Linux CVEs
18,386 CVEs and advisories name Linux as an affected vendor, 14 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-40048uio_hv_generic: Let userspace take care of interrupt mask
- CVE-2025-40047io_uring/waitid: always prune wait queue entry in io_waitid_wait()
- CVE-2025-40046io_uring/zcrx: fix overshooting recv limit
- CVE-2025-40045ASoC: codecs: wcd937x: set the comp soundwire port correctly
- CVE-2025-40044fs: udf: fix OOB read in lengthAllocDescs handling
- CVE-2025-40043net: nfc: nci: Add parameter validation for packet data
- CVE-2025-40042tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
- CVE-2025-40041LoongArch: BPF: Sign-extend struct ops return values properly
- CVE-2025-40040mm/ksm: fix flag-dropping behavior in ksm_madvise
- CVE-2025-40039ksmbd: Fix race condition in RPC handle list access
- CVE-2025-40038KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid
- CVE-2025-40037fbdev: simplefb: Fix use after free in simplefb_detach_genpds()
- CVE-2025-40036misc: fastrpc: fix possible map leak in fastrpc_put_args
- CVE-2025-40035Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
- CVE-2025-40034PCI/AER: Avoid NULL pointer dereference in aer_ratelimit()
- CVE-2025-40033remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable()
- CVE-2025-40032PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release
- CVE-2025-40031tee: fix register_shm_helper()
- CVE-2025-40030pinctrl: check the return value of pinmux_ops::get_function_name()
- CVE-2025-40029bus: fsl-mc: Check return value of platform_get_resource()
- CVE-2025-40028binder: fix double-free in dbitmap
- CVE-2025-40027net/9p: fix double req put in p9_fd_cancelled
- CVE-2025-40026KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
- CVE-2025-40025f2fs: fix to do sanity check on node footer for non inode dnode
- CVE-2025-40024vhost: Take a reference on the task in struct vhost_task.
- CVE-2025-40023drm/xe/vf: Don't expose sysfs attributes not applicable for VFs
- CVE-2025-40022crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
- CVE-2025-40021tracing: dynevent: Add a missing lockdown check on dynevent
- CVE-2025-40020can: peak_usb: fix shift-out-of-bounds issue
- CVE-2025-40019crypto: essiv - Check ssize for decryption and in-place encryption