Linux
Page 11 of 100 — Linux CVEs from a corpus of 24866, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-90258 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: airoha: add missed IRQ resource helpers Without hooking .irq_request_resources… | |
CVE-2026-90257 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtio_bt: avoid OOB read of build info string The virtbt_setup_zephyr() sends… | |
CVE-2026-90256 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind hci_conn::l2cap_… |
CVE-2026-90255 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix the SCO setup context lifetime hci_setup_sync() queues a conn_ha… |
CVE-2026-90254 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths adv_ti… | |
CVE-2026-90253 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the mesh send cancel command when it is cancelled mesh_send_cancel(… | |
CVE-2026-90252 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the HCI command when it is cancelled mgmt_hci_cmd_sync() queues the… | |
CVE-2026-90251 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MSFT: validate evt_prefix_len against the response length read_supported_featu… | |
CVE-2026-90250 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage… | |
CVE-2026-90249 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes The IIO core doe… | |
CVE-2026-90248 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: fix teardown of an adopted proto on insert-race loss In tc_new_tfilte… | |
CVE-2026-90247 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix mmap_lock leak in irq_work path stack_map_get_build_id_offset() introduced a per… | |
CVE-2026-90246 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix integer overflow in verify_tags() bounds check verify_tags() validates the… |
CVE-2026-90245 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: fbdev: kyro: Validate overlay viewport coordinates The overlay viewport end coordinates a… | |
CVE-2026-90244 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Restore locking around msi_page_list Unlike a group's default domain, which is… |
CVE-2026-90243 | High | 8.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down copied context entry copied_context_tea… |
CVE-2026-90242 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix iopf_refcount leak on RID domain replacement intel_iommu_attach_device()… | |
CVE-2026-90241 | High | 8.2 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Tear down scalable-mode context on probe failure intel_pasid_setup_sm_context… |
CVE-2026-90240 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush context cache with correct SID when tearing down aliases domain_context… |
CVE-2026-90239 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumem() isp4if_alloc_fw… | |
CVE-2026-90238 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error path isp4sd_pwron_an… | |
CVE-2026-90237 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: move custom expectation support to helper Originally, the ct expectati… |
CVE-2026-90236 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Release the export reference when reaping open stateids nfs4_put_stid() releases th… | |
CVE-2026-90235 | Critical | 9.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE xprtsock rep… |
CVE-2026-90234 | High | 7.5 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: NFS: Return a delegation the client fails to record When an NFS server grants a delegatio… |
CVE-2026-90233 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nvme-pci: release descriptor pools on probe failure The per-NUMA-node descriptor DMA pool… | |
CVE-2026-90232 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: amt: Don't support cross-netns setup. When a lower device is unregistered, amt_device_eve… | |
CVE-2026-90231 | High | 8.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unconfined user namespace restriction forced stack If a task is already con… |
CVE-2026-90230 | Critical | 9.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate() nvmet_execute_auth_send() al… |
CVE-2026-90229 | High | 7.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Destroy the admin queue on removal The admin queue is allocated with blk_mq_a… |
CVE-2026-90228 | High | 7.5 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() When a host issues… |
CVE-2026-90227 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() Unlike IO_CMD / IO64_CMD, NVME_IOCTL_… |
CVE-2026-90226 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: avoid userspace overflow on invalid optlen nfc_llcp_getsockopt() casts optval… | |
CVE-2026-90225 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: read llcp_sock->local under the socket lock in getsockopt nfc_llcp_getsockopt(… |
CVE-2026-90224 | High | 7.5 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix double completion race in nci_data_exchange_complete nci_close_device() and… |
CVE-2026-90223 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound SNL TLV parsing to the skb and add length checks nfc_llcp_recv_snl() wal… |
CVE-2026-90222 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: hold a reference to the request skb during send_frame __pn533_send_async() pu… | |
CVE-2026-90221 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing nci_core_init_rsp_pack… | |
CVE-2026-90220 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Don't leak the extension cell pointer in the bounce payload The bounce_error_e… | |
CVE-2026-90219 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Free debugfs on registration failure c4iw_alloc() creates the per-device debu… | |
CVE-2026-90218 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix WARNING in res_to_rt syzbot reported a WARN_ON(!res->dev) in res_to_rt() tr… | |
CVE-2026-90217 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Compare iterator types during state pruning An iterator stack slot can be MEM_RCU or… |
CVE-2026-90216 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ubi: Fix rollback for explicit UBI device numbers ubi_init_attach() rolls back module ini… | |
CVE-2026-90215 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: mtd: ubi: Release device reference on busy detach ubi_detach_mtd_dev() obtains a device r… | |
CVE-2026-90214 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ASoC: xilinx: formatter_pcm: fix stream_data leak on open error In xlnx_formatter_pcm_ope… | |
CVE-2026-90213 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix memory leak in error path of build_tree() In the error path of build_… | |
CVE-2026-90212 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: arm64/efi: Avoid voluntary preemption with efi_mm installed Gus reports a bad kernel memo… | |
CVE-2026-90211 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf, s390: Clear fetch destination on faulting arena atomic Same missing register clear a… | |
CVE-2026-90210 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in bpf_trampoline_multi_attach_free on update failure When bpf_trampoline_up… |
CVE-2026-90209 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix deadlock during unregister Unregistering an s390dbf debug area while one… | |
