2026 CVEs (page 104)
Page 104 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-89736 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_audio: Fix use-after-free on sound card disconnect g_audio_cleanup() invok… |
CVE-2026-89735 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: remove default configfs groups on teardown f_midi2_alloc_inst() creat… | |
CVE-2026-89734 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init() In uvcg_video_init()… | |
CVE-2026-89733 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() … |
CVE-2026-89732 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Prevent deadlock during ep0 read loop Currently, ffs_ep0_read() holds… | |
CVE-2026-89731 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read cxl_rch_get_aer_info(… |
CVE-2026-89730 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write The trailing byte path… | |
CVE-2026-89729 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature sensor_hub_get_feature… |
CVE-2026-89728 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Fix out-of-bounds access for newdevs mask When software initiates DAA (Dyna… | |
CVE-2026-89727 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID vgic_v2_deactivate() passes… | |
CVE-2026-89726 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Patch series "lib/ucs2_string… | |
CVE-2026-89725 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: media: cec: stm32: prevent out-of-bounds write on RX overflow stm32_rx_done() appends eac… |
CVE-2026-89724 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: media: vicodec: fix out-of-bounds write in FWHT encoder vidioc_s_fmt_vid_out() sizes the… |
CVE-2026-89723 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Shuangpeng Bai… |
CVE-2026-89722 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() pci_write_legacy_io() loads 4… | |
CVE-2026-89721 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: phy: rockchip-samsung-dcphy: fix out-of-range max_register The PHY register block is 64KB… | |
CVE-2026-89720 | High | 7.7 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ubifs: fix out-of-bounds read in signature length check ubifs_sb_verify_signature() bound… |
CVE-2026-89719 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in read_block_state() read_block_state() calculates nr_pag… | |
CVE-2026-89718 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in writeback_store() Patch series "zram: fix stale scan bo… | |
CVE-2026-89717 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: zram: set default primary compressor in zram_destroy_comps() Patch series "zram: fix zram… | |
CVE-2026-89716 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: zram: validate deflate params We must validate user-supplied deflate winbits before we pa… | |
CVE-2026-89715 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfs_uuid_add_file failure When nfs_uuid_add_file() races wit… | |
CVE-2026-89714 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails nfs4_server_com… | |
CVE-2026-89713 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsd_setattr() checks whether a size upd… |
CVE-2026-89712 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock nfsd4_ssc_expire_umount… |
CVE-2026-89711 | High | 8.2 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check The header for commit e75b23f9e323… |
CVE-2026-89710 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path When the server… | |
CVE-2026-89709 | High | 8.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvc_ops dispatch nlmsvc_ops is published by nfsd_lockd_init()… |
CVE-2026-89708 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown After a DESTROY… |
CVE-2026-89707 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on follow_down() error nfsd_cross_mnt() initializes a local struc… |
CVE-2026-89706 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY writeback fails Async COPY captures nn->writev… |
CVE-2026-89705 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths nfsd_dispatch()… |
CVE-2026-89704 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop _nfsd_copy_file_range() sample… |
CVE-2026-89703 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations nfsd4_drop_revoked_s… |
CVE-2026-89702 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: size fh_verify server sockaddr slot by xpt_locallen The nfsd_fh_verify and nfsd_fh_… |
CVE-2026-89701 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIME_DELEG decode paths The xdrgen-based TIME_DELEG_ACCESS and… | |
CVE-2026-89700 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: validate sockaddr length per family in listener_set nfsd_sock_nl_policy declares NF… | |
CVE-2026-89699 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4_decode_create() accepts an unb… |
CVE-2026-89698 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage struct nfsd_genl_rqstp dec… | |
CVE-2026-89697 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() The BOTH_TIME… |
CVE-2026-89696 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIG_NFSD_V4_… |
CVE-2026-89695 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4_decode_posixacl() reads a u32… |
CVE-2026-89694 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOAD_CANCEL… | |
CVE-2026-89693 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create() nfsd4_create() stores the… | |
CVE-2026-89692 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: clear CALLBACK_RUNNING on failed delegation recall queue nfsd_break_one_deleg() set… |
CVE-2026-89691 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4_release_compoundargs(… |
CVE-2026-89690 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpc_status UAF The rpc_status netlink dumpit wal… |
CVE-2026-89689 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: don't free session slots that are still in use nfsd4_sequence() can free the very s… |
CVE-2026-89688 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry In nfs4_preprocess_s… |
