Linux
Page 2 of 100 — Linux CVEs from a corpus of 24867, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-98073 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: Remove conflicting altnames for dying netns in __dev_change_net_namespace(). syzbot… |
CVE-2026-98072 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/rds: use wq_has_sleeper() in release_in_xmit() release_in_xmit() clears RDS_IN_XMIT w… | |
CVE-2026-98071 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/rds: clear cp_flags bits individually in rds_conn_path_reset() rds_conn_path_reset()… | |
CVE-2026-98070 | High | 8.1 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() rds_tcp_reset_callbacks() quies… |
CVE-2026-98069 | High | 8.1 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire the fastpath locks in rds_conn_shutdown() rds_conn_shutdown() quiesces t… |
CVE-2026-98068 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let rds_conn_shutdown() consume a concurrent drop rds_conn_shutdown() fini… | |
CVE-2026-98067 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: erofs: disable LZ4 rolling decompression for now LZ4 rolling decompression [1] was introd… | |
CVE-2026-98066 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Fix potential double-free at error path The fix for caiaq driver's resource… | |
CVE-2026-98065 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject key-less BTF for hash maps map_check_btf() allows a key-less BTF (btf_key_typ… | |
CVE-2026-98064 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref when showing a void BTF type btf_modifier_show() resolves the mod… | |
CVE-2026-98063 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref in btf_var_show() btf_var_show() calls btf_type_id_resolve() unco… | |
CVE-2026-98062 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Mark signal tracepoint siginfo arguments as scalar The signal_generate and signal_de… | |
CVE-2026-98061 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject tail calls directly from callback frames A tail call from a non-zero frame is… | |
CVE-2026-98060 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject resilient lock operations in rbtree callbacks __bpf_rbtree_add() keeps parent… | |
CVE-2026-98059 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Mark sched_process_wait argument as nullable do_wait() passes wo->wo_pid to the sche… | |
CVE-2026-98058 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Mark syscall helpers as sleepable bpf_sys_bpf() executes the bpf(2) syscall body, wh… | |
CVE-2026-98057 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Add checking nr_subbufs to persistent ring buffer validation Sashiko reporte… | |
CVE-2026-98056 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: nvme: remove stale namespaces by NSID range during scan nvme_scan_ns_list() drops the sta… |
CVE-2026-98055 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Clean up the bus when fetching ML caps fails snd_hdac_ext_bus_get_ml_ca… | |
CVE-2026-98054 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix unbalanced module reference count strace_open() invokes try_module_… | |
CVE-2026-98053 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Refactor and fix init_config access Existing code accesses enties found… | |
CVE-2026-98052 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb->last before writing each descriptor bcmasp_xmit() only wrote txc… |
CVE-2026-98051 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times The loop initialised nex… | |
CVE-2026-98050 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context Currently mlxs… |
CVE-2026-98049 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpxchg bpf_convert_ctx_accesses() rewrite… | |
CVE-2026-98048 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: don't rewrite bpf_fastcall patterns entered by a jump mark_fastcall_pattern_for_call… | |
CVE-2026-98047 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Check ancestor frames for rbtree callbacks bpf_rbtree_add() invokes its comparator w… | |
CVE-2026-98046 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpf_btf_find_by_name_kind() as sleepable When bpf_btf_find_by_name_kind() finds… | |
CVE-2026-98045 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Mark faultable stack helpers as sleepable The faultable variants of bpf_get_stack()… | |
CVE-2026-98044 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject legacy packet loads from callbacks check_ld_abs() models a failed BPF_LD_ABS… | |
CVE-2026-98043 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Don't infer non-NULL from a pointer with an unbounded offset reg_not_null() decides… | |
CVE-2026-98042 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Don't resurrect a scalar id dropped by collect_linked_regs() check_cond_jmp_op() cop… | |
CVE-2026-98041 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Don't predict JMP32 pointer vs zero comparisons Consider the following program: … |
CVE-2026-98040 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Mark the zero register precise for a register-form NULL check check_cond_jmp_op() ac… | |
CVE-2026-98039 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Require MEM_PERCPU for percpu kptr stores map_kptr_match_type() treats perm_flags as… | |
CVE-2026-98038 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Keep refcount_acquire nullable for borrowed RCU kptrs bpf_refcount_acquire() is fall… | |
CVE-2026-98037 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject untrusted allocated-object pointers When the final RCU read-side critical sec… | |
CVE-2026-98036 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve special fields in recycled rhtab elements rhtab_map_update_elem() initializ… | |
CVE-2026-98035 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields when recycling rhtab elements rhtab_map_update_existing() and… | |
CVE-2026-98034 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Mark NULL kptr stores precise check_map_kptr_access() permits a scalar store into an… | |
CVE-2026-98033 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve inner map identity in callback frames Callback frame constructors initializ… | |
CVE-2026-98032 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix subbuf resize races with trace_pipe_raw readers Concurrent subbuffer resizes… | |
CVE-2026-98031 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: nexthop: Initialize extack in remove_nh_grp_entry() remove_nh_grp_entry() prints the exta… | |
CVE-2026-98030 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size bcm_sf2_cfp_rule_g… |
CVE-2026-98029 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: eth: nfp: bound the ntuple rule dump by the caller's buffer size nfp_net_get_fs_loc() dum… |
CVE-2026-98028 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: eth: nfp: drop the replaced rule from the list when reprogramming fails nfp_net_fs_add()… | |
CVE-2026-98027 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size mv88e6xxx_get… |
CVE-2026-98026 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: properly convert mglist to rcu Sashiko reported a bug [1] that br_mul… | |
CVE-2026-98025 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap… | |
