardware filters on open |
| LOW | | 5.5 | | CVE-2026-98317 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS |
| LOW | | 5.5 | | CVE-2026-98321 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_nat: unregister and release hooks on error |
| LOW | | 5.5 | | CVE-2026-98332 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: only operate on TDLS peers in the TDLS code |
| LOW | | 5.5 | | CVE-2026-98338 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: ibss: ref BSS entry for joined event |
| LOW | | 5.5 | | CVE-2026-98389 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip gfx switch_power_profile during GPU reset |
| LOW | | 5.5 | | CVE-2026-98393 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU |
| LOW | | 5.5 | | CVE-2026-98424 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: undo netns switch if renaming the wiphy fails |
| LOW | | 5.5 | | CVE-2026-98427 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: net/sched: codel: bound the dropping loop per dequeue call |
| LOW | | 5.5 | | CVE-2026-98431 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency |
| LOW | | 3.3 | | CVE-2026-98551 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: perf/core: Fill branch entries with a single assignment |
| LOW | | 2.3 | | CVE-2026-98628 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: bpf: Make post-verification instruction rewrites killable |
| LOW | | 2.5 | | CVE-2026-98682 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: drain and invalidate before server-side copy/clone |
| LOW | | 2.5 | | CVE-2026-98683 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush dirty data before zeroing a range |
| LOW | | 2.5 | | CVE-2026-98684 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush and commit data before querying allocated ranges |
| LOW | | 3.3 | | CVE-2026-98685 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: smb: client: discard post-EOF pagecache when extending a file via clone range |
| LOW | | 3.7 | | CVE-2026-98802 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | kernel: seg6: ensure packet data is writable before modifying SRH and IPv6 DA |
| LOW | | | | TEMP-0000000-F7A20F | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | [Kernel: Unprivileged user can freeze journald] |
| LOW | | 5 | | CVE-2004-0230 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | TCP, when using a large Window Size, makes it easier for remote attack ... |
| LOW | | 4.9 | | CVE-2005-3660 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | Linux kernel 2.4 and 2.6 allows attackers to cause a denial of service ... |
| LOW | | 2.1 | | CVE-2007-3719 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: secretly Monopolizing the CPU Without Superuser Privileges |
| LOW | | 5.5 | | CVE-2008-2544 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: mounting proc readonly on a different mount point silently mounts it rw if the /proc mount is rw |
| LOW | | 7.1 | | CVE-2008-4609 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: TCP protocol vulnerabilities from Outpost24 |
| LOW | | 5 | | CVE-2010-4563 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ipv6: sniffer detection |
| LOW | | 4.3 | | CVE-2010-5321 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: v4l: videobuf: hotfix a bug on multiple calls to mmap() |
| LOW | | 5.5 | | CVE-2011-4915 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | fs/proc/base.c in the Linux kernel through 3.1 allows local users to o ... |
| LOW | | 5.5 | | CVE-2011-4916 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | Linux kernel through 3.1 allows local users to obtain sensitive keystr ... |
| LOW | | 5.5 | | CVE-2011-4917 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel through 3.1 there is an information disclosure iss ... |
| LOW | | 4.9 | | CVE-2012-4542 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: block: default SCSI command filter does not accomodate commands overlap across device classes |
| LOW | | 5.5 | | CVE-2014-9892 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | The snd_compr_tstamp function in sound/core/compress_offload.c in the ... |
| LOW | | 7.5 | | CVE-2014-9900 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Info leak in uninitialized structure ethtool_wolinfo in ethtool_get_wol() |
| LOW | | 3.3 | | CVE-2015-2877 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | Kernel: Cross-VM ASL INtrospection (CAIN) |
| LOW | | 5.5 | | CVE-2016-10723 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel through 4.17.2. Since the ... |
| LOW | | 5.5 | | CVE-2016-8660 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: xfs: local DoS due to a page lock order bug in the XFS seek hole/data implementation |
| LOW | | 4.7 | | CVE-2017-0630 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Information disclosure vulnerability in kernel trace subsystem |
| LOW | | 5.5 | | CVE-2017-13693 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ACPI operand cache leak in dsutils.c |
| LOW | | 5.5 | | CVE-2017-13694 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ACPI node and node_ext cache leak |
| LOW | | 5.9 | | CVE-2018-1121 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | procps: process hiding through race condition enumerating /proc |
| LOW | | 5.5 | | CVE-2018-12928 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: NULL pointer dereference in hfs_ext_read_extent in hfs.ko |
| LOW | | 4.9 | | CVE-2018-17977 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Mishandled interactions among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets resulting in a d |
| LOW | | 2.5 | | CVE-2019-11191 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: race condition in load_aout_binary() allows local users to bypass ASLR on setuid a.out programs |
| LOW | | 5.7 | | CVE-2019-12378 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip6_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12379 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: memory leak in con_insert_unipair in drivers/tty/vt/consolemap.c |
| LOW | | 6.2 | | CVE-2019-12380 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: memory allocation failure in the efi subsystem leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12381 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12382 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12455 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c causing denial of service |
| LOW | | 7.8 | | CVE-2019-12456 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: double fetch in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c |
| LOW | | 4.1 | | CVE-2019-16229 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c |
| LOW | | 4.7 | | CVE-2019-16230 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/radeon/radeon_display.c |
| LOW | | 4.1 | | CVE-2019-16231 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c |
| LOW | | 4.1 | | CVE-2019-16232 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/wireless/marvell/libertas/if_sdio.c |
| LOW | | 4.1 | | CVE-2019-16233 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c |
| LOW | | 4.7 | | CVE-2019-16234 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/net/wireless/intel/iwlwifi/pcie/trans.c |
| LOW | | 7.5 | | CVE-2019-19070 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: A memory leak in the spi_gpio_probe() function in drivers/spi/spi-gpio.c allows for a DoS |
| LOW | | 7.8 | | CVE-2019-19378 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in index_rbio_pages in fs/btrfs/raid56.c |
| LOW | | 7.8 | | CVE-2020-11725 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: improper handling of private_size*count multiplication due to count=info->owner typo |
| LOW | | 3.4 | | CVE-2020-35501 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: audit not logging access to syscall open_by_handle_at for users with CAP_DAC_READ_SEARCH capability |
| LOW | | 7.8 | | CVE-2021-26934 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel 4.18 through 5.10.16, as u ... |
| LOW | | 5.9 | | CVE-2021-3714 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Remote Page Deduplication Attacks |
| LOW | | 7.5 | | CVE-2022-0400 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Out of bounds read in the smc protocol stack |
| LOW | | 7.8 | | CVE-2022-1247 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: A race condition bug in rose_connect() |
| LOW | | 7.8 | | CVE-2022-25265 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Executable Space Protection Bypass |
| LOW | | 7 | | CVE-2022-2961 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: race condition in rose_bind() |
| LOW | | 7.8 | | CVE-2022-3238 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ntfs3 local privledge escalation if NTFS character set and remount and umount called simultaneously |
| LOW | | 4.2 | | CVE-2022-41848 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Race condition between mgslpc_ioctl and mgslpc_detach |
| LOW | | 6.4 | | CVE-2022-44032 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | Kernel: Race between cmm_open() and cm4000_detach() result in UAF |
| LOW | | 6.4 | | CVE-2022-44033 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | Kernel: A race condition between cm4040_open() and reader_detach() may result in UAF |
| LOW | | 5.5 | | CVE-2022-4543 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KASLR Prefetch Bypass Breaks KPTI |
| LOW | | 7 | | CVE-2022-45884 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_register_device() |
| LOW | | 7 | | CVE-2022-45885 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_frontend.c |
| LOW | | 6.4 | | CVE-2023-23039 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: tty: vcc: race condition leading to use-after-free in vcc_open() |
| LOW | | 7.8 | | CVE-2023-26242 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: kernel: fpga: dfl-afu: integer overflow in afu_mmio_region_get_by_offset() |
| LOW | | 5.5 | | CVE-2023-31081 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | An issue was discovered in drivers/media/test-drivers/vidtv/vidtv_brid ... |
| LOW | | 5.5 | | CVE-2023-31085 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: divide-by-zero error in ctrl_cdev_ioctl when do_div happens and erasesize is 0 |
| LOW | | 7.8 | | CVE-2023-3640 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and pref |
| LOW | | 6.5 | | CVE-2024-0564 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: max page sharing of Kernel Samepage Merging (KSM) may cause memory deduplication |
| LOW | | | | CVE-2025-40065 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Write hgatp register with valid mode bits |
| LOW | | 5.5 | | CVE-2025-40086 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds |
| LOW | | | | CVE-2025-40136 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: crypto: hisilicon/qm - request reserved interrupt for virtual function |
| LOW | | 5.5 | | CVE-2025-68193 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Add devm release action to safely tear down CT |
| LOW | | 5.5 | | CVE-2025-68359 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix double free of qgroup record after failure to add delayed ref head |
| LOW | | | | CVE-2025-68376 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: coresight: ETR: Fix ETR buffer use-after-free issue |
| LOW | | 3.3 | | CVE-2025-68751 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: s390/fpu: Fix false-positive kmsan report in fpu_vstl() |
| LOW | | | | CVE-2025-68755 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: staging: most: remove broken i2c driver |
| LOW | | | | CVE-2026-31536 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: smb: server: let send_done handle a completion without IB_SEND_SIGNALED |
| LOW | | | | CVE-2026-43263 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix Null reference while testing fluster |
| LOW | | | | CVE-2026-45956 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() |
| LOW | | | | CVE-2026-46175 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by FGGC of node block |
| LOW | | | | CVE-2026-52983 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: airoha: fix BQL imbalance in TX path |
| LOW | | | | CVE-2026-53024 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free if write is called after disconnect |
| LOW | | | | CVE-2026-53025 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free on cdev close |
| LOW | | 5.5 | | CVE-2026-53284 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: btrfs: only release the dirty pages io tree after successful writes |
| LOW | | | | CVE-2026-53368 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage |
| LOW | | | | CVE-2026-63825 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: gcov: use atomic counter updates to fix concurrent access crashes |
| LOW | | 5.5 | | CVE-2026-64388 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix chown/chgrp with SMB3 POSIX Extensions |
| LOW | | 5.5 | | CVE-2026-64513 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Unconditionally recompute CR8 intercept on PPR update |
| LOW | | 4.7 | | CVE-2026-68081 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state |
| LOW | | 5.5 | | CVE-2026-68105 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Fix kernel panic during driver load failure |
| LOW | | 5.5 | | CVE-2026-68238 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Release VFCT ACPI table reference |
| LOW | | 5.5 | | CVE-2026-68241 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/i915/mst: limit DP MST ESI service loop |
| LOW | | 5.5 | | CVE-2026-68375 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Handle partially initialized auxiliary devices |
| LOW | | 5.5 | | CVE-2026-68412 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() |
| LOW | | 5.5 | | CVE-2026-68418 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Prevent user-triggered null deref on QP create |
| LOW | | 5.5 | | CVE-2026-68436 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: use kvzalloc to allocate struct dc |
| LOW | | 5.5 | | CVE-2026-72009 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI |
| LOW | | 5.5 | | CVE-2026-72031 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD |
| LOW | | 5.5 | | CVE-2026-72321 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() |
| LOW | | 5.5 | | CVE-2026-72366 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_create_write_req() to handle async cache object creation |
| LOW | | 5.5 | | CVE-2026-72439 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: md/raid10: fix writes_pending leak on write request failures |
| LOW | | 5.5 | | CVE-2026-72494 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Replace waitqueue and flag with completion |
| LOW | | 5.5 | | CVE-2026-72497 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Add a max slot check for SQ |
| LOW | | 5.5 | | CVE-2026-74261 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: avoid stale FIFO cells during resize |
| LOW | | 5.5 | | CVE-2026-74338 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject sleepable BPF_LSM_CGROUP programs at load time |
| LOW | | 5.5 | | CVE-2026-74373 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix bio accounting for split md cloned bios |
| LOW | | 5.5 | | CVE-2026-74374 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix error-path detection with md_cloned_bio() |
| LOW | | 5.5 | | CVE-2026-74375 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix deadlock in read error recovery path |
| LOW | | 5.5 | | CVE-2026-74558 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: xsk: reclaim invalid Tx descriptors in ZC batch path |
| LOW | | 5.5 | | CVE-2026-74559 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: xsk: drain continuation descs after overflow in xsk_build_skb() |
| LOW | | 5.5 | | CVE-2026-74560 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx |
| LOW | | 5.5 | | CVE-2026-74571 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: btrfs: skip global block reserve accounting for rescue mounts |
| LOW | | | | CVE-2026-74690 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| LOW | | 5.5 | | CVE-2026-74728 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: xfs: handle NULL b_addr in xfs_buf_free |
| LOW | | 5.5 | | CVE-2026-74733 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock |
| LOW | | 5.5 | | CVE-2026-74734 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: firewire: ohci: fix NULL pointer dereference in ar_context_release |
| LOW | | 5.5 | | CVE-2026-74754 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: scsi: core: pair EH runtime PM get and put |
