Linux
Page 15 of 100 — Linux CVEs from a corpus of 24866, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-89857 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject qla_nvme_ls_reject_iocb() allo… |
CVE-2026-89856 | High | 8.4 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation ha->msix_count is u16… |
CVE-2026-89855 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Serialize flash version read in reset handler The "update cache versions w… | |
CVE-2026-89854 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix cs84xx use-after-free on host teardown qla84xx_put_chip() drops the la… |
CVE-2026-89853 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump qla2x00_free_fce_trace()… | |
CVE-2026-89852 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() The mbx_cmd_t is alloc… | |
CVE-2026-89851 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix FCE trace enable parsing in debugfs qla2x00_dfs_fce_write() called kst… | |
CVE-2026-89850 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Don't query firmware state while chip is down qla2x00_fw_state_show() init… | |
CVE-2026-89849 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00_status_entry() filter… |
CVE-2026-89848 | High | 8.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Quiesce response IRQ before freeing request queue qla2xxx_delete_qpair() d… |
CVE-2026-89847 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid double completion in async IOCB timeout qla2x00_async_iocb_timeout()… |
CVE-2026-89846 | Critical | 9.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read In qla2x00_status_entry()… |
CVE-2026-89845 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() qla2x00_error_entry()… | |
CVE-2026-89844 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition qla24xx_repo… |
CVE-2026-89843 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Several bsg handlers stage… | |
CVE-2026-89842 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started qla_nvme_xmt_ls_rsp() bails o… | |
CVE-2026-89841 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: only redirty pinned folios in redirty_blocks redirty_blocks() pins folios with read… |
CVE-2026-89840 | High | 7.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: validate MOVE_RANGE destination size F2FS_IOC_MOVE_RANGE checks the source range, b… |
CVE-2026-89839 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set() f2fs_xattr_advis… | |
CVE-2026-89838 | High | 7.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: limit recovery filename logging to stored length F2FS stores recovery filenames as… |
CVE-2026-89837 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix dentry folio leak in find_in_level find_in_level() gets a dentry folio with f2f… | |
CVE-2026-89836 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix folio_nr_pages() race after put in large folio invalidate Our v6.18 based Andro… |
CVE-2026-89835 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thread access in sysfs checkpoint_merge can be enabled even w… | |
CVE-2026-89834 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during free_segment_range In free_segment_range()… | |
CVE-2026-89833 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() There is potential deadl… | |
CVE-2026-89832 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to clear dirty flag on folio in error path If node block is corrupted due to ch… |
CVE-2026-89831 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: protect critical_task_priority updates with s_umount The sysfs store path already t… | |
CVE-2026-89830 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix valid block count leak on data block allocation failure In __allocate_data_bloc… | |
CVE-2026-89829 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer() Otherwise in f2fs_sanit… |
CVE-2026-89828 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init() drmm_cgroup_register_region() is… | |
CVE-2026-89827 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid force-completing uninitialized UVD rings uvd_v7_0_sw_init() does not in… | |
CVE-2026-89826 | High | 7.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: harden firmware build-info bounds checks panthor_fw_read_build_info() checks… |
CVE-2026-89825 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: fix firmware control interface bounds checks panthor_init_cs_iface() and pan… |
CVE-2026-89824 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/panel-edp: fix i2c adapter leak on probe failure Make sure to drop the i2c adapter re… | |
CVE-2026-89823 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm: fix race between partial drm_dev_register() failure and ioctl If drm_dev_register()… |
CVE-2026-89822 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/i915: Guard against NULL driver_data in i915_pci_probe() pci_match_device() can retur… | |
CVE-2026-89821 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: avoid divide-by-zero in __is_lut_linear() __is_lut_linear() computes the… | |
CVE-2026-89820 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix dc_lock leak on GPU reset error paths On GPU reset, dm_suspend() tak… | |
CVE-2026-89819 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: validate plane degamma LUT size for private color prop Unlike the CRTC d… |
CVE-2026-89818 | High | 7.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check If the supplied msg[2]… |
CVE-2026-89817 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/gud: NUL-terminate TV mode names read from the device gud_connector_add_tv_mode() rea… | |
CVE-2026-89816 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used Commit 1c6ceeee6eb… | |
CVE-2026-89815 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Drop tt->restore after successful restore ttm_pool_restore_and_alloc() can succe… |
CVE-2026-89814 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: clamp the isolation index for rings outside a partition adev->isolation[] has… |
CVE-2026-89813 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the KIQ ring fences on reset Like the MES scheduler ring, the… | |
CVE-2026-89812 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the MES ring fences on reset The MES scheduler ring has no drm… | |
CVE-2026-89811 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES (Micro Engine Scheduler… |
CVE-2026-89810 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix error path at svm_migrate_copy_to_ram If page migration from device to sy… |
CVE-2026-89809 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds Reading /sys/kernel/debu… | |
CVE-2026-89808 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram When migration… |
