Linux
Page 13 of 100 — Linux CVEs from a corpus of 24866, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-90057 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() Jaeyoung Chung and… |
CVE-2026-90056 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net: fec: only stop PTP if it was initialized fec_ptp_init() is only called when fep->buf… | |
CVE-2026-90055 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: usb: atm: usbatm: fix invalid ci_range initialization syzbot reported a shift-out-of-boun… | |
CVE-2026-90054 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: tcp: fix corruption of urgent data on multi-segment retransmit On the normal xmit path, w… | |
CVE-2026-90053 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_htb: limit htb_classify inner-class filter hops htb_classify() follows eac… | |
CVE-2026-90052 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow with keyed discard Since commit 68c5c42567bc ("dm-integ… |
CVE-2026-90051 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: tcp: reject non zerocopy devmem tx Devmem tcp tx doesn't work without zero-copy, however… |
CVE-2026-90050 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net/sched: fq: clamp quantum and initial_quantum in change path The fq change path accept… | |
CVE-2026-90049 | Critical | 9.3 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() skb_zerocopy() copies… |
CVE-2026-90048 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() ni_create_attr_list() all… |
CVE-2026-90047 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't hand out the flat CCS storage as usable VRAM get_flat_ccs_offset() reads th… |
CVE-2026-90046 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: don't spin_trylock() in NMI on UP Patch series "mm/page_alloc: fixes for f… |
CVE-2026-90045 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: USB: gadget: ffs: fix mm lifetime handling io_data stores a pointer to the submitting tas… |
CVE-2026-90044 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix Use-After-Free in AIO error path In ffs_epfile_write_iter() and ff… |
CVE-2026-90043 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: zram: fix slot lock bit position on big-endian 64-bit The slot lock is a bit operation on… |
CVE-2026-90042 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ceph: properly decrypt filenames in vmalloc() buffers The fscrypt subsystem uses the scat… |
CVE-2026-90041 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: HID: sony: clean up device list on probe failure sony_input_configured() adds some contro… |
CVE-2026-90040 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped Wire up a gme… | |
CVE-2026-90039 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Guard admin state-revocation walks with NFSD_NET_UP Writing to /proc/fs/nfsd/unlock… | |
CVE-2026-90038 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during export state revocation nfsd4_revoke_export_st… |
CVE-2026-90037 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during close_lru reaping An nfs4_openowner left on nn… |
CVE-2026-90036 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its… |
CVE-2026-90035 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix division by zero in get_estimated_bw() get_estimated_bw() divides by… | |
CVE-2026-90034 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: usb: image: mdc800: change kmalloc() to kzalloc() Change the kmalloc() calls in usb_mdc80… | |
CVE-2026-90033 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() The snd_usbmidi_us122l_outp… | |
CVE-2026-90032 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: media: usbtv: keep device alive while ALSA card exists The ALSA PCM callbacks store the d… |
CVE-2026-90031 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: usb-storage: ene_ub6250: fix race between scan work and probe ene_ub6250_probe() calls us… | |
CVE-2026-90030 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: clear forceRM when issuing EndTransfer The forceRM bit of the DEPCMD register… |
CVE-2026-90029 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: usb: storage: realtek_cr: fix use-after-free on disconnect realtek_cr_destructor() calls… | |
CVE-2026-90028 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: hd3ss3220: track VBUS enable state per consumer regulator_is_enabled() report… | |
CVE-2026-90027 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop cc_debounce_dwork is queue… |
CVE-2026-90026 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic: cancel reset_work on stop pdphy_stop() disables IRQs but leaves re… |
CVE-2026-90025 | High | 7.7 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix OOB altmode array index The UCSI displayport driver in… |
CVE-2026-90024 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs A null-pointer d… | |
CVE-2026-90023 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() … | |
CVE-2026-90022 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi2: fix use-after-free in string attribute show path f_midi2_opts_str_s… |
CVE-2026-90021 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi: initialize work in f_midi_alloc() f_midi_alloc initializes free_ref… | |
CVE-2026-90020 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() gadget_dev_ioctl() reads… | |
CVE-2026-90019 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fix null pointer dereference in usb_put_function_instance() usb_put_function… | |
CVE-2026-90018 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() rtw_get_wps_attr(… |
CVE-2026-90017 | High | 7.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() rtw_action_frame_parse() tak… |
CVE-2026-90016 | High | 7.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() rtw_restruct_wmm_ie() scans in_… |
CVE-2026-90015 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: xhci: fix lost bounce buffers on TDs spanning several ring segments When a TD reaches a l… | |
CVE-2026-90014 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: tracing: Have show_event_filters/triggers files take trace array ref The newly added file… |
CVE-2026-90013 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: tracing: Take trace_array reference when opening options file The options files do not ta… |
CVE-2026-90012 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: spi: Fix DMA mapping ownership on partial map failure If RX mapping fails after TX mappin… |
CVE-2026-90011 | Critical | 9.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsi_target_check_l… |
CVE-2026-90010 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap io_uring sense copy to max_response_len Completion copied scmd->sense_len… |
CVE-2026-90009 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in io_uring passthrough command setup scsi_bsg_uring_cmd() reads bs… |
CVE-2026-90008 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame megasas_make_prp_nvme(… |
CVE-2026-90007 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Use rollback index when freeing MSI-X vectors pm8001_request_msix() unwinds… |