CVE-2026-89687 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file ->atomic_open is permi… |
CVE-2026-89686 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke nfsd4_alloc_la… |
CVE-2026-89685 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix clock domain mismatch in clients_still_reclaiming() clients_still_reclaiming()… |
CVE-2026-89684 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4_init_cp_state nfs4_alloc_init_cpntf_state() publishe… |
CVE-2026-89683 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup nfsd_set_fh_dentry() leaks t… | |
CVE-2026-89682 | High | 8.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net nfsd_file_dispose_l… |
CVE-2026-89681 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix layout fence worker double-reference race The workqueue core clears WORK_STRUCT… |
CVE-2026-89680 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd_file leak on inter-server COPY setup failure When nfsd4_setup_inter_ssc()… |
CVE-2026-89679 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs When a SETATTR requ… |
CVE-2026-89678 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix partial-write detection in nfsd_direct_write nfsd_direct_write() walks a list o… |
CVE-2026-89677 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file() dentry_create() can… |
CVE-2026-89676 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY For an async COPY, nfsd4_copy()… |
CVE-2026-89675 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An async copy could be freed or used afte… |
CVE-2026-89674 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget The XDR buffer size calcula… |
CVE-2026-89673 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo nfsd4_ff_encode_getdeviceinf… | |
CVE-2026-89672 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp->mask The NFSACL v2 SETACL path shares the decoder convent… |
CVE-2026-89671 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs3 setacl by argp->mask nfsd3_proc_setacl() calls set_posix_acl() unconditio… |
CVE-2026-89670 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: hold rcu across localio cmpxchg retry nfsd_file objects are freed via call_rcu (fil… |
CVE-2026-89669 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4_copy_notify() finished in… |
CVE-2026-89668 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd() nfsd_debugfs_init(… |
CVE-2026-89667 | High | 8.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache The shrinker, GC w… |
CVE-2026-89666 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an N… | |
CVE-2026-89665 | High | 8.2 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder conver… |
CVE-2026-89664 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: release OPEN-decoded posix ACLs via op_release nfsd4_decode_createhow4() calls nfsd… |
CVE-2026-89663 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before dropping their reference Copy-notify stateids li… |
CVE-2026-89662 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown __destroy_client() release… |
CVE-2026-89661 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent post-shutdown use-after-free in unlock_filesystem Writing a filesystem path… | |
CVE-2026-89660 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a… |
CVE-2026-89659 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds o… |
CVE-2026-89658 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup nfs40_clean_admi… |
CVE-2026-89657 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: libceph: validate OSD extent maps before cursor advance net/ceph/osd_client.c:osd_sparse_… |
CVE-2026-89656 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crush_decode() stores bucket data by ar… |
CVE-2026-89655 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock list_for_each_ent… |
CVE-2026-89654 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in check_new_map() on session freed during unlock check_new_map() iterates… |
CVE-2026-89653 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode MDSMap export_targets… |
CVE-2026-89652 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export get_name ceph_get_name() copies the M… |
CVE-2026-89651 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fs_name decode in handle_session() handle_session() decod… |
CVE-2026-89650 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: bound num_export_targets array for mds info v2/v3 ceph_mdsmap_decode() in fs/ceph/m… |
CVE-2026-89649 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in __build_xattrs() __build_xattrs() decodes the MDS-suppl… |
CVE-2026-89648 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in ceph_parse_deleg_inos() ceph_parse_deleg_inos() decode… |
CVE-2026-89647 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: do not repeat ceph_trim_dentries() if no progress possible ceph_cap_reclaim_work()… |
CVE-2026-89646 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount ceph_dirty_folio() takes a… |
CVE-2026-89645 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: btrfs: drop recovered reloc root refs on recovery failure During relocation recovery, eac… | |
CVE-2026-89644 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map leak in NOCOW direct I/O write btrfs_dio_iomap_begin() calls btrfs_… | |
CVE-2026-89643 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: audit: avoid dropping live tree ref on fsnotify rule autoremove audit_del_rule() is used… |
CVE-2026-89642 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: cifs: call pagecache_isize_extended() in cifs_setsize() when extending cifs_setsize() cal… | |
CVE-2026-89641 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() When the else branch of… |
CVE-2026-89640 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 With len == 0 (clone… |
CVE-2026-89639 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC cifs_do_truncate() is… |
CVE-2026-89638 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions W… |
CVE-2026-89637 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 Wh… |