CVE-2026-89807 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore Both create_queue_cpsch(… | |
CVE-2026-89806 | High | 8.4 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation The framebuffer size calcul… |
CVE-2026-89805 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: Fix folio allocation fallback and use-after-put drm_pagemap_migrate_populate… |
CVE-2026-89804 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: fix mismatched DMA unmap size for large folios Device-private THP migra… |
CVE-2026-89803 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: unsubscribe the channel-kill event before the fence context nouveau_channel_… |
CVE-2026-89802 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op Each bind_job_op is zeroed… | |
CVE-2026-89801 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE In nouveau_uvmm_bin… |
CVE-2026-89800 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE A successful OP_… | |
CVE-2026-89799 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpf_get_stackid The get_perf_callchain call needs disabled pre… |
CVE-2026-89798 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: rpcrdma: arm rn_done before publishing the notification rpcrdma_rn_register() inserts @rn… | |
CVE-2026-89797 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: power: supply: ab8500_fg: fix use-after-free on remove ab8500_fg_remove() destroys the dr… | |
CVE-2026-89796 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: avoid infinite kdamond_merge_regions() internal loop Patch series "mm/damo… | |
CVE-2026-89795 | High | 8.4 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: PCI: Allow per function PCI slots to fix slot reset on s390 On s390 systems, which use a… |
CVE-2026-89794 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: zero pipe read compound padding Compound response handling extends the last respon… | |
CVE-2026-89793 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ublk: clear VM_MAYWRITE on read-only ublk char device mmap ublk_ch_mmap() rejects mmap re… |
CVE-2026-89792 | High | 7.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds reads in share config responses Validate IPC share configura… |
CVE-2026-89791 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: perf: Fix use-after-free when perf mmap() revival races with the last munmap() perf_mmap_… |
CVE-2026-89790 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid divide by zero in rt6_multipath_rebalance rt6_multipath_rebalance() calculate… | |
CVE-2026-89789 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free gtp_newl… |
CVE-2026-89788 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix tree connection use-after-free in smb2_tree_connect() ksmbd_tree_conn_connect(… |
CVE-2026-89787 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() For casef… | |
CVE-2026-89786 | Critical | 9.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix out-of-bounds read in ext4_read_inline_dir() ext4_read_inline_dir() can read a… |
CVE-2026-89785 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init ntfs_reparse_init()… | |
CVE-2026-89784 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 rpcb_register_in… | |
CVE-2026-89783 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full The depth check… |
CVE-2026-89782 | High | 8.4 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject restart table growth beyond U16_MAX entries During $LogFile replay, log_… |
CVE-2026-89781 | High | 8.4 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() read_log_rec_buf() copies a log re… |
CVE-2026-89780 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: restore skb->dev on deaggregated frames rmnet_map_deaggregate() all… | |
CVE-2026-89779 | Critical | 9.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef->size covers the record's name and value When an EA record has a no… |
CVE-2026-89778 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: isofs: fix out-of-bounds page array access on empty zisofs block zisofs_uncompress_block(… |
CVE-2026-89777 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev->msi_perm after freeing it on init failure vfio_msi_cap_len() lazily… |
CVE-2026-89776 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes The VXLAN VNI filter en… | |
CVE-2026-89775 | Critical | 9.3 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effe… |
CVE-2026-89774 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in sco_conn_ready sk deref in sco_conn_ready must be don… |
CVE-2026-89773 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip Update HDCP Config In Transition State Transition state does not ha… | |
CVE-2026-89772 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios during data writeback commit 095be159f3eb ("btrfs: unify foli… | |
CVE-2026-89771 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers trace_buffer subbuf_size is… |
CVE-2026-89770 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iomap: don't free integrity payload that doesn't exist fs_bio_integrity_alloc might not a… | |
CVE-2026-89769 | High | 7.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path When cpuhp_setu… |
CVE-2026-89768 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fs: fix user path of nested backing files backing_file_open() derives the path to be stor… | |
CVE-2026-89767 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ovl: fix double end_creating() on the casefold-mismatch path ovl_create_real() releases t… |
CVE-2026-89766 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: pidfd: hold exec_update_lock around namespace ioctl The PIDFD_GET_*_NAMESPACE ioctls in p… | |
CVE-2026-89765 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: timers/itimer: Zero-init old itimerval before copy to userspace On native sparc64, struct… | |
CVE-2026-89764 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition wh… |
CVE-2026-89763 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted_tpm_exit() drops the TPM chip reference… |
CVE-2026-89762 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begin_current_label_crit_section() AppArmor's begin_curr… |
CVE-2026-89761 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds write when null terminating a label vec aa_vec_unique() null… |
CVE-2026-89760 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm, swap: don't free a hibernation slot that is in the swap cache A slot with a folio in… |
CVE-2026-89759 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup when scanning task stacks Patch series "mm/kmemleak: avoid… | |
CVE-2026-89758 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: skip non-present PMDs when queueing folios Patch series "mm: handle device-… |