High-severity CVEs (page 84)
Page 84 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-89601 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ext2: Fix lost inode updates for IS_SYNC inodes ext2_setsize() and ext2_xattr_set2() had… |
CVE-2026-89600 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fanotify: fix use-after-free of file range info fsnotify_pre_content() builds its file_ra… |
CVE-2026-89599 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: panel-dsi-cm: initialize lock before registering display dsicm_probe() reg… |
CVE-2026-89597 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fbdev: uvesafb: unregister connector callback on init failure uvesafb_init() registers th… |
CVE-2026-89596 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nv_suspend() and nv_… |
CVE-2026-89594 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device The OMAP SSI dri… |
CVE-2026-89593 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: hugetlb: only adjust reservation during unmapping if mapcount is 0 Since df7a6d1f6405, __… |
CVE-2026-89588 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In ghes_handle_arm_hw_er… |
CVE-2026-89587 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ACPI: pfr_update: fix stack buffer overflow in query_capability() query_capability() copi… |
CVE-2026-89586 | High | 8.2 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes ata_scsi_write_sam… |
CVE-2026-89585 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: auxdisplay: charlcd: cancel backlight work on registration failure With CONFIG_CHARLCD_BL… |
CVE-2026-89584 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: block: validate user space vectors during extraction The bio-based drivers don't necessar… |
CVE-2026-89583 | High | 8.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eir_get_service_data() eir_get_service_data() walks the a… |
CVE-2026-89581 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an extended register The destination of the… |
CVE-2026-89580 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in __bpf_get_stack get_perf_callchain() returns a per-CPU perf_ca… |
CVE-2026-89579 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloom_map_alloc() has two… |
CVE-2026-89574 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read array_block_check() validates blocknr and… |
CVE-2026-89573 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's array_block_check()… |
CVE-2026-89571 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: cxl/features: bound fwctl command payload to the input buffer fwctl_cmd_rpc() copies cmd-… |
CVE-2026-89570 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the… |
CVE-2026-89569 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcomm_security_cfm() looks u… |
CVE-2026-89564 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ip: orphan prefetched skbs before multicast forwarding IPv4 and IPv6 input preserve an sk… |
CVE-2026-89563 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() ip6_tnl_xmit() may need to expand headro… |
CVE-2026-89562 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ip6_gre: fix hardware header length for NBMA tunnels ip6gre_tnl_link_config_route() accum… |
CVE-2026-89561 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() ipv6_rpl_srh_rcv() derefere… |
CVE-2026-89560 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation Whiteout objects are… |
CVE-2026-89559 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in __nd_label_validate() The on-media namespac… |
CVE-2026-89557 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: md: do overflow check for sb->bblog_shift in super_1_load() In super_1_load(), sb->bblog_… |
CVE-2026-89554 | High | 8.2 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction mptcp_token_join_co… |
CVE-2026-89553 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nouveau/gem: reserve the bo in the info ioctl around the vma lookup In the non-uvmm path… |
CVE-2026-89549 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svc_pool_for_cpu() svc_set_num_threads() spreads the… |
CVE-2026-89548 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cache_cleaner before destroying a cache_detail sunrpc_destroy_cache_… |
CVE-2026-89547 | High | 8.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation __svc_create() initializes three per-poo… |
CVE-2026-89545 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rq_argp and rq_resp free until after RCU grace period svc_rqst_free() frees… |
CVE-2026-89544 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssx_dec_option_array error path bugs Four coupled defects in the gssx XDR op… |
CVE-2026-89540 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sunrpc: init gssp_lock before publishing proc entry create_use_gss_proxy_proc_entry() pub… |
CVE-2026-89535 | High | 8.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id svc_rdma_free() caches rdma… |
CVE-2026-89534 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails When svc_rdma_listen_handler()… |
CVE-2026-89528 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Read lists that exceed the page budget Individual Read segment lengths ar… |
CVE-2026-89524 | High | 8.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6kl_c… |
CVE-2026-89523 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel pending mlo_pm_work If the device is reset, suspended or unreg… |
CVE-2026-89522 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: media: staging/ipu7: fix async notifier UAF on probe error path isys_register_devices() r… |
CVE-2026-89521 | High | 7.3 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sched/core: Handle pick_task() releasing the rq lock Core scheduling's pick_next_task() b… |
CVE-2026-89520 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sched/core: Make core-sched flips wait for in-flight selections Core scheduling's pick_ne… |
CVE-2026-89513 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENT_GET_INFO stores guest-c… |
CVE-2026-89511 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: qede: Fix NULL pointer dereference in TPA fragment processing Under memory pressure, the… |
CVE-2026-89510 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel reg_work before freeing device on remove c4iw_uld_state_change() queue… |
CVE-2026-89508 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma_set_ib_path() ucma_set_ib_path() calls ucma_event_han… |
CVE-2026-89507 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma_write_cm_event() ctx->file may only be changed under… |