| LOW | | 5.5 | | CVE-2026-80581 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout |
| LOW | | 5.5 | | CVE-2026-80607 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg |
| LOW | | 5.5 | | CVE-2026-80616 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() |
| LOW | | 5.5 | | CVE-2026-80643 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: EDAC/igen6: Fix call trace due to missing release() |
| LOW | | 5.5 | | CVE-2026-80653 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: scsi: hisi_sas: Add slave_destroy interface for v3 hw |
| LOW | | 5.5 | | CVE-2026-80705 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: check if dml21_add_phantom_plane() is successful |
| LOW | | | | CVE-2026-80738 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| LOW | | | | CVE-2026-80747 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| LOW | | | | CVE-2026-80785 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| LOW | | 5.5 | | CVE-2026-80786 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: fbdev: Wrap user-invoked calls to fb_set_var() in helper |
| LOW | | 5.5 | | CVE-2026-80866 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: tipc: avoid busy looping in tipc_exit_net() |
| LOW | | | | CVE-2026-80872 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | 5.5 | | CVE-2026-80884 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ntb: Store original DMA address for future release |
| LOW | | | | CVE-2026-80899 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: e ... |
| LOW | | 5.5 | | CVE-2026-80948 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() |
| LOW | | 5.5 | | CVE-2026-89601 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ext2: Fix lost inode updates for IS_SYNC inodes |
| LOW | | 5.5 | | CVE-2026-89808 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram |
| LOW | | 5.5 | | CVE-2026-89812 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the MES ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89813 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the KIQ ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89862 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Fix BSG job leak on validate flash image error path |
| LOW | | 5.5 | | CVE-2026-90084 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: octeontx2-vf: fix workqueue and netdev race in probe/remove |
| LOW | | 5.4 | | CVE-2026-90086 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: xsk: honor XDP_TX_METADATA in zero-copy path |
| LOW | | 5.5 | | CVE-2026-90097 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition |
| LOW | | 5.5 | | CVE-2026-90144 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: dpll: fix NULL deref in dpll_device_ops() during teardown race |
| LOW | | 5.5 | | CVE-2026-90182 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: blk-iocost: clear delay state when freeing policy data |
| LOW | | 5.5 | | CVE-2026-90183 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: blk-iolatency: clear delay state when freeing policy data |
| LOW | | 6.1 | | CVE-2026-90211 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf, s390: Clear fetch destination on faulting arena atomic |
| LOW | | 5.5 | | CVE-2026-90261 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: flush active metadata block group at btree_writepages() start |
| LOW | | 5.5 | | CVE-2026-90267 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails |
| LOW | | 5.5 | | CVE-2026-90306 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: ARM: 9481/2: breakpoint: CFI breakpoints only on demand |
| LOW | | 5.5 | | CVE-2026-90311 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: thermal: hwmon: Remove hwmon class device along with its parent |
| LOW | | 5.5 | | CVE-2026-90330 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: HID: logitech-hidpp: Fix FF device cleanup on init failure |
| LOW | | 5.5 | | CVE-2026-90335 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: tty: skip cdev_del() when no cdev is registered |
| LOW | | 5.5 | | CVE-2026-90346 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: nl80211: clean up color-change beacon data on errors |
| LOW | | 5.5 | | CVE-2026-90424 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path |
| LOW | | 5.5 | | CVE-2026-92493 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active |
| LOW | | 5.5 | | CVE-2026-93116 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: platform/x86: asus-wmi: fix resource leaks on probe failure |
| LOW | | 6.7 | | CVE-2026-93125 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max |
| LOW | | 5.5 | | CVE-2026-93129 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: platform/x86: dell-wmi-base: Fix handling of ultra performance key |
| LOW | | 6.7 | | CVE-2026-93144 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject writes through untrusted BTF pointers |
| LOW | | 5.5 | | CVE-2026-93146 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: time/namespace: Validate nanosecond field in proc_timens_set_offset() |
| LOW | | 5.5 | | CVE-2026-93181 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel/uncore: Fix uncore_box ref/unref ordering |
| LOW | | 5.5 | | CVE-2026-93202 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: i3c: master: Fix recursive locking during device registration |
| LOW | | 5.5 | | CVE-2026-93216 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() |
| LOW | | 5.5 | | CVE-2026-93230 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier |
| LOW | | | | CVE-2026-93237 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| LOW | | | | CVE-2026-93251 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | | | CVE-2026-93260 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| LOW | | 5.5 | | CVE-2026-97424 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq |
| LOW | | 5.5 | | CVE-2026-97477 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() |
| LOW | | 5.5 | | CVE-2026-97479 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: driver core: Avoid warning when removing a device while its supplier is unbinding |
| LOW | | 5.5 | | CVE-2026-97480 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: tty: serial: 8250: protect against NULL uart->port.dev in register |
| LOW | | 5.5 | | CVE-2026-97501 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction |
| LOW | | 5.5 | | CVE-2026-97503 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: genirq/proc: Size interrupt directory names for 10-digit interrupt numbers |
| LOW | | 5.5 | | CVE-2026-97928 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip the VMID 0 flush for VRAM |
| LOW | | 5.5 | | CVE-2026-97989 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: vduse: validate virtqueue alignment |
| LOW | | 5.5 | | CVE-2026-97997 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: virtio_ring: fix stale descriptor flags after a failed packed add |
| LOW | | 5.5 | | CVE-2026-98003 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: iommu/amd: Do not reallocate GA log buffers on resume |
| LOW | | 5.5 | | CVE-2026-98038 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Keep refcount_acquire nullable for borrowed RCU kptrs |
| LOW | | 5.5 | | CVE-2026-98044 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject legacy packet loads from callbacks |
| LOW | | 5.5 | | CVE-2026-98058 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark syscall helpers as sleepable |
| LOW | | 5.5 | | CVE-2026-98067 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: erofs: disable LZ4 rolling decompression for now |
| LOW | | 5.5 | | CVE-2026-98073 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: Remove conflicting altnames for dying netns in __dev_change_net_namespace() |
| LOW | | 5.5 | | CVE-2026-98079 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: btrfs: zstd: fix lost wakeup when waiting for a workspace |
| LOW | | 5.5 | | CVE-2026-98087 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate |
| LOW | | 5.5 | | CVE-2026-98119 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfs: break unbuffered write when netfs_alloc_subrequest() fails |
| LOW | | 5.5 | | CVE-2026-98147 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: printk: Don't WARN on kthread_run failure |
| LOW | | 5.5 | | CVE-2026-98148 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/gud: validate GUD_ROTATION_0 is present in supported rotations |
| LOW | | 7 | | CVE-2026-98176 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| LOW | | 5.5 | | CVE-2026-98177 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow in EOP ring size calculation |
| LOW | | 5.5 | | CVE-2026-98285 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| LOW | | 5.5 | | CVE-2026-98289 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: af_unix: Unify scc_index when finalising SCC in __unix_walk_scc() |
| LOW | | 5.5 | | CVE-2026-98304 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: bcmgenet: restore the hardware filters on open |
| LOW | | 5.5 | | CVE-2026-98317 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS |
| LOW | | 5.5 | | CVE-2026-98321 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_nat: unregister and release hooks on error |
| LOW | | 5.5 | | CVE-2026-98332 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: only operate on TDLS peers in the TDLS code |
| LOW | | 5.5 | | CVE-2026-98338 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: ibss: ref BSS entry for joined event |
| LOW | | 5.5 | | CVE-2026-98389 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip gfx switch_power_profile during GPU reset |
| LOW | | 5.5 | | CVE-2026-98393 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU |
| LOW | | 5.5 | | CVE-2026-98424 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: undo netns switch if renaming the wiphy fails |
| LOW | | 5.5 | | CVE-2026-98427 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: net/sched: codel: bound the dropping loop per dequeue call |
| LOW | | 5.5 | | CVE-2026-98431 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency |
| LOW | | 3.3 | | CVE-2026-98551 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: perf/core: Fill branch entries with a single assignment |
| LOW | | 2.3 | | CVE-2026-98628 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: bpf: Make post-verification instruction rewrites killable |
| LOW | | 2.5 | | CVE-2026-98682 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: smb: client: drain and invalidate before server-side copy/clone |
| LOW | | 2.5 | | CVE-2026-98683 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush dirty data before zeroing a range |
| LOW | | 2.5 | | CVE-2026-98684 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush and commit data before querying allocated ranges |
| LOW | | 3.3 | | CVE-2026-98685 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: smb: client: discard post-EOF pagecache when extending a file via clone range |
| LOW | | 3.7 | | CVE-2026-98802 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | kernel: seg6: ensure packet data is writable before modifying SRH and IPv6 DA |
| LOW | | | | TEMP-0000000-F7A20F | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | [Kernel: Unprivileged user can freeze journald] |
| LOW | | 5 | | CVE-2004-0230 | linux-libc-dev | 1:6.18.34-1+rpt1 | | TCP, when using a large Window Size, makes it easier for remote attack ... |
| LOW | | 4.9 | | CVE-2005-3660 | linux-libc-dev | 1:6.18.34-1+rpt1 | | Linux kernel 2.4 and 2.6 allows attackers to cause a denial of service ... |
| LOW | | 2.1 | | CVE-2007-3719 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: secretly Monopolizing the CPU Without Superuser Privileges |
| LOW | | 5.5 | | CVE-2008-2544 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: mounting proc readonly on a different mount point silently mounts it rw if the /proc mount is rw |
| LOW | | 7.1 | | CVE-2008-4609 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: TCP protocol vulnerabilities from Outpost24 |
| LOW | | 5 | | CVE-2010-4563 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ipv6: sniffer detection |
| LOW | | 4.3 | | CVE-2010-5321 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: v4l: videobuf: hotfix a bug on multiple calls to mmap() |
| LOW | | 5.5 | | CVE-2011-4915 | linux-libc-dev | 1:6.18.34-1+rpt1 | | fs/proc/base.c in the Linux kernel through 3.1 allows local users to o ... |
| LOW | | 5.5 | | CVE-2011-4916 | linux-libc-dev | 1:6.18.34-1+rpt1 | | Linux kernel through 3.1 allows local users to obtain sensitive keystr ... |
| LOW | | 5.5 | | CVE-2011-4917 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel through 3.1 there is an information disclosure iss ... |
| LOW | | 4.9 | | CVE-2012-4542 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: block: default SCSI command filter does not accomodate commands overlap across device classes |
| LOW | | 5.5 | | CVE-2014-9892 | linux-libc-dev | 1:6.18.34-1+rpt1 | | The snd_compr_tstamp function in sound/core/compress_offload.c in the ... |
| LOW | | 7.5 | | CVE-2014-9900 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Info leak in uninitialized structure ethtool_wolinfo in ethtool_get_wol() |
| LOW | | 3.3 | | CVE-2015-2877 | linux-libc-dev | 1:6.18.34-1+rpt1 | | Kernel: Cross-VM ASL INtrospection (CAIN) |
| LOW | | 5.5 | | CVE-2016-10723 | linux-libc-dev | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel through 4.17.2. Since the ... |
| LOW | | 5.5 | | CVE-2016-8660 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: xfs: local DoS due to a page lock order bug in the XFS seek hole/data implementation |
| LOW | | 4.7 | | CVE-2017-0630 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Information disclosure vulnerability in kernel trace subsystem |
| LOW | | 5.5 | | CVE-2017-13693 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ACPI operand cache leak in dsutils.c |
| LOW | | 5.5 | | CVE-2017-13694 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ACPI node and node_ext cache leak |
| LOW | | 5.9 | | CVE-2018-1121 | linux-libc-dev | 1:6.18.34-1+rpt1 | | procps: process hiding through race condition enumerating /proc |
| LOW | | 5.5 | | CVE-2018-12928 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: NULL pointer dereference in hfs_ext_read_extent in hfs.ko |
| LOW | | 4.9 | | CVE-2018-17977 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Mishandled interactions among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets resulting in a d |
| LOW | | 2.5 | | CVE-2019-11191 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: race condition in load_aout_binary() allows local users to bypass ASLR on setuid a.out programs |
| LOW | | 5.7 | | CVE-2019-12378 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip6_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12379 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: memory leak in con_insert_unipair in drivers/tty/vt/consolemap.c |
| LOW | | 6.2 | | CVE-2019-12380 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: memory allocation failure in the efi subsystem leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12381 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: unchecked kmalloc of new_ra in ip_ra_control leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12382 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service |
| LOW | | 5.5 | | CVE-2019-12455 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c causing denial of service |
| LOW | | 7.8 | | CVE-2019-12456 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: double fetch in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c |
| LOW | | 4.1 | | CVE-2019-16229 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c |
| LOW | | 4.7 | | CVE-2019-16230 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/gpu/drm/radeon/radeon_display.c |
| LOW | | 4.1 | | CVE-2019-16231 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c |
| LOW | | 4.1 | | CVE-2019-16232 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: null-pointer dereference in drivers/net/wireless/marvell/libertas/if_sdio.c |
| LOW | | 4.1 | | CVE-2019-16233 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c |
| LOW | | 4.7 | | CVE-2019-16234 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: null pointer dereference in drivers/net/wireless/intel/iwlwifi/pcie/trans.c |
| LOW | | 7.5 | | CVE-2019-19070 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: A memory leak in the spi_gpio_probe() function in drivers/spi/spi-gpio.c allows for a DoS |
| LOW | | 7.8 | | CVE-2019-19378 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: out-of-bounds write in index_rbio_pages in fs/btrfs/raid56.c |
