Linux
24867 CVEs across 21 Linux products. Browse Linux vulnerabilities, severities, and proof-of-concept exploits.
Linux products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-98164 | | 2026-09-29 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check write tracking in all address spaces kvm_gfn_is_write_tracked() check… | |
CVE-2026-98163 | | 2026-09-26 | In the Linux kernel, the following vulnerability has been resolved: cgroup: Avoid iteration of dying tasks with zero refcount The commit 260fbcb92bbea ("cgro… | |
CVE-2026-98162 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb/server: fix tree connection leak in smb2_tree_connect() See the procedure below: s… | |
CVE-2026-98161 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep PREFLUSH before data writes pmem_submit_bio() records a REQ_PREFLUSH e… | |
CVE-2026-98160 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() padapter->HalDa… | |
CVE-2026-100079 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: unregister debugfs entries on teardown ucsi_register() creates per-inst… | |
CVE-2026-100078 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mei: pass correct argument to function The first argument to iwl_mei_write… | |
CVE-2026-100077 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: drm/msm: Recover HW before retire hung submit During recovery, it is not safe to retire t… | |
CVE-2026-100076 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths issue_beacon(… | |
CVE-2026-100075 | Critical | 9.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters When srpt_alloc_rw_ctxs() fails partw… |
CVE-2026-100074 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpf_refcount field as unique BPF_REFCOUNT is not marked as a unique field, whil… | |
CVE-2026-100073 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix transaction overflow during writeback Commit 95ad8ee45cdb ("ext4: correct the r… | |
CVE-2026-100072 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ACPI: platform: Use acpi_bus_get_primary_device() The acpi_get_first_physical_node() usag… | |
CVE-2026-100071 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsr_dev_finalize() can fail after a… | |
CVE-2026-100070 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet sashiko says: If map_ad… | |
CVE-2026-98159 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: validate CLC firmware records The CLC region is supplied by firmware… | |
CVE-2026-98158 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ppp_async: drop the errored frame instead of resetting its headroom ppp_receive_nonmp_fra… | |
CVE-2026-98157 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation The poll_msec sys… | |
CVE-2026-98156 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use the DMA API for resource backing on Xen On a Xen PV domain page addresses… |
CVE-2026-98155 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in resp_worker() Although 'commit 2feec5… | |
CVE-2026-98154 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queue_rq On -EIO, the RDMA queue_rq path reports a h… |
CVE-2026-98153 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: nvme: fix racy access to FDP placement id array nvme_query_fdp_info() is called per-path… | |
CVE-2026-98152 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix queue leak when connect backlog is exceeded When pending disconnecting qu… | |
CVE-2026-98151 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic Take the following un… | |
CVE-2026-98150 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix BPF_F_CPU validation for sparse CPU IDs BPF_F_CPU stores the target CPU ID in th… |
CVE-2026-98149 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix percpu map update indexing with sparse CPU IDs Per-CPU array, hash, and cgroup s… | |
CVE-2026-98148 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate GUD_ROTATION_0 is present in supported rotations The rotation argument… | |
CVE-2026-98147 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: printk: Don't WARN on kthread_run failure. Since __kthread_create_on_node() returns -EINT… | |
CVE-2026-98146 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain struct amdxdna_cmd_chain… | |
CVE-2026-98145 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose command_coun… | |
CVE-2026-98144 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: put the chained BO when its mapping fails amdxdna_cmd_set_error() looks up… | |
CVE-2026-98143 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Don't read the U65 rounding mode as a storage mode Bits 15:14 of NPU_SET_{… |
CVE-2026-98142 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: drm/cirrus-qemu: Validate BAR0 size during probe The `cirrus-qemu` driver relies on `CIRR… | |
CVE-2026-98141 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ntfs: propagate reparse index insertion failure update_reparse_data() ignores the return… | |
CVE-2026-98140 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ntfs: fix kmap_local leak in write_mft_record_nolock() error paths write_mft_record_noloc… | |
CVE-2026-98139 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ntfs: only count successfully cleared runs when freeing clusters ntfs_cluster_free_from_r… | |
CVE-2026-98138 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ntfs: do not mark the volume clean in sync_fs when errors were recorded ntfs_put_super()… | |
CVE-2026-98137 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ntfs: treat any nonzero dio zero-range return as an error ntfs_dio_zero_range() returns e… | |
CVE-2026-98136 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ntfs: bound $AttrDef table walk to the loaded table size ntfs_attr_find_in_attrdef() walk… | |
CVE-2026-98135 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid sectors_per_cluster in the boot sector is_boot_sector_ntfs() checks… | |
CVE-2026-98134 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: check_cond_jmp_op(): properly infer if register is null Nicholas Carlini reported a… | |
CVE-2026-98133 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ntfs: leave HasEA flag untouched on setxattr failure In ntfs_set_ea(), the exit path unco… | |
CVE-2026-98132 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO states.c:__clean_func_sta… | |
CVE-2026-98131 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix dma mapping leak in stmmac_tso_xmit() In stmmac_tso_xmit(), if the DMA m… | |
CVE-2026-98130 | High | 8.1 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START The SCTP_CMD_TIMER_START handler checks t… |
CVE-2026-98129 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add() sas_port_alloc_num()… | |
CVE-2026-98128 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add() mpi3mr_get_tgtdev_… | |
CVE-2026-98127 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for insert range smb3_insert_range() does not check if the n… | |
