Linux
Page 40 of 100 — Linux CVEs from a corpus of 24865, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-64468 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_free_transaction() In binder_free_transaction(), the t->to_proc… |
CVE-2026-64467 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: rust_binder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks… |
CVE-2026-64466 | | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: rust_binder: clear freeze listener on node removal Generally userspace is supposed to exp… | |
CVE-2026-64465 | | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix sleep in atomic context in xhci_free_streams() When a USB device with acti… | |
CVE-2026-64464 | | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: fix ring sg table pages leak xhci_ring_to_sgtable() allocates a temporary… | |
CVE-2026-64463 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres rt1711h_probe() registers th… |
CVE-2026-64462 | | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: PCI: altera: Fix resource leaks on probe failure The chained IRQ handler is set during pr… | |
CVE-2026-64461 | | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek: Fix IRQ domain leak when port fails to enable When mtk_pcie_enable_port()… | |
CVE-2026-64460 | High | 7.0 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Skip VF Resizable BAR restore on read error sriov_restore_vf_rebar_state() uses… |
CVE-2026-64459 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: tcp: restore RCU grace period in tcp_ao_destroy_sock Commit 51e547e8c89c ("tcp: Free TCP-… |
CVE-2026-64458 | | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: handle extreme intervals in damon_hot_score() Fix three issues in da… | |
CVE-2026-64457 | | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: virtio_pci: fix vq info pointer lookup via wrong index Unbinding a virtio balloon device… | |
CVE-2026-64456 | High | 7.7 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len at copy_data() random_recv_done() stores th… |
CVE-2026-64455 | | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: chaoskey: Fix slab-use-after-free in chaoskey_release() The chaoskey driver has a us… | |
CVE-2026-64454 | | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: run gadget disconnect from sleepable suspend context dwc3_gadget_suspend() tak… | |
CVE-2026-64453 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbio_disconnect() walks usbio->c… |
CVE-2026-64452 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpan_nhc_do_uncompression() looks u… |
CVE-2026-64451 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in func_set_flag() func_set_flag() dereferences tr-… |
CVE-2026-64450 | Critical | 9.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATE_MSG c… |
CVE-2026-64449 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: bound slave read/write to the kern_buf size The SLAVE-path helpers buf… |
CVE-2026-64448 | High | 8.2 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc[0] exemption to responses without data area smb2_check_… |
CVE-2026-64447 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix double-free and use-after-free in error paths In both ipu7_isys… |
CVE-2026-64446 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() supplicant_ie i… |
CVE-2026-64445 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() OnAuth() has two bu… |
CVE-2026-64444 | High | 8.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop The IE parsing loop in OnAssocRs… |
CVE-2026-64443 | High | 8.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop The IE parsing loop in u… |
CVE-2026-64442 | High | 8.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Two… |
CVE-2026-64441 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_… |
CVE-2026-64440 | High | 8.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HT_caps_handler() HT_caps_handler() iterates pIE->le… |
CVE-2026-64439 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5_aead_encrypt(), krb5_a… |
CVE-2026-64438 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() The VF2PF interrupt han… |
CVE-2026-64437 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL Commit f… |
CVE-2026-64436 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: net: af_key: initialize alg_key_len for IPComp states pfkey_msg2xfrm_state() handles the… |
CVE-2026-64435 | High | 8.2 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skb_queue_len() readers on audit_queue Multiple readers access a… |
CVE-2026-64434 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2cap_chan_timeout() run… |
CVE-2026-64433 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete add_device_complete()… |
CVE-2026-64432 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns In the analysis pass… |
CVE-2026-64431 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid calling post_write_mst_fixup() for invalid index_block ntfs_icx_ib_sync_write… |
CVE-2026-64430 | High | 7.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid calling pci_irq_vector() from hardirq context ntb_epf_vec_isr() calls pci… |
CVE-2026-64429 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: gpio: eic-sprd: use raw_spinlock_t in the irq startup path sprd_eic_irq_unmask() enables… |
CVE-2026-64428 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: gpio: sch: use raw_spinlock_t in the irq startup path sch_irq_unmask() enables the GPIO I… |
CVE-2026-64427 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: HID: logitech-dj: Fix maxfield check in DJ short report validation Commit b6a57912854e ("… |
CVE-2026-64426 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE NOP file-acquisition support… |
CVE-2026-64425 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item commit 10dc95939817 ("i… |
CVE-2026-64424 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: netpoll: fix a use-after-free on shutdown path There is a use-after-free error on netpoll… |
CVE-2026-64423 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is… |
CVE-2026-64422 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Reject invalid `net.ipv… |
CVE-2026-64421 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix use-after-free on remove KASAN reports a slab-use-after-free in… |
