Linux
Page 16 of 100 — Linux CVEs from a corpus of 24866, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-89757 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm/mglru: fix and remove redundant unevictable folio handling sort_folio() has a shortcut… | |
CVE-2026-89756 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() migrate_pages_batc… | |
CVE-2026-89755 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: clear stale mapping after freeing swapcache __migrate_device_pages() r… |
CVE-2026-89754 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk->action escaping walk_pmd_range() If ->pmd_entry() sets walk-… |
CVE-2026-89753 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() I am seeing some rcu_task… | |
CVE-2026-89752 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm: memcg: stop reclaim when a limit update is superseded kernfs serializes file operatio… | |
CVE-2026-89751 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handle_in() and handle_out() in arch/x86/coc… | |
CVE-2026-89750 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: tracing/user_events: Clear copied tracing state before fork duplication dup_task_struct()… |
CVE-2026-89749 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERR_PTR to kthread_stop() event_test_stuff() calls kthread_run… | |
CVE-2026-89748 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simple_ring_buffer_swap_r… |
CVE-2026-89747 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change Writing to buff… |
CVE-2026-89746 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on diffe… |
CVE-2026-89745 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: debugfs: Fix lockdown check for mmap_prepare Commit 651fdda8406d ("relay: update relay to… | |
CVE-2026-89744 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnode_for_each_child_node() When iterate over chil… |
CVE-2026-89743 | High | 7.7 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsm_sendrecv_msg_locked() stores the… |
CVE-2026-89742 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: rapidio: mport_cdev: fix use-after-free in dma_req_free() dma_req_free() acquires buf_mut… |
CVE-2026-89741 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: Revert "media: v4l2-dev: fix error handling in __video_register_device()" This reverts co… |
CVE-2026-89740 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: serial: imx: serialize imx_uart_ports[] lifetime imx_uart_probe() publishes its devm-allo… | |
CVE-2026-89739 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition … | |
CVE-2026-89738 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mo… |
CVE-2026-89737 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: thunderbolt: Disable work before freeing tbt on remove tbt_altmode_remove() d… | |
CVE-2026-89736 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_audio: Fix use-after-free on sound card disconnect g_audio_cleanup() invok… |
CVE-2026-89735 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: remove default configfs groups on teardown f_midi2_alloc_inst() creat… | |
CVE-2026-89734 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init() In uvcg_video_init()… | |
CVE-2026-89733 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() … |
CVE-2026-89732 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Prevent deadlock during ep0 read loop Currently, ffs_ep0_read() holds… | |
CVE-2026-89731 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read cxl_rch_get_aer_info(… |
CVE-2026-89730 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write The trailing byte path… | |
CVE-2026-89729 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature sensor_hub_get_feature… |
CVE-2026-89728 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Fix out-of-bounds access for newdevs mask When software initiates DAA (Dyna… | |
CVE-2026-89727 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID vgic_v2_deactivate() passes… | |
CVE-2026-89726 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Patch series "lib/ucs2_string… | |
CVE-2026-89725 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: media: cec: stm32: prevent out-of-bounds write on RX overflow stm32_rx_done() appends eac… |
CVE-2026-89724 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: media: vicodec: fix out-of-bounds write in FWHT encoder vidioc_s_fmt_vid_out() sizes the… |
CVE-2026-89723 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Shuangpeng Bai… |
CVE-2026-89722 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() pci_write_legacy_io() loads 4… | |
CVE-2026-89721 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: phy: rockchip-samsung-dcphy: fix out-of-range max_register The PHY register block is 64KB… | |
CVE-2026-89720 | High | 7.7 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ubifs: fix out-of-bounds read in signature length check ubifs_sb_verify_signature() bound… |
CVE-2026-89719 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in read_block_state() read_block_state() calculates nr_pag… | |
CVE-2026-89718 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in writeback_store() Patch series "zram: fix stale scan bo… | |
CVE-2026-89717 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: zram: set default primary compressor in zram_destroy_comps() Patch series "zram: fix zram… | |
CVE-2026-89716 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: zram: validate deflate params We must validate user-supplied deflate winbits before we pa… | |
CVE-2026-89715 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfs_uuid_add_file failure When nfs_uuid_add_file() races wit… | |
CVE-2026-89714 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails nfs4_server_com… | |
CVE-2026-89713 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsd_setattr() checks whether a size upd… |
CVE-2026-89712 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock nfsd4_ssc_expire_umount… |
CVE-2026-89711 | High | 8.2 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check The header for commit e75b23f9e323… |
