High-severity CVEs (page 67)
Page 67 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-93147 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpu_nr is a 32 bit value and BPF_REG_0 is a 64… |
CVE-2026-93144 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject writes through untrusted BTF pointers check_ptr_to_btf_access() lets program-… |
CVE-2026-93138 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux bpf_get_btf_vmlinux() lazily parses… |
CVE-2026-93137 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free on mm_struct in bpf_find_vma() bpf_find_vma() reads task->mm and… |
CVE-2026-93127 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Drop scalar id on sign-extending narrowing stack fills When a spilled scalar is fill… |
CVE-2026-93125 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max check_kfunc_args() d… |
CVE-2026-93122 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uac: validate rate list length before storing UAC1 and UAC2 configfs rate-li… |
CVE-2026-93121 | High | 7.0 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths The error paths… |
CVE-2026-93116 | High | 7.0 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wmi: fix resource leaks on probe failure During driver initialization… |
CVE-2026-93112 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Require a BPF cpumask for bpf_cpumask_populate() bpf_cpumask_populate() writes to it… |
CVE-2026-93111 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Mark tracing_multi trampolines as ftrace managed Since tracing_multi link does not s… |
CVE-2026-93107 | High | 8.2 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state When… |
CVE-2026-93105 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: esp: do not unref managed frag pages in esp_ssg_unref() esp_ssg_unref() releases the page… |
CVE-2026-93095 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: hfsplus: validate thread record before delete key rebuild hfsplus_delete_cat() is called… |
CVE-2026-93079 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Get Feature count larger than the output buffer cxlctl_get_feature()… |
CVE-2026-93074 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: use __va(phys) for kaddr in direct_access Use __va(phys) instead of virt_addr… |
CVE-2026-93070 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: media: ipu6: Do not free aux device pdata after init ipu6_bus_initialize_device() stores… |
CVE-2026-93063 | High | 8.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mei: check SAP message length before reading it Verify the SAP message siz… |
CVE-2026-93054 | High | 7.0 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: uio: Fix stale info pointer in failed registration path After device_add(), the UIO devic… |
CVE-2026-93046 | High | 7.0 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: software node: Fix software_node_get_reference_args() with index -1 The bounds check for… |
CVE-2026-93045 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject arena frees below the arena base bpf_arena_free_pages() accepts scalar arena… |
CVE-2026-93042 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Terminate all descriptors without callbacks The DMA Engine client doc… |
CVE-2026-93039 | High | 7.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: Keep link pointers valid on realloc failure meson_card_reallocate_links() gr… |
CVE-2026-93037 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Propagate sdma_txinit_ahg() errors set_txreq_header_ahg() ignores the return v… |
CVE-2026-92980 | High | 7.2 | 2026-09-17 | HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as… |
CVE-2026-92525 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] For a user QP, qp->sq.q… |
CVE-2026-92522 | High | 7.3 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: validate MADT IOAPIC entry bounds The IOAPIC hotplug lookup parses both… |
CVE-2026-92518 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix kernel stack corruption in tailcall with CFI When CONFIG_CFI_CLANG is ena… |
CVE-2026-92511 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ib_destroy_cq_user() When accessing a CQ via t… |
CVE-2026-92510 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ib_destroy_srq_user() When accessing a SRQ via… |
CVE-2026-92508 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ib_free_cq() When accessing a CQ via the netli… |
CVE-2026-92507 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ib_dealloc_pd_user() When accessing a PD via t… |
CVE-2026-92504 | High | 7.0 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: thermal: intel: int3400: clean up ODVP on probe failures evaluate_odvp() creates per-ODVP… |
CVE-2026-92488 | High | 7.0 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: complete object teardown when the destroy command fails erdma_destroy_qp(), e… |
CVE-2026-92485 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix WARNING in bpf_tracing_link_release The trampoline could be corrupted by the bli… |
CVE-2026-90435 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix integer overflow of user QP buffer size set_user_buf_size() computes the Q… |
CVE-2026-90429 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init A user VINTF is to… |
CVE-2026-90427 | High | 7.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() __tegra241_cm… |
CVE-2026-90425 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID tegra241_vintf_init_vsid()… |
CVE-2026-90423 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix UAF in ODP init error-handling path rxe_odp_mr_init_user() stores &umem_odp… |
CVE-2026-90419 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: prevent out-of-bounds read in super root block parsing super-root inode metadata… |
CVE-2026-90408 | High | 7.7 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() There is no po… |
CVE-2026-90407 | High | 7.7 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() There is no po… |
CVE-2026-90403 | High | 7.0 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix error path in rtl_pci_probe() In the last error path in rtl_pci_p… |
CVE-2026-90402 | High | 7.0 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Fix controller cleanup on EDL sysfs failure mhi_register_controller() add… |
CVE-2026-90401 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: md: remove REQ_NOWAIT support from raid1/10/456 REQ_NOWAIT support in md personalities th… |
CVE-2026-90399 | High | 8.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() Currently, in ath12k_wmi_mac_ph… |
CVE-2026-90398 | High | 8.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() Currently, in ath11k_wmi_tlv_ma… |
CVE-2026-90392 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF when reading bpf link info In bpf_link_show_fdinfo and bpf_link_ge… |
CVE-2026-90388 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Check atomic pool allocation result directly The non-blocking, non-coherent al… |
