Linux
Page 23 of 100 — Linux CVEs from a corpus of 24866, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-80640 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: cxl/fwctl: Fix __fortify_panic Fix a runtime assertion in cxlctl_get_supported_features()… | |
CVE-2026-80639 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: cxl/test: Fix __fortify_panic Fix a runtime assertion in setup_xor_mapping(). Fortify com… | |
CVE-2026-80638 | High | 8.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent [BUG] Unlinking a refcount… |
CVE-2026-80637 | High | 7.5 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: fix unaligned memory access in timestamp adjustment Use get_unaligne… |
CVE-2026-80636 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: revert ct extension genid infrastructure This infrastructure is not… | |
CVE-2026-80635 | High | 8.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response… |
CVE-2026-80634 | Critical | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag The DEV_PATH_BR_VLA… |
CVE-2026-80633 | High | 8.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Take dma_resv lock before dma_buf_unpin() in release path dma_buf_unpin() requir… |
CVE-2026-80632 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996_init_tx_queues() When MT76_NPU… | |
CVE-2026-80631 | High | 7.5 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzo_decompress_… |
CVE-2026-80630 | Critical | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restorin… |
CVE-2026-80629 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: npc: Fix size of entry2cntr_map KASAN prints below splat. This is caused by… | |
CVE-2026-80628 | High | 7.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Serialize readq reset state with q->lock snd_seq_oss_readq_clear() resets… |
CVE-2026-80627 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: MIPS: mm: Fix out-of-bounds write in maar_res_walk() maar_res_walk() uses wi->num_cfg as… | |
CVE-2026-80626 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del fsl_emb_pmu_del() unconditio… | |
CVE-2026-80625 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix memory leak of bonding resources In a corner case of concurrent driver remo… | |
CVE-2026-80624 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: mfd: cs42l43: Sanity check firmware size Currently the code checks if a firmware was rece… | |
CVE-2026-80623 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: coresight: ete: Always save state on power down System register ETMs and ETE are unlikely… | |
CVE-2026-80622 | High | 7.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: char: tlclk: fix use-after-free in tlclk_cleanup() This patch improves the module cleanup… |
CVE-2026-80621 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: Avoid dwc_pcie_rasdes_debugfs_deinit() NULL dereference when no RAS DES capabili… | |
CVE-2026-80620 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13… | |
CVE-2026-80619 | High | 7.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix potential UAF in aa_replace_profiles The function aa_replace_profiles was a… |
CVE-2026-80618 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free amdgpu_amdkfd_gpuvm_free_memo… | |
CVE-2026-80617 | Critical | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: net: airoha: fix foe_check_time allocation size foe_check_time is declared as u16 pointer… |
CVE-2026-80616 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() It's pointless… | |
CVE-2026-80615 | High | 8.2 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone kmalloc_flex() i… |
CVE-2026-80614 | High | 7.5 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: net: emac: Fix NULL pointer dereference in emac_probe Move devm_request_irq() after devm_… |
CVE-2026-80613 | High | 7.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: veth: fix NAPI leak in XDP enable error path During XDP enablement in veth, if xdp_rxq_in… |
CVE-2026-80612 | Critical | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passi… |
CVE-2026-80611 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: ACPI: processor_idle: Mark LPI enter functions as __cpuidle When function tracing or Kpro… | |
CVE-2026-80610 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: net: enetc: fix potential divide-by-zero when num_vsi is zero For i.MX94 series, all the… | |
CVE-2026-80609 | Critical | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: qede: fix out-of-bounds check for cqe->len_list[] Move index check before element access. |
CVE-2026-80608 | High | 8.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix iommu domain lifetime race during device removal When force_iova mode… |
CVE-2026-80607 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg Sashiko found that user can cause… | |
CVE-2026-80606 | High | 7.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/userptr: Hold notifier_lock for write on inject test path When CONFIG_DRM_XE_USERP… |
CVE-2026-80605 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() In picolcd_send… | |
CVE-2026-80604 | High | 8.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hid_get_report for numbered reports When a caller passes a siz… |
CVE-2026-80603 | Critical | 9.1 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read parse_dcc() treats data_… |
CVE-2026-80602 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/lbr: Fix kernel address leakage A user-only branch stack can contain branche… | |
CVE-2026-80601 | High | 8.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: gw: acquire ethernet header only after skb realloc The pskb_may_pull() called… |
CVE-2026-80600 | Critical | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: acquire ARP hw source only after skb realloc The pskb_may_pull() called… |
CVE-2026-80599 | High | 8.1 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: ensure accessible eth_hdr proto field When batadv_get_vid() accesses the… |
CVE-2026-80598 | High | 7.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in decompress_lznt decompress_lznt() does not validate arra… |
CVE-2026-80597 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix NULL pointer dereference in initialization The mtd_info contain… | |
CVE-2026-80596 | High | 8.4 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - only expose sysfs attributes on control interface When the driver was co… |
CVE-2026-80595 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - add response length checks The driver processes response data from devic… | |
CVE-2026-80594 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing The driver p… | |
CVE-2026-80593 | High | 8.4 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus_atk0110) Check package count before accessing element atk_ec_present() walks… |
CVE-2026-80592 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: fail early if address range parameters are invalid The comment on to… | |
CVE-2026-80591 | High | 7.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix listxattr handling of corrupted xattr entries Validate the xattr entry before r… |
CVE-2026-80590 | High | 8.6 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: inet: frags: strip GSO state from fragments before reassembly A virtio_net_hdr (tun/tap… |
CVE-2026-80589 | Critical | 9.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a never added disk disk_release() undoes blk… |
CVE-2026-80588 | High | 7.5 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors After commit 9db5b3cec4ec ("mpt… |
CVE-2026-80587 | Critical | 9.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions Some MPTCP suboptions are mutually exclus… |
CVE-2026-80586 | Critical | 9.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a ma… |
CVE-2026-80585 | Critical | 9.4 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a v… |
CVE-2026-80584 | High | 8.4 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP and ARP query ioctls qeth_snmp_command() a… |
CVE-2026-80583 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses The "DEC0 MODE" to "DEC7 MODE" c… |
CVE-2026-80582 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: drm/shmem_helper: Check VMA boundaries for PMD mappings In the ->huge_fault handler do no… |
CVE-2026-80581 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout Ignore IPC erro… | |
CVE-2026-80580 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer mode_string() uses snprintf() which ca… |
CVE-2026-80579 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: fbdev: clear fb_info->mode before deleting a videomode fb_set_var() can delete a mode fro… |
CVE-2026-80578 | High | 7.3 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: fbdev: core: Fix pointer desynchronization in fb_io_read() In fb_io_read(), if copy_to_us… |
CVE-2026-80577 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: skip zero-sized firmware sections panthor_fw_load_section_entry() skips BO c… | |
CVE-2026-80576 | High | 8.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpu_cs_p2_i… |
CVE-2026-80575 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: Input: cs40l50-vibra - validate custom data from user space cs40l50_add() copies the cust… |
CVE-2026-80574 | High | 8.4 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Make finger2 (… |
CVE-2026-80573 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforce_process_packet() reads fixed fields… | |
CVE-2026-80572 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer deletion before freeing private data byd_disconnect() uses… |
CVE-2026-80571 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak In papr_phy_attest_… | |
CVE-2026-80570 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero report size on F54 work error In rmi_f54_work(), if an error… |
CVE-2026-80569 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer rmi_f54_work()… |
CVE-2026-80568 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - block s_input when F54 queue is busy Changing the input (diagnost… |
CVE-2026-80567 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Previously, rmi_f54_buf… | |
CVE-2026-80566 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: Input: hynitron_cstxxx - validate touch count and finger IDs The driver allocates max_tou… | |
CVE-2026-80565 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix error path in devm_qce_register_algs If ops->register_algs() fails, the… |
CVE-2026-80564 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: gve: fix NULL dereference due to missing ptp adjfine Fix NULL dereference due to missing… | |
CVE-2026-80563 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind The "trigge… | |
CVE-2026-80562 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: gpio: ml-ioh: use raw_spinlock_t for the register lock ioh_irq_type() is registered as th… | |
CVE-2026-80561 | Critical | 9.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decode_locker() decode_locker() in cls_lock_clien… |
CVE-2026-80560 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: openrisc: signal: do not restore privileged SR bits on sigreturn restore_sigcontext() cop… |
CVE-2026-80559 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: Input: sur40 - fix input device registration ordering In sur40_probe(), input_register_de… |
CVE-2026-80558 | Critical | 9.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primary_temp A corrupted osdmap received fr… |
CVE-2026-80557 | Critical | 9.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decode_watchers() via missing bounds check ceph_start_decoding()… |
CVE-2026-80556 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition In atmci_probe… |
CVE-2026-80555 | High | 7.1 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Free all memory if cp_init() fails The routine cp_free() is called to unpi… |
CVE-2026-80554 | Critical | 9.3 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Limit the number of channel program segments The processing of channel pro… |
CVE-2026-80553 | High | 8.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Cancel existing workqueues The initialization of the io_work and crw_work… |
CVE-2026-80552 | High | 8.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure index for read/write regions are within range The introduction of t… |
CVE-2026-80551 | Critical | 9.3 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure first IDAW remains constant The first IDAW in a list does not need… |
CVE-2026-80550 | High | 7.9 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Fix out of bounds check on CCW array The routine ccwchain_calc_length() co… |
CVE-2026-80549 | High | 8.2 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Move cp cleanup out of not operational The fsm_notoper() routine is called… |
CVE-2026-80548 | High | 8.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Selectively expand io_mutex The io_mutex was defined to serialize the io_r… |
CVE-2026-80547 | High | 8.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Implement a crw lock Unlike the channel_program struct, which covers synch… |
CVE-2026-80546 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve CCA CPRB length and overflow checks The xcrb_msg_to_type6cprb_msgx()… |
CVE-2026-80545 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB length and overflow checks The xcrb_msg_to_type6_ep11cprb_… |
CVE-2026-80544 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing The zcrypt_msgtype6_sen… |
CVE-2026-80543 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Pad trailing CCA or EP11 message with zeros The both functions xcrb_msg_to_t… | |
CVE-2026-80542 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() amdgpu_dm_cr… | |
CVE-2026-80541 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate GEM_CREATE domain combinations AMDGPU_GEM_CREATE checked domain bits… |