2026 CVEs (page 105)
Page 105 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-89636 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce->tgthint in free_tgts() When free_tgts() frees all structures in ce… |
CVE-2026-89635 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: only rebind the reopened file's own oplock on durable reconnect ksmbd_reopen_durab… |
CVE-2026-89634 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN() overflow in symlink_data() error context loop The check added by… |
CVE-2026-89633 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() coalesce_t2(… |
CVE-2026-89632 | High | 8.2 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() reparse_buf_p… |
CVE-2026-89631 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon() boun… |
CVE-2026-89630 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the data_offset bound in is_valid_oplock_break() Commit 83bfbd0bb902… |
CVE-2026-89629 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Check size of status and firmware events before reading them Malformed… | |
CVE-2026-89628 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcd_debug_eeprom_r… | |
CVE-2026-89627 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: roccat: free buffered reports when destroying device roccat_report_event() duplicate… | |
CVE-2026-89626 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix field sysfs group cleanup on failure hid_sensor_custom_add_attri… |
CVE-2026-89625 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind For GHL (Guitar Hero Live… | |
CVE-2026-89624 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: universal-pidff: stop the device when force-feedback init fails universal_pidff_prob… |
CVE-2026-89623 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: stop device IO before hid_hw_stop Quiesce device IO at the start of the dev… | |
CVE-2026-89622 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcp_i2c_smbus_read() stores… |
CVE-2026-89621 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221_raw_event() mcp2221_raw_event() never valid… | |
CVE-2026-89620 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy write_cmd_to_txdma()… |
CVE-2026-89619 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer quicks… |
CVE-2026-89618 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: eventfs: Initialize ei->children and ei->list in init_ei() eventfs_create_dir() allocates… | |
CVE-2026-89617 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log replay Each DIR_PAGE_ENTRY ends in a page_lcns… |
CVE-2026-89616 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() ni_read_frame() dec… |
CVE-2026-89615 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound page_lcns[] index by the log record The copy_lcns loop and the redo short… |
CVE-2026-89614 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol->lcn_empty_bits_per_page is si… |
CVE-2026-89613 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if… |
CVE-2026-89612 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MF… |
CVE-2026-89611 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfs_attr_update_meta() shifts the attribut… |
CVE-2026-89610 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ntfs: verify run length exceeding volume boundary The mapping pairs decoder validates tha… |
CVE-2026-89609 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ecryptfs: hold msg ctx list lock when cleaning daemon queue ecryptfs_exorcise_daemon() dr… |
CVE-2026-89608 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ecryptfs: pass packet set buffer size to parser ecryptfs_parse_packet_set() receives a po… |
CVE-2026-89607 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet parse_tag_3_packet()… |
CVE-2026-89606 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject too-small tag 70 packets ecryptfs_parse_tag_70_packet() subtracts fixed… |
CVE-2026-89605 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ecryptfs: release message context on send failure ecryptfs_send_message_locked() moves a… |
CVE-2026-89604 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: efivarfs: Rate limit statfs() handler Ravi reports that statfs() may be called by unprivi… | |
CVE-2026-89603 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: entry: Fix seccomp bypass after ptrace with TSYNC Sashiko review pointed out the followin… |
CVE-2026-89602 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: erofs: skip sufficiently large global buffers when resizing z_erofs_gbuf_nrpages is advan… |
CVE-2026-89601 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ext2: Fix lost inode updates for IS_SYNC inodes ext2_setsize() and ext2_xattr_set2() had… |
CVE-2026-89600 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fanotify: fix use-after-free of file range info fsnotify_pre_content() builds its file_ra… |
CVE-2026-89599 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: panel-dsi-cm: initialize lock before registering display dsicm_probe() reg… |
CVE-2026-89598 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fbdev: ssd1307fb: defer I2C transfers from damage callbacks The fbdev damage callbacks ma… | |
CVE-2026-89597 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fbdev: uvesafb: unregister connector callback on init failure uvesafb_init() registers th… |
CVE-2026-89596 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nv_suspend() and nv_… |
CVE-2026-89595 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fsnotify: Fix stale object mask after concurrent mark updates When a mark gets a new even… | |
CVE-2026-89594 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device The OMAP SSI dri… |
