Linux
Page 4 of 100 — Linux CVEs from a corpus of 24867, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-97595 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mac802154: fix use-after-free of sdata via queued RX frames The RX softirq producer ieee8… |
CVE-2026-97594 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: landlock: Fix use-after-free of the source's parent directory current_check_refer_path()… |
CVE-2026-97593 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX When using a… | |
CVE-2026-97592 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm In function… | |
CVE-2026-97591 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix handling of EBUSY in PHMAC when req is pushed to crypto engine When a re… | |
CVE-2026-97590 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix missing scrub of temp buffers with PAES algorithm In function ctr_paes_d… | |
CVE-2026-97589 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix wrong return code to engine in asynch callbacks When crypto_finalize_has… |
CVE-2026-97588 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly When hardware persiste… | |
CVE-2026-97587 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: perf: RISC-V: store available counter mask as bitmap The available-counter mask was a sin… | |
CVE-2026-97586 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix missing kunmap in afs_dir_search_bucket() Fix afs_dir_search_bucket() to kunmap… | |
CVE-2026-97585 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix double-unmap of directory block Fix afs_edit_dir_remove() to use a cleanup funct… | |
CVE-2026-97584 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix incorrect free in candidate cleanup in afs_lookup_server() Fix afs_lookup_server… |
CVE-2026-97583 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: afs: Clear stale peer app data after address list changes afs_fs_probe_fileserver() fetch… |
CVE-2026-97582 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (gpio-fan) Fix use-after-free in alarm work fan_alarm_irq_handler() queues fan_dat… | |
CVE-2026-97581 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity prepare_tile_i… | |
CVE-2026-97580 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: bound HEVC tile loops and PPS id to the array capacity compute_tiles_unifo… |
CVE-2026-97579 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity vdec_av1_slice_s… |
CVE-2026-97578 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer rockchip_vpu981_av… |
CVE-2026-97577 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity rockchip_vpu9… |
CVE-2026-97576 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC tile counts The stateless HEVC decoders read num_tile_co… |
CVE-2026-97575 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate AV1 tile counts The stateless AV1 decoders use tile_info.tile… |
CVE-2026-97574 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Don't free the live ring's TPA state on queue restart failure bnxt_queue_mem_all… | |
CVE-2026-97573 | High | 8.1 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() bnxt_rx_ring_reset() fr… |
CVE-2026-97572 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Propagate RX ring init failures in bnxt_init_nic() bnxt_init_rx_rings() returns… | |
CVE-2026-97571 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() bnxt_alloc_on… | |
CVE-2026-97570 | High | 8.1 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Bound SW TPA IDs to prevent crashes FW supports up to 1024 concurrent TPAs, so t… |
CVE-2026-97569 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Prevent queue stop with deferred completions When the driver receives a burst of… | |
CVE-2026-97568 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mptcp: syncookies: remember the request backup flag Instead of using an uninitialised bit… | |
CVE-2026-97567 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mptcp: prevent race between disconnect() and rtx Sashiko noted that the two event can rac… | |
CVE-2026-97566 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0 The in-kernel MPTCP path manag… | |
CVE-2026-97565 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: reject short READ responses in CIFSSMBRead() CIFSSMBRead() reads DataLengthH… | |
CVE-2026-97564 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.idmap descriptions cifs.idmap key descriptions carry a… | |
CVE-2026-97563 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() The SMB1 synchronous read h… | |
CVE-2026-97562 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tcon_super_cb() stores a raw superbl… |
CVE-2026-97561 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid When the administrator… | |
CVE-2026-97560 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix one-byte OOB read in smb2_parse_native_symlink() When parsing a share-ro… | |
CVE-2026-97559 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fail DACL rewrite when the new DACL exceeds 64K replace_sids_and_copy_aces()… | |
CVE-2026-97558 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix cifsFileInfo reference leak in deferred close When cifs_close() defers a… | |
CVE-2026-97557 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount in cifs_queue_oplock_break() cifs_queue_oplock_break(… |
CVE-2026-97556 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount when cifs_sb_tlink() fails cifs_oplock_break() takes… | |
CVE-2026-97555 | High | 8.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When id_mode_to_cifs_acl rewri… |
CVE-2026-97554 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() cifs_posix_to_fattr(… | |
CVE-2026-97553 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: lock the healthmon when inserting unmount event LOLLM complains that xfs_healthmon_u… | |
CVE-2026-97552 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: initialise error in xfs_defer_finish_one() xfs_defer_finish_one() declares error wit… | |
CVE-2026-97551 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: initialise args->total for parent pointer updates xfs_parent_da_args_init() builds a… | |
CVE-2026-97550 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix unit conversions in per_binval computation LOLLM noticed that we're doing the un… | |
CVE-2026-97549 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix under-reservation of blocks when repairing sf directories Whilst running QA on X… | |
CVE-2026-97548 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions The _maxlevels_ondisk func… |
CVE-2026-97547 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN When exchanging two… | |
CVE-2026-97546 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: don't spin forever on zero-length dirents when salvaging them LOLLM noticed that xre… | |