CVE-2026-98024 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: s390/ism: folio_put() after error dmb->cpu_addr was allocated via folio_alloc(). Use foli… | |
CVE-2026-98023 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vxlan: reject dynamic fdb entries that reference a nexthop id The commit cited in the Fix… |
CVE-2026-98022 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations Several subsystems… | |
CVE-2026-98021 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: reject oversized tx_queue_len at netlink parse time rtnl_create_link() assigns IFLA_… | |
CVE-2026-98020 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: pds_core: fix cmd_regs access racing BAR unmap on reset pdsc_reset_prepare() and pdsc_res… | |
CVE-2026-98019 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: mark a NULL call argument precise check_func_arg() allows bpf_register_is_null() for… | |
CVE-2026-98018 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: mctp: i3c: serialize probe with bus removal mctp_i3c_probe() drops busdevs_lock afte… | |
CVE-2026-98017 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTM_NEWQDISC request can make cls… |
CVE-2026-98016 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free race in sample_restore_put() Concurrent teardown of TC samp… | |
CVE-2026-98015 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put In mlx5_eswitch_termtb… | |
CVE-2026-98014 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch, prevent mc_list repopulation during vport disable In mlx5_esw_vport_d… | |
CVE-2026-98013 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: fq_pie: clamp quantum in change path fq_pie_change() accepts any quantum value… | |
CVE-2026-98012 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum in change path sfq_change() accepts any non-negative quantu… | |
CVE-2026-98011 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum in change and init paths hhf_change() accepts any quantum f… | |
CVE-2026-98010 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: drr: clamp quantum in change class drr_change_class() rejects explicit quantum… | |
CVE-2026-98009 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: clamp quantum in parse and fallback paths ets_qdisc_change() falls back t… | |
CVE-2026-98008 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: macb: fix NULL pointer dereference on unbind with fixed-link When the device tree de… | |
CVE-2026-98007 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpf_loop iteration counts bpf_loop() declares its nr_loops argumen… | |
CVE-2026-98006 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev The epq_in_urb object belonging to the ca… | |
CVE-2026-98005 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: erofs: delimit inode_share cache key components Previously, inode_share keys were encoded… | |
CVE-2026-98004 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: iommu/riscv: Serialize command queue publishing Serialize command queue publishing so sof… | |
CVE-2026-98003 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Do not reallocate GA log buffers on resume Commit c5e1a1eb9279 ("iommu/amd: Si… | |
CVE-2026-98002 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix ineffective error check in nested domain allocation amd_iommu_pdom_id_allo… |
CVE-2026-98001 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (ltc4282) Make sure clk_init_data is fully initialized The clk_init_data structure… | |
CVE-2026-98000 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: hwmon: Fix potential UAF in pec_store Sashiko reports: In pec_store(), a guard(mutex)(&h… | |
CVE-2026-97998 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: cope with concurrent instance destruction Instances are refcoun… | |
CVE-2026-97997 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: virtio_ring: fix stale descriptor flags after a failed packed add In a packed ring the AV… | |
CVE-2026-97996 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: virtio: fix use-after-free in unregister_virtio_device() device_unregister() is device_de… | |
CVE-2026-97995 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: virtio_console: do not free control-out buffers on remove __send_control_msg() publishes… | |
CVE-2026-97994 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRING_NUM larger than device max vhost_vring_set_num() accepts any non… | |
CVE-2026-97993 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx vhost_vdpa_set_conf… | |
CVE-2026-97992 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: protect config_ctx from being freed under the config callback vhost_vdpa_conf… | |
CVE-2026-97991 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_blk: reject out-of-range sector starts vdpasim_blk_check_range() logs an invalid… |
CVE-2026-97990 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_net: check TX pull result before RX copy vringh_iov_pull_iotlb() returns a signe… |
CVE-2026-97989 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vduse: validate virtqueue alignment vduse_validate_config() only checks the upper bound o… | |
CVE-2026-97988 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vhost: invalidate vring access on IOTLB transitions When VIRTIO_F_ACCESS_PLATFORM changes… | |
CVE-2026-97987 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: virtio_input: reset device if input_register_device() fails Probe marks the device DRIVER… | |
CVE-2026-97986 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: virtio_input: stop callbacks before unregistering input device virtinput_remove() unregis… | |
CVE-2026-97985 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: af_unix: Update last skb marker in manage_oob(). Fahad Alharbi reported that blocking rec… | |
CVE-2026-97984 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork… | |
CVE-2026-97983 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vduse: return compat ioctl results directly The compat handler handles VDUSE_IOTLB_GET_FD… | |
CVE-2026-97982 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Fix budget accounting The gmac_rx() function returns the remainin… | |
CVE-2026-97981 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Count dropped frames as NAPI work The RX loop only consumes budge… | |
CVE-2026-97980 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debug_set_level() Commit a2cec6863709 ("s390/… | |
CVE-2026-97979 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ice: add missing xa_destroy for sched_node_ids Commit 16dfa49406bc ("ice: Introduce new p… | |
CVE-2026-97978 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: eth: ice: don't dereference pointers from TP_printk() After forwarding net-next during th… | |
CVE-2026-97977 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: Fix UAF of btusb_data by rx_work btusb_close() and btusb_flush() cancel… | |
CVE-2026-97976 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: validate packet_len before skb_put_data btintel_pcie_submit_rx_w… | |
CVE-2026-97975 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() A NULL pointer derefer… | |
CVE-2026-97974 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings() syzbot reported a… | |
CVE-2026-97973 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: macb: destroy the phylink instance on the probe error path macb_mii_init() creates a… |