Linux 6.12.95 livepatch coverage

This page applies only to vpsAdminOS systems booted with Linux 6.12.95. Livepatch availability and vulnerability coverage are specific to a boot kernel; no coverage for other kernel versions is implied.

Current livepatch

The current cumulative livepatch is v5. When active, it changes the kernel release reported by uname -r from 6.12.95 to 6.12.95.5 and is loaded as module livepatch_5.

Item Value
Boot kernel 6.12.95
Livepatch v5 (6.12.95.5)
Reviewed stable range v6.12.95..v6.12.103
Covered security fixes 47
Covered fixes with assigned CVEs 20
Kernel backports vpsadminos-6.12.95-backports at 885b99c34cde
vpsAdminOS integration 1895bbcdd21d on staging

V5 is cumulative: it retains all fixes from v1 through v4 and adds eight security fixes. The First livepatch column below identifies the release which first carried a fix; every listed fix is present in v5.

CVE assignments on this page were checked on 2026-08-14. Fixes which receive a CVE assignment later should be moved from the unassigned list into the CVE table.

CVE first covered by v5

CVE Covered defect Backport commit
CVE-2026-64563 rhashtable iterator-restart stale-pointer UAF 77c893cd5de6

All CVEs covered by v5

CVE Covered defect First livepatch Backport commit
CVE-2025-37964 x86 TLB-switch ordering correction for the ineffective 6.12 stable fix v1 acd4273495dc
CVE-2026-46093 vmalloc pool list/RB-tree corruption during concurrent shrink and purge v3 3fed23dbf00a
CVE-2026-53365 virtio-vsock multi-SKB zerocopy managed-page lifetime corruption v1 15a821959caf
CVE-2026-64189 ipset dump/resize array UAF v1 4a79812d4b92
CVE-2026-64265 FUSE resend interrupt-list UAF v1 d2a87bbb84e8
CVE-2026-64266 FUSE copy-chain request UAF v1 6bc0aab7e34f
CVE-2026-64422 TCP MTU-probe out-of-bounds kernel-memory disclosure v1 1d3aec63b45f
CVE-2026-64423 IPv4 multicast-device teardown UAF v1 d91dee2abccc
CVE-2026-64507 x86 IBPB flush on BPF JIT allocation v1 209fc0382f26
CVE-2026-64508 BPF JIT-reuse predictor-poisoning hardening v1 e8bf743dd136
CVE-2026-64551 Repeatable unauthenticated SCTP kernel/network-buffer disclosure v3 9df58893ecc6
CVE-2026-64554 Bridge IPv6 fragmentation stale-prevhdr UAF write v1 60d861b02617
CVE-2026-64556 perf remove-on-exec group corruption and reclaimable UAF v1 80d0b7fda790
CVE-2026-64560 POSIX CPU-timer UAF in the non-leader exec() race v2 d9f980d536c9
CVE-2026-64561 Zapscape KVM MMU UAF/post-free write and guest-to-host code execution v3 1a0ebeddf734
CVE-2026-64562 Nested-VMX shadow-VMCS UAF/write during VMCLEAR and vCPU migration v3 6c0cf165e7cc
CVE-2026-64563 rhashtable iterator-restart stale-pointer UAF v5 77c893cd5de6
CVE-2026-64564 SCTP ASCONF DEL-IP transport UAF and association corruption v2 723248d13bad
CVE-2026-64580 XFRM6 error-path reference underflow and net_device UAF v2 a02546c61afc
CVE-2026-68480 SRSO Safe-RET interrupt-injection bypass and speculative host-data disclosure v3 71fce134f76c

For CVE-2025-37964, the official record names the earlier 6.12 stable fix. Linux 6.12.95 already contained that fix, but it was ineffective on the 6.12 stable line. The livepatch carries the later stable correction and restores the intended protection.

Covered security fixes without a published CVE

The other 27 selected security fixes had no published CVE assignment when this page was last updated.

First carried by v1

  • nfs: use nfsi->rwsem to protect traversal of the file lock list
  • xfrm: Fix xfrm state cache insertion race
  • netfilter: ipset: make sure gc is properly stopped
  • bridge: stp: Fix a potential use-after-free when deleting a bridge
  • ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
  • ipv6: mcast: Fix potential UAF in MLD delayed work
  • SUNRPC: pin upper rpc_clnt across the TLS connect_worker
  • netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
  • netfilter: nft_set_pipapo: don't leak bad clone into future transaction
  • ipvs: reload ip header after head reallocation

First carried by v2

  • ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
  • net/packet: avoid fanout hook re-registration after unregister
  • sctp: avoid auth_enable sysctl UAF during netns teardown
  • libceph: Fix multiplication overflow in decode_new_up_state_weight()
  • libceph: refresh auth->authorizer_buf{,_len} after authorizer update
  • xfrm: nat_keepalive: avoid double free on send error

First carried by v3 and retained by v4/v5

  • netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp
  • ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
  • libceph: reject zero bucket types in crush_decode
  • KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug

First carried by v5

  • netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge()
  • netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
  • netfilter: nf_tables: make nft_object rhltable per table
  • KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active
  • sctp: validate Adaptation Indication parameter length
  • net: bridge: stop fast-leave after deleting a port group
  • sctp: prevent peer transport count overflow

Two non-security source prerequisites retained from earlier releases are not counted as vulnerabilities. CVEs associated only with reviewed but unselected stable commits are not claimed as covered.