| LOW | | 7.8 | | CVE-2020-11725 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: improper handling of private_size*count multiplication due to count=info->owner typo |
| LOW | | 3.4 | | CVE-2020-35501 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: audit not logging access to syscall open_by_handle_at for users with CAP_DAC_READ_SEARCH capability |
| LOW | | 7.8 | | CVE-2021-26934 | linux-libc-dev | 1:6.18.34-1+rpt1 | | An issue was discovered in the Linux kernel 4.18 through 5.10.16, as u ... |
| LOW | | 5.9 | | CVE-2021-3714 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Remote Page Deduplication Attacks |
| LOW | | 7.5 | | CVE-2022-0400 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Out of bounds read in the smc protocol stack |
| LOW | | 7.8 | | CVE-2022-1247 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: A race condition bug in rose_connect() |
| LOW | | 7.8 | | CVE-2022-25265 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Executable Space Protection Bypass |
| LOW | | 7 | | CVE-2022-2961 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: race condition in rose_bind() |
| LOW | | 7.8 | | CVE-2022-3238 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ntfs3 local privledge escalation if NTFS character set and remount and umount called simultaneously |
| LOW | | 4.2 | | CVE-2022-41848 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Race condition between mgslpc_ioctl and mgslpc_detach |
| LOW | | 6.4 | | CVE-2022-44032 | linux-libc-dev | 1:6.18.34-1+rpt1 | | Kernel: Race between cmm_open() and cm4000_detach() result in UAF |
| LOW | | 6.4 | | CVE-2022-44033 | linux-libc-dev | 1:6.18.34-1+rpt1 | | Kernel: A race condition between cm4040_open() and reader_detach() may result in UAF |
| LOW | | 5.5 | | CVE-2022-4543 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KASLR Prefetch Bypass Breaks KPTI |
| LOW | | 7 | | CVE-2022-45884 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_register_device() |
| LOW | | 7 | | CVE-2022-45885 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: use-after-free due to race condition occurring in dvb_frontend.c |
| LOW | | 6.4 | | CVE-2023-23039 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: tty: vcc: race condition leading to use-after-free in vcc_open() |
| LOW | | 7.8 | | CVE-2023-26242 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: kernel: fpga: dfl-afu: integer overflow in afu_mmio_region_get_by_offset() |
| LOW | | 5.5 | | CVE-2023-31081 | linux-libc-dev | 1:6.18.34-1+rpt1 | | An issue was discovered in drivers/media/test-drivers/vidtv/vidtv_brid ... |
| LOW | | 5.5 | | CVE-2023-31085 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: divide-by-zero error in ctrl_cdev_ioctl when do_div happens and erasesize is 0 |
| LOW | | 7.8 | | CVE-2023-3640 | linux-libc-dev | 1:6.18.34-1+rpt1 | | Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and pref |
| LOW | | 6.5 | | CVE-2024-0564 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: max page sharing of Kernel Samepage Merging (KSM) may cause memory deduplication |
| LOW | | | | CVE-2025-40065 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: RISC-V: KVM: Write hgatp register with valid mode bits |
| LOW | | 5.5 | | CVE-2025-40086 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds |
| LOW | | | | CVE-2025-40136 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: crypto: hisilicon/qm - request reserved interrupt for virtual function |
| LOW | | 5.5 | | CVE-2025-68193 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/xe/guc: Add devm release action to safely tear down CT |
| LOW | | 5.5 | | CVE-2025-68359 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: btrfs: fix double free of qgroup record after failure to add delayed ref head |
| LOW | | | | CVE-2025-68376 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: coresight: ETR: Fix ETR buffer use-after-free issue |
| LOW | | 3.3 | | CVE-2025-68751 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: s390/fpu: Fix false-positive kmsan report in fpu_vstl() |
| LOW | | | | CVE-2025-68755 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: staging: most: remove broken i2c driver |
| LOW | | | | CVE-2026-31536 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: smb: server: let send_done handle a completion without IB_SEND_SIGNALED |
| LOW | | | | CVE-2026-43263 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: media: chips-media: wave5: Fix Null reference while testing fluster |
| LOW | | | | CVE-2026-45956 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() |
| LOW | | | | CVE-2026-46175 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by FGGC of node block |
| LOW | | | | CVE-2026-52983 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: airoha: fix BQL imbalance in TX path |
| LOW | | | | CVE-2026-53024 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free if write is called after disconnect |
| LOW | | | | CVE-2026-53025 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: greybus: raw: fix use-after-free on cdev close |
| LOW | | 5.5 | | CVE-2026-53284 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: btrfs: only release the dirty pages io tree after successful writes |
| LOW | | | | CVE-2026-53368 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage |
| LOW | | | | CVE-2026-63825 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: gcov: use atomic counter updates to fix concurrent access crashes |
| LOW | | 5.5 | | CVE-2026-64388 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: smb/client: fix chown/chgrp with SMB3 POSIX Extensions |
| LOW | | 5.5 | | CVE-2026-64513 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KVM: x86: Unconditionally recompute CR8 intercept on PPR update |
| LOW | | 4.7 | | CVE-2026-68081 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state |
| LOW | | 5.5 | | CVE-2026-68105 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Fix kernel panic during driver load failure |
| LOW | | 5.5 | | CVE-2026-68238 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: Release VFCT ACPI table reference |
| LOW | | 5.5 | | CVE-2026-68241 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/i915/mst: limit DP MST ESI service loop |
| LOW | | 5.5 | | CVE-2026-68375 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bnxt_en: Handle partially initialized auxiliary devices |
| LOW | | 5.5 | | CVE-2026-68412 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() |
| LOW | | 5.5 | | CVE-2026-68418 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Prevent user-triggered null deref on QP create |
| LOW | | 5.5 | | CVE-2026-68436 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: use kvzalloc to allocate struct dc |
| LOW | | 5.5 | | CVE-2026-72009 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI |
| LOW | | 5.5 | | CVE-2026-72031 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD |
| LOW | | 5.5 | | CVE-2026-72321 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() |
| LOW | | 5.5 | | CVE-2026-72366 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfs: Fix netfs_create_write_req() to handle async cache object creation |
| LOW | | 5.5 | | CVE-2026-72439 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: md/raid10: fix writes_pending leak on write request failures |
| LOW | | 5.5 | | CVE-2026-72494 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: RDMA/irdma: Replace waitqueue and flag with completion |
| LOW | | 5.5 | | CVE-2026-72497 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: RDMA/bnxt_re: Add a max slot check for SQ |
| LOW | | 5.5 | | CVE-2026-74261 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ALSA: seq: avoid stale FIFO cells during resize |
| LOW | | 5.5 | | CVE-2026-74338 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject sleepable BPF_LSM_CGROUP programs at load time |
| LOW | | 5.5 | | CVE-2026-74373 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix bio accounting for split md cloned bios |
| LOW | | 5.5 | | CVE-2026-74374 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix error-path detection with md_cloned_bio() |
| LOW | | 5.5 | | CVE-2026-74375 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: md/raid1,raid10: fix deadlock in read error recovery path |
| LOW | | 5.5 | | CVE-2026-74558 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: xsk: reclaim invalid Tx descriptors in ZC batch path |
| LOW | | 5.5 | | CVE-2026-74559 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: xsk: drain continuation descs after overflow in xsk_build_skb() |
| LOW | | 5.5 | | CVE-2026-74560 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx |
| LOW | | 5.5 | | CVE-2026-74571 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: btrfs: skip global block reserve accounting for rescue mounts |
| LOW | | | | CVE-2026-74690 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| LOW | | 5.5 | | CVE-2026-74728 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: xfs: handle NULL b_addr in xfs_buf_free |
| LOW | | 5.5 | | CVE-2026-74733 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock |
| LOW | | 5.5 | | CVE-2026-74734 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: firewire: ohci: fix NULL pointer dereference in ar_context_release |
| LOW | | 5.5 | | CVE-2026-74754 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: scsi: core: pair EH runtime PM get and put |
| LOW | | 5.5 | | CVE-2026-80581 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout |
| LOW | | 5.5 | | CVE-2026-80607 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg |
| LOW | | 5.5 | | CVE-2026-80616 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() |
| LOW | | 5.5 | | CVE-2026-80643 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: EDAC/igen6: Fix call trace due to missing release() |
| LOW | | 5.5 | | CVE-2026-80653 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: scsi: hisi_sas: Add slave_destroy interface for v3 hw |
| LOW | | 5.5 | | CVE-2026-80705 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amd/display: check if dml21_add_phantom_plane() is successful |
| LOW | | | | CVE-2026-80738 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| LOW | | | | CVE-2026-80747 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| LOW | | | | CVE-2026-80785 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| LOW | | 5.5 | | CVE-2026-80786 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: fbdev: Wrap user-invoked calls to fb_set_var() in helper |
| LOW | | 5.5 | | CVE-2026-80866 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: tipc: avoid busy looping in tipc_exit_net() |
| LOW | | | | CVE-2026-80872 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | 5.5 | | CVE-2026-80884 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ntb: Store original DMA address for future release |
| LOW | | | | CVE-2026-80899 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: e ... |
| LOW | | 5.5 | | CVE-2026-80948 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() |
| LOW | | 5.5 | | CVE-2026-89601 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ext2: Fix lost inode updates for IS_SYNC inodes |
| LOW | | 5.5 | | CVE-2026-89808 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram |
| LOW | | 5.5 | | CVE-2026-89812 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the MES ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89813 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: force complete the KIQ ring fences on reset |
| LOW | | 5.5 | | CVE-2026-89862 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: scsi: qla2xxx: Fix BSG job leak on validate flash image error path |
| LOW | | 5.5 | | CVE-2026-90084 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: octeontx2-vf: fix workqueue and netdev race in probe/remove |
| LOW | | 5.4 | | CVE-2026-90086 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: xsk: honor XDP_TX_METADATA in zero-copy path |
| LOW | | 5.5 | | CVE-2026-90097 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition |
| LOW | | 5.5 | | CVE-2026-90144 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: dpll: fix NULL deref in dpll_device_ops() during teardown race |
| LOW | | 5.5 | | CVE-2026-90182 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: blk-iocost: clear delay state when freeing policy data |
| LOW | | 5.5 | | CVE-2026-90183 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: blk-iolatency: clear delay state when freeing policy data |
| LOW | | 6.1 | | CVE-2026-90211 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf, s390: Clear fetch destination on faulting arena atomic |
| LOW | | 5.5 | | CVE-2026-90261 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: btrfs: zoned: flush active metadata block group at btree_writepages() start |
| LOW | | 5.5 | | CVE-2026-90267 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails |
| LOW | | 5.5 | | CVE-2026-90306 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: ARM: 9481/2: breakpoint: CFI breakpoints only on demand |
| LOW | | 5.5 | | CVE-2026-90311 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: thermal: hwmon: Remove hwmon class device along with its parent |
| LOW | | 5.5 | | CVE-2026-90330 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: HID: logitech-hidpp: Fix FF device cleanup on init failure |
| LOW | | 5.5 | | CVE-2026-90335 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: tty: skip cdev_del() when no cdev is registered |
| LOW | | 5.5 | | CVE-2026-90346 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: nl80211: clean up color-change beacon data on errors |
| LOW | | 5.5 | | CVE-2026-90424 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path |
| LOW | | 5.5 | | CVE-2026-92493 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active |
| LOW | | 5.5 | | CVE-2026-93116 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: platform/x86: asus-wmi: fix resource leaks on probe failure |
| LOW | | 6.7 | | CVE-2026-93125 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max |
| LOW | | 5.5 | | CVE-2026-93129 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: platform/x86: dell-wmi-base: Fix handling of ultra performance key |
| LOW | | 6.7 | | CVE-2026-93144 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject writes through untrusted BTF pointers |
| LOW | | 5.5 | | CVE-2026-93146 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: time/namespace: Validate nanosecond field in proc_timens_set_offset() |
| LOW | | 5.5 | | CVE-2026-93181 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: perf/x86/intel/uncore: Fix uncore_box ref/unref ordering |
| LOW | | 5.5 | | CVE-2026-93202 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: i3c: master: Fix recursive locking during device registration |
| LOW | | 5.5 | | CVE-2026-93216 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() |
| LOW | | 5.5 | | CVE-2026-93230 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier |
| LOW | | | | CVE-2026-93237 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: L ... |
| LOW | | | | CVE-2026-93251 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: A ... |
| LOW | | | | CVE-2026-93260 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| LOW | | 5.5 | | CVE-2026-97424 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq |
| LOW | | 5.5 | | CVE-2026-97477 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() |
| LOW | | 5.5 | | CVE-2026-97479 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: driver core: Avoid warning when removing a device while its supplier is unbinding |
| LOW | | 5.5 | | CVE-2026-97480 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: tty: serial: 8250: protect against NULL uart->port.dev in register |
| LOW | | 5.5 | | CVE-2026-97501 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction |
| LOW | | 5.5 | | CVE-2026-97503 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: genirq/proc: Size interrupt directory names for 10-digit interrupt numbers |
| LOW | | 5.5 | | CVE-2026-97928 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip the VMID 0 flush for VRAM |
| LOW | | 5.5 | | CVE-2026-97989 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: vduse: validate virtqueue alignment |
| LOW | | 5.5 | | CVE-2026-97997 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: virtio_ring: fix stale descriptor flags after a failed packed add |
| LOW | | 5.5 | | CVE-2026-98003 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: iommu/amd: Do not reallocate GA log buffers on resume |
| LOW | | 5.5 | | CVE-2026-98038 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Keep refcount_acquire nullable for borrowed RCU kptrs |
