High-severity CVEs (page 38)
Page 38 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-64081 | High | 8.4 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Validate framework notification message layout Framework notifications… |
CVE-2026-64078 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: add and use xtables_unregister_table_exit Previous change added xtab… |
CVE-2026-64077 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: move to two-stage removal scheme Like previous patches for x_tables… |
CVE-2026-64076 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: eb_tables: close module init race sashiko reports for unrelated patch… |
CVE-2026-64074 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap statmount_mnt_idmap() w… |
CVE-2026-64073 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT On PREEMPT_RT, non-HARD i… |
CVE-2026-64058 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_read_folio() to wait on writeback Fix netfs_read_folio() to wait for an… |
CVE-2026-64057 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix the locking used by afs_get_link() The afs filesystem in the kernel doesn't do l… |
CVE-2026-64053 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: block: don't overwrite bip_vcnt in bio_integrity_copy_user() bio_integrity_add_page() alr… |
CVE-2026-64051 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check to remap_pfn_range during mmap The call to remap_pfn_range… |
CVE-2026-64050 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: don't mix devm and drmm functions Mixing devm and drmm functions will result… |
CVE-2026-64048 | High | 7.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot On the SMC-D client, slo… |
CVE-2026-64045 | High | 8.4 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - use cached peer pointer in ovpn_tcp_close() ovpn_tcp_close() loads the ovpn_s… |
CVE-2026-64044 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in CMD_NEW_PEER error path ovpn_nl_peer_new_doit()'s error pa… |
CVE-2026-64042 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Check BAR resources before exporting a DMABUF A DMABUF exports access to BAR re… |
CVE-2026-64041 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: fs210x: fix possible buffer overflow In fs210x_effect_scene_info(), a strin… |
CVE-2026-64039 | High | 7.7 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/snapshot: fix dumping of the unaligned regions The snapshotting code internally a… |
CVE-2026-64036 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: cgroup/rstat: validate cpu before css_rstat_cpu() access css_rstat_updated() is exposed a… |
CVE-2026-64032 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix a possible use-after-free when removing a bridge port When per-VLAN mu… |
CVE-2026-64031 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: erofs: fix managed cache race for unaligned extents After unaligned compressed extents we… |
CVE-2026-64030 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs IEEE80211_MLE_STA_EPCS_CONTROL_… |
CVE-2026-64029 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize UMP output teardown with event_input seq_ump_process_event() borrows… |
CVE-2026-64027 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: shaper: rework the VALID marking (again) Recent commit changed the semantics from NO… |
CVE-2026-64026 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg This improves th… |
CVE-2026-64023 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: fix a potential use-after-free On error we free aggr->lookups->dev_id b… |
CVE-2026-64020 | High | 7.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma_vecs leak on p2p memory We don't unmap P2P memory, so we don't need to… |
CVE-2026-64017 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task s… |
CVE-2026-64015 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: security/keys: fix missed RCU read section on lookup Nicholas Carlini reports that the ke… |
CVE-2026-64011 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free in llcp_sock_release() llcp_sock_release() unconditionally… |
CVE-2026-64010 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() A race condition exists in the N… |
CVE-2026-64009 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: xfrm: Check for underflow in xfrm_state_mtu Leo Lin reported OOB write issue in esp compo… |
CVE-2026-64008 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in create_bo rocket_ioctl_create_bo() inser… |
CVE-2026-64005 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net/smc: Do not re-initialize smc hashtables INIT_HLIST_HEAD(&smc_v*_hashinfo.ht) are cal… |
CVE-2026-64004 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix locking in .getsockopt Mirror iucv_sock_setsockopt() and wrap the whole swi… |
CVE-2026-64003 | High | 7.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues While a SCS… |
CVE-2026-64002 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() ipv4… |
CVE-2026-63996 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpl… |
CVE-2026-63995 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate start_cmd_payload_size from module The CMIS firmware update code… |
CVE-2026-63987 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES ethnl_update_profil… |
CVE-2026-63985 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ethtool: eeprom: add more safeties to EEPROM Netlink fallback The Netlink fallback path f… |
CVE-2026-63980 | High | 7.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spin_lock_bh for hn_lock nvmet_tcp_state_change(), a socket callback t… |
CVE-2026-63977 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work The change_work was… |
CVE-2026-63976 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success l2cap_ecred_reconf_r… |
CVE-2026-63975 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp If dcid is received for an a… |
CVE-2026-63974 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Since hci_dev_close_… |
CVE-2026-63972 | High | 7.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: mana: Skip redundant detach on already-detached port When mana_per_port_queue_reset_… |
CVE-2026-63971 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctp_wait_for_connect and peeloff sctp_wait_for_connect() drops an… |
CVE-2026-63970 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: bind uarg before filling zerocopy skb virtio_transport_send_pkt_info() allo… |