CVE-2026-64420 | High | 7.0 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: mfd: cros_ec: Delay dev_set_drvdata() until probe success If ec_device_probe() fails, cro… |
CVE-2026-64419 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() Reading the debugfs "c… |
CVE-2026-64418 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix shrinker_info teardown race with expansion expand_shrinker_info() itera… |
CVE-2026-64417 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix NULL pointer dereference in debugfs shrinker_debugfs_add() creates both… |
CVE-2026-64416 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host lookup_swap_cgr… |
CVE-2026-64415 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup We hit a… |
CVE-2026-64414 | High | 7.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: handle unreadable frags sashiko reports: When an skb with unreadable fragment… |
CVE-2026-64413 | High | 7.0 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables table t… |
CVE-2026-64412 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: module names must be null-terminated We need to explicitly check the… |
CVE-2026-64411 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: terminate table name before find_table_lock() update_counters() and… |
CVE-2026-64410 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: IPIP tunnel hardware offload is not yet support No driver supports… |
CVE-2026-64409 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() Every once in a while we… |
CVE-2026-64408 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnep_add_connection() re… |
CVE-2026-64407 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() During the… |
CVE-2026-64406 | High | 8.0 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in bt_accept_dequeue() bt_accept_get() takes a temporary reference bef… |
CVE-2026-64405 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() hci_abort_conn() read hci_skb… |
CVE-2026-64404 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() iso_conn_big_sync() drops… |
CVE-2026-64403 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2cap_get_conf_opt… |
CVE-2026-64402 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() When the SMB sink is use… |
CVE-2026-64401 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: resolve SWN tcon from live registrations cifs_swn_notify() looks up a witnes… |
CVE-2026-64400 | High | 8.6 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent path traversal bypass by restricting caseless retry ksmbd_vfs_path_lookup(… |
CVE-2026-64399 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE The FSCTL_DUPLICATE_EXTE… |
CVE-2026-64398 | High | 8.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTL_SET_ZERO_DATA FSCTL_SET_ZERO_DATA in smb2_ioctl()… |
CVE-2026-64397 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERY_DIRECTORY requests per file smb2_query_dir() stores a pointer to i… |
CVE-2026-64396 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation When a blockin… |
CVE-2026-64395 | High | 7.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read access for duplicate extents FSCTL_DUPLICATE_EXTENTS_TO_FILE p… |
CVE-2026-64394 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY commit cc57232cae23 ("… |
CVE-2026-64393 | Critical | 9.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: run set info with opener credentials SMB2 SET_INFO handlers call path-based VFS he… |
CVE-2026-64392 | Critical | 9.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for delete-on-close Delete-on-close can be completed by def… |
CVE-2026-64391 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Un… |
CVE-2026-64390 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2_LOCK adds each granted byte-ran… |
CVE-2026-64389 | High | 8.2 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbd_auth_ntlmv2() derives t… |
CVE-2026-64388 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership (chown) and group (chgrp… |
CVE-2026-64387 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return… |
CVE-2026-64386 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query_info() replay double-free A response-bearing attempt can return a… |
CVE-2026-64385 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return… |
CVE-2026-64384 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing attempt can return a… |
CVE-2026-64383 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_flush() replay SMB2_flush() keeps its response buffe… |
CVE-2026-64382 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_open() replay A response-bearing attempt can return… |
CVE-2026-64381 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix next buffer leak in receive_encrypted_standard() receive_encrypted_stand… |
CVE-2026-64380 | High | 8.2 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posix_info_sid_size() reads sid[1] to obtain… |
CVE-2026-64379 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active… |
CVE-2026-64378 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() When a conta… |
CVE-2026-64377 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcom_cpufreq.data is allocated with de… |
CVE-2026-64376 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: firmware_loader: fix device reference leak in firmware_upload_register() firmware_upload_… |
CVE-2026-64375 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: proc: protect ptrace_may_access() with exec_update_lock (FD links) proc_pid_get_link() an… |
CVE-2026-64374 | High | 7.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT RT migration is done aggress… |
CVE-2026-64373 | Medium | 4.7 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: Fix hotplug-suspend race during reboot During system reboot, cpufreq_suspend() i… |
CVE-2026-64372 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation pcc_cpufreq_do_osc()… |
CVE-2026-64371 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: proc: protect ptrace_may_access() with exec_update_lock (part 1) Fix the easy cases where… |
CVE-2026-64370 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path In do_cpu_nanosl… |
CVE-2026-64369 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: s390: Revert support for DCACHE_WORD_ACCESS load_unaligned_zeropad() reads eight bytes fr… |