CVE-2026-89710 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path When the server… | |
CVE-2026-89709 | High | 8.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvc_ops dispatch nlmsvc_ops is published by nfsd_lockd_init()… |
CVE-2026-89708 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown After a DESTROY… |
CVE-2026-89707 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on follow_down() error nfsd_cross_mnt() initializes a local struc… |
CVE-2026-89706 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY writeback fails Async COPY captures nn->writev… |
CVE-2026-89705 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths nfsd_dispatch()… |
CVE-2026-89704 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop _nfsd_copy_file_range() sample… |
CVE-2026-89703 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations nfsd4_drop_revoked_s… |
CVE-2026-89702 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: size fh_verify server sockaddr slot by xpt_locallen The nfsd_fh_verify and nfsd_fh_… |
CVE-2026-89701 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIME_DELEG decode paths The xdrgen-based TIME_DELEG_ACCESS and… | |
CVE-2026-89700 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: validate sockaddr length per family in listener_set nfsd_sock_nl_policy declares NF… | |
CVE-2026-89699 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4_decode_create() accepts an unb… |
CVE-2026-89698 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage struct nfsd_genl_rqstp dec… | |
CVE-2026-89697 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() The BOTH_TIME… |
CVE-2026-89696 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIG_NFSD_V4_… |
CVE-2026-89695 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4_decode_posixacl() reads a u32… |
CVE-2026-89694 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOAD_CANCEL… | |
CVE-2026-89693 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create() nfsd4_create() stores the… | |
CVE-2026-89692 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: clear CALLBACK_RUNNING on failed delegation recall queue nfsd_break_one_deleg() set… |
CVE-2026-89691 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4_release_compoundargs(… |
CVE-2026-89690 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpc_status UAF The rpc_status netlink dumpit wal… |
CVE-2026-89689 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: don't free session slots that are still in use nfsd4_sequence() can free the very s… |
CVE-2026-89688 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry In nfs4_preprocess_s… |
CVE-2026-89687 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file ->atomic_open is permi… |
CVE-2026-89686 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke nfsd4_alloc_la… |
CVE-2026-89685 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix clock domain mismatch in clients_still_reclaiming() clients_still_reclaiming()… |
CVE-2026-89684 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4_init_cp_state nfs4_alloc_init_cpntf_state() publishe… |
CVE-2026-89683 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup nfsd_set_fh_dentry() leaks t… | |
CVE-2026-89682 | High | 8.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net nfsd_file_dispose_l… |
CVE-2026-89681 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix layout fence worker double-reference race The workqueue core clears WORK_STRUCT… |
CVE-2026-89680 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd_file leak on inter-server COPY setup failure When nfsd4_setup_inter_ssc()… |
CVE-2026-89679 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs When a SETATTR requ… |
CVE-2026-89678 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix partial-write detection in nfsd_direct_write nfsd_direct_write() walks a list o… |
CVE-2026-89677 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file() dentry_create() can… |
CVE-2026-89676 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY For an async COPY, nfsd4_copy()… |
CVE-2026-89675 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An async copy could be freed or used afte… |
CVE-2026-89674 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget The XDR buffer size calcula… |
CVE-2026-89673 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo nfsd4_ff_encode_getdeviceinf… | |
CVE-2026-89672 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp->mask The NFSACL v2 SETACL path shares the decoder convent… |
CVE-2026-89671 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs3 setacl by argp->mask nfsd3_proc_setacl() calls set_posix_acl() unconditio… |
CVE-2026-89670 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: hold rcu across localio cmpxchg retry nfsd_file objects are freed via call_rcu (fil… |
CVE-2026-89669 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4_copy_notify() finished in… |
CVE-2026-89668 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd() nfsd_debugfs_init(… |
CVE-2026-89667 | High | 8.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache The shrinker, GC w… |
CVE-2026-89666 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an N… | |
CVE-2026-89665 | High | 8.2 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder conver… |
CVE-2026-89664 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: release OPEN-decoded posix ACLs via op_release nfsd4_decode_createhow4() calls nfsd… |
CVE-2026-89663 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before dropping their reference Copy-notify stateids li… |
CVE-2026-89662 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown __destroy_client() release… |
CVE-2026-89661 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent post-shutdown use-after-free in unlock_filesystem Writing a filesystem path… | |
CVE-2026-89660 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a… |
CVE-2026-89659 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds o… |
CVE-2026-89658 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup nfs40_clean_admi… |