CVE-2026-63968 | High | 7.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in fib6_select_path() Found while auditing the same patt… |
CVE-2026-63955 | High | 7.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: do not trigger BUG() on BH disabled context __get_vm_area_node() currently tr… |
CVE-2026-63954 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: hpfs: fix a crash if hpfs_map_dnode_bitmap fails If hpfs_map_dnode_bitmap fails, the code… |
CVE-2026-63952 | High | 8.4 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEAL_WRITE When SEAL_EXEC is added, SEAL_WRI… |
CVE-2026-63951 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_writeback_endio A crash was observed in zram_writeback_e… |
CVE-2026-63950 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one Initialize nr_pages t… |
CVE-2026-63947 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidp_input_report() hidp_input_report() rea… |
CVE-2026-63946 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in iso_recv_frame iso_recv_frame reads conn->sk under iso_conn_lo… |
CVE-2026-63945 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock iso_sock_close() calls is… |
CVE-2026-63944 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync hci_le_create_cis_sync() dereferen… |
CVE-2026-63942 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: parport: Fix race between port and client registration The parport subsystem registers po… |
CVE-2026-63941 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor ZCR_EL2 can be updated b… |
CVE-2026-63937 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer Use READ_ONCE() wh… |
CVE-2026-63930 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: fix use-after-free in error path In the err_put_buffers cleanup… |
CVE-2026-63927 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: Fix use after free in debug code We're not allowed to dereference "urb" after… |
CVE-2026-63926 | High | 8.4 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data When bpf_msg_push_data() inse… |
CVE-2026-63925 | High | 8.1 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: macsec: fix replay protection at XPN lower-PN wrap In macsec_post_decrypt(), when pn is U… |
CVE-2026-63923 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify rvu_mbox_handler… |
CVE-2026-63921 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). After patch 1/2 in this series, vti6_… |
CVE-2026-63920 | High | 7.1 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6_datagram_recv_specific_… |
CVE-2026-63919 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection… |
CVE-2026-63918 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname A reader in l2tp_session_ge… |
CVE-2026-63917 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n n… |
CVE-2026-63916 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: HID: wacom: Fix OOB write in wacom_hid_set_device_mode() wacom_hid_set_device_mode() curr… |
CVE-2026-63915 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfc_hci_recv_from_llc() and n… |
CVE-2026-63914 | High | 7.3 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: xfrm: route MIGRATE notifications to caller's netns xfrm_send_migrate() in net/xfrm/xfrm_… |
CVE-2026-63913 | High | 8.2 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check … |
CVE-2026-63911 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: reset runtime state when cloning SAs iptfs_clone_state() clones the IPTFS mo… |
CVE-2026-63910 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: dma-buf: fix UAF in dma_buf_fd() tracepoint Once FD_ADD() returns, the fd is live in the… |
CVE-2026-63909 | High | 8.1 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Commit d07b26f39246 ("… |
CVE-2026-63906 | High | 8.4 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Fix use-after-free in omap2430_probe() In omap2430_probe(), of_node_… |
CVE-2026-63894 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: serialize DMABUF cancel against request completion ffs_epfile_dmabuf_i… |
CVE-2026-63893 | High | 8.1 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() entry->value is u32 a… |
CVE-2026-63889 | High | 8.1 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel… |
CVE-2026-63885 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between change_handle and handle_delete drm_gem_change_handle_ioctl lea… |
CVE-2026-63884 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo->ttm object might be changed… |
CVE-2026-63883 | High | 7.3 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ When uart_f… |
CVE-2026-63881 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger get_queue_ids() compu… |
CVE-2026-63879 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpu_hmm_range_get_pages The notifier sequence must only be read once o… |
CVE-2026-63875 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: arm64: tlb: Flush walk cache when unsharing PMD tables When huge_pmd_unshare() is called… |
CVE-2026-63874 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: mctp: usb: fix race between urb completion and rx_retry cancellation It's possible t… |
CVE-2026-63870 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() The aoe driver (or similar… |
CVE-2026-63869 | High | 7.6 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap When parsing… |
CVE-2026-63867 | High | 8.2 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcv_wnd The MPTCP output path access locklessly… |
CVE-2026-63866 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link() Clear WCID pointer… |
CVE-2026-63865 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks bpf_lsm_task_t… |
CVE-2026-63864 | High | 8.4 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: bpf: Propagate error from visit_tailcall_insn Commit e40f5a6bf88a ("bpf: correct stack li… |
CVE-2026-63863 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm() There is a unbalanced lock/unlo… |
CVE-2026-63860 | High | 8.4 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Prefer NLA_NUL_STRING These attributes are evaluated as c-string (passed to st… |
CVE-2026-63858 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: add hook transactions for device deletions Restore the flag that in… |
CVE-2026-63856 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings VCN encoder and decoder ring… |
CVE-2026-63855 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings VCN encoder and decoder ring… |