High-severity CVEs (page 71)
Page 71 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-90018 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() rtw_get_wps_attr(… |
CVE-2026-90017 | High | 7.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() rtw_action_frame_parse() tak… |
CVE-2026-90016 | High | 7.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() rtw_restruct_wmm_ie() scans in_… |
CVE-2026-90014 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: tracing: Have show_event_filters/triggers files take trace array ref The newly added file… |
CVE-2026-90013 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: tracing: Take trace_array reference when opening options file The options files do not ta… |
CVE-2026-90010 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap io_uring sense copy to max_response_len Completion copied scmd->sense_len… |
CVE-2026-90009 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in io_uring passthrough command setup scsi_bsg_uring_cmd() reads bs… |
CVE-2026-90008 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame megasas_make_prp_nvme(… |
CVE-2026-90007 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Use rollback index when freeing MSI-X vectors pm8001_request_msix() unwinds… |
CVE-2026-90003 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: futex: Prevent rcuwait use-after-free during requeue PI On PREEMPT_RT, FUTEX_CMP_REQUEUE_… |
CVE-2026-90002 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ftrace: Take trace_array reference before accessing its ftrace_ops The trace instance fil… |
CVE-2026-90001 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: HID: bpf: serialize device reference release in struct_ops destroy path __hid_bpf_ops_des… |
CVE-2026-90000 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeRe… |
CVE-2026-89999 | High | 8.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: HID: wacom: validate report length in wacom_intuos_pro2_bt_irq wacom_intuos_pro2_bt_irq()… |
CVE-2026-89998 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: dm: fix race when loading and unloading a table If the userspace calls two concurrent tab… |
CVE-2026-89997 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: dm: fix resume-vs-remove race If the user issues the resume ioctl and the remove ioctl at… |
CVE-2026-89995 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: dma-direct: return struct page from dma_direct_alloc_from_pool() Commit 5b138c534fda ("dm… |
CVE-2026-89994 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-edma: tracing: no ptr dereference during log output The fsl edma events st… |
CVE-2026-89992 | High | 8.4 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: cpuidle: dt_idle_genpd: kfree() the original name allocation dt_idle_pd_alloc() kasprintf… |
CVE-2026-89988 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: kprobes: Protect kprobe_blacklist with RCU __within_kprobe_blacklist() traverses kprobe_b… |
CVE-2026-89986 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave() syzbot re… |
CVE-2026-89985 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: memcg: keep folio's objcg same as its node memcg_reparent_objcgs() has an inherent assump… |
CVE-2026-89980 | High | 8.4 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ALSA: harmony: initialize locks before requesting IRQ snd_harmony_create() registers the… |
CVE-2026-89979 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix race between non-atomic ops and trigger-start We protect the races of the… |
CVE-2026-89974 | High | 7.5 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails nvmf_create_ctrl()… |
CVE-2026-89973 | High | 8.2 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: check the data direction of a C2HData PDU nvme_tcp_handle_c2h_data() finds the… |
CVE-2026-89971 | High | 7.5 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: nvme: skip the zoned limits update if the zone info query failed nvme_query_zone_info() r… |
CVE-2026-89968 | High | 7.5 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: reject unsolicited H2CData PDUs nvmet_tcp_handle_h2c_data_pdu() accepts an H2C… |
CVE-2026-89967 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: avoid out-of-bounds writes for compound folios migrate_device_range()… |
CVE-2026-89965 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: reject an arena whose nfree is below the lane count The BTT info block's nfre… |
CVE-2026-89961 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population vmemmap_populate_c… |
CVE-2026-89960 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm() In vfio_ap_m… |
CVE-2026-89959 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove The vfio_ap_config_re… |
CVE-2026-89957 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed The vfio_ap_m… |
CVE-2026-89954 | High | 8.0 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: mtd: afs: validate v2 image info bounds The AFS v2 parser uses footer[8] to locate the im… |
CVE-2026-89951 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix stale receive device on merged fragments Fragment reassembly reuses the s… |
CVE-2026-89947 | High | 8.0 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: clk: meson: align gxbb_32k_clk_sel number of parents with actual count The following out-… |
CVE-2026-89943 | High | 8.4 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ASoC: loongson: Fix error handling in ACPI property parsing In loongson_card_parse_acpi()… |
CVE-2026-89942 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Fix potential use-after-free in anonymous buffer release An anonymous buffer… |
CVE-2026-89941 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Make IIO DMA fence release RCU-safe The `dma_fence` documentation states tha… |
CVE-2026-89940 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Tie IIO dma fence lock lifetime to the fence The `iio_dma_fence` implementat… |
CVE-2026-89938 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF The atlas dr… |
CVE-2026-89932 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Always flush vpid02 on first use Make sure vpid02 is always flushed on first u… |
CVE-2026-89929 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU When emulating INVVPID… |
CVE-2026-89928 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk __kvm_rmap_lock() d… |
CVE-2026-89927 | High | 7.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock Fix an issue where userspace o… |
CVE-2026-89922 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Take srcu when importing watchpoint data __import_wp_info() backs up the origi… |
CVE-2026-89920 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix memory corruption by not reinjecting CK machine checks Channel-subsystem d… |
CVE-2026-89919 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: s390: keyop: use mmu_lock to read gmap->asce Every other dat_* consumer in this file… |