CVE-2026-89504 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_nod… |
CVE-2026-89503 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() ring_buffer_alloc_… |
CVE-2026-89501 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf Because, ring_buffer_subbuf_ord… |
CVE-2026-89500 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page Discarding a cached reade… |
CVE-2026-89499 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Stop remote reader update when page swap fails The remote swap_reader_page c… |
CVE-2026-89497 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: orangefs: skip leading spaces before parsing client debug masks orangefs_prepare_cdm_arra… |
CVE-2026-89493 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rl_used against rl_count in refcount block validator ocfs2_find_refcount_… |
CVE-2026-89489 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: openrisc: fix arbitrary kernel memory access via or1k_atomic syscall sys_or1k_atomic() (s… |
CVE-2026-89488 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state u… |
CVE-2026-89487 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skb_tx_error() a packet we are about to drop queue_userspace_packet() b… |
CVE-2026-89486 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() Commit 9e91f8a6c868 ("ipmi:m… |
CVE-2026-89483 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvme_setup_discard() always maps sizeof(struct nvme_… |
CVE-2026-89481 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme_tcp_handle_r2t() does… |
CVE-2026-89480 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvme_tcp_recv_data() completes a r… |
CVE-2026-89477 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctp_process_strreset_outreq(), s… |
CVE-2026-89476 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream->outcnt underflow on duplicate RECONF responses A cached RECONF chunk ma… |
CVE-2026-89472 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: register regulators before exposing sysfs charger_manager… |
CVE-2026-89471 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: cros_usbpd-charger: bound the EC-reported port count cros_usbpd_charger_pr… |
CVE-2026-89470 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Currently the cros_us… |
CVE-2026-89469 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix use-after-free in lp8727_release_irq() lp8727_isr_func(), the… |
CVE-2026-89466 | High | 7.7 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: qcom_battmgr: terminate the strings from firmware The qcom_battmgr_sc8280x… |
CVE-2026-89465 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: quiesce delayed work before teardown The threaded IRQ handler can… |
CVE-2026-89459 | High | 7.0 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: s390/percpu: Fix MVIY_PERCPU() with older binutils Commit a737737cdb9c ("s390/percpu: Inf… |
CVE-2026-89456 | High | 7.0 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Propagate partial completion length across ERP recovery dasd_default_erp_posta… |
CVE-2026-89452 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommu/msm: Unwind probe state on registration failure msm_iommu_probe() adds its devm-man… |
CVE-2026-89450 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field tegra241_vintf_init_vs… |
CVE-2026-89445 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGER_IOPF borrows an atta… |
CVE-2026-89443 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isst_if_get_perf_level_mask() and… |
CVE-2026-89442 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in clos_assoc ioctl isst_if_clos_assoc() validates… |
CVE-2026-89441 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: cancel card-detect work on remove Disabling the device interrupt and free… |
CVE-2026-89440 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: stop card-detect handling on probe failure request_irq() registers the SD… |
CVE-2026-89436 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[] acpi_pcc_retrieve_bio… |
CVE-2026-81017 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carrie… |
CVE-2026-81016 | High | 7.7 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Propagate SMU errors and validate S2D address amd_stb_s2d_init() di… |
CVE-2026-81015 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails amd_pmc_probe() regi… |
CVE-2026-81012 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() hp_get_stri… |
CVE-2026-81011 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type pa… |
CVE-2026-81010 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: honor task_work cancellation io_waitid_cb() may run through the fallback… |
CVE-2026-81008 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: interconnect: Fix use after free in icc_get() and of_icc_get_by_index() In of_icc_get_by_… |
CVE-2026-81007 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmb_write() read message fields before validat… |
CVE-2026-81006 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ipmi: Remove all sysfs files on registration failure ipmi_add_smi() creates the nr_users… |
CVE-2026-81004 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ipmi:msghandler: Cancel work cleanly on an error If an error occurs during startup of an… |
CVE-2026-81003 | High | 8.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucv_hs_rcv() by ingress device afiucv_hs_rcv() selects a so… |
CVE-2026-81001 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: slip: fix use-after-free in sl_sync() slip_devs[] stores bare net_device pointers and tak… |
CVE-2026-81000 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and… |
CVE-2026-80998 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: net: bnxt: ring the doorbell when SW USO exits early When a burst of packets is handed do… |
CVE-2026-80997 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix stalled modem TX queue after runtime resume ipa_start_xmit() unconditionall… |
CVE-2026-80995 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: net: mctp: hold a reference to the route device in mctp_route_lookup() mctp_route_lookup(… |
CVE-2026-80994 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix flow mask use-after-free on flow deletion The commit in the Fixes t… |
CVE-2026-80992 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: net: ravb: avoid dereferencing an invalid PTP clock The PTP clock is unavailable before t… |
CVE-2026-80991 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: net: ravb: serialize PTP clock teardown ravb_ptp_interrupt() can race with ravb_ptp_stop(… |