| LOW | | 5.5 | | CVE-2026-98044 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Reject legacy packet loads from callbacks |
| LOW | | 5.5 | | CVE-2026-98058 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Mark syscall helpers as sleepable |
| LOW | | 5.5 | | CVE-2026-98067 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: erofs: disable LZ4 rolling decompression for now |
| LOW | | 5.5 | | CVE-2026-98073 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: Remove conflicting altnames for dying netns in __dev_change_net_namespace() |
| LOW | | 5.5 | | CVE-2026-98079 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: btrfs: zstd: fix lost wakeup when waiting for a workspace |
| LOW | | 5.5 | | CVE-2026-98087 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate |
| LOW | | 5.5 | | CVE-2026-98119 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfs: break unbuffered write when netfs_alloc_subrequest() fails |
| LOW | | 5.5 | | CVE-2026-98147 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: printk: Don't WARN on kthread_run failure |
| LOW | | 5.5 | | CVE-2026-98148 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/gud: validate GUD_ROTATION_0 is present in supported rotations |
| LOW | | 7 | | CVE-2026-98176 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| LOW | | 5.5 | | CVE-2026-98177 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amdkfd: Avoid integer underflow in EOP ring size calculation |
| LOW | | 5.5 | | CVE-2026-98285 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| LOW | | 5.5 | | CVE-2026-98289 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: af_unix: Unify scc_index when finalising SCC in __unix_walk_scc() |
| LOW | | 5.5 | | CVE-2026-98304 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: bcmgenet: restore the hardware filters on open |
| LOW | | 5.5 | | CVE-2026-98317 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS |
| LOW | | 5.5 | | CVE-2026-98321 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: netfilter: nf_nat: unregister and release hooks on error |
| LOW | | 5.5 | | CVE-2026-98332 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: mac80211: only operate on TDLS peers in the TDLS code |
| LOW | | 5.5 | | CVE-2026-98338 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: ibss: ref BSS entry for joined event |
| LOW | | 5.5 | | CVE-2026-98389 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: drm/amdgpu: skip gfx switch_power_profile during GPU reset |
| LOW | | 5.5 | | CVE-2026-98393 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU |
| LOW | | 5.5 | | CVE-2026-98424 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: wifi: cfg80211: undo netns switch if renaming the wiphy fails |
| LOW | | 5.5 | | CVE-2026-98427 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: net/sched: codel: bound the dropping loop per dequeue call |
| LOW | | 5.5 | | CVE-2026-98431 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency |
| LOW | | 3.3 | | CVE-2026-98551 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: perf/core: Fill branch entries with a single assignment |
| LOW | | 2.3 | | CVE-2026-98628 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: bpf: Make post-verification instruction rewrites killable |
| LOW | | 2.5 | | CVE-2026-98682 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: smb: client: drain and invalidate before server-side copy/clone |
| LOW | | 2.5 | | CVE-2026-98683 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush dirty data before zeroing a range |
| LOW | | 2.5 | | CVE-2026-98684 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: smb: client: flush and commit data before querying allocated ranges |
| LOW | | 3.3 | | CVE-2026-98685 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: smb: client: discard post-EOF pagecache when extending a file via clone range |
| LOW | | 3.7 | | CVE-2026-98802 | linux-libc-dev | 1:6.18.34-1+rpt1 | | kernel: seg6: ensure packet data is writable before modifying SRH and IPv6 DA |
| LOW | | | | TEMP-0000000-F7A20F | linux-libc-dev | 1:6.18.34-1+rpt1 | | [Kernel: Unprivileged user can freeze journald] |
| LOW | | 5 | | CVE-2010-4756 | locales | 2.41-12+rpt1+deb13u3 | | glibc: glob implementation can cause excessive CPU and memory consumption due to crafted glob expressions |
| LOW | | 7.5 | | CVE-2018-20796 | locales | 2.41-12+rpt1+deb13u3 | | glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c |
| LOW | | 9.8 | | CVE-2019-1010022 | locales | 2.41-12+rpt1+deb13u3 | | glibc: stack guard protection bypass |
| LOW | | 8.8 | | CVE-2019-1010023 | locales | 2.41-12+rpt1+deb13u3 | | glibc: running ldd on malicious ELF leads to code execution because of wrong size computation |
| LOW | | 5.3 | | CVE-2019-1010024 | locales | 2.41-12+rpt1+deb13u3 | | glibc: ASLR bypass using cache of thread stack and heap |
| LOW | | 5.3 | | CVE-2019-1010025 | locales | 2.41-12+rpt1+deb13u3 | | glibc: information disclosure of heap addresses of pthread_created thread |
| LOW | | 7.5 | | CVE-2019-9192 | locales | 2.41-12+rpt1+deb13u3 | | glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c |
| LOW | | 3.7 | | CVE-2026-97399 | locales | 2.41-12+rpt1+deb13u3 | | glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp |
| LOW | | 4.9 | | CVE-2007-5686 | login.defs | 1:4.17.4-2 | | initscripts in rPath Linux 1 sets insecure permissions for the /var/lo ... |
| LOW | | 3.6 | | CVE-2024-56433 | login.defs | 1:4.17.4-2 | | shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise |
| LOW | | | | TEMP-0628843-DBAD28 | login.defs | 1:4.17.4-2 | | [more related to CVE-2005-4890] |
| LOW | | 5.5 | | CVE-2022-0563 | login | 1:4.16.0-2+really2.41-5 | | util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline |
| LOW | | 6.1 | | CVE-2025-14104 | login | 1:4.16.0-2+really2.41-5 | 2.41.3-1 | util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames |
| LOW | | 5.5 | | CVE-2022-0563 | mount | 2.41-5 | | util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline |
| LOW | | 6.1 | | CVE-2025-14104 | mount | 2.41-5 | 2.41.3-1 | util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames |
| LOW | | 3.3 | | CVE-2025-6141 | ncurses-base | 6.5+20250216-2 | | gnu-ncurses: ncurses Stack Buffer Overflow |
| LOW | | 3.3 | | CVE-2025-6141 | ncurses-bin | 6.5+20250216-2 | | gnu-ncurses: ncurses Stack Buffer Overflow |
| LOW | | 3.3 | | CVE-2025-6141 | ncurses-term | 6.5+20250216-2 | | gnu-ncurses: ncurses Stack Buffer Overflow |
| LOW | | 2.1 | | CVE-2002-1976 | net-tools | 2.10-1.3 | | ifconfig, when used on the Linux kernel 2.2 and later, does not report ... |
| LOW | | 3.3 | | CVE-2025-9615 | network-manager-l10n | 1.52.1-1+rpt4 | | NetworkManager: NetworkManager File Access |
| LOW | | 3.3 | | CVE-2025-9615 | network-manager | 1.52.1-1+rpt4 | | NetworkManager: NetworkManager File Access |
| LOW | | 5 | | CVE-2007-2243 | openssh-client | 1:10.0p1-7+deb13u4 | | OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabl ... |
| LOW | | 4.3 | | CVE-2007-2768 | openssh-client | 1:10.0p1-7+deb13u4 | | OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, a ... |
| LOW | | 6.5 | | CVE-2008-3234 | openssh-client | 1:10.0p1-7+deb13u4 | | sshd in OpenSSH 4 on Debian GNU/Linux, and the 20070303 OpenSSH snapsh ... |
| LOW | | 5.9 | | CVE-2016-20012 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: Public key information leak |
| LOW | | 5.3 | | CVE-2018-15919 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: User enumeration via malformed packets in authentication requests |
| LOW | | 6.8 | | CVE-2019-6110 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: Acceptance and display of arbitrary stderr allows for spoofing of scp client output |
| LOW | | 5.9 | | CVE-2020-14145 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: Observable discrepancy leading to an information leak in the algorithm negotiation |
| LOW | | 7.4 | | CVE-2020-15778 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: scp allows command injection when using backtick characters in the destination argument |
| LOW | | 3.7 | | CVE-2026-106582 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: openssh: Information disclosure via shared compression side-channel |
| LOW | | 3.3 | | CVE-2026-106584 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: openssh: Incorrect certificate expiration times via Daylight Saving Time mishandling |
| LOW | | 3.6 | | CVE-2026-106587 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Improper access control via misinterpretation of disabled configuration options |
| LOW | | 3.7 | | CVE-2026-55654 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: Heap out-of-bounds read in Red Hat Enterprise Linux versions of OpenSSH GSSAPI indicator cleanup due to missing |
| LOW | | 3.5 | | CVE-2026-73281 | openssh-client | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: ssh-agent allows remote execution of local operations |
| LOW | | 5 | | CVE-2007-2243 | openssh-server | 1:10.0p1-7+deb13u4 | | OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabl ... |
| LOW | | 4.3 | | CVE-2007-2768 | openssh-server | 1:10.0p1-7+deb13u4 | | OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, a ... |
| LOW | | 6.5 | | CVE-2008-3234 | openssh-server | 1:10.0p1-7+deb13u4 | | sshd in OpenSSH 4 on Debian GNU/Linux, and the 20070303 OpenSSH snapsh ... |
| LOW | | 5.9 | | CVE-2016-20012 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: Public key information leak |
| LOW | | 5.3 | | CVE-2018-15919 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: User enumeration via malformed packets in authentication requests |
| LOW | | 6.8 | | CVE-2019-6110 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: Acceptance and display of arbitrary stderr allows for spoofing of scp client output |
| LOW | | 5.9 | | CVE-2020-14145 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: Observable discrepancy leading to an information leak in the algorithm negotiation |
| LOW | | 7.4 | | CVE-2020-15778 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: scp allows command injection when using backtick characters in the destination argument |
| LOW | | 3.7 | | CVE-2026-106582 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: openssh: Information disclosure via shared compression side-channel |
| LOW | | 3.3 | | CVE-2026-106584 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: openssh: Incorrect certificate expiration times via Daylight Saving Time mishandling |
| LOW | | 3.6 | | CVE-2026-106587 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Improper access control via misinterpretation of disabled configuration options |
| LOW | | 3.7 | | CVE-2026-55654 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: Heap out-of-bounds read in Red Hat Enterprise Linux versions of OpenSSH GSSAPI indicator cleanup due to missing |
| LOW | | 3.5 | | CVE-2026-73281 | openssh-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: ssh-agent allows remote execution of local operations |
| LOW | | 5 | | CVE-2007-2243 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabl ... |
| LOW | | 4.3 | | CVE-2007-2768 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, a ... |
| LOW | | 6.5 | | CVE-2008-3234 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | sshd in OpenSSH 4 on Debian GNU/Linux, and the 20070303 OpenSSH snapsh ... |
| LOW | | 5.9 | | CVE-2016-20012 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: Public key information leak |
| LOW | | 5.3 | | CVE-2018-15919 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: User enumeration via malformed packets in authentication requests |
| LOW | | 6.8 | | CVE-2019-6110 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: Acceptance and display of arbitrary stderr allows for spoofing of scp client output |
| LOW | | 5.9 | | CVE-2020-14145 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: Observable discrepancy leading to an information leak in the algorithm negotiation |
| LOW | | 7.4 | | CVE-2020-15778 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: scp allows command injection when using backtick characters in the destination argument |
| LOW | | 3.7 | | CVE-2026-106582 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: openssh: Information disclosure via shared compression side-channel |
| LOW | | 3.3 | | CVE-2026-106584 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: openssh: Incorrect certificate expiration times via Daylight Saving Time mishandling |
| LOW | | 3.6 | | CVE-2026-106587 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Improper access control via misinterpretation of disabled configuration options |
| LOW | | 3.7 | | CVE-2026-55654 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: Heap out-of-bounds read in Red Hat Enterprise Linux versions of OpenSSH GSSAPI indicator cleanup due to missing |
| LOW | | 3.5 | | CVE-2026-73281 | openssh-sftp-server | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: ssh-agent allows remote execution of local operations |
| LOW | | 7.5 | | CVE-2026-14457 | openssl-provider-legacy | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: RPK server signature algorithm selection can dereference a missing certificate |
| LOW | | 3.7 | | CVE-2026-35189 | openssl-provider-legacy | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: openssl: Denial of Service via excessive memory allocation in CRL distribution point processing |
| LOW | | 3.7 | | CVE-2026-35191 | openssl-provider-legacy | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: openssl: Traffic amplification Denial of Service via QUIC packet over-accounting |
| LOW | | 7.5 | | CVE-2026-54874 | openssl-provider-legacy | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: excessive memory use buffering DTLS records for a future epoch |
| LOW | | 5.9 | | CVE-2026-63073 | openssl-provider-legacy | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: untrusted sender DN used as format string in CMP response validation |
| LOW | | 7.5 | | CVE-2026-63074 | openssl-provider-legacy | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: CMP indefinite cache growth of ExtraCerts |
| LOW | | 7.5 | | CVE-2026-63075 | openssl-provider-legacy | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: QUIC ACK-only packet retention can cause memory exhaustion |
| LOW | | 3.7 | | CVE-2026-75803 | openssl-provider-legacy | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher() |
| LOW | | 7.5 | | CVE-2026-14457 | openssl | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: RPK server signature algorithm selection can dereference a missing certificate |
| LOW | | 3.7 | | CVE-2026-35189 | openssl | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: openssl: Denial of Service via excessive memory allocation in CRL distribution point processing |
| LOW | | 3.7 | | CVE-2026-35191 | openssl | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u3 | openssl: openssl: Traffic amplification Denial of Service via QUIC packet over-accounting |
| LOW | | 7.5 | | CVE-2026-54874 | openssl | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: excessive memory use buffering DTLS records for a future epoch |
| LOW | | 5.9 | | CVE-2026-63073 | openssl | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: untrusted sender DN used as format string in CMP response validation |
| LOW | | 7.5 | | CVE-2026-63074 | openssl | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: CMP indefinite cache growth of ExtraCerts |
| LOW | | 7.5 | | CVE-2026-63075 | openssl | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: QUIC ACK-only packet retention can cause memory exhaustion |
| LOW | | 3.7 | | CVE-2026-75803 | openssl | 3.5.6-1~deb13u2+rpt1 | 3.5.7-1~deb13u2 | openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher() |
| LOW | | 4.9 | | CVE-2007-5686 | passwd | 1:4.17.4-2 | | initscripts in rPath Linux 1 sets insecure permissions for the /var/lo ... |
| LOW | | 3.6 | | CVE-2024-56433 | passwd | 1:4.17.4-2 | | shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise |
| LOW | | | | TEMP-0628843-DBAD28 | passwd | 1:4.17.4-2 | | [more related to CVE-2005-4890] |
| LOW | | 5.8 | | CVE-2010-4651 | patch | 2.8-2 | | patch: directory traversal flaw allows for arbitrary file creation |
| LOW | | 7.5 | | CVE-2018-6951 | patch | 2.8-2 | | patch: NULL pointer dereference in pch.c:intuit_diff_type() causes a crash |
| LOW | | 7.5 | | CVE-2018-6952 | patch | 2.8-2 | | patch: Double free of memory in pch.c:another_hunk() causes a crash |
| LOW | | 5.5 | | CVE-2021-45261 | patch | 2.8-2 | | patch: Invalid Pointer via another_hunk function |
| LOW | | 5.5 | | CVE-2026-56288 | patch | 2.8-2 | | patch: GNU patch: Denial of Service via specially crafted patch file |
