Skip to content
← All tracked CVEs

Updated 09:00

last 30 days

933 fixed within SLA

CVEStatusSeveritySummaryReleaseClock startedDeadlineFixedTime to fix
Fixed within SLAMediumPowerPC64: PMD migration/munmap race causes VM_BUG_ON in pmdp_huge_get_and_clear_fullsecure-packages-26.05Jul 27, 2026Sep 10, 2026Aug 11, 202615 days
Fixed within SLAHighUse-after-free when filling offloaded BPF map/prog info due to netns teardown racesecure-packages-26.05Jul 27, 2026Aug 11, 2026Aug 11, 202615 days
Fixed within SLAMediumLinux kernel ice driver TX timestamp ring cleanup race causes NULL dereferencesecure-packages-26.05Jul 16, 2026Aug 30, 2026Aug 11, 202626 days
Fixed within SLAMediumPotential NULL dereference in ice_set_ringparam error path due to uncleared ICE_TX_RING_FLAGS_TXTIMEsecure-packages-26.05Jul 16, 2026Aug 30, 2026Aug 11, 202626 days
Fixed within SLACriticalsecure-packages-rollingAug 10, 2026Aug 17, 2026Aug 11, 20261 day
Fixed within SLAHighGSO headers not in skb->head during qdisc init, risking tso_build_hdr memcpy misusesecure-packages-25.11Jul 27, 2026Aug 11, 2026Aug 11, 202615 days
Fixed within SLAHighfbcon_do_set_font error rollback misses hi_font state restore, causing out-of-bounds font readssecure-packages-25.11Aug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLACriticalnfsd setlease failure frees layout stid without idr_remove, causing IDR dangling pointer dereferencesecure-packages-25.11Aug 4, 2026Aug 11, 2026Aug 10, 20266 days
Fixed within SLAHighNFSv4 flexfiles ff_layout_alloc_lseg accepts zero fh_count, causing NULL pointer dereferencesecure-packages-25.11Aug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAMediumvsock/virtio zerocopy multi-skb sends miss completion tracking, leaking pinned pages, no notificationsecure-packages-25.11Jul 23, 2026Sep 6, 2026Aug 10, 202618 days
Fixed within SLAMediumPhonet: pn_socket_autobind BUG_ON on EINVAL bind causes user-triggerable kernel panicsecure-packages-25.11Jul 9, 2026Aug 23, 2026Aug 10, 202632 days
Fixed within SLAMediumRockchip GPIO: generic IRQ chips leaked on remove, causing potential UAF and crashessecure-packages-25.11Jul 6, 2026Aug 20, 2026Aug 10, 202635 days
Fixed within SLAMediumNTFS3: Missing vcn0 run load causes SPARSE_LCN and WARN_ON in attr_data_get_block_lockedsecure-packages-25.11Jul 17, 2026Aug 31, 2026Aug 10, 202624 days
Fixed within SLAMediumdrm/v3d infinite loop via empty multisync extension; userspace self-referential chain DoSsecure-packages-25.11Jul 9, 2026Aug 23, 2026Aug 10, 202632 days
Fixed within SLAMediumImageMagick <7.1.2-27 magick CLI memory leak on malformed options causes DoSsecure-packages-rollingAug 5, 2026Sep 19, 2026Aug 10, 20265 days
Fixed within SLAMediumCrafted image triggers heap buffer over-read in ImageMagick BGR decoder pre-7.1.2-27secure-packages-rollingAug 4, 2026Sep 18, 2026Aug 10, 20266 days
Fixed within SLAHighKVM: Missing memslot bounds check causes OOB lpage_info access during hugepage recoverysecure-packages-rollingAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAHighGuest-triggered kernel BUG via unaligned ioeventfd datamatch on KVM page-split MMIOsecure-packages-rollingAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAHighLinux nx crypto: kernel oops from wrong ctx type passed to nx_crypto_ctx_exitsecure-packages-rollingAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAHighgfs2: use-after-free in gfs2_qd_dealloc when superblock freed before RCU callbacks finishsecure-packages-rollingAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAHighUse-after-free from PPP protocol timers when HDLC state is freed during detachsecure-packages-rollingAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAHighUse-after-free in blk-cgroup __blkcg_rstat_flush via llist_del_all during concurrent blkg releasessecure-packages-rollingAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAHighTIPC decrypt async completion UAF from missing netns ref when crypto_aead_decrypt offloadedsecure-packages-rollingAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLACriticalUse-after-free in pNFS pnfs_update_layout() tracepoint after freeing lo with pnfs_put_layout_hdrsecure-packages-rollingAug 4, 2026Aug 11, 2026Aug 10, 20266 days