CVE-2026-89913 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables vgic_v3_save_pe… |
CVE-2026-89912 | High | 7.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops… |
CVE-2026-89911 | High | 7.9 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap TLBI Range to the architural limit TLB Invalidation by Range ha… |
CVE-2026-89910 | High | 7.3 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc Variable vector[] is… |
CVE-2026-89908 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY kvm_arch_prepare_memory_… |
CVE-2026-89907 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate MSI data before routing it to EIOINTC pch_msi_set_irq() passes e… |
CVE-2026-89906 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old macro-based jmp_off… |
CVE-2026-89904 | High | 8.4 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix acpi_package_ids[] array overflow With LoongArch virt machine, a typical s… |
CVE-2026-89903 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: Do not save/restore percpu base register in rethook trampoline The rethook tra… |
CVE-2026-89902 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: Avoid preempt count underflow without probe LoongArch uses break 11 for the br… |
CVE-2026-89899 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: media: cec: disable delayed work before freeing an interrupted transmit cec_transmit_msg_… |
CVE-2026-89898 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: media: cec: extron-da-hd-4k-plus: add sanity check Add check to prevent overflowing msg.m… |
CVE-2026-89897 | High | 7.5 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: media: cec: Serialize exclusive follower delivery cec_receive_notify() reads the exclusiv… |
CVE-2026-89894 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidioc_s_fmt_vid_cap(… |
CVE-2026-89893 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: media: cx23885: cancel NetUP CI work before teardown netup_ci_exit() frees a netup_ci_sta… |
CVE-2026-89890 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: media: go7007: defer the ALSA v4l2 put until card release go7007_snd_init() already takes… |
CVE-2026-89888 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov02a10: fix endpoint parsing use-after-free The ov02a10_check_hwcfg() functi… |
CVE-2026-89887 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov7740: fix use-after-destroy in remove The ov7740_remove() function had a se… |
CVE-2026-89885 | High | 8.4 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: media: platform: mtk-mdp3: Fix SCP device refcounting mdp_probe() first tries to get the… |
CVE-2026-89883 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: media: rc: sunxi-cir: Unregister rc device on probe failure After rc_register_device() su… |
CVE-2026-89882 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow st_ref_pic_set_predicti… |
CVE-2026-89880 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure rtl2832_… |
CVE-2026-89877 | High | 8.4 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: media: saa7164: fix cleanup on resource allocation failure saa7164_dev_setup() adds the d… |
CVE-2026-89875 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: media: ti: vpe: quiesce overflow recovery before freeing streams The VIP overflow recover… |
CVE-2026-89873 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC EXT SPS RPS counts The HEVC SPS control carries the shor… |
CVE-2026-89870 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: media: zoran: Avoid freeing a registered video_device twice zoran_init_video_device() ins… |
CVE-2026-89863 | High | 7.5 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check qla_chk_edif_rx_sa_dele… |
CVE-2026-89861 | High | 8.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() In the format 1 pa… |
CVE-2026-89860 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Initialize NVMe abort_work once at submission qla_nvme_fcp_abort() and qla… |
CVE-2026-89856 | High | 8.4 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation ha->msix_count is u16… |
CVE-2026-89854 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix cs84xx use-after-free on host teardown qla84xx_put_chip() drops the la… |
CVE-2026-89849 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00_status_entry() filter… |
CVE-2026-89848 | High | 8.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Quiesce response IRQ before freeing request queue qla2xxx_delete_qpair() d… |
CVE-2026-89844 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition qla24xx_repo… |
CVE-2026-89841 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: only redirty pinned folios in redirty_blocks redirty_blocks() pins folios with read… |
CVE-2026-89840 | High | 7.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: validate MOVE_RANGE destination size F2FS_IOC_MOVE_RANGE checks the source range, b… |
CVE-2026-89838 | High | 7.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: limit recovery filename logging to stored length F2FS stores recovery filenames as… |
CVE-2026-89836 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix folio_nr_pages() race after put in large folio invalidate Our v6.18 based Andro… |
CVE-2026-89832 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to clear dirty flag on folio in error path If node block is corrupted due to ch… |
CVE-2026-89829 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer() Otherwise in f2fs_sanit… |
CVE-2026-89826 | High | 7.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: harden firmware build-info bounds checks panthor_fw_read_build_info() checks… |
CVE-2026-89825 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: fix firmware control interface bounds checks panthor_init_cs_iface() and pan… |
CVE-2026-89823 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm: fix race between partial drm_dev_register() failure and ioctl If drm_dev_register()… |
CVE-2026-89819 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: validate plane degamma LUT size for private color prop Unlike the CRTC d… |
CVE-2026-89818 | High | 7.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check If the supplied msg[2]… |
CVE-2026-89815 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Drop tt->restore after successful restore ttm_pool_restore_and_alloc() can succe… |
CVE-2026-89814 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: clamp the isolation index for rings outside a partition adev->isolation[] has… |
CVE-2026-89811 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES (Micro Engine Scheduler… |
CVE-2026-89810 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix error path at svm_migrate_copy_to_ram If page migration from device to sy… |
CVE-2026-89808 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram When migration… |
CVE-2026-89806 | High | 8.4 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation The framebuffer size calcul… |