| LOW | | 5.5 | | CVE-2026-56289 | patch | 2.8-2 | | patch: GNU patch: Denial of Service via crafted unified-diff input |
| LOW | | 3.3 | | CVE-2011-4116 | perl-base | 5.40.1-6 | | perl: File:: Temp insecure temporary file handling |
| LOW | | 3.3 | | CVE-2011-4116 | perl-modules-5.40 | 5.40.1-6 | | perl: File:: Temp insecure temporary file handling |
| LOW | | 3.3 | | CVE-2011-4116 | perl | 5.40.1-6 | | perl: File:: Temp insecure temporary file handling |
| LOW | | 6.7 | | CVE-2025-7519 | polkitd | 126-2 | | polkit: XML policy file with a large number of nested elements may lead to out-of-bounds write |
| LOW | | 6.9 | | CVE-2008-5366 | ppp | 2.5.2-1+1 | | The postinst script in ppp 2.4.4rel on Debian GNU/Linux allows local u ... |
| LOW | | 6.9 | | CVE-2008-5367 | ppp | 2.5.2-1+1 | | ip-up in ppp-udeb 2.4.4rel on Debian GNU/Linux allows local users to o ... |
| LOW | | 5.3 | | CVE-2026-112300 | python3-configobj | 5.0.9-1 | | configobj: configobj: Denial of Service via inefficient regular expression evaluation |
| LOW | | 9.8 | | CVE-2019-8341 | python3-jinja2 | 3.1.6-1 | | python-jinja2: command injection in function from_string |
| LOW | | | | CVE-2025-45768 | python3-jwt | 2.10.1-2+deb13u1 | | pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is ... |
| LOW | | 3.9 | | CVE-2026-1703 | python3-pip-whl | 25.1.1+dfsg-1+rpt1 | | pip: pip: Information disclosure via path traversal when installing crafted wheel archives |
| LOW | | 3.3 | | CVE-2026-4539 | python3-pygments | 2.18.0+dfsg-2 | | pygments: Pygments: Denial of Service via inefficient regular expression processing in AdlLexer |
| LOW | | | | CVE-2026-115557 | python3.13-minimal | 3.13.5-2+deb13u2 | | Python has added a denylist for known compromised certificates to the ... |
| LOW | | 7.8 | | CVE-2026-12003 | python3.13-minimal | 3.13.5-2+deb13u2 | | python: Python: Privilege escalation due to insecure VPATH handling in Windows legacy installers |
| LOW | | 2.8 | | CVE-2026-18503 | python3.13-minimal | 3.13.5-2+deb13u2 | | python: Python: Denial of Service via super-linear regular expression work in csv.Sniffer.sniff() |
| LOW | | 3.3 | | CVE-2026-3479 | python3.13-minimal | 3.13.5-2+deb13u2 | | python: Python pkgutil.get_data(): Path Traversal via improper resource argument validation |
| LOW | | 2.2 | | CVE-2026-6879 | python3.13-minimal | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: Python: Performance degradation in XML processing due to quadratic time complexity |
| LOW | | | | CVE-2026-115557 | python3.13-venv | 3.13.5-2+deb13u2 | | Python has added a denylist for known compromised certificates to the ... |
| LOW | | 7.8 | | CVE-2026-12003 | python3.13-venv | 3.13.5-2+deb13u2 | | python: Python: Privilege escalation due to insecure VPATH handling in Windows legacy installers |
| LOW | | 2.8 | | CVE-2026-18503 | python3.13-venv | 3.13.5-2+deb13u2 | | python: Python: Denial of Service via super-linear regular expression work in csv.Sniffer.sniff() |
| LOW | | 3.3 | | CVE-2026-3479 | python3.13-venv | 3.13.5-2+deb13u2 | | python: Python pkgutil.get_data(): Path Traversal via improper resource argument validation |
| LOW | | 2.2 | | CVE-2026-6879 | python3.13-venv | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: Python: Performance degradation in XML processing due to quadratic time complexity |
| LOW | | | | CVE-2026-115557 | python3.13 | 3.13.5-2+deb13u2 | | Python has added a denylist for known compromised certificates to the ... |
| LOW | | 7.8 | | CVE-2026-12003 | python3.13 | 3.13.5-2+deb13u2 | | python: Python: Privilege escalation due to insecure VPATH handling in Windows legacy installers |
| LOW | | 2.8 | | CVE-2026-18503 | python3.13 | 3.13.5-2+deb13u2 | | python: Python: Denial of Service via super-linear regular expression work in csv.Sniffer.sniff() |
| LOW | | 3.3 | | CVE-2026-3479 | python3.13 | 3.13.5-2+deb13u2 | | python: Python pkgutil.get_data(): Path Traversal via improper resource argument validation |
| LOW | | 2.2 | | CVE-2026-6879 | python3.13 | 3.13.5-2+deb13u2 | 3.13.5-2+deb13u5 | python: Python: Performance degradation in XML processing due to quadratic time complexity |
| LOW | | 5.5 | | CVE-2022-0563 | rfkill | 2.41-5 | | util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline |
| LOW | | 6.1 | | CVE-2025-14104 | rfkill | 2.41-5 | 2.41.3-1 | util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames |
| LOW | | 5.9 | | CVE-2026-45232 | rsync | 3.4.1+ds1-5+deb13u3 | 3.4.1+ds1-5+deb13u4 | rsync: Rsync: Denial of Service via malformed HTTP proxy response |
| LOW | | 5 | | CVE-2007-2243 | ssh | 1:10.0p1-7+deb13u4 | | OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabl ... |
| LOW | | 4.3 | | CVE-2007-2768 | ssh | 1:10.0p1-7+deb13u4 | | OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, a ... |
| LOW | | 6.5 | | CVE-2008-3234 | ssh | 1:10.0p1-7+deb13u4 | | sshd in OpenSSH 4 on Debian GNU/Linux, and the 20070303 OpenSSH snapsh ... |
| LOW | | 5.9 | | CVE-2016-20012 | ssh | 1:10.0p1-7+deb13u4 | | openssh: Public key information leak |
| LOW | | 5.3 | | CVE-2018-15919 | ssh | 1:10.0p1-7+deb13u4 | | openssh: User enumeration via malformed packets in authentication requests |
| LOW | | 6.8 | | CVE-2019-6110 | ssh | 1:10.0p1-7+deb13u4 | | openssh: Acceptance and display of arbitrary stderr allows for spoofing of scp client output |
| LOW | | 5.9 | | CVE-2020-14145 | ssh | 1:10.0p1-7+deb13u4 | | openssh: Observable discrepancy leading to an information leak in the algorithm negotiation |
| LOW | | 7.4 | | CVE-2020-15778 | ssh | 1:10.0p1-7+deb13u4 | | openssh: scp allows command injection when using backtick characters in the destination argument |
| LOW | | 3.7 | | CVE-2026-106582 | ssh | 1:10.0p1-7+deb13u4 | | openssh: openssh: Information disclosure via shared compression side-channel |
| LOW | | 3.3 | | CVE-2026-106584 | ssh | 1:10.0p1-7+deb13u4 | | openssh: openssh: Incorrect certificate expiration times via Daylight Saving Time mishandling |
| LOW | | 3.6 | | CVE-2026-106587 | ssh | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: Improper access control via misinterpretation of disabled configuration options |
| LOW | | 3.7 | | CVE-2026-55654 | ssh | 1:10.0p1-7+deb13u4 | | openssh: Heap out-of-bounds read in Red Hat Enterprise Linux versions of OpenSSH GSSAPI indicator cleanup due to missing |
| LOW | | 3.5 | | CVE-2026-73281 | ssh | 1:10.0p1-7+deb13u4 | | openssh: OpenSSH: ssh-agent allows remote execution of local operations |
| LOW | | 2.1 | | CVE-2005-1119 | sudo | 1.9.16p2-3+deb13u2 | | Sudo VISudo 1.6.8 and earlier allows local users to corrupt arbitrary ... |
| LOW | | 7.8 | | CVE-2026-82474 | sudo | 1.9.16p2-3+deb13u2 | | sudo: Sudo: Policy bypass allows unauthorized program execution via execveat |
| LOW | | 3.3 | | CVE-2013-4392 | systemd-sysv | 257.13-1~deb13u1 | | systemd: TOCTOU race condition when updating file permissions and SELinux security contexts |
| LOW | | 5.3 | | CVE-2023-31437 | systemd-sysv | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can modify a seale ... |
| LOW | | 5.3 | | CVE-2023-31438 | systemd-sysv | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can truncate a sea ... |
| LOW | | 5.3 | | CVE-2023-31439 | systemd-sysv | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can modify the con ... |
| LOW | | 3.3 | | CVE-2026-40228 | systemd-sysv | 257.13-1~deb13u1 | | systemd: systemd-journald: Unintended output to user terminals via logger command |
| LOW | | 3.3 | | CVE-2013-4392 | systemd-timesyncd | 257.13-1~deb13u1 | | systemd: TOCTOU race condition when updating file permissions and SELinux security contexts |
| LOW | | 5.3 | | CVE-2023-31437 | systemd-timesyncd | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can modify a seale ... |
| LOW | | 5.3 | | CVE-2023-31438 | systemd-timesyncd | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can truncate a sea ... |
| LOW | | 5.3 | | CVE-2023-31439 | systemd-timesyncd | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can modify the con ... |
| LOW | | 3.3 | | CVE-2026-40228 | systemd-timesyncd | 257.13-1~deb13u1 | | systemd: systemd-journald: Unintended output to user terminals via logger command |
| LOW | | 3.3 | | CVE-2013-4392 | systemd | 257.13-1~deb13u1 | | systemd: TOCTOU race condition when updating file permissions and SELinux security contexts |
| LOW | | 5.3 | | CVE-2023-31437 | systemd | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can modify a seale ... |
| LOW | | 5.3 | | CVE-2023-31438 | systemd | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can truncate a sea ... |
| LOW | | 5.3 | | CVE-2023-31439 | systemd | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can modify the con ... |
| LOW | | 3.3 | | CVE-2026-40228 | systemd | 257.13-1~deb13u1 | | systemd: systemd-journald: Unintended output to user terminals via logger command |
| LOW | | | | TEMP-0517018-A83CE6 | sysvinit-utils | 3.14-4 | | [sysvinit: no-root option in expert installer exposes locally exploitable security flaw] |
| LOW | | 10 | | CVE-2005-2541 | tar | 1.35+dfsg-3.1 | | tar: does not properly warn the user when extracting setuid or setgid files |
| LOW | | | | TEMP-0290435-0B57B5 | tar | 1.35+dfsg-3.1 | | [tar's rmt command may have undesired side effects] |
| LOW | | 3.3 | | CVE-2013-4392 | udev | 257.13-1~deb13u1 | | systemd: TOCTOU race condition when updating file permissions and SELinux security contexts |
| LOW | | 5.3 | | CVE-2023-31437 | udev | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can modify a seale ... |
| LOW | | 5.3 | | CVE-2023-31438 | udev | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can truncate a sea ... |
| LOW | | 5.3 | | CVE-2023-31439 | udev | 257.13-1~deb13u1 | | An issue was discovered in systemd 253. An attacker can modify the con ... |
| LOW | | 3.3 | | CVE-2026-40228 | udev | 257.13-1~deb13u1 | | systemd: systemd-journald: Unintended output to user terminals via logger command |
| LOW | | 3.3 | | CVE-2021-4217 | unzip | 6.0-29 | | unzip: Null pointer dereference in Unicode strings code |
| LOW | | | | TEMP-1142904-117334 | unzip | 6.0-29 | 6.0-29+deb13u1 | [heap OOB read in EF_IZUNIX3 extra field handler] |
| LOW | | | | TEMP-1142905-081994 | unzip | 6.0-29 | 6.0-29+deb13u1 | [stack out-of-bounds NUL write in EF_SMARTZIP handler] |
| LOW | | 5.5 | | CVE-2022-0563 | util-linux | 2.41-5 | | util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline |
| LOW | | 6.1 | | CVE-2025-14104 | util-linux | 2.41-5 | 2.41.3-1 | util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames |
| LOW | | 4.3 | | CVE-2008-4677 | vim-common | 2:9.1.1230-2 | | vim: netrw plugin: FTP username and password disclosure |
| LOW | | 5.5 | | CVE-2017-1000382 | vim-common | 2:9.1.1230-2 | | vim: Ignores umask when creating a swap file |
| LOW | | 6.6 | | CVE-2026-28419 | vim-common | 2:9.1.1230-2 | | vim: Vim: Information disclosure and denial of service via malformed tags file |
| LOW | | 2.2 | | CVE-2026-28422 | vim-common | 2:9.1.1230-2 | | vim: Vim: Integrity impact due to stack-buffer-overflow via wide terminal statusline rendering |
| LOW | | 5.5 | | CVE-2026-32249 | vim-common | 2:9.1.1230-2 | | vim: NFA regex engine NULL pointer dereference |
| LOW | | 8.2 | | CVE-2026-52859 | vim-common | 2:9.1.1230-2 | | vim: Vim: Denial of Service via out-of-bounds write in terminal handling |
| LOW | | 4.3 | | CVE-2008-4677 | vim-tiny | 2:9.1.1230-2 | | vim: netrw plugin: FTP username and password disclosure |
| LOW | | 5.5 | | CVE-2017-1000382 | vim-tiny | 2:9.1.1230-2 | | vim: Ignores umask when creating a swap file |
| LOW | | 6.6 | | CVE-2026-28419 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Information disclosure and denial of service via malformed tags file |
| LOW | | 2.2 | | CVE-2026-28422 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Integrity impact due to stack-buffer-overflow via wide terminal statusline rendering |
| LOW | | 5.5 | | CVE-2026-32249 | vim-tiny | 2:9.1.1230-2 | | vim: NFA regex engine NULL pointer dereference |
| LOW | | 8.2 | | CVE-2026-52859 | vim-tiny | 2:9.1.1230-2 | | vim: Vim: Denial of Service via out-of-bounds write in terminal handling |
| LOW | | 6.5 | | CVE-2026-16599 | wget | 1.25.0-2 | | wget: wget: Denial of Service via crafted FTP OPIE/S-KEY authentication challenge |
| LOW | | 8.1 | | CVE-2017-13084 | wpasupplicant | 2:2.10-24 | | wpa_supplicant: reinstallation of the STK key in the PeerKey handshake |
| LOW | | 6.5 | | CVE-2019-5062 | wpasupplicant | 2:2.10-24 | | An exploitable denial-of-service vulnerability exists in the 802.11w s ... |
| LOW | | 7.8 | | CVE-2017-15131 | xdg-user-dirs | 0.18-2 | | gnome-session: Xsession creation of XDG user directories does not honor system umask policy |
| LOW | | 9.8 | | CVE-2026-56857 | stdlib | 1.26.4 | 1.26.9, 1.27.2 | os: golang: golang: Directory traversal via Windows junction handling |
| LOW | | 7.4 | | CVE-2024-12797 | cryptography | 43.0.0 | 44.0.1 | openssl: RFC7250 handshakes with unauthenticated servers don't abort as expected |
| LOW | | 5.3 | | CVE-2026-34073 | cryptography | 43.0.0 | 46.0.6 | python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation |
| LOW | | 3.9 | | CVE-2026-1703 | pip | 25.1.1 | 26.0 | pip: pip: Information disclosure via path traversal when installing crafted wheel archives |
| LOW | | 3.3 | | CVE-2026-4539 | pygments | 2.18.0 | 2.20.0 | pygments: Pygments: Denial of Service via inefficient regular expression processing in AdlLexer |
| LOW | | 5.9 | | CVE-2026-48524 | pyjwt | 2.10.1 | 2.13.0 | python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs |
| LOW | | | | GHSA-xmj3-9gf7-h52w | setuptools | 78.1.1 | 84.1.0 | setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description |
| UNKNOWN | | | | CVE-2026-48112 | 7zip | 25.01+dfsg-1~deb13u2 | | 7-Zip is a file archiver with a high compression ratio. Versions 9.18 ... |
| UNKNOWN | | | | CVE-2025-32735 | firmware-atheros | 1:20250410-2+rpt1 | | Improper conditions check in some firmware for some Intel(R) NPU Drive ... |
| UNKNOWN | | | | CVE-2025-32735 | firmware-brcm80211 | 1:20250410-2+rpt1 | | Improper conditions check in some firmware for some Intel(R) NPU Drive ... |
| UNKNOWN | | | | CVE-2025-32735 | firmware-libertas | 1:20250410-2+rpt1 | | Improper conditions check in some firmware for some Intel(R) NPU Drive ... |
| UNKNOWN | | | | CVE-2025-32735 | firmware-mediatek | 1:20250410-2+rpt1 | | Improper conditions check in some firmware for some Intel(R) NPU Drive ... |
| UNKNOWN | | | | CVE-2025-32735 | firmware-realtek | 1:20250410-2+rpt1 | | Improper conditions check in some firmware for some Intel(R) NPU Drive ... |
| UNKNOWN | | | | TEMP-0000000-096B8D | groff-base | 1.23.0-9 | | [groff issues] |
| UNKNOWN | | | | CVE-2026-115506 | libexpat1 | 2.7.1-2 | | libexpat through 2.9.0 contains a denial of service vulnerability beca ... |
| UNKNOWN | | | | TEMP-1147318-639065 | liblzma5 | 5.8.1-1 | 5.8.1-1+deb13u2 | [GHSA-5qpq-xqfv-j9pg: Invalid write if a decoder is reinitialized after allocation failure] |
| UNKNOWN | | | | TEMP-0000000-001B0E | libntfs-3g89t64 | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u3 | [GHSA-r6xj-6488-p8mv: NTFS-3G-SA_2026-06-1_05] |
| UNKNOWN | | | | TEMP-0000000-17A9B4 | libntfs-3g89t64 | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u3 | [GHSA-wf3w-fjjg-x4w3: NTFS-3G-SA_2026-06-1_08] |
| UNKNOWN | | | | TEMP-0000000-37DA2F | libntfs-3g89t64 | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u3 | [GHSA-mc3c-983p-wqm8: NTFS-3G-SA_2026-06-1_07] |
| UNKNOWN | | | | TEMP-0000000-52FEFD | libntfs-3g89t64 | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u3 | [GHSA-x98j-3g35-f59x: NTFS-3G-SA_2026-06-1_19] |
| UNKNOWN | | | | TEMP-0000000-575F54 | libntfs-3g89t64 | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u3 | [GHSA-2c97-47cr-9xr8: NTFS-3G-SA_2026-06-1_10] |
| UNKNOWN | | | | TEMP-0000000-724ECC | libntfs-3g89t64 | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u3 | [GHSA-jcjj-9262-6j6p: NTFS-3G-SA_2026-06-1_12] |
| UNKNOWN | | | | TEMP-0000000-B9374C | libntfs-3g89t64 | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u3 | [GHSA-pc48-m7cx-qf72: NTFS-3G-SA_2026-06-1_20] |
| UNKNOWN | | | | TEMP-0000000-D7723D | libntfs-3g89t64 | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u3 | [GHSA-xrvx-6jrp-4q3x: NTFS-3G-SA_2026-06-1_11] |
| UNKNOWN | | | | CVE-2026-82560 | libperl5.40 | 5.40.1-6 | | Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhausti ... |
| UNKNOWN | | | | CVE-2026-114583 | libpython3.13-minimal | 3.13.5-2+deb13u2 | | tarfile.tar_filter could be bypassed using crafted link entries, inclu ... |
