High-severity CVEs (page 11)
Page 11 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-68419 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent rereg_mr for non-mem regions When a QP/CQ/SRQ is created, a two step… |
CVE-2026-68417 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: publish QP after initialization siw_create_qp() currently calls siw_qp_add() be… |
CVE-2026-68415 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: xfrm: clear mode callbacks after failed mode setup xfrm_state_gc_task can run long after… |
CVE-2026-68414 | High | 7.5 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel sched scan results work on unregister cfg80211_sched_scan_results(… |
CVE-2026-68409 | High | 8.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU sta_remove_link() frees a removed… |
CVE-2026-68404 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: use wiphy work for socket owner autodisconnect nl80211_netlink_notify() w… |
CVE-2026-68402 | High | 7.1 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: bound element ID read when checking non-inheritance cfg80211_is_element_i… |
CVE-2026-68401 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() Sashiko (locally)… |
CVE-2026-68400 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation Use the descr… |
CVE-2026-68399 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts Similar to recent commit 9b51a6155d14 ("bpf,for… |
CVE-2026-68398 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF pppol2tp_recv() run… |
CVE-2026-68397 | High | 8.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: net/iucv: take a reference on the socket found in afiucv_hs_rcv() afiucv_hs_rcv() looks u… |
CVE-2026-68394 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update MGMT_OP_LOAD_CONN_PARAM queues… |
CVE-2026-68393 | High | 8.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: extend conn_hash lookup critical sections Using RCU-protected pointe… |
CVE-2026-68392 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync Dereferencing RCU-protected… |
CVE-2026-68391 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds Dereferencing RCU-prote… |
CVE-2026-68390 | High | 8.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups hci_conn_params_lookup r… |
CVE-2026-68389 | High | 8.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: Clear memdump state on invalid dump size qca_controller_memdump() all… |
CVE-2026-68387 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: can: raw: add locking for raw flags bitfield With commit 890e5198a6e5 ("can: raw: use bit… |
CVE-2026-68384 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves xe_bo_move() attaches VF… |
CVE-2026-68383 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Keep scheduler timeline name alive The scheduler keeps a pointer to the timel… |
CVE-2026-68382 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Hold device ref until queue teardown completes GuC exec queue destruction can… |
CVE-2026-68380 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix use-after-free of mm_struct in job scheduler amdxdna_cmd_submit() stor… |
CVE-2026-68379 | High | 7.5 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: tcp: fix TIME_WAIT socket reference leak on PSP policy failure Release the TIME_WAIT sock… |
CVE-2026-68377 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_tunnel_key: Defer dst_release to RCU callback Fix a race-condition use-aft… |
CVE-2026-68376 | High | 8.1 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix auth_hmacs array size in struct sctp_cookie The auth_hmacs array in struct sctp… |
CVE-2026-68374 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: usb: core: sysfs: add lock to bos_descriptors_read() Add a lock to the function bos_descr… |
CVE-2026-68373 | High | 8.1 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() at76_guess_freq() checks… |
CVE-2026-68371 | High | 8.4 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Do not put borrowed of_node in probe omap2430_probe() stores pdev->d… |
CVE-2026-68370 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback dummy_hcd embeds a single… |
CVE-2026-68354 | High | 8.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: firewire: net: Fix fragmented datagram reassembly fwnet_frag_new() keeps a sorted list of… |
CVE-2026-68353 | High | 8.1 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler The firmware-cont… |
CVE-2026-68352 | High | 8.3 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware IE lengths in connect event The firmware-control… |
CVE-2026-68348 | High | 7.1 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2781: bound firmware description string parsing The TAS2781 firmware parser read… |
CVE-2026-68341 | High | 8.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: ovpn: fix use after free in unlock_ovpn() unlock_ovpn() iterates over the release_list us… |
CVE-2026-68340 | High | 7.7 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: hwmon: occ: validate poll response sensor blocks The OCC poll response parser walks a cou… |
CVE-2026-68338 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: net/packet: avoid fanout hook re-registration after unregister packet_set_ring() temporar… |
CVE-2026-68335 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: rds: drop incoming messages that cross network namespace boundaries rds_find_bound() look… |
CVE-2026-68330 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix DMA direction for NPU mailbox buffer airoha_npu_send_msg() always maps t… |
CVE-2026-68329 | High | 8.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() need… |
CVE-2026-68326 | High | 8.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound uAP association event IEs to the event buffer mwifiex_process_uap_ev… |
CVE-2026-68323 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: tipc: serialize udp bearer replicast list updates tipc_udp_rcast_add() and cleanup_bearer… |
CVE-2026-68320 | High | 7.3 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid sctp_auth_ep_add_chu… |
CVE-2026-68316 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix element size accounting for cmd stream validation There are 2 issues w… |
CVE-2026-68315 | High | 7.5 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: sctp: validate stream count in sctp_process_strreset_inreq() When processing a RESET_IN_R… |
CVE-2026-68314 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: net: mctp i3c: clean up notifier and buses if driver register fails mctp_i3c_mod_init() r… |
CVE-2026-68305 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers CCS read/write buffer… |
CVE-2026-68299 | High | 7.5 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets vmxnet3_get_hdr_len() ass… |
CVE-2026-68298 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create() Commit 9e9787414882 (… |
CVE-2026-68297 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: tipc: fix u16 MTU truncation in media and bearer MTU validation Both TIPC_NL_MEDIA_SET an… |
CVE-2026-68295 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Zero-extend signed ALU32 div/mod results ALU32 operations write a 32-bit… |
