Linux
Page 27 of 100 — Linux CVEs from a corpus of 24866, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-74474 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() for transmit path header pulls In vxlan_xmit(), arp_re… |
CVE-2026-74473 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() in route_shortcircuit() route_shortcircuit() currently… |
CVE-2026-74472 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() ublk_ctrl_add_dev() memcp… | |
CVE-2026-74471 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: tracing: Check return value of __register_event() in trace_module_add_events() trace_modu… |
CVE-2026-74470 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write resp_report_zones() size… |
CVE-2026-74469 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the associat… |
CVE-2026-74468 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: gpio: pch: use raw_spinlock_t for the register lock pch_irq_type() is registered as the i… | |
CVE-2026-74467 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: s390/qeth: Check CAP_NET_ADMIN for private ioctls Gate the SIOCDEVPRIVATE ioctl commands… |
CVE-2026-74466 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a… | |
CVE-2026-74465 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix potential UAF on meter attach failure While attaching a newly creat… |
CVE-2026-74464 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix skb leak on flow key update failure during ct ovs_ct_execute() alwa… | |
CVE-2026-74463 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock Fix a se… | |
CVE-2026-74462 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: i2c: imx: mark I2C adapter when hardware is powered down On some i.MX platforms, certain… | |
CVE-2026-74461 | High | 8.4 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2c_imx_unreg_slave(), the slav… |
CVE-2026-74460 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: validate CPC message lengths ems_usb_read_bulk_callback() walks CPC message… | |
CVE-2026-74459 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure e… | |
CVE-2026-74458 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents The w… | |
CVE-2026-74457 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: add bounds check for USB channel index The channel control index ctrl_idx… | |
CVE-2026-74456 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error I… |
CVE-2026-74455 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: validate uCAN receive record lengths pcan_usb_fd_decode_buf() walks uCAN r… | |
CVE-2026-74454 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size vc4_overflow_me… |
CVE-2026-74453 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16M… |
CVE-2026-74452 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthor_fw_load_section_entr… |
CVE-2026-74451 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes iface_fw_to_cpu_addr() only chec… |
CVE-2026-74450 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix pptable use-after-free amdgpu_dpm_get_pp_table() returns a pointer to a d… |
CVE-2026-74449 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport If a pla… |
CVE-2026-74448 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix QID bit leak in pqm_create_queue() When MES is enabled and amdgpu_amdkfd_… | |
CVE-2026-74447 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment eop_ring_buffer_size… |
CVE-2026-74446 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: hold event_mutex while checkpointing CRIU events kfd_criu_checkpoint_events()… |
CVE-2026-74445 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: reject DX_BIND_QUERY without a DX context vmw_cmd_dx_bind_query() uncondition… | |
CVE-2026-74444 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division vmw_cmd_draw() computes … |
CVE-2026-74443 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmw_cmd_dma() locates the… |
CVE-2026-74442 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure Two paths through vmw_vkms… | |
CVE-2026-74441 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Fix race condition and ordering in port unregistration A synchronizatio… | |
CVE-2026-74440 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xe_exec… |
CVE-2026-74439 | Critical | 9.3 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry device_pasi… |
CVE-2026-74438 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: crypto: sun4i-ss - Remove insecure and unused rng_alg Remove sun4i_ss_rng, as it is insec… |
CVE-2026-74437 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work If a UVC… | |
CVE-2026-74436 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: serialize kernel accept preallocation with socket teardown rxrpc_kernel_charge_acc… |
CVE-2026-74435 | High | 7.5 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc rxrpc_recvmsg_data() calls rxrpc_veri… |
CVE-2026-74434 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don't move a peeked OOB message onto the pending queue rxrpc_recvmsg_oob() takes a… |
CVE-2026-74433 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix UAF in rxgk_issue_challenge() Fix rxgk_issue_challenge() to free the page cont… |
CVE-2026-74432 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) Fix rxrpc_recvmsg() to also drop th… | |
CVE-2026-74431 | High | 7.5 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential infinite loop in rxrpc_recvmsg() Fix the wait in rxrpc_recvmsg() als… |
CVE-2026-74430 | High | 7.5 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpc_input_ackall() accepts ACKALL packets without che… |
CVE-2026-74429 | High | 7.5 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the reception of a reply packet before data transmission Fix rxrpc_receiving_r… |
CVE-2026-74428 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix double unlock in rxrpc_recvmsg() Fix a double unlock in rxrpc_recvmsg() when d… |
CVE-2026-74427 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs ne… |
CVE-2026-74426 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: afs: fix NULL pointer dereference in afs_get_tree() afs_alloc_sbi() uses kzalloc for memo… | |
CVE-2026-74425 | High | 7.5 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: afs: handle CB.InitCallBackState3 requests without a server record The cache manager call… |
CVE-2026-74424 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: fbcon: fix NULL pointer dereference for a console without vc_data fbcon_new_modelist() ru… | |
