Linux
Page 8 of 100 — Linux CVEs from a corpus of 24866, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-93112 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Require a BPF cpumask for bpf_cpumask_populate() bpf_cpumask_populate() writes to it… |
CVE-2026-93111 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Mark tracing_multi trampolines as ftrace managed Since tracing_multi link does not s… |
CVE-2026-93110 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Wait for RCU callbacks before unloading ib_core put_gid_ndev() is queued with… | |
CVE-2026-93109 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Drain RCU callbacks during module teardown devx_free_subscription() can remain… | |
CVE-2026-93108 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/ipoib: Drain RCU callbacks during module teardown IPoIB reclamation completions can… | |
CVE-2026-93107 | High | 8.2 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state When… |
CVE-2026-93106 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: crash_dump: release keyring reference at the correct time restore_dm_crypt_keys_to_thread… | |
CVE-2026-93105 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: esp: do not unref managed frag pages in esp_ssg_unref() esp_ssg_unref() releases the page… |
CVE-2026-93104 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rvt: Return NULL after port allocation failure rvt_alloc_device() deallocates the IB… | |
CVE-2026-93103 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Preserve unit 0 on allocation failure hfi1_free_devdata() assumes that the dev… | |
CVE-2026-93102 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Free RX data on late probe failure hfi1_init_dd() allocates the shared AIP/VNI… | |
CVE-2026-93101 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: media: v4l2-async: Unregister sub-device if asc_list is empty When my em28xx USB device t… | |
CVE-2026-93100 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() A struct rdtgroup is reference co… | |
CVE-2026-93099 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix UAF from worker threads when domains are removed The mbm_handle_overflow(… | |
CVE-2026-93098 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: rpmsg: glink: fix deadlock in endpoint destroy during driver detach During driver detach… | |
CVE-2026-93097 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 wit… | |
CVE-2026-93096 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: cxl/features: Serialize multi-part Get/Set Feature transfers A Get or Set Feature payload… | |
CVE-2026-93095 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: hfsplus: validate thread record before delete key rebuild hfsplus_delete_cat() is called… |
CVE-2026-93094 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollback ath12k_mac_vdev_cr… | |
CVE-2026-93093 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Publish channel state before callbacks Transport setup can enable cal… | |
CVE-2026-93092 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Unregister device notifier before IDR teardown The requested-devices… | |
CVE-2026-93091 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Quiesce notifications before teardown scmi_notification_exit() clears… | |
CVE-2026-93090 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Clean up channels on setup failure scmi_channels_setup() can fail aft… | |
CVE-2026-93089 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Free transport channel on IDR failure If transport channel setup succ… | |
CVE-2026-93086 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Avoid IDR updates while cleaning channels scmi_cleanup_channels() wal… | |
CVE-2026-93085 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Reject out of range DT protocol IDs SCMI protocol IDs carried in mess… | |
CVE-2026-93084 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Drop handle on protocol bind failures The SCMI bus notifier acquires… | |
CVE-2026-93083 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Unwind TX receiver mailbox setup failure mailbox_chan_setup() can req… | |
CVE-2026-93082 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Unwind P2A receiver mailbox setup failure mailbox_chan_setup() can re… | |
CVE-2026-93081 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix SCMI device destroy lifetimes scmi_child_dev_find() drops the ref… | |
CVE-2026-93080 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix transport device teardown lookup SCMI transport devices are delib… | |
CVE-2026-93079 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Get Feature count larger than the output buffer cxlctl_get_feature()… |
CVE-2026-93078 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Set Features output buffer smaller than the header cxlctl_set_featur… | |
CVE-2026-93077 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: cxl/features: Clamp Get Feature output size to the remaining buffer cxl_get_feature() rea… | |
CVE-2026-93076 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: clear vmemmap_shift when binding static pgmap Clear pgmap->vmemmap_shift for s… | |
CVE-2026-93075 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: clear pgmap ops and owner on unbind fsdev_dax_probe() sets pgmap->ops = &fsdev… | |
CVE-2026-93074 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: use __va(phys) for kaddr in direct_access Use __va(phys) instead of virt_addr… |
CVE-2026-93073 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: dax: read holder_ops once in dax_holder_notify_failure() dax_holder_notify_failure() read… | |
CVE-2026-93072 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: irqchip/renesas-irqc: Fix generic interrupt chip leak on remove The driver allocates doma… | |
CVE-2026-93071 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: media: bcm2835-unicam: Fix asc leaked in error/remove path v4l2_async_nf_add_fwnode_remot… | |
CVE-2026-93070 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: media: ipu6: Do not free aux device pdata after init ipu6_bus_initialize_device() stores… |
CVE-2026-93069 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: OPP: Fix cleanup ordering Commit 173e02d67494 ("OPP: Initialize scope-based pointers inli… | |
CVE-2026-93068 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix DM I2C teardown race DM I2C adapters can remain visible to userspace… | |
CVE-2026-93067 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: drm/bridge: tc358767: clamp the reported AUX read size to the request tc_aux_transfer() c… | |
CVE-2026-93066 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Take cpa_lock around large-page collapse Loading and unloading modules concur… | |
CVE-2026-93065 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs The loop counter 'count' was… | |
CVE-2026-93064 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser iwl_mvm_frob_txf_key_iter() track… | |
CVE-2026-93063 | High | 8.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mei: check SAP message length before reading it Verify the SAP message siz… |
CVE-2026-93062 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments Make sure we… | |