CVE-2026-68294 | High | 8.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entir… |
CVE-2026-68293 | High | 7.1 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads The MCIA register can retur… |
CVE-2026-68290 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: rds: tcp: unregister sysctl before tearing down listen socket rds_tcp_exit_net() frees th… |
CVE-2026-68287 | High | 7.5 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix size calculations for 64-bit attributes net_dm_packet_report_fill() and… |
CVE-2026-68284 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() tcp_bpf_sendmsg() keeps msg_tx… |
CVE-2026-68283 | High | 8.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free freeing trigger private data Commit 61d445af0a7c ("tracing: A… |
CVE-2026-68274 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Fix buffer overflow in steered register list allocation The size calculation… |
CVE-2026-68273 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix context pstate override handling There are several problems in the contex… |
CVE-2026-68266 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Hold a dma-buf reference for imported BOs An imported dma-buf BO is created as a… |
CVE-2026-68265 | High | 7.3 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC When prefetch region is DRM_X… |
CVE-2026-68264 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() xe_pt_update_ops_init() fails to r… |
CVE-2026-68263 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix double call to drm_sched_entity_fini() Call sequence of double call… |
CVE-2026-68262 | High | 7.1 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix user array stride in pvr_set_uobj_array() pvr_set_uobj_array() copie… |
CVE-2026-68260 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM The drm gpuvm code… |
CVE-2026-68258 | High | 7.1 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size We weren't checking whet… |
CVE-2026-68257 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation total_cwsr_size was comput… |
CVE-2026-68255 | High | 7.7 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: drm/virtio: bound EDID block reads to the response buffer virtio_get_edid_block() validat… |
CVE-2026-68253 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: drm/i915/hdcp: check streams[] bounds before overflow The data->streams[] overflow check… |
CVE-2026-68245 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() The vm pointer returned… |
CVE-2026-68240 | High | 8.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: publish dpagemap early to avoid device mapping leak on error drm_gpusvm_get_p… |
CVE-2026-68236 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set new_stream to NULL after release In dm_update_crtc_state(), the skip… |
CVE-2026-68230 | High | 7.3 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: media: amlogic-c3: Add validations for ae and awb config Avoid invalid memory access if t… |
CVE-2026-68229 | High | 7.1 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: media: cedrus: skip invalid H.264 reference list entries Cedrus consumes H.264 ref_pic_li… |
CVE-2026-68228 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Move src_buf Removal to finish_encode During encoder processin… |
CVE-2026-68222 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: media: msi2500: Return queued buffers on start_streaming() failure The vb2 framework hand… |
CVE-2026-68219 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix potential out-of-bounds issues The maximum downscaling factor s… |
CVE-2026-68216 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: media: pwc: Return queued buffers on start_streaming() failure The vb2 framework hands bu… |
CVE-2026-68213 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: media: rtl2832_sdr: Return queued buffers on start_streaming() failure The vb2 framework… |
CVE-2026-68210 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: media: stm32: dcmi: unregister notifier on probe failure dcmi_graph_init() registers the… |
CVE-2026-68209 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: media: sun4i-csi: Return queued buffers on start_streaming() failure The vb2 framework ha… |
CVE-2026-68206 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC active reference counts HEVC slice parameters are shared… |
CVE-2026-68204 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: media: vivid: check for vb2_is_busy() when toggling caps The vivid_update_format_cap/out(… |
CVE-2026-68202 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: close a re-opened queue timer in the destructor queue_delete() closes the queu… |
CVE-2026-68201 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: drain a slave's callback before its master detaches it snd_timer_close_locke… |
CVE-2026-68200 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driv… |
CVE-2026-68199 | High | 8.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB access from firmware ADDBA window size aggr_recv_addba_req_evt() lo… |
CVE-2026-68198 | High | 8.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free in aggr_reset_state() The aggr_reset_state() function us… |
CVE-2026-68196 | High | 8.3 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: validate assoc response length before subtracting header wilc_parse_assoc… |
CVE-2026-68192 | High | 8.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: make release_scratchbuffers idempotent brcmf_pcie_release_scratchbuffers(… |
CVE-2026-68189 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Protect UUID list traversal The hci_sync conversion moved class-of-d… |
CVE-2026-68179 | High | 8.4 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: misc: nsm: only unlock nsm_dev on post-lock error paths nsm_dev_ioctl() jumps to the comm… |
CVE-2026-68178 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: misc: nsm: pin the module while the device is open misc_open() installs a misc driver's f… |
CVE-2026-68177 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: tracing: Delay module ref count for "enable_event" trigger Triggers are now delayed from… |
CVE-2026-68173 | High | 7.1 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: ublk: wait on ublk_dev_ready() instead of ub->completion ub->completion is only re-armed… |
CVE-2026-68172 | High | 7.1 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: arm64: make huge_ptep_get handled unaligned addresses huge_ptep_get() can be handed a vir… |
CVE-2026-68163 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: mm/page_vma_mapped: fix device-private PMD handling Commit 65edfda6f3f2 ("mm/rmap: extend… |
CVE-2026-68162 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: sctp: avoid auth_enable sysctl UAF during netns teardown proc_sctp_do_auth() updates the… |
CVE-2026-68157 | High | 7.5 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent… |
CVE-2026-68155 | High | 7.5 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPH_MSG_MON_MAP cont… |