CVE-2026-90387 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: swiotlb: Preserve allocation virtual address for dynamic pools swiotlb_alloc_tlb() can al… |
CVE-2026-90383 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: misc: sgi-gru: remove interrupt-context page-table walks The GRU TLB miss handler walks a… |
CVE-2026-90381 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()… |
CVE-2026-90380 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete A use-after-free issue oc… |
CVE-2026-90379 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash When an AER erro… |
CVE-2026-90372 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss If a peer's VHT/HE MCS… |
CVE-2026-90371 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix RXDMAD_C buffer recycling race The RXDMAD_C buffers come from the RRO dat… |
CVE-2026-90367 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER mt7996_mac_rese… |
CVE-2026-90358 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix trampoline stack size for 128-bit arguments btf_distill_func_proto() accept… |
CVE-2026-90357 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement The flow is added to… |
CVE-2026-90353 | High | 7.0 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix ext PHY use-after-free on register error path After mt7915_regist… |
CVE-2026-90347 | High | 8.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry Commit e057b9477232 ("arm6… |
CVE-2026-90343 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: stop PMSR before P2P and NAN teardown PMSR request teardown must abort ac… |
CVE-2026-90341 | High | 7.7 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: firmware: coreboot: Validate table bounds The existing coreboot_table_populate() bounds c… |
CVE-2026-90332 | High | 8.2 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Flush cached MSI write before unmapping the iATU The MSI-X path already flu… |
CVE-2026-90329 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: HID: synchronize input before cleaning up a failed probe hid_device_io_start() allows rep… |
CVE-2026-90326 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix race between policy activation and blkg destruction When switching an IO… |
CVE-2026-90325 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: skip dying blkg in blkcg_activate_policy() When switching IO schedulers on a… |
CVE-2026-90324 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ublk: check import_ubuf() return value import_ubuf() can fail if the address range (provi… |
CVE-2026-90321 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate inline xattrs during inode block validation Patch series "ocfs2: validate… |
CVE-2026-90320 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate external xattr entries when reading metadata ocfs2_validate_xattr_block()… |
CVE-2026-90317 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Invalidate RCU pointers after final spin unlock In a sleepable BPF program, a spin l… |
CVE-2026-90316 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: drm/omap: dsi: Do not copy isr table To be able to unregister stuff from isrs, the corres… |
CVE-2026-90312 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Check load-acquire src ptr type before the load check_atomic_load() calls check_load… |
CVE-2026-90309 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Hold CQ references when processing EQ events EQ handlers look up CQs from dev… |
CVE-2026-90308 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Hold QP references for AE and CM processing AE QP fatal events and iWARP CM p… |
CVE-2026-90301 | High | 8.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: o2hb: quiesce negotiate handlers and timeout work Heartbeat regions publish struct… |
CVE-2026-90294 | High | 7.5 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: IB/isert: delay the final Login Response until the session is registered isert_put_login_… |
CVE-2026-90293 | High | 7.5 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registration isert_put_logi… |
CVE-2026-90292 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siw_accept() siw_accept() looks up the QP supplied by use… |
CVE-2026-90291 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmod_dup_req lifetime handling The kmod dups code uses… |
CVE-2026-90289 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Resize MST HDCP per-connector arrays to 32 AMDGPU_DM_MAX_DISPLAY_INDEX i… |
CVE-2026-90288 | High | 7.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure for_each_child_of… |
CVE-2026-90286 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: Use PFP on the compute queues too On GFX6, the compute rings use the sam… |
CVE-2026-90268 | High | 8.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix error handling in sd_probe() after large pool creation failure After device… |
CVE-2026-90260 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: don't clobber the extent buffer when zeroing it out On a zoned filesystem a… |
CVE-2026-90256 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind hci_conn::l2cap_… |
CVE-2026-90255 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix the SCO setup context lifetime hci_setup_sync() queues a conn_ha… |
CVE-2026-90246 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix integer overflow in verify_tags() bounds check verify_tags() validates the… |
CVE-2026-90244 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Restore locking around msi_page_list Unlike a group's default domain, which is… |
CVE-2026-90243 | High | 8.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down copied context entry copied_context_tea… |
CVE-2026-90241 | High | 8.2 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Tear down scalable-mode context on probe failure intel_pasid_setup_sm_context… |
CVE-2026-90240 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush context cache with correct SID when tearing down aliases domain_context… |
CVE-2026-90237 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: move custom expectation support to helper Originally, the ct expectati… |
CVE-2026-90234 | High | 7.5 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: NFS: Return a delegation the client fails to record When an NFS server grants a delegatio… |
CVE-2026-90231 | High | 8.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unconfined user namespace restriction forced stack If a task is already con… |
CVE-2026-90229 | High | 7.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Destroy the admin queue on removal The admin queue is allocated with blk_mq_a… |
CVE-2026-90228 | High | 7.5 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() When a host issues… |
CVE-2026-90227 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() Unlike IO_CMD / IO64_CMD, NVME_IOCTL_… |
CVE-2026-90225 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: read llcp_sock->local under the socket lock in getsockopt nfc_llcp_getsockopt(… |