| UNKNOWN | | | | CVE-2026-114583 | libpython3.13-stdlib | 3.13.5-2+deb13u2 | | tarfile.tar_filter could be bypassed using crafted link entries, inclu ... |
| UNKNOWN | | | | CVE-2026-114583 | libpython3.13 | 3.13.5-2+deb13u2 | | tarfile.tar_filter could be bypassed using crafted link entries, inclu ... |
| UNKNOWN | | | | CVE-2026-16762 | libqt6core6t64 | 6.8.2+dfsg-9+deb13u2 | | An attacker able to supply a crafted XML document to an application us ... |
| UNKNOWN | | | | CVE-2026-98874 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98875 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98878 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-98883 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98894 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98897 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-98914 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98916 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98917 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| UNKNOWN | | | | CVE-2026-98924 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98926 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98929 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| UNKNOWN | | | | CVE-2026-98932 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: E ... |
| UNKNOWN | | | | CVE-2026-98942 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98946 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98951 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-98954 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98958 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98966 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| UNKNOWN | | | | CVE-2026-98972 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: c ... |
| UNKNOWN | | | | CVE-2026-98974 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98975 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98977 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98978 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98981 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98983 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: u ... |
| UNKNOWN | | | | CVE-2026-98985 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98989 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98993 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98996 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98999 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99002 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99009 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99014 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99019 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99021 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-99026 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99027 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99028 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99041 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99044 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99076 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99077 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99082 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: K ... |
| UNKNOWN | | | | CVE-2026-99083 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-99085 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99086 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99087 | linux-base-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98874 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98875 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98878 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-98883 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98894 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98897 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-98914 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98916 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98917 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| UNKNOWN | | | | CVE-2026-98924 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98926 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98929 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| UNKNOWN | | | | CVE-2026-98932 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: E ... |
| UNKNOWN | | | | CVE-2026-98942 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98946 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98951 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-98954 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98958 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98966 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| UNKNOWN | | | | CVE-2026-98972 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: c ... |
| UNKNOWN | | | | CVE-2026-98974 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98975 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98977 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98978 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98981 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98983 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: u ... |
| UNKNOWN | | | | CVE-2026-98985 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98989 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98993 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98996 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98999 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99002 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99009 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99014 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99019 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99021 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-99026 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99027 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99028 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99041 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99044 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99076 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99077 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99082 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: K ... |
| UNKNOWN | | | | CVE-2026-99083 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-99085 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99086 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99087 | linux-base-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98874 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98875 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98878 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-98883 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98894 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98897 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-98914 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98916 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98917 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| UNKNOWN | | | | CVE-2026-98924 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98926 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98929 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| UNKNOWN | | | | CVE-2026-98932 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: E ... |
| UNKNOWN | | | | CVE-2026-98942 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98946 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98951 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-98954 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98958 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98966 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| UNKNOWN | | | | CVE-2026-98972 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: c ... |
| UNKNOWN | | | | CVE-2026-98974 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98975 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98977 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98978 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98981 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98983 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: u ... |
| UNKNOWN | | | | CVE-2026-98985 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98989 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98993 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98996 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98999 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99002 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99009 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99014 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99019 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99021 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-99026 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99027 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99028 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99041 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99044 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99076 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99077 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99082 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: K ... |
| UNKNOWN | | | | CVE-2026-99083 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-99085 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99086 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99087 | linux-base-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98874 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98875 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98878 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-98883 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98894 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98897 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-98914 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98916 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98917 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| UNKNOWN | | | | CVE-2026-98924 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98926 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98929 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| UNKNOWN | | | | CVE-2026-98932 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: E ... |
| UNKNOWN | | | | CVE-2026-98942 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98946 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98951 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-98954 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98958 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98966 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| UNKNOWN | | | | CVE-2026-98972 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: c ... |
| UNKNOWN | | | | CVE-2026-98974 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98975 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98977 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98978 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98981 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98983 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: u ... |
| UNKNOWN | | | | CVE-2026-98985 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98989 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98993 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98996 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98999 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99002 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99009 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99014 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99019 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99021 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-99026 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99027 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99028 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99041 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99044 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99076 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99077 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99082 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: K ... |
| UNKNOWN | | | | CVE-2026-99083 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-99085 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99086 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99087 | linux-base-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98874 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98875 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98878 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-98883 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98894 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98897 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-98914 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98916 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98917 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| UNKNOWN | | | | CVE-2026-98924 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98926 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98929 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| UNKNOWN | | | | CVE-2026-98932 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: E ... |
| UNKNOWN | | | | CVE-2026-98942 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98946 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98951 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-98954 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98958 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98966 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| UNKNOWN | | | | CVE-2026-98972 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: c ... |
| UNKNOWN | | | | CVE-2026-98974 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98975 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98977 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98978 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98981 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98983 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: u ... |
| UNKNOWN | | | | CVE-2026-98985 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98989 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98993 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98996 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98999 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99002 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99009 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99014 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99019 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99021 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-99026 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99027 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99028 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99041 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99044 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99076 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99077 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99082 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: K ... |
| UNKNOWN | | | | CVE-2026-99083 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-99085 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99086 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99087 | linux-headers-6.18.34+rpt-common-rpi | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98874 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98875 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98878 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-98883 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98894 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98897 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-98914 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98916 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98917 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| UNKNOWN | | | | CVE-2026-98924 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98926 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98929 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| UNKNOWN | | | | CVE-2026-98932 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: E ... |
