The CISA KEV Catalogue, Searchable

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

linux kernel 7.0.10, linux kernel 6.18.33, linux kernel 6.12.91, linux kernel 6.6.141, linux kernel 6.1.174 and 7 older

CISA due date

31 Oct 2026

Weakness

CWE-456

NVD Record · Vendor Advisory · Advisory 2 · Advisory 3 · More on Linux kernel

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits().

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

linux kernel 7.0.13, linux kernel 6.18.36, linux kernel 6.12.94, linux kernel 6.6.143, linux kernel 6.1.176 and 4 older

CISA due date

21 Sep 2026

Weakness

CWE-787

NVD Record · Vendor Advisory · More on Linux kernel

In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

linux kernel 7.1.3, linux kernel 6.18.38, linux kernel 6.12.95, linux kernel 6.6.144, linux kernel 6.1.177

CISA due date

30 Aug 2026

Weakness

CWE-787, CWE-122

NVD Record · Vendor Advisory · More on Linux kernel

An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

linux kernel 5.16.5, linux kernel 5.15.29, linux kernel 5.10.106

CISA due date

29 Aug 2026

Weakness

CWE-787

NVD Record · Vendor Advisory · More on Linux kernel

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

linux kernel 6.19.12, linux kernel 6.18.22, linux kernel 6.12.85, linux kernel 6.6.137, linux kernel 6.1.170 and 7 older

CISA due date

15 May 2026

Weakness

CWE-669

NVD Record · Vendor Advisory · Advisory 2 · More on Linux kernel

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

linux kernel 6.15.3, linux kernel 6.12.34, linux kernel 6.6.94, linux kernel 6.1.142, linux kernel 5.15.186 and 2 older

CISA due date

25 Sep 2025

Weakness

CWE-367

NVD Record · Vendor Advisory · Advisory 2 · More on Linux kernel

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

linux kernel 6.1.9, linux kernel 5.15.91

CISA due date

8 Jul 2025

Weakness

CWE-282

NVD Record · Vendor Advisory · Advisory 2 · Advisory 3 · More on Ubuntu / Debian packages

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configuration for allocating dev->config. This can lead to out-of-bounds accesses later, e.g. in usb_destroy_configuration.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

linux kernel 6.12.2, linux kernel 6.11.11, linux kernel 6.6.64, linux kernel 6.1.120, linux kernel 5.15.174 and 3 older

CISA due date

30 Apr 2025

Weakness

CWE-787

NVD Record · Vendor Advisory · Advisory 2 · More on Linux kernel

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

linux kernel 6.12.2, linux kernel 6.11.11, linux kernel 6.6.64, linux kernel 6.1.120, linux kernel 5.15.174 and 2 older

CISA due date

30 Apr 2025

Weakness

CWE-125

NVD Record · Vendor Advisory · Advisory 2 · More on Linux kernel

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Fixed in (NVD)

linux kernel 6.12.1, linux kernel 6.11.8, linux kernel 6.6.61, linux kernel 6.1.117, linux kernel 5.15.172 and 3 older

CISA due date

26 Feb 2025

Weakness

CWE-787

NVD Record · Vendor Advisory · More on Linux kernel

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Fixed in (NVD)

linux kernel 4.0.2, linux kernel 3.19.7, linux kernel 3.18.14, linux kernel 3.16.35, linux kernel 3.14.41 and 4 older

CISA due date

30 Sep 2024

Weakness

CWE-119

NVD Record · More on Linux kernel

A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.

What to do

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

Fixed in (NVD)

linux kernel 5.16.2, linux kernel 5.15.16, linux kernel 5.10.93, linux kernel 5.4.173

CISA due date

11 Sep 2024

Weakness

CWE-190

NVD Record · More on Linux kernel

In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Fixed in (NVD)

linux kernel 6.9.4, linux kernel 6.6.34, linux kernel 6.1.94, linux kernel 5.15.161, linux kernel 5.10.219 and 2 older

CISA due date

28 Aug 2024

Weakness

CWE-416

NVD Record · Vendor Advisory · More on Linux kernel

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.

What to do

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

Fixed in (NVD)

siemens simatic s7-1500 tm mfp firmware 1.1, linux kernel 5.19.2, linux kernel 5.18.18, linux kernel 5.15.61, linux kernel 5.10.137 and 4 older

CISA due date

17 Jul 2024

Weakness

CWE-416

NVD Record · More on Linux kernel

The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.