Fixed within SLAHighsched/mmcid: OOB clear_bit from MM_CID_UNSET during per-CPU CID fixupsecure-packages-rollingAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAMediumimgpdc irqchip resource leak and dangling chained handlers cause use-after-free, kernel crashessecure-packages-rollingAug 4, 2026Sep 18, 2026Aug 10, 20266 days
Fixed within SLAHighrpmsg char: callbacks use freed eptdev after probe failure due to stale privsecure-packages-rollingAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAHighOCFS2 accepts oversized group bitmap descriptors causing OOB bitmap access and use-after-freesecure-packages-rollingAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLACritical9p p9_client_walk error drops oldfid reference when clone=false, causing UAF/refcount underflowsecure-packages-rollingAug 4, 2026Aug 11, 2026Aug 10, 20266 days
Fixed within SLAHighKVM SVM unbounded destination offset causes page overflow and memcpy overrun in sev_dbg_crypt ENCRYPTsecure-packages-rollingAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAMediumImageMagick JNX parsing integer overflow on 32-bit platforms causes heap buffer overwritesecure-packages-rollingAug 4, 2026Sep 18, 2026Aug 10, 20266 days
Fixed within SLAMediumHeap buffer overwrite in ImageMagick fx operation via crafted argument before 7.1.2-27secure-packages-rollingAug 4, 2026Sep 18, 2026Aug 10, 20266 days
Fixed within SLAMediumfbdev: fb_videomode_to_var NULL deref when new modelist omits current modesecure-packages-rollingAug 4, 2026Sep 18, 2026Aug 10, 20266 days
Fixed within SLAHighfbcon_do_set_font err_out misses hi_font rollback, enabling OOB read/memory leaksecure-packages-rollingAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAHighi2c core adapter registration race causes i2c_get_adapter to access uninitialized device, NULL/UAFsecure-packages-rollingAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLACriticalUse-after-free via IDR leak and uninitialized delayed_work on nfsd layout setlease failuresecure-packages-rollingAug 4, 2026Aug 11, 2026Aug 10, 20266 days
Fixed within SLACriticalNFSD: SECINFO_NO_NAME decode leaves stale sin_exp; exp_put called after truncated XDRsecure-packages-rollingAug 4, 2026Aug 11, 2026Aug 10, 20266 days
Fixed within SLAHighnfsd: posix_acl memory leak when SETACL decode fails; pc_release didn't free ACLssecure-packages-rollingAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAHighLinux nfsd4_create_file ignores ACL conversion errors; leaks posix_acl allocationssecure-packages-rollingAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAHighDead ACL conflict guard in nfsd4_create leaks posix_acls, causing unbounded slab exhaustionsecure-packages-rollingAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAHighnfsd memory leak: pre-allocated openowner overwritten during unconfirmed owner retry racesecure-packages-rollingAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAMediumnfsd fails to reset write verifier on deferred writeback errors, causing COMMIT data losssecure-packages-rollingAug 4, 2026Sep 18, 2026Aug 10, 20266 days
Fixed within SLAHighNFSv4/flexfiles accepts zero fh_count, causing ZERO_SIZE_PTR and KASAN null dereferencesecure-packages-rollingAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAHighNFSv4/pNFS: zero-length r_addr triggers NULL pointer dereference in nfs4_decode_mp_ds_addrsecure-packages-rollingAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAHighksmbd: OOB read in smb_check_perm_dacl due to ACE/SID length mismatchsecure-packages-rollingAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAHighUse-after-free in TCP-AO del_async due to dangling current_key/rnext_key on LISTEN socketssecure-packages-rollingAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAHighLinux kernel IPv4 __ip_append_data paged allocation miscalculates fraggap, causing undersized linear area, overstated pagedlensecure-packages-rollingJul 23, 2026Aug 7, 2026Aug 7, 202615 days
Fixed within SLAHighUnprivileged IPv6 UDP fraggap misaccounting overflows skb in paged allocation using MSG_SPLICE_PAGESsecure-packages-rollingJul 23, 2026Aug 7, 2026Aug 7, 202615 days
Fixed within SLAHighaf_unix race: unix_gc may run with gc_in_progress false, breaking MSG_PEEK safetysecure-packages-rollingJul 23, 2026Aug 7, 2026Aug 7, 202615 days
Fixed within SLAHighKVM x86 shadow paging UAF due to child page role mismatch after PDE changesecure-packages-rollingJul 23, 2026Aug 7, 2026Aug 7, 202615 days