CVE-2026-90006 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: handle damon_stop() failure damon_sample_mtier_stop() assumes its da… | |
CVE-2026-90005 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: samples/damon/wsse: handle damon_start() failure Patch series "samples/damon: handle damo… | |
CVE-2026-90004 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: handle region split failure in apply_min_nr_regions() damon_apply_min_nr_r… | |
CVE-2026-90003 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: futex: Prevent rcuwait use-after-free during requeue PI On PREEMPT_RT, FUTEX_CMP_REQUEUE_… |
CVE-2026-90002 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ftrace: Take trace_array reference before accessing its ftrace_ops The trace instance fil… |
CVE-2026-90001 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: HID: bpf: serialize device reference release in struct_ops destroy path __hid_bpf_ops_des… |
CVE-2026-90000 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeRe… |
CVE-2026-89999 | High | 8.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: HID: wacom: validate report length in wacom_intuos_pro2_bt_irq wacom_intuos_pro2_bt_irq()… |
CVE-2026-89998 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: dm: fix race when loading and unloading a table If the userspace calls two concurrent tab… |
CVE-2026-89997 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: dm: fix resume-vs-remove race If the user issues the resume ioctl and the remove ioctl at… |
CVE-2026-89996 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds DMA_HEAP_IOCTL_ALLOC a… | |
CVE-2026-89995 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: dma-direct: return struct page from dma_direct_alloc_from_pool() Commit 5b138c534fda ("dm… |
CVE-2026-89994 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-edma: tracing: no ptr dereference during log output The fsl edma events st… |
CVE-2026-89993 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Initialize IRQ data before requesting IRQs dw_edma_irq_request() pass… | |
CVE-2026-89992 | High | 8.4 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: cpuidle: dt_idle_genpd: kfree() the original name allocation dt_idle_pd_alloc() kasprintf… |
CVE-2026-89991 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix infinite loop in pcpu_freelist push with one possible CPU __pcpu_freelist_push()… | |
CVE-2026-89990 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ceph: lock mutex in ceph_mds_check_access() MDS session OPEN handling replaces mdsc->s_ca… |
CVE-2026-89989 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() dentry_path() returns E… | |
CVE-2026-89988 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: kprobes: Protect kprobe_blacklist with RCU __within_kprobe_blacklist() traverses kprobe_b… |
CVE-2026-89987 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: transfer the pmd dirty bit to the folio on zap zap_huge_pmd_folio() propa… | |
CVE-2026-89986 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave() syzbot re… |
CVE-2026-89985 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: memcg: keep folio's objcg same as its node memcg_reparent_objcgs() has an inherent assump… |
CVE-2026-89984 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix kernel address leakages in LBR stack Before Arch LBR gained CPL filte… | |
CVE-2026-89983 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix debugfs UAF on adapter removal i2c_del_adapter() frees the adapter's debug… | |
CVE-2026-89982 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: i2c: mux: Fix channel node leak on adapter add failure i2c_mux_add_adapter() takes a refe… | |
CVE-2026-89981 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: arm64: Don't read GMID_EL1 when MTE is disabled __cpuinfo_store_cpu() gates the GMID_EL1… | |
CVE-2026-89980 | High | 8.4 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ALSA: harmony: initialize locks before requesting IRQ snd_harmony_create() registers the… |
CVE-2026-89979 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix race between non-atomic ops and trigger-start We protect the races of the… |
CVE-2026-89978 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: return early from a zero-length flush SYNC_BO does not constrain its size… | |
CVE-2026-89977 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: check MMIO mapping errors in probe devm_platform_ioremap_resource() returns… | |
CVE-2026-89976 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix job completion fence cleanup ethosu_ioctl_submit_job() allocates done_f… | |
CVE-2026-89975 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: nvme-fabrics: fix DHCHAP secret leak on parse failure nvmf_parse_options() duplicates dhc… | |
CVE-2026-89974 | High | 7.5 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails nvmf_create_ctrl()… |
CVE-2026-89973 | High | 8.2 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: check the data direction of a C2HData PDU nvme_tcp_handle_c2h_data() finds the… |
CVE-2026-89972 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: nvme: add missing SRCU grace period in error path nvme_alloc_ns() error path at out_unlin… |
CVE-2026-89971 | High | 7.5 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: nvme: skip the zoned limits update if the zone info query failed nvme_query_zone_info() r… |
CVE-2026-89970 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmet_auth_sq_free() cancels auth… |
CVE-2026-89969 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU nvmet_tcp_try_recv_pdu… |
CVE-2026-89968 | High | 7.5 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: reject unsolicited H2CData PDUs nvmet_tcp_handle_h2c_data_pdu() accepts an H2C… |
CVE-2026-89967 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: avoid out-of-bounds writes for compound folios migrate_device_range()… |
CVE-2026-89966 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio alloc_bud… | |
CVE-2026-89965 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: reject an arena whose nfree is below the lane count The BTT info block's nfre… |
CVE-2026-89964 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: parisc: eisa: Fix infinite loop when parsing invalid IRQ value When an invalid value is p… | |
CVE-2026-89963 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: powerpc/kexec_file: Fix null-ptr-def in extra size calculation A static Sashiko AI review… | |
CVE-2026-89962 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: powerpc/kexec_file: Prevent kexec range truncation Sashiko AI review pointed out the foll… | |
CVE-2026-89961 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population vmemmap_populate_c… |
CVE-2026-89960 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm() In vfio_ap_m… |
CVE-2026-89959 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove The vfio_ap_config_re… |
CVE-2026-89958 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL The ap_driver st… |