What to do

The impacted product is end-of-life and should be disconnected if still in use.

Fixed in (NVD)

linux kernel 2.6.36

CISA due date

2 Jun 2023

Weakness

CWE-20

NVD Record · More on Linux kernel

A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e

What to do

Apply updates per vendor instructions.

Fixed in (NVD)

linux kernel 6.1.6, linux kernel 5.15.88, linux kernel 5.10.163, linux kernel 5.4.229, linux kernel 4.19.270 and 1 older

CISA due date

20 Apr 2023

Weakness

CWE-416

NVD Record · More on Linux kernel

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.

What to do

Apply updates per vendor instructions.

Fixed in (NVD)

canonical ubuntu linux 20.10, canonical ubuntu linux 20.04, canonical ubuntu linux 18.04

CISA due date

10 Nov 2022

Weakness

CWE-862

NVD Record · More on Ubuntu / Debian packages

The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.

What to do

Apply updates per vendor instructions.

Fixed in (NVD)

linux kernel 3.5.5, linux kernel 3.4.12, linux kernel 3.2.54

CISA due date

6 Oct 2022

Weakness

CWE-20

NVD Record · More on Linux kernel

Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.

What to do

Apply updates per vendor instructions.

Fixed in (NVD)

linux kernel 3.8.9, linux kernel 3.4.42, linux kernel 3.2.45, linux kernel 3.0.75

CISA due date

6 Oct 2022

Weakness

CWE-189

NVD Record · More on Linux kernel

The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.

What to do

Apply updates per vendor instructions.

Fixed in (NVD)

linux kernel 3.8.9, linux kernel 3.4.42, linux kernel 3.2.45, linux kernel 3.0.75

CISA due date

6 Oct 2022

Weakness

CWE-189

NVD Record · More on Linux kernel

The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.

What to do

Apply updates per vendor instructions.

Fixed in (NVD)

linux kernel 3.14.6, linux kernel 3.12.22, linux kernel 3.10.42, linux kernel 3.4.92, linux kernel 3.2.60

CISA due date

15 Jun 2022

Weakness

CWE-269

NVD Record · More on Linux kernel

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

What to do

Apply updates per vendor instructions.

Fixed in (NVD)

siemens scalance lpe9403 firmware 2.0, linux kernel 5.16.11, linux kernel 5.15.25, linux kernel 5.10.102

CISA due date

16 May 2022

Weakness

CWE-665

NVD Record · More on Linux kernel

A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755

What to do

Apply updates per vendor instructions.

Fixed in (NVD)

linux kernel 5.15.11, linux kernel 5.10.88, linux kernel 5.4.168, linux kernel 4.19.222, linux kernel 4.14.259

CISA due date

2 May 2022

Weakness

CWE-415

NVD Record · More on Linux kernel

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."

What to do

Apply updates per vendor instructions.

Fixed in (NVD)

paloaltonetworks pan-os 7.1.8, paloaltonetworks pan-os 7.0.14, linux kernel 4.8.3, linux kernel 4.7.9, linux kernel 4.4.26 and 7 older

CISA due date

24 Mar 2022

Weakness

CWE-362

NVD Record · More on Linux kernel

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.

What to do

Apply updates per vendor instructions.

Fixed in (NVD)

linux kernel 5.1.17, linux kernel 4.19.58, linux kernel 4.14.133, linux kernel 4.9.185, linux kernel 4.9 and 3 older

CISA due date

10 Jun 2022

Weakness

CWE-269

NVD Record · More on Linux kernel

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095

What to do

Apply updates per vendor instructions.

Fixed in (NVD)

huawei bla-l29c firmware 9.1.0.300\(c432e4r1p11t8\), huawei berkeley-tl10 firmware 9.1.0.333\(c01e333r1p1t8\), huawei ares-al10d firmware 9.1.0.165\(c00e165r2p5t8\), huawei berkeley-l09 firmware 9.1.0.351\(c432e5r1p13t8\), huawei bla-al00b firmware 10.0.0.170\(c786e170r2p4\) and 7 older

CISA due date

3 May 2022

Weakness

CWE-416

NVD Record · More on Ubuntu / Debian packages