CVE-2022-41674High· 8.1▾ TwilightAn issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.8 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
4.1%
An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c.
linux_kernel >= 5.1, < 5.4.218linux_kernel >= 5.5, < 5.10.148linux_kernel >= 5.11, < 5.15.74linux_kernel >= 5.16, < 5.19.16linux_kernel >= 6.0, < 6.0.2fedora = 35fedora = 36fedora = 37debian_linux = 10.0debian_linux = 11.0Upgrade past the affected range:
linux_kernel 6.0.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-31401High· 7.8In the Linux kernel, the following vulnerability has been resolved: HID: bpf: prevent buffer overflow in hid_hw_request right now the returned value is considered to be always valid
CVE-2026-31607Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When a USB/IP client receives a RET_SUBMIT response, usbip_pack_ret_submit() unconditionally overwrites ur…
CVE-2026-31402Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operat…
CVE-2026-43501Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps the next segment into ipv6_hdr…
CVE-2026-43125Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: dlm: validate length in dlm_search_rsb_tree The len parameter in dlm_dump_rsb_name() is not validated and comes from network messages
CVE-2026-98312High· 7.0In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix OOB write from device-reported iso length usb6fire_pcm_in_urb_handler() sizes each outgoing isochronous packet as (actual_length - 4) / (in_n_analog <…