Linux
Page 17 of 100 — Linux CVEs from a corpus of 24866, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-89657 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: libceph: validate OSD extent maps before cursor advance net/ceph/osd_client.c:osd_sparse_… |
CVE-2026-89656 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crush_decode() stores bucket data by ar… |
CVE-2026-89655 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock list_for_each_ent… |
CVE-2026-89654 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in check_new_map() on session freed during unlock check_new_map() iterates… |
CVE-2026-89653 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode MDSMap export_targets… |
CVE-2026-89652 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export get_name ceph_get_name() copies the M… |
CVE-2026-89651 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fs_name decode in handle_session() handle_session() decod… |
CVE-2026-89650 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: bound num_export_targets array for mds info v2/v3 ceph_mdsmap_decode() in fs/ceph/m… |
CVE-2026-89649 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in __build_xattrs() __build_xattrs() decodes the MDS-suppl… |
CVE-2026-89648 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in ceph_parse_deleg_inos() ceph_parse_deleg_inos() decode… |
CVE-2026-89647 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: do not repeat ceph_trim_dentries() if no progress possible ceph_cap_reclaim_work()… |
CVE-2026-89646 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount ceph_dirty_folio() takes a… |
CVE-2026-89645 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: btrfs: drop recovered reloc root refs on recovery failure During relocation recovery, eac… | |
CVE-2026-89644 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map leak in NOCOW direct I/O write btrfs_dio_iomap_begin() calls btrfs_… | |
CVE-2026-89643 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: audit: avoid dropping live tree ref on fsnotify rule autoremove audit_del_rule() is used… |
CVE-2026-89642 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: cifs: call pagecache_isize_extended() in cifs_setsize() when extending cifs_setsize() cal… | |
CVE-2026-89641 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() When the else branch of… |
CVE-2026-89640 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 With len == 0 (clone… |
CVE-2026-89639 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC cifs_do_truncate() is… |
CVE-2026-89638 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions W… |
CVE-2026-89637 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 Wh… |
CVE-2026-89636 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce->tgthint in free_tgts() When free_tgts() frees all structures in ce… |
CVE-2026-89635 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: only rebind the reopened file's own oplock on durable reconnect ksmbd_reopen_durab… |
CVE-2026-89634 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN() overflow in symlink_data() error context loop The check added by… |
CVE-2026-89633 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() coalesce_t2(… |
CVE-2026-89632 | High | 8.2 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() reparse_buf_p… |
CVE-2026-89631 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon() boun… |
CVE-2026-89630 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the data_offset bound in is_valid_oplock_break() Commit 83bfbd0bb902… |
CVE-2026-89629 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Check size of status and firmware events before reading them Malformed… | |
CVE-2026-89628 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcd_debug_eeprom_r… | |
CVE-2026-89627 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: roccat: free buffered reports when destroying device roccat_report_event() duplicate… | |
CVE-2026-89626 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix field sysfs group cleanup on failure hid_sensor_custom_add_attri… |
CVE-2026-89625 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind For GHL (Guitar Hero Live… | |
CVE-2026-89624 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: universal-pidff: stop the device when force-feedback init fails universal_pidff_prob… |
CVE-2026-89623 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: stop device IO before hid_hw_stop Quiesce device IO at the start of the dev… | |
CVE-2026-89622 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcp_i2c_smbus_read() stores… |
CVE-2026-89621 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221_raw_event() mcp2221_raw_event() never valid… | |
CVE-2026-89620 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy write_cmd_to_txdma()… |
CVE-2026-89619 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer quicks… |
CVE-2026-89618 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: eventfs: Initialize ei->children and ei->list in init_ei() eventfs_create_dir() allocates… | |
CVE-2026-89617 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log replay Each DIR_PAGE_ENTRY ends in a page_lcns… |
CVE-2026-89616 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() ni_read_frame() dec… |
CVE-2026-89615 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound page_lcns[] index by the log record The copy_lcns loop and the redo short… |
CVE-2026-89614 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol->lcn_empty_bits_per_page is si… |
CVE-2026-89613 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if… |
CVE-2026-89612 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MF… |
CVE-2026-89611 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfs_attr_update_meta() shifts the attribut… |
CVE-2026-89610 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ntfs: verify run length exceeding volume boundary The mapping pairs decoder validates tha… |
CVE-2026-89609 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ecryptfs: hold msg ctx list lock when cleaning daemon queue ecryptfs_exorcise_daemon() dr… |
CVE-2026-89608 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ecryptfs: pass packet set buffer size to parser ecryptfs_parse_packet_set() receives a po… |
CVE-2026-89607 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet parse_tag_3_packet()… |
CVE-2026-89606 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject too-small tag 70 packets ecryptfs_parse_tag_70_packet() subtracts fixed… |
CVE-2026-89605 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ecryptfs: release message context on send failure ecryptfs_send_message_locked() moves a… |
CVE-2026-89604 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: efivarfs: Rate limit statfs() handler Ravi reports that statfs() may be called by unprivi… | |
CVE-2026-89603 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: entry: Fix seccomp bypass after ptrace with TSYNC Sashiko review pointed out the followin… |
CVE-2026-89602 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: erofs: skip sufficiently large global buffers when resizing z_erofs_gbuf_nrpages is advan… |
CVE-2026-89601 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ext2: Fix lost inode updates for IS_SYNC inodes ext2_setsize() and ext2_xattr_set2() had… |
CVE-2026-89600 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fanotify: fix use-after-free of file range info fsnotify_pre_content() builds its file_ra… |
CVE-2026-89599 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: panel-dsi-cm: initialize lock before registering display dsicm_probe() reg… |
CVE-2026-89598 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fbdev: ssd1307fb: defer I2C transfers from damage callbacks The fbdev damage callbacks ma… | |
CVE-2026-89597 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fbdev: uvesafb: unregister connector callback on init failure uvesafb_init() registers th… |
CVE-2026-89596 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nv_suspend() and nv_… |
CVE-2026-89595 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fsnotify: Fix stale object mask after concurrent mark updates When a mark gets a new even… | |
CVE-2026-89594 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device The OMAP SSI dri… |
CVE-2026-89593 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: hugetlb: only adjust reservation during unmapping if mapcount is 0 Since df7a6d1f6405, __… |
CVE-2026-89592 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix NULL dereference and integer overflow in rocket_job_push() rocket_job_p… | |
CVE-2026-89591 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: accel/rocket: initialize job domain before cleanup paths rocket_ioctl_submit_job() releas… | |
CVE-2026-89590 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocket_job_run() In rocket_job_run(), after taki… | |
CVE-2026-89589 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks The CXL CPER work registration… | |
CVE-2026-89588 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In ghes_handle_arm_hw_er… |
CVE-2026-89587 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ACPI: pfr_update: fix stack buffer overflow in query_capability() query_capability() copi… |
CVE-2026-89586 | High | 8.2 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes ata_scsi_write_sam… |
CVE-2026-89585 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: auxdisplay: charlcd: cancel backlight work on registration failure With CONFIG_CHARLCD_BL… |
CVE-2026-89584 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: block: validate user space vectors during extraction The bio-based drivers don't necessar… |
CVE-2026-89583 | High | 8.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eir_get_service_data() eir_get_service_data() walks the a… |
CVE-2026-89582 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix double free in bnx2x_init_firmware() error path bnx2x_init_firmware() frees bp… | |
CVE-2026-89581 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an extended register The destination of the… |
CVE-2026-89580 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in __bpf_get_stack get_perf_callchain() returns a per-CPU perf_ca… |
CVE-2026-89579 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloom_map_alloc() has two… |
CVE-2026-89578 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: dm-io: clone the source bio instead of copying its biovec For DM_IO_BIO requests, do_regi… | |
CVE-2026-89577 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: dm-io: report non-retryable errors separatedly The error codes BLK_STS_NOTSUPP and BLK_ST… | |
CVE-2026-89576 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: dm-era: fix shadowed superblock leak on take-snap failure metadata_take_snap() bumps the… | |
CVE-2026-89575 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: dm raid1: reserve space for NUL-terminator in build_constructor_string() Reserve space fo… | |
CVE-2026-89574 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read array_block_check() validates blocknr and… |
CVE-2026-89573 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's array_block_check()… |
CVE-2026-89572 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: apple-soc: Fix OPP table cleanup apple_soc_cpufreq_init() adds OPP tables from f… | |
CVE-2026-89571 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: cxl/features: bound fwctl command payload to the input buffer fwctl_cmd_rpc() copies cmd-… |
CVE-2026-89570 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the… |
CVE-2026-89569 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcomm_security_cfm() looks u… |
CVE-2026-89568 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: kho: fix size calculation in kho_preserved_memory_reserve() kho_preserved_memory_reserve(… | |
CVE-2026-89567 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: jbd2: bound shrinker scans by examined checkpoint buffers The jbd2 shrinker currently acc… | |
CVE-2026-89566 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: jbd2: check need_resched() when skipping busy checkpoint buffers journal_shrink_one_cp_li… | |
CVE-2026-89565 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collect_md mode when metadata_dst allocation fails In collect_md mo… | |
CVE-2026-89564 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ip: orphan prefetched skbs before multicast forwarding IPv4 and IPv6 input preserve an sk… |
CVE-2026-89563 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() ip6_tnl_xmit() may need to expand headro… |
CVE-2026-89562 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ip6_gre: fix hardware header length for NBMA tunnels ip6gre_tnl_link_config_route() accum… |
CVE-2026-89561 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() ipv6_rpl_srh_rcv() derefere… |
CVE-2026-89560 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation Whiteout objects are… |
CVE-2026-89559 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in __nd_label_validate() The on-media namespac… |
CVE-2026-89558 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix still_degraded being inverted in raid10_sync_request() Commit fe6a19d40ceb… |