CVE-2026-90208 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type Samsung PWM timer might be… | |
CVE-2026-90207 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with event_input snd_midi_input_event() must no… |
CVE-2026-90206 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nvmet: fix max_qid race between configfs and controller allocation The function nvmet_sub… | |
CVE-2026-90205 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate orphan slot during inode read Patch series "ocfs2: validate active orphan… |
CVE-2026-90204 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate DIO orphan slot during inode read [BUG] A corrupted append-DIO dinode (hi… |
CVE-2026-90203 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Squashfs: check block offset is not negative If a negative offset is read off disk (for e… |
CVE-2026-90202 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers _base_release_memory_pools() un… | |
CVE-2026-90201 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race This bug was… | |
CVE-2026-90200 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix integer overflow in MFT cluster validation In ntfs_init_from_boot(), the bo… | |
CVE-2026-90199 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject out-of-range evcn in mi_enum_attr() In mi_enum_attr(), the start/end VCN… |
CVE-2026-90198 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix use-after-free in snd_card_do_free() A use-after-free was detected in snd… | |
CVE-2026-90197 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: HID: haptic: don't write an uninitialized value to unhandled usages fill_effect_buf() ini… | |
CVE-2026-90196 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer… | |
CVE-2026-90195 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args On RV64, the ABI… | |
CVE-2026-90194 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ACPI: scan: fix bus ID cleanup on device_add() failures When device_add() fails after acp… | |
CVE-2026-90193 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler qcom_cpucp_mbox_irq_fn()… | |
CVE-2026-90192 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in send_data callback mailbox_clear_channel() calls… | |
CVE-2026-90191 | High | 8.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls… |
CVE-2026-90190 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: null_blk: use DEFINE_MUTEX for the file-scope mutex In null_init(), mutex_init(&lock) cur… | |
CVE-2026-90189 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: null_blk: register configfs subsystem after creating default devices In null_init(), conf… | |
CVE-2026-90188 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: null_blk: free global tag_set on init error path If shared_tags is enabled, null_setup_ta… | |
CVE-2026-90187 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: null_blk: free zones array on device power-off null_init_zoned_dev() allocates dev->zones… | |
CVE-2026-90186 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: null_blk: reject per-device queue resize for shared tag set When shared_tags is enabled… | |
CVE-2026-90185 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: null_blk: serialize configfs attribute stores with the lock The NULLB_DEVICE_ATTR _store… | |
CVE-2026-90184 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: null_blk: serialize configfs attribute updates with device setup The attribute store meth… | |
CVE-2026-90183 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: clear delay state when freeing policy data io.latency can throttle a group… | |
CVE-2026-90182 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: blk-iocost: clear delay state when freeing policy data iocg_kick_delay() turns sufficient… | |
CVE-2026-90181 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ublk: avoid teardown retry loop on xarray allocation failure __ublk_shmem_remove_ranges()… | |
CVE-2026-90180 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: block: mtip32xx: synchronize ioctls with device removal The ioctl handlers only test REMO… | |
CVE-2026-90179 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix deadlock in complain-mode change_hat The use of change_hat when in complain… | |
CVE-2026-90178 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (coretemp) Fix core_data leak on CPUs without PTS pdata->core_data is allocated in… | |
CVE-2026-90177 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Check pointer type for all atomic RMW paths Atomic RMW verification records an instr… |
CVE-2026-90176 | High | 8.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: Do not skip lock checks for single-byte ranges check_lock_range() uses inclusive r… |
CVE-2026-90175 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer Free it unconditio… | |
CVE-2026-90174 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() ksmbd_alloc_user() copies resp->… |
CVE-2026-90173 | Critical | 9.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: free completion queues with ib_free_cq() smbdirect_connection_destroy_qp(… |
CVE-2026-90172 | High | 7.5 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: destroy QP before mem pools on accept failure On the rdma_accept_failed e… |
CVE-2026-90171 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: release pending child sockets outside the handler lock smbdirect_socket_d… | |
CVE-2026-90170 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ipc response length before dereferencing its fields ipc_validate_msg() co… | |
CVE-2026-90169 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: free preauth sessions on connection teardown SMB3.1.1 multichannel binding preserv… | |
CVE-2026-90167 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize oplock close with pending break ownership close may abort an in-flight o… | |
CVE-2026-90166 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request() See the procedure belo… | |
CVE-2026-90165 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger() See the pro… | |
CVE-2026-90164 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: smb/server: abort initialization when proc setup fails ksmbd_server_init() calls ksmbd_pr… | |
CVE-2026-90163 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: smb/server: call ksmbd_proc_cleanup() on module init failure When a later initializer fai… | |
CVE-2026-90162 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer publishing granted locks to prevent UAF/double-free race In smb2_lock(), mid… |
CVE-2026-90161 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced ztailpacking pclusters On-disk sizes of interlaced pclusters should… |
CVE-2026-90160 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: lwt_bpf: Restore reserved headroom after xmit program ip_finish_output2() expands an skb… | |
CVE-2026-90159 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks _bpf_setsockopt() and _bp… | |
CVE-2026-90158 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: m68k: nfcon: Do not call console_is_registered() in nfcon_device() Since 7c2af0f634f1 ("t… |