kernel patch

A recently recorded Linux-kernel security entry, CVE-2026-22991, fixes a subtle but practical memory-safety bug in the kernel’s Ceph client library (libceph) by hardening the cleanup routine free_choose_arg_map() so it no longer dereferences NULL when its caller fails after a partial allocation...

A one-line mistake in XFS scrub code has produced a classic memory-safety problem with outsized operational impact: a use-after-free (UAF) in the XFS filesystem’s B-tree checking path, tracked as CVE-2026-23223, has been fixed upstream and is now being rolled into stable kernels and Linux...

A subtle parse-time error in the Linux in‑kernel SMB server (ksmbd) can let a malformed SMB2 Create request provoke an out‑of‑bounds memory access in kernel space — a defect tracked as CVE‑2024‑22705 that was fixed upstream in the 6.6.10 stable release and that carries real, immediate...

A subtle bug in the Linux kernel’s TIPC subsystem — a double-locking condition in tipc_crypto_key_revoke() — can be driven into a kernel‑level deadlock that lets a local, authenticated user hang or crash a machine. The issue, tracked as CVE‑2024‑0641, is an availability‑only failure (denial of...

A focused upstream patch for the Linux kernel's F2FS driver resolved a subtle but consequential metadata-checking bug that could trigger kernel panics when mounting deliberately malformed or improperly resized F2FS images, and Microsoft’s public guidance makes one thing clear: Azure Linux is the...

A subtle pointer mix-up in the Linux kernel’s mISDN telephony driver — a use‑after‑free in hfcmulti_tx() — landed as CVE‑2024‑42280 and serves as another clear reminder that tiny lifecycle mistakes in kernel code can produce outsized operational pain for operators and vendors alike. The flaw is...

The Linux kernel scheduler received a surgical but important fix in early April 2025 that closes a subtle pointer-conversion bug in the fair scheduler’s leaf-list handling — a defect tracked as CVE-2025-21919 that can produce memory corruption and unpredictable system behavior if left unpatched...

The Linux kernel patch tracked as CVE-2025-37977 fixes a subtle but important UFS (Universal Flash Storage) configuration bug in the Exynos UFS host driver: when the device tree omits the dma-coherent property, descriptors are treated as non-cacheable but the IOC (I/O cache controller)...

A subtle lifetime-management bug in the Linux kernel’s module subsystem — tracked as CVE-2025-37995 — can lead to the kernel dereferencing an uninitialized completion pointer when code calls kobject_put() on certain internal module kobjects, creating a locally-triggered denial‑of‑service risk...

A recently disclosed vulnerability in the Linux kernel’s AMD DRM power-management code — tracked as CVE-2025-37769 — allows a carefully crafted input to trigger a division-by-zero inside the SMU11 power-management path, causing kernel crashes and sustained denial-of-service on affected systems...

A recently disclosed Linux-kernel defect tracked as CVE‑2025‑23144 exposes a locking error in the LED backlight subsystem (led_bl) that can produce kernel lockdep warnings, race conditions and availability failures during LED/backlight removal; the upstream remedy is a small but necessary change...

The Linux kernel vulnerability tracked as CVE-2025-38480 has been published: a subtle correctness bug in the COMEDI subsystem where the helper function insn_rw_emulate_bits could read uninitialized data when presented with an instruction that specifies zero samples. Upstream kernel maintainers...

The Linux kernel received a small but important defensive patch addressing a potential NULL-pointer dereference in the Samsung SXGBE Ethernet driver’s receive path — tracked as CVE‑2025‑68302 — that can cause a kernel oops when the driver attempts to dereference a NULL skb (socket buffer). The...

A recently assigned CVE — CVE-2025-68328 — pins down a subtle but consequential bug in the Linux kernel’s Stratix10 Service Layer driver (stratix10-svc) that could cause module removal to fail and trigger a kernel panic, and kernel developers have issued a corrective patch to eliminate the...

A newly reported OCFS2 filesystem vulnerability described as "relax BUG to ocfs2_error in __ocfs2_move_extent" highlights a recurring class of Linux kernel filesystem defects where aggressive kernel assertions escalate recoverable metadata inconsistencies into host‑crashing kernel BUGs...

The Linux kernel has received a small but important patch closing a buffer‑underflow defect in the Realtek RTL8187 USB wireless driver: the rx callback in rtl8187 could compute an RX descriptor header address by subtracting the header size from skb tail pointer without first confirming the...

A Linux kernel vulnerability tracked as CVE-2025-68729 has been published: a logic error in the ath12k Wi‑Fi driver’s RX error path that can leave received packet buffers unaccounted-for, with the potential to cause kernel crashes and buffer leaks unless the upstream patch is applied. Background...

A quiet but sharp fix landed in upstream Linux this summer for a long-tail networking subsystem, and it’s the kind of kernel bug that rewards attention from system administrators: the ATM CLIP driver contained an infinite recursive call condition in clip_push that can crash the kernel when...

Microsoft’s short advisory that “Azure Linux includes this open‑source library and is therefore potentially affected” is accurate as a product‑level attestation — but it is not a technical guarantee that no other Microsoft product can include the same vulnerable ksmbd code; customers must treat...

A small but important fix landed in the Linux kernel’s AMD display stack that corrects a sizing error and closes a local null‑pointer dereference in the DRM amdgpu code — a patch now tracked as CVE‑2025‑40354 that increases the driver’s maximum link count and guards against a NULL encoder access...