CVE-2026-97545 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails LOLLM observes that in xfs_btree… | |
CVE-2026-97544 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: don't leak dqacct if rhashtable insertion fails LOLLM observes that xqcheck_mod_live… | |
CVE-2026-97543 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: destroy seen inode bitmap when we fail to add a dirpath LOLLM observes a memory leak… | |
CVE-2026-97542 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: bail out on bitmap errors in xrep_agfl_fill LOLLM also points out that the xagb_bitm… | |
CVE-2026-97541 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: don't store usb_device_id usb_device_id is not guaranteed to live longer… | |
CVE-2026-97540 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: don't rely on id table pointer arithmetic The current code is broken w… | |
CVE-2026-97539 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: usb: xusbatm: don't rely on id table pointer arithmetic The current code is broken when d… | |
CVE-2026-97538 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus_rog_ryujin) Validate HID report lengths rog_ryujin_raw_event() parses respon… | |
CVE-2026-97537 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking qla25xx_free_req_que()… | |
CVE-2026-97536 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown The response queue MSI-… |
CVE-2026-97535 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size The VP control IOCB select… | |
CVE-2026-97534 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: f2fs: accurately adjust free_sections during free_segment_range In free_segment_range()… | |
CVE-2026-97533 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF A previous commit… | |
CVE-2026-97532 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path When qla2x00_mem… | |
CVE-2026-97531 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Skip vport under deletion in report ID acquisition qla24xx_report_id_acqui… |
CVE-2026-97530 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature qla27xx_copy_multiple_… | |
CVE-2026-97529 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] The FC BSG transport… | |
CVE-2026-97528 | High | 8.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error qla_nvme_xmt_ls_rs… |
CVE-2026-97527 | High | 8.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock The fcport->unsol_ctx… |
CVE-2026-97526 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: s390/pai: Support CPU hotplug for PMU PAI The command 'perf stat -e pai_crypto/CRYPTO_ALL… | |
CVE-2026-97525 | High | 8.2 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Allocate split page tables as kernel page tables A PTE is allocated directly… |
CVE-2026-97524 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid unneeded actions on subflow reset Once in a blue moon, the mptcp receive pat… |
CVE-2026-97523 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mptcp: close race between scheduler and state change The mptcp scheduler may race with su… |
CVE-2026-97522 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix bad accounting in __mptcp_subflow_push_pending() If __subflow_push_pending() e… | |
CVE-2026-97521 | | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: gfs2: fix quota init duplicate scan gfs2_quota_init() checks for duplicate quota_change I… | |
CVE-2026-97520 | High | 7.1 | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: gfs2: move quota_init qc iterator increment Move qc++ from the loop body into the for-loo… |
CVE-2026-97519 | | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix null pointer dereference in devcoredump cleanup In xe_devcoredump_snapshot_fr… | |
CVE-2026-97518 | | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: reject duplicate wiphy cipher suite entries Duplicate entries in wiphy->c… | |
CVE-2026-97517 | | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject beacons with bad HE operation The HE operation element not only nee… | |
CVE-2026-97516 | | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result() It was recen… | |
CVE-2026-97515 | | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 On NPCM845, when a tar… | |
CVE-2026-97514 | | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Fix Reports from Kernel Lock Validator handle_dynamic_resoluti… | |
CVE-2026-97513 | High | 7.8 | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Release m2m_ctx after Instance Removed from List Possible use… |
CVE-2026-97512 | | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM The runtime PM functions… | |
CVE-2026-97511 | | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid out-of-bounds access in monitor In NAN, we don't know on what band… | |
CVE-2026-97510 | | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() If tb_c… | |
CVE-2026-97509 | High | 8.8 | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep XDomain reference during the lifetime of a service This is needed becau… |
CVE-2026-97508 | High | 7.5 | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Set tb->root_switch to NULL when domain is stopped Similarly what we do with… |
CVE-2026-97507 | | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: media: dm1105: fix missing error check for dma_alloc_coherent The return value of dm1105_… | |
CVE-2026-97506 | | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: crypto: ixp4xx - fix buffer chain unwind on allocation failure chainup_buffers() builds a… | |
CVE-2026-97505 | | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() Currently, the __resource… | |
CVE-2026-97504 | | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk Review by sashiko.de… | |
CVE-2026-97503 | | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: genirq/proc: Size interrupt directory names for 10-digit interrupt numbers /proc/irq/<n>/… | |
CVE-2026-97502 | | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: mmc: davinci: avoid NULL deref of host->data in IRQ handler mmc_davinci_irq() returns ear… | |
CVE-2026-97501 | | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction pinctrl_gpio_di… | |
CVE-2026-97500 | | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: phy: check length before parsing PHY status IE Hardware might report PHY sta… | |
CVE-2026-97499 | | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: coresight: perf: Retrieve path and source from event data ETM perf callbacks currently us… | |
CVE-2026-97498 | | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: pin mqd and fw object bo to avoid eviction mqd and fw objects are queue… | |
CVE-2026-97497 | High | 7.8 | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id allocate_sdma_queue has… |
CVE-2026-97496 | High | 7.1 | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix OOB memory exposure in get_wave_state() The get_wave_state() function for… |