| UNKNOWN | | | | CVE-2026-98942 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98946 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98951 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-98954 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98958 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98966 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| UNKNOWN | | | | CVE-2026-98972 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: c ... |
| UNKNOWN | | | | CVE-2026-98974 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98975 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98977 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98978 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98981 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98983 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: u ... |
| UNKNOWN | | | | CVE-2026-98985 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98989 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98993 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98996 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98999 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99002 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99009 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99014 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99019 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99021 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-99026 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99027 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99028 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99041 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99044 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99076 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99077 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99082 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: K ... |
| UNKNOWN | | | | CVE-2026-99083 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-99085 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99086 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99087 | linux-headers-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98874 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98875 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98878 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-98883 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98894 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98897 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-98914 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98916 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98917 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| UNKNOWN | | | | CVE-2026-98924 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98926 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98929 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| UNKNOWN | | | | CVE-2026-98932 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: E ... |
| UNKNOWN | | | | CVE-2026-98942 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98946 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98951 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-98954 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98958 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98966 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| UNKNOWN | | | | CVE-2026-98972 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: c ... |
| UNKNOWN | | | | CVE-2026-98974 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98975 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98977 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98978 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98981 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98983 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: u ... |
| UNKNOWN | | | | CVE-2026-98985 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98989 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98993 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98996 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98999 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99002 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99009 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99014 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99019 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99021 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-99026 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99027 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99028 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99041 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99044 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99076 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99077 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99082 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: K ... |
| UNKNOWN | | | | CVE-2026-99083 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-99085 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99086 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99087 | linux-headers-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98874 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98875 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98878 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-98883 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98894 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98897 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-98914 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98916 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98917 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| UNKNOWN | | | | CVE-2026-98924 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98926 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98929 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| UNKNOWN | | | | CVE-2026-98932 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: E ... |
| UNKNOWN | | | | CVE-2026-98942 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98946 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98951 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-98954 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98958 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98966 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| UNKNOWN | | | | CVE-2026-98972 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: c ... |
| UNKNOWN | | | | CVE-2026-98974 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98975 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98977 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98978 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98981 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98983 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: u ... |
| UNKNOWN | | | | CVE-2026-98985 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98989 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98993 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98996 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98999 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99002 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99009 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99014 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99019 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99021 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-99026 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99027 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99028 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99041 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99044 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99076 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99077 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99082 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: K ... |
| UNKNOWN | | | | CVE-2026-99083 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-99085 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99086 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99087 | linux-headers-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98874 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98875 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98878 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-98883 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98894 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98897 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-98914 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98916 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98917 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| UNKNOWN | | | | CVE-2026-98924 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98926 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98929 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| UNKNOWN | | | | CVE-2026-98932 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: E ... |
| UNKNOWN | | | | CVE-2026-98942 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98946 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98951 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-98954 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98958 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98966 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| UNKNOWN | | | | CVE-2026-98972 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: c ... |
| UNKNOWN | | | | CVE-2026-98974 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98975 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98977 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98978 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98981 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98983 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: u ... |
| UNKNOWN | | | | CVE-2026-98985 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98989 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98993 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98996 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98999 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99002 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99009 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99014 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99019 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99021 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-99026 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99027 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99028 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99041 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99044 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99076 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99077 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99082 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: K ... |
| UNKNOWN | | | | CVE-2026-99083 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-99085 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99086 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99087 | linux-headers-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98874 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98875 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98878 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-98883 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98894 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98897 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-98914 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98916 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98917 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| UNKNOWN | | | | CVE-2026-98924 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98926 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98929 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| UNKNOWN | | | | CVE-2026-98932 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: E ... |
| UNKNOWN | | | | CVE-2026-98942 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98946 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98951 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-98954 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98958 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98966 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| UNKNOWN | | | | CVE-2026-98972 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: c ... |
| UNKNOWN | | | | CVE-2026-98974 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98975 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98977 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98978 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98981 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98983 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: u ... |
| UNKNOWN | | | | CVE-2026-98985 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98989 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98993 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98996 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98999 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99002 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99009 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99014 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99019 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99021 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-99026 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99027 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99028 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99041 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99044 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99076 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99077 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99082 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: K ... |
| UNKNOWN | | | | CVE-2026-99083 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-99085 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99086 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99087 | linux-image-6.18.34+rpt-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98874 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98875 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98878 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-98883 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98894 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98897 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-98914 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98916 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98917 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| UNKNOWN | | | | CVE-2026-98924 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98926 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98929 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| UNKNOWN | | | | CVE-2026-98932 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: E ... |
| UNKNOWN | | | | CVE-2026-98942 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98946 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98951 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-98954 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98958 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98966 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| UNKNOWN | | | | CVE-2026-98972 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: c ... |
| UNKNOWN | | | | CVE-2026-98974 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98975 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98977 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98978 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98981 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98983 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: u ... |
| UNKNOWN | | | | CVE-2026-98985 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98989 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98993 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98996 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98999 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99002 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99009 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99014 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99019 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99021 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-99026 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99027 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99028 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99041 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99044 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99076 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99077 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99082 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: K ... |