CVE-2026-98126 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for zero range When FALLOC_FL_ZERO_RANGE is used without FAL… | |
CVE-2026-98125 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb/client: fix stale page cache in insert/collapse range smb3_insert_range() and smb3_co… | |
CVE-2026-98124 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb/client: invalidate fscache for fallocate range operations smb3_zero_range(), smb3_pun… | |
CVE-2026-98123 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration sctp_verify_asconf() w… | |
CVE-2026-98122 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del() vxlan_mdb_is_valid_source()… |
CVE-2026-98121 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Fix NULL pointer dereference in PM callbacks msc313e_wdt_probe() doesn… | |
CVE-2026-98120 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix subreq ref leak Fix a subrequest ref leak in netfs_unbuffered_write() in the e… | |
CVE-2026-98119 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: netfs: break unbuffered write when netfs_alloc_subrequest() fails syzbot reported a null-… | |
CVE-2026-98118 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix readahead synchronisation issues by loading all folios upfront There are some… | |
CVE-2026-98117 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix potential UAF/KASAN warning Currently, trace_cachefiles_coherency() is be… | |
CVE-2026-98116 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF snd_pcm_hw_params(… |
CVE-2026-98115 | High | 8.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one sess… |
CVE-2026-98114 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: propagate DACL parsing errors parse_dacl() silently accepts truncated ACEs and all… | |
CVE-2026-98113 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: rate limit unmapped SID errors A client can include many structurally valid but un… | |
CVE-2026-98112 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix listener task lifetime on netdev events The listener thread exits when its lis… |
CVE-2026-98111 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate version TLV value lengths btintel_parse_version_tlv() verifi… | |
CVE-2026-98110 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-t… | |
CVE-2026-98109 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix race condition during device registration In hci_register_dev()… | |
CVE-2026-98108 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan l2cap_new_connection(… |
CVE-2026-98107 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect l2cap_chan_connect() tri… | |
CVE-2026-98106 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: Prevent double migration of device pages A device-private folio migrated to… | |
CVE-2026-98105 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: oa_tc6: Improve the error recovery When oversubscribed traffic causes lot… | |
CVE-2026-98104 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted gen_new_kid() fal… | |
CVE-2026-98103 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: igmp: convert struct ip_sf_list to RCU Commit 23d2b94043ca ("igmp: Add ip_mc_list lock in… | |
CVE-2026-98102 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src() When removing a source filter wh… | |
CVE-2026-98101 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() pmc->sflist is read lockles… | |
CVE-2026-98099 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcu_assign_pointer() for __rcu list updates Several places in net/ipv6/m… | |
CVE-2026-98098 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in tipc_named_node_up() on empty publication list User-space applica… | |
CVE-2026-98097 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: tipc: Dont send random pad bytes in RESET/ACTIVATE messages The interface name is passed… | |
CVE-2026-98096 | High | 7.4 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6_srh_rcv() runs with s… |
CVE-2026-98095 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). syzbot reporte… | |
CVE-2026-98094 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: make dirty_lock IRQ-safe fbtft_mkdirty() can be reached from the fbcon re… | |
CVE-2026-98093 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl_micfil: balance mclk enable/disable hw_params() enables mclk unconditionally an… | |
CVE-2026-98092 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() acp6x_pdm_dma_close() does not fr… | |
CVE-2026-98091 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: btrfs: detach failed sprout device from transaction update list When creating the first m… | |
CVE-2026-98090 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: btrfs: restore active device pointers after failed sprout btrfs_init_new_device() switche… | |
CVE-2026-98089 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix uninitialized transport header access in alb_determine_nd() alb_determi… | |
CVE-2026-98088 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues() … | |
CVE-2026-98087 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate A migrate_disable(… | |
CVE-2026-98086 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: do not touch legacy_rmidi before it exists snd_ump_parse_endpoint() sets ump->… | |
CVE-2026-98085 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge Nicholas Carlini reported a… | |
CVE-2026-98084 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks When processing calls t… | |
CVE-2026-98083 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction use-after-free in raid stripe insertion If allocation of a RAID st… |
CVE-2026-98082 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix the possible bioc_list memory leak during error There are two possible ways to… | |
CVE-2026-98081 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: finish active block group cleanup if call_zone_finish() fails do_zone_finis… | |
CVE-2026-98080 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: btrfs: do not force reloc root creation during qgroup_account_snapshot() [BUG] When runni… | |
CVE-2026-98079 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: btrfs: zstd: fix lost wakeup when waiting for a workspace A writer can sleep forever in z… | |
CVE-2026-98078 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ipvs: fix reversed sequence option serialization hton_seq() expects the host-order source… | |
CVE-2026-98077 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() sip_skip_whitespace()… | |
CVE-2026-98076 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Fix use-after-free on field name/type of events with multiple probes The… | |
CVE-2026-98075 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: reject BPF_PSEUDO_FUNC reference to the main program fixups.c:jit_subprogs() rewrite… | |
CVE-2026-98074 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bonding: do not clear curr_active_slave prematurely when releasing all slaves When releas… |