CVE-2026-74423 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix leak when pinning ubuf pages When pin_user_pages_fast() returns fewer… | |
CVE-2026-74422 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: inno-hdmi: Switch to drmm_kzalloc() Driver makes use of drmm_encoder_init()… | |
CVE-2026-74421 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dw_dp: Switch to drmm_kzalloc() Driver makes use of drmm_encoder_init() to… | |
CVE-2026-74420 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Reject VMAs with VM_IO or VM_PFNMAP when creating SVM ranges VMAs marked with… | |
CVE-2026-74419 | High | 7.3 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Adjust size for copy_to_user() The amount of data returned to user space s… |
CVE-2026-74418 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: dma-fence: Fix potential tracepoint null pointer dereferences Trace_dma_fence_signaled, t… | |
CVE-2026-74417 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix integer overflow in radeon_align_pitch() radeon_align_pitch() has the sam… |
CVE-2026-74416 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix memory leak in radeon_ring_restore() on lock failure radeon_ring_restore(… | |
CVE-2026-74415 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: spi: atcspi200: fix use-after-free when driver unbind DMA resource is initialized after S… | |
CVE-2026-74414 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: hfsplus: Remove the duplicate attr inode dirty marking action Syzbot reported a null-ptr-… | |
CVE-2026-74413 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix wrong pci_get_drvdata type in AER handlers rtw89 stores an ieee80211_hw… |
CVE-2026-74412 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers rtw88 stores an ieee80211_hw… |
CVE-2026-74411 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop A kernel soft lockup… |
CVE-2026-74410 | High | 8.1 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer In rtw_pci_rx_… |
CVE-2026-74409 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware mac_id in link lookup The mac_id field in RX de… |
CVE-2026-74408 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID ath_tx_edma_tasklet() access… |
CVE-2026-74407 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cancel SSR work items during PCI shutdown A reboot can crash the kernel if… |
CVE-2026-74406 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). udp_tunnel_sock_relea… |
CVE-2026-74405 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: OPP: Fix race between OPP addition and lookup A race exists between dev_pm_opp_add_dynami… |
CVE-2026-74404 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one Sashiko notes: > regardin… |
CVE-2026-74403 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Check for page allocation failure correctly in TIO Sashiko notes: > if __s… |
CVE-2026-74402 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - fix blocking and non-blocking rng logic The blocking and non-bloc… | |
CVE-2026-74401 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: dlm: fix add msg handle in send_queue ordered In a benchmark scenario triggering a lot of… |
CVE-2026-74400 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries bpf_set_dentry_xatt… | |
CVE-2026-74399 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: evm: terminate and bound the evm_xattrs read buffer evm_read_xattrs() allocates size + 1… | |
CVE-2026-74398 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD addrconf_dad_fail… |
CVE-2026-74397 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier mlx5_ib_alloc_tran… |
CVE-2026-74396 | High | 7.5 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure mlx5r_umr_update_xlt() allocates a… |
CVE-2026-74395 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference MLX5_IB_METHOD_DEVX_SUBSCRIBE… | |
CVE-2026-74394 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check imm_buf->len is a user-con… |
CVE-2026-74393 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/syncobj: Fix memory leak in drm_syncobj_find_fence() Commit 18226ba52159 ("drm/syncob… | |
CVE-2026-74392 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: dm: limit target bio polling to one shot dm_poll_bio() is the ->poll_bio() callback for a… | |
CVE-2026-74391 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: tracing: Bound synthetic-field strings with seq_buf The synthetic field helpers build a p… | |
CVE-2026-74390 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs The irdma_copy_user_pgaddr… |
CVE-2026-74389 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix log flood after cmd_mbox failure hns_roce_cmd_mbox() is the command interfa… | |
CVE-2026-74388 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data The OSS sequencer pro… |
CVE-2026-74387 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with event_input event_process_midi() borrows… |
CVE-2026-74386 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix page fragment cache leak in error path In nvmet_tcp_alloc_queue(), when a… | |
CVE-2026-74385 | High | 7.5 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock The return value of nvmet_tcp_s… |
CVE-2026-74384 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nvme_ns_head struct nvme_ns_head contains a… |
CVE-2026-74383 | High | 8.4 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools nvme_setup_descriptor_p… |
CVE-2026-74382 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_bpf: prevent unbounded recursion in offload rollback Quan Sun reported [1]… | |
CVE-2026-74381 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via ho… | |
CVE-2026-74380 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix iommu_map_sgtable() return value check Commit "iommu: return full error… |
CVE-2026-74379 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: dax/kmem: account for partial discontiguous resource upon removal When dev_dax_kmem_probe… | |
CVE-2026-74378 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe get_srq_wqe() reads wqe->dma.num_sge fr… |
CVE-2026-74377 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path For non-SRQ QPs, the responder… |
CVE-2026-74376 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: md/raid10: reset read_slot when reusing r10bio for discard put_all_bios() always drops de… |
CVE-2026-74375 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix deadlock in read error recovery path raid1d and raid10d may resubmit… |