| UNKNOWN | | | | CVE-2026-99083 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-99085 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99086 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99087 | linux-image-6.18.34+rpt-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98874 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98875 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98878 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-98883 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98894 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98897 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-98914 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98916 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98917 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| UNKNOWN | | | | CVE-2026-98924 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98926 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98929 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| UNKNOWN | | | | CVE-2026-98932 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: E ... |
| UNKNOWN | | | | CVE-2026-98942 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98946 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98951 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-98954 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98958 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98966 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| UNKNOWN | | | | CVE-2026-98972 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: c ... |
| UNKNOWN | | | | CVE-2026-98974 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98975 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98977 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98978 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98981 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98983 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: u ... |
| UNKNOWN | | | | CVE-2026-98985 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98989 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98993 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98996 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98999 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99002 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99009 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99014 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99019 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99021 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-99026 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99027 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99028 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99041 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99044 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99076 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99077 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99082 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: K ... |
| UNKNOWN | | | | CVE-2026-99083 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-99085 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99086 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99087 | linux-image-rpi-2712 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98874 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98875 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98878 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-98883 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98894 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98897 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-98914 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98916 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98917 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| UNKNOWN | | | | CVE-2026-98924 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98926 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98929 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| UNKNOWN | | | | CVE-2026-98932 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: E ... |
| UNKNOWN | | | | CVE-2026-98942 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98946 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98951 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-98954 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98958 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98966 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| UNKNOWN | | | | CVE-2026-98972 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: c ... |
| UNKNOWN | | | | CVE-2026-98974 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98975 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98977 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98978 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98981 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98983 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: u ... |
| UNKNOWN | | | | CVE-2026-98985 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98989 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98993 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98996 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98999 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99002 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99009 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99014 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99019 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99021 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-99026 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99027 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99028 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99041 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99044 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99076 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99077 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99082 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: K ... |
| UNKNOWN | | | | CVE-2026-99083 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-99085 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99086 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99087 | linux-image-rpi-v8 | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98874 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98875 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98878 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-98883 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98894 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98897 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-98914 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98916 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98917 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| UNKNOWN | | | | CVE-2026-98924 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98926 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98929 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| UNKNOWN | | | | CVE-2026-98932 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: E ... |
| UNKNOWN | | | | CVE-2026-98942 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98946 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98951 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-98954 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98958 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98966 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| UNKNOWN | | | | CVE-2026-98972 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: c ... |
| UNKNOWN | | | | CVE-2026-98974 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98975 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98977 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98978 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98981 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98983 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: u ... |
| UNKNOWN | | | | CVE-2026-98985 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98989 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98993 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98996 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98999 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99002 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99009 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99014 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99019 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99021 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-99026 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99027 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99028 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99041 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99044 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99076 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99077 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99082 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: K ... |
| UNKNOWN | | | | CVE-2026-99083 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-99085 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99086 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99087 | linux-kbuild-6.18.34+rpt | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98874 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98875 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98878 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-98883 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98894 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98897 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-98914 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98916 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98917 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: p ... |
| UNKNOWN | | | | CVE-2026-98924 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98926 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98929 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: m ... |
| UNKNOWN | | | | CVE-2026-98932 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: E ... |
| UNKNOWN | | | | CVE-2026-98942 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-98946 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-98951 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-98954 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98958 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: w ... |
| UNKNOWN | | | | CVE-2026-98966 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: b ... |
| UNKNOWN | | | | CVE-2026-98972 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: c ... |
| UNKNOWN | | | | CVE-2026-98974 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98975 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: x ... |
| UNKNOWN | | | | CVE-2026-98977 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98978 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98981 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98983 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: u ... |
| UNKNOWN | | | | CVE-2026-98985 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98989 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98993 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-98996 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: f ... |
| UNKNOWN | | | | CVE-2026-98999 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99002 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99009 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99014 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: B ... |
| UNKNOWN | | | | CVE-2026-99019 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99021 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: r ... |
| UNKNOWN | | | | CVE-2026-99026 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99027 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99028 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: n ... |
| UNKNOWN | | | | CVE-2026-99041 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99044 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99076 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99077 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: i ... |
| UNKNOWN | | | | CVE-2026-99082 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: K ... |
| UNKNOWN | | | | CVE-2026-99083 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: k ... |
| UNKNOWN | | | | CVE-2026-99085 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: s ... |
| UNKNOWN | | | | CVE-2026-99086 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-99087 | linux-libc-dev | 1:6.18.34-1+rpt1 | | In the Linux kernel, the following vulnerability has been resolved: d ... |
| UNKNOWN | | | | CVE-2026-90783 | mkvtoolnix | 92.0-1 | 92.0-1+deb13u1 | MKVToolNix through 101.0 contains a heap buffer overflow in the bundle ... |
| UNKNOWN | | | | TEMP-0000000-001B0E | ntfs-3g | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u3 | [GHSA-r6xj-6488-p8mv: NTFS-3G-SA_2026-06-1_05] |
| UNKNOWN | | | | TEMP-0000000-17A9B4 | ntfs-3g | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u3 | [GHSA-wf3w-fjjg-x4w3: NTFS-3G-SA_2026-06-1_08] |
| UNKNOWN | | | | TEMP-0000000-37DA2F | ntfs-3g | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u3 | [GHSA-mc3c-983p-wqm8: NTFS-3G-SA_2026-06-1_07] |
| UNKNOWN | | | | TEMP-0000000-52FEFD | ntfs-3g | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u3 | [GHSA-x98j-3g35-f59x: NTFS-3G-SA_2026-06-1_19] |
| UNKNOWN | | | | TEMP-0000000-575F54 | ntfs-3g | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u3 | [GHSA-2c97-47cr-9xr8: NTFS-3G-SA_2026-06-1_10] |
| UNKNOWN | | | | TEMP-0000000-724ECC | ntfs-3g | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u3 | [GHSA-jcjj-9262-6j6p: NTFS-3G-SA_2026-06-1_12] |
| UNKNOWN | | | | TEMP-0000000-B9374C | ntfs-3g | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u3 | [GHSA-pc48-m7cx-qf72: NTFS-3G-SA_2026-06-1_20] |
| UNKNOWN | | | | TEMP-0000000-D7723D | ntfs-3g | 1:2022.10.3-5+deb13u1 | 1:2022.10.3-5+deb13u3 | [GHSA-xrvx-6jrp-4q3x: NTFS-3G-SA_2026-06-1_11] |
| UNKNOWN | | | | CVE-2026-82560 | perl-base | 5.40.1-6 | | Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhausti ... |
| UNKNOWN | | | | CVE-2026-82560 | perl-modules-5.40 | 5.40.1-6 | | Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhausti ... |
| UNKNOWN | | | | CVE-2026-82560 | perl | 5.40.1-6 | | Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhausti ... |
| UNKNOWN | | | | CVE-2026-75883 | ppp | 2.5.2-1+1 | | The code in pppd that formats a response to a PEAP Request packet in p ... |
| UNKNOWN | | | | CVE-2026-85495 | ppp | 2.5.2-1+1 | | Title Not Available |
| UNKNOWN | | | | CVE-2026-114583 | python3.13-minimal | 3.13.5-2+deb13u2 | | tarfile.tar_filter could be bypassed using crafted link entries, inclu ... |
| UNKNOWN | | | | CVE-2026-114583 | python3.13-venv | 3.13.5-2+deb13u2 | | tarfile.tar_filter could be bypassed using crafted link entries, inclu ... |
| UNKNOWN | | | | CVE-2026-114583 | python3.13 | 3.13.5-2+deb13u2 | | tarfile.tar_filter could be bypassed using crafted link entries, inclu ... |
| UNKNOWN | | | | TEMP-1142906-2C6C79 | unzip | 6.0-29 | 6.0-29+deb13u1 | [heap buffer overflow WRITE in memextract() STORED path] |
| UNKNOWN | | | | TEMP-1148985-A50803 | wpasupplicant | 2:2.10-24 | | [wpa_config_write() follows symlinks (no O_NOFOLLOW) -> arbitrary root file overwrite by a netdev-group user] |
| UNKNOWN | | | | TEMP-1147318-639065 | xz-utils | 5.8.1-1 | 5.8.1-1+deb13u2 | [GHSA-5qpq-xqfv-j9pg: Invalid write if a decoder is reinitialized after allocation failure] |
| UNKNOWN | | | | TEMP-1143866-6DBA82 | zip | 3.0-15 | 3.0-15+deb13u1 | [Command injection issue with zip] |
| UNKNOWN | | | | GO-2026-5932 | golang.org/x/crypto | v0.53.0 | | The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues |