Linux
Page 18 of 100 — Linux CVEs from a corpus of 24866, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-89557 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: md: do overflow check for sb->bblog_shift in super_1_load() In super_1_load(), sb->bblog_… |
CVE-2026-89556 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elf_validity_cache_sechdrs, section sizes… | |
CVE-2026-89555 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mpls: reload header after pskb_may_pull() mpls_select_multipath() calls mpls_multipath_ha… |
CVE-2026-89554 | High | 8.2 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction mptcp_token_join_co… |
CVE-2026-89553 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nouveau/gem: reserve the bo in the info ioctl around the vma lookup In the non-uvmm path… |
CVE-2026-89552 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: params: fix charp corruption on allocation failure param_set_charp() stores charp paramet… | |
CVE-2026-89551 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow xdr_buf_trim() trims `len` bytes… |
CVE-2026-89550 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: enforce krb5 token minimum length svcauth_gss_unwrap_priv() validate… |
CVE-2026-89549 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svc_pool_for_cpu() svc_set_num_threads() spreads the… |
CVE-2026-89548 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cache_cleaner before destroying a cache_detail sunrpc_destroy_cache_… |
CVE-2026-89547 | High | 8.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation __svc_create() initializes three per-poo… |
CVE-2026-89546 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can co… |
CVE-2026-89545 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rq_argp and rq_resp free until after RCU grace period svc_rqst_free() frees… |
CVE-2026-89544 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssx_dec_option_array error path bugs Four coupled defects in the gssx XDR op… |
CVE-2026-89543 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir Norma… | |
CVE-2026-89542 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens gss_krb5_unwrap_v2() reads the EC… |
CVE-2026-89541 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_unwrap_resp_priv length checks gss_unwrap_resp_priv() validates the RP… |
CVE-2026-89540 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sunrpc: init gssp_lock before publishing proc entry create_use_gss_proxy_proc_entry() pub… |
CVE-2026-89539 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: reject duplicate CREDS_VALUE options gssx_dec_option_array() walks the wire-suppl… | |
CVE-2026-89538 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field gss_krb5_unwrap_v2() sets buf-… |
CVE-2026-89537 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 gss_krb5_verify_mic_v2… |
CVE-2026-89536 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake callback xs_tls_handshake_sync() gives xs… |
CVE-2026-89535 | High | 8.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id svc_rdma_free() caches rdma… |
CVE-2026-89534 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails When svc_rdma_listen_handler()… |
CVE-2026-89533 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in read_chunk_range svc_rdma_read_chunk_range() walks a Re… |
CVE-2026-89532 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix pcl_for_each_segment for empty chunks When a parsed chunk list contains a ch… |
CVE-2026-89531 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject connection when transport allocation fails handle_connect_req() returns w… | |
CVE-2026-89530 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client c… |
CVE-2026-89529 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject oversized Read segments at decode time The RPC/RDMA Read list decoder sto… | |
CVE-2026-89528 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Read lists that exceed the page budget Individual Read segment lengths ar… |
CVE-2026-89527 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svc_xprt_put to free listener on create failure svc_rdma_create() calls kfre… | |
CVE-2026-89526 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk posi… |
CVE-2026-89525 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses… | |
CVE-2026-89524 | High | 8.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6kl_c… |
CVE-2026-89523 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel pending mlo_pm_work If the device is reset, suspended or unreg… |
CVE-2026-89522 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: media: staging/ipu7: fix async notifier UAF on probe error path isys_register_devices() r… |
CVE-2026-89521 | High | 7.3 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sched/core: Handle pick_task() releasing the rq lock Core scheduling's pick_next_task() b… |
CVE-2026-89520 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sched/core: Make core-sched flips wait for in-flight selections Core scheduling's pick_ne… |
CVE-2026-89519 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return SCX_RQ_BAL_KEEP tells t… | |
CVE-2026-89518 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix this_rq() assumptions in dispatch kfuncs Under core scheduling, dispatch r… | |
CVE-2026-89517 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix rq->core_pick corruption under core scheduling Core scheduling's pick_next… | |
CVE-2026-89516 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users scx_bpf_dsq_reenq… | |
CVE-2026-89515 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() During fuzz testing, the f… | |
CVE-2026-89514 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock fnic_fcoe_process_vlan_resp() al… | |
CVE-2026-89513 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENT_GET_INFO stores guest-c… |
CVE-2026-89512 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Make sure to drop the referen… | |
CVE-2026-89511 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: qede: Fix NULL pointer dereference in TPA fragment processing Under memory pressure, the… |
CVE-2026-89510 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel reg_work before freeing device on remove c4iw_uld_state_change() queue… |
CVE-2026-89509 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdma_counter allocation Commit 7e53b31acc7f ("RD… | |
CVE-2026-89508 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma_set_ib_path() ucma_set_ib_path() calls ucma_event_han… |
CVE-2026-89507 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma_write_cm_event() ctx->file may only be changed under… |
CVE-2026-89506 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR The original commit missed that… | |
CVE-2026-89505 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Guard legacy bundles without method_elm The legacy write() path dispatches t… | |
CVE-2026-89504 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_nod… |
CVE-2026-89503 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() ring_buffer_alloc_… |
CVE-2026-89502 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Free cpu_buffer::free_page with subbuf_order When sub-buffers use an order g… | |
CVE-2026-89501 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf Because, ring_buffer_subbuf_ord… |
CVE-2026-89500 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page Discarding a cached reade… |
CVE-2026-89499 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Stop remote reader update when page swap fails The remote swap_reader_page c… |
CVE-2026-89498 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailer_buf on readdir copy failure On a readdir downcall, o… | |
CVE-2026-89497 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: orangefs: skip leading spaces before parsing client debug masks orangefs_prepare_cdm_arra… |
CVE-2026-89496 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: always run deallocs on copy-on-write completion Local fuzzing of 6.12.94 has found… | |
CVE-2026-89495 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlm_migrate_request_handler Patch series "ocfs2/dlm: bound peer-c… |
CVE-2026-89494 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlm_mig_lockres_handler A node receiving a DLM_MIG_LOCKRES mes… |
CVE-2026-89493 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rl_used against rl_count in refcount block validator ocfs2_find_refcount_… |
CVE-2026-89492 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2_validate_dx_leaf… |
CVE-2026-89491 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() Patch serie… | |
CVE-2026-89490 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix readdir position truncation on 32-bit kernels In ocfs2_dir_foreach_blk_el(), t… | |
CVE-2026-89489 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: openrisc: fix arbitrary kernel memory access via or1k_atomic syscall sys_or1k_atomic() (s… |
CVE-2026-89488 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state u… |
CVE-2026-89487 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skb_tx_error() a packet we are about to drop queue_userspace_packet() b… |
CVE-2026-89486 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() Commit 9e91f8a6c868 ("ipmi:m… |
CVE-2026-89485 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file across nlm_inspect_file lock-drop nlm_traverse_files() pins the curr… |
CVE-2026-89484 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: lockd: fix NULL dereference on lockowner allocation failure nlmclnt_locks_init_private()… | |
CVE-2026-89483 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvme_setup_discard() always maps sizeof(struct nvme_… |
CVE-2026-89482 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone Commit 25e5cb780e62… |
CVE-2026-89481 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme_tcp_handle_r2t() does… |
CVE-2026-89480 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvme_tcp_recv_data() completes a r… |
CVE-2026-89479 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctp_endpoint_bh_rcv() loo… |
CVE-2026-89478 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctp_rcv() resolves the transport once pe… |
CVE-2026-89477 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctp_process_strreset_outreq(), s… |
CVE-2026-89476 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream->outcnt underflow on duplicate RECONF responses A cached RECONF chunk ma… |
CVE-2026-89475 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-manag… | |
CVE-2026-89474 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: bq256xx: drain usb_work before freeing the charger The USB-PHY notifier qu… | |
CVE-2026-89473 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix power_supply reference leak bq25890_fw_probe() acquires a ref… | |
CVE-2026-89472 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: register regulators before exposing sysfs charger_manager… |
CVE-2026-89471 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: cros_usbpd-charger: bound the EC-reported port count cros_usbpd_charger_pr… |
CVE-2026-89470 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Currently the cros_us… |
CVE-2026-89469 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix use-after-free in lp8727_release_irq() lp8727_isr_func(), the… |
CVE-2026-89468 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8788-charger: fix use-after-free on remove lp8788_charger_remove() flush… | |
CVE-2026-89467 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: qcom_battmgr: fix use-after-free qcom_battmgr_pdr_notify() queues enable_w… | |
CVE-2026-89466 | High | 7.7 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: qcom_battmgr: terminate the strings from firmware The qcom_battmgr_sc8280x… |
CVE-2026-89465 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: quiesce delayed work before teardown The threaded IRQ handler can… |
CVE-2026-89464 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: twl4030_charger: cancel workers via devm bci is devm-allocated. Two worker… | |
CVE-2026-89463 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: ucs1002: fix use-after-free on remove ucs1002 has no remove callback, so u… | |
CVE-2026-89462 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: propagate register read errors max17040_get_vcell() and max17040… | |
CVE-2026-89461 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: synchronize work cancellation on suspend max17040_work() requeue… | |
CVE-2026-89460 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cyc… | |
CVE-2026-89459 | High | 7.0 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: s390/percpu: Fix MVIY_PERCPU() with older binutils Commit a737737cdb9c ("s390/percpu: Inf… |
CVE-2026-89458 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Do not complete a failed ESE read as successful dasd_int_handler() completes a… |