CVE-2026-93061 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Avoid stack over-read in debug output helpers host1x_debug_output() and host… | |
CVE-2026-93060 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: fix use after free on error path in a6xx_gpu_init() The a6xx_destroy() fu… | |
CVE-2026-93059 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix task_struct reference leak in recover_worker get_pid_task() increments the t… | |
CVE-2026-93058 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: drm/msm: Only fini scheduler after successful init msm_ringbuffer_new() destroys a partia… | |
CVE-2026-93057 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context TX EQTR may ru… | |
CVE-2026-93056 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_uac1_legacy: remove broken string configfs attributes The UAC1_STR_ATTRIBU… | |
CVE-2026-93055 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: UDF symlink pathComponent header OOB read udf_symlink_filler() can enter udf_pc_to_char()… | |
CVE-2026-93054 | High | 7.0 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: uio: Fix stale info pointer in failed registration path After device_add(), the UIO devic… |
CVE-2026-93053 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: speakup: keyhelp: guard letter_offsets possible out-of-range indexing help_init() builds… | |
CVE-2026-93052 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: misc: bcm-vk: Use acquire/release for msgq_inited bcm_vk_sync_msgq() fills the message qu… | |
CVE-2026-93051 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: misc: ad525x_dpot: use driver core groups for sysfs files ad_dpot_probe() creates per-RDA… | |
CVE-2026-93050 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove Three is… | |
CVE-2026-93049 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: mtd: mtdswap: Avoid freeing registered blktrans device twice In mtdswap_add_mtd(), debugf… | |
CVE-2026-93048 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() mtd_add_partition() does not… | |
CVE-2026-93047 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Associate BOs with every job that accesses them A submission can expand into a c… | |
CVE-2026-93046 | High | 7.0 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: software node: Fix software_node_get_reference_args() with index -1 The bounds check for… |
CVE-2026-93045 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject arena frees below the arena base bpf_arena_free_pages() accepts scalar arena… |
CVE-2026-93044 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for arena-related insns Since the interpreter does not… | |
CVE-2026-93043 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for gotox insn The interpreter does not recognize the… | |
CVE-2026-93042 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Terminate all descriptors without callbacks The DMA Engine client doc… |
CVE-2026-93041 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize abort state updates dw_edma_abort_interrupt() drops vc.lock… | |
CVE-2026-93040 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize channel state checks pause() and resume() read and update c… | |
CVE-2026-93039 | High | 7.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: Keep link pointers valid on realloc failure meson_card_reallocate_links() gr… |
CVE-2026-93038 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iio: dac: ad5686: missing NULL check on match data Verify that chip_info pointer is not N… | |
CVE-2026-93037 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Propagate sdma_txinit_ahg() errors set_txreq_header_ahg() ignores the return v… |
CVE-2026-92525 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] For a user QP, qp->sq.q… |
CVE-2026-92524 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() When its_irq_gic_domain_al… | |
CVE-2026-92523 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: validate dynamic counter attribute length RDMA_NLDEV_ATTR_STAT_HWCOUNTERS is… | |
CVE-2026-92522 | High | 7.3 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: validate MADT IOAPIC entry bounds The IOAPIC hotplug lookup parses both… |
CVE-2026-92521 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root acpi_pci_root_add()… | |
CVE-2026-92520 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Zero queue and stack outputs on lock failure Queue and stack pop/peek helpers accept… | |
CVE-2026-92519 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix memory leak in bpf_jit_free When bpf_int_jit_compile() is called for subp… | |
CVE-2026-92518 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix kernel stack corruption in tailcall with CFI When CONFIG_CFI_CLANG is ena… |
CVE-2026-92517 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf, riscv: Fix extable handling for arena load_acquire emit_atomic_ld_st() returns 1 to… | |
CVE-2026-92516 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix offset warn check for bpf_res_spin_lock Sashiko pointed out correctly that the c… | |
CVE-2026-92515 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve unique-field state across nested structs btf_find_struct_field() initialize… | |
CVE-2026-92514 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Fix CEQ tasklet use-after-free on removal Each CEQ interrupt handler only sch… | |
CVE-2026-92513 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/mana_ib: drain QP references after partial table insertion mana_table_store_ud_qp()… | |
CVE-2026-92512 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix use after free in ib_query_qp() When querying a QP via the netlink flow th… | |
CVE-2026-92511 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ib_destroy_cq_user() When accessing a CQ via t… |
CVE-2026-92510 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ib_destroy_srq_user() When accessing a SRQ via… |
CVE-2026-92509 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in counter_release() When accessing a counter via… | |
CVE-2026-92508 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ib_free_cq() When accessing a CQ via the netli… |
CVE-2026-92507 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ib_dealloc_pd_user() When accessing a PD via t… |
CVE-2026-92506 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix requested device removal race scmi_protocol_device_unrequest() dr… | |
CVE-2026-92505 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix undefined behavior in devid_write debugfs function When for_each_pci_segme… | |
CVE-2026-92504 | High | 7.0 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: thermal: intel: int3400: clean up ODVP on probe failures evaluate_odvp() creates per-ODVP… |
CVE-2026-92503 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() Syzbot/stress-ng reported an ABB… | |
CVE-2026-92502 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ext4: clear stale xarray tags on folios skipped during writeback In data=journal mode, th… | |
CVE-2026-92501 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ext4: drain in-flight DIO before buffered write fallback generic/746 started failing inte… | |
CVE-2026-92500 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ext4: use fsdata to track inline data write state and fix race Instead of checking the li… |