CVE-2026-89593 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: hugetlb: only adjust reservation during unmapping if mapcount is 0 Since df7a6d1f6405, __… |
CVE-2026-89592 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix NULL dereference and integer overflow in rocket_job_push() rocket_job_p… | |
CVE-2026-89591 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: accel/rocket: initialize job domain before cleanup paths rocket_ioctl_submit_job() releas… | |
CVE-2026-89590 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocket_job_run() In rocket_job_run(), after taki… | |
CVE-2026-89589 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks The CXL CPER work registration… | |
CVE-2026-89588 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In ghes_handle_arm_hw_er… |
CVE-2026-89587 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ACPI: pfr_update: fix stack buffer overflow in query_capability() query_capability() copi… |
CVE-2026-89586 | High | 8.2 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes ata_scsi_write_sam… |
CVE-2026-89585 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: auxdisplay: charlcd: cancel backlight work on registration failure With CONFIG_CHARLCD_BL… |
CVE-2026-89584 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: block: validate user space vectors during extraction The bio-based drivers don't necessar… |
CVE-2026-89583 | High | 8.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eir_get_service_data() eir_get_service_data() walks the a… |
CVE-2026-89582 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix double free in bnx2x_init_firmware() error path bnx2x_init_firmware() frees bp… | |
CVE-2026-89581 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an extended register The destination of the… |
CVE-2026-89580 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in __bpf_get_stack get_perf_callchain() returns a per-CPU perf_ca… |
CVE-2026-89579 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloom_map_alloc() has two… |
CVE-2026-89578 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: dm-io: clone the source bio instead of copying its biovec For DM_IO_BIO requests, do_regi… | |
CVE-2026-89577 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: dm-io: report non-retryable errors separatedly The error codes BLK_STS_NOTSUPP and BLK_ST… | |
CVE-2026-89576 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: dm-era: fix shadowed superblock leak on take-snap failure metadata_take_snap() bumps the… | |
CVE-2026-89575 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: dm raid1: reserve space for NUL-terminator in build_constructor_string() Reserve space fo… | |
CVE-2026-89574 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read array_block_check() validates blocknr and… |
CVE-2026-89573 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's array_block_check()… |
CVE-2026-89572 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: apple-soc: Fix OPP table cleanup apple_soc_cpufreq_init() adds OPP tables from f… | |
CVE-2026-89571 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: cxl/features: bound fwctl command payload to the input buffer fwctl_cmd_rpc() copies cmd-… |
CVE-2026-89570 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the… |
CVE-2026-89569 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcomm_security_cfm() looks u… |
CVE-2026-89568 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: kho: fix size calculation in kho_preserved_memory_reserve() kho_preserved_memory_reserve(… | |
CVE-2026-89567 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: jbd2: bound shrinker scans by examined checkpoint buffers The jbd2 shrinker currently acc… | |
CVE-2026-89566 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: jbd2: check need_resched() when skipping busy checkpoint buffers journal_shrink_one_cp_li… | |
CVE-2026-89565 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collect_md mode when metadata_dst allocation fails In collect_md mo… | |
CVE-2026-89564 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ip: orphan prefetched skbs before multicast forwarding IPv4 and IPv6 input preserve an sk… |
CVE-2026-89563 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() ip6_tnl_xmit() may need to expand headro… |
CVE-2026-89562 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ip6_gre: fix hardware header length for NBMA tunnels ip6gre_tnl_link_config_route() accum… |
CVE-2026-89561 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() ipv6_rpl_srh_rcv() derefere… |
CVE-2026-89560 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation Whiteout objects are… |
CVE-2026-89559 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in __nd_label_validate() The on-media namespac… |
CVE-2026-89558 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix still_degraded being inverted in raid10_sync_request() Commit fe6a19d40ceb… |
CVE-2026-89557 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: md: do overflow check for sb->bblog_shift in super_1_load() In super_1_load(), sb->bblog_… |
CVE-2026-89556 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elf_validity_cache_sechdrs, section sizes… | |
CVE-2026-89555 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mpls: reload header after pskb_may_pull() mpls_select_multipath() calls mpls_multipath_ha… |
CVE-2026-89554 | High | 8.2 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction mptcp_token_join_co… |
CVE-2026-89553 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nouveau/gem: reserve the bo in the info ioctl around the vma lookup In the non-uvmm path… |
CVE-2026-89552 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: params: fix charp corruption on allocation failure param_set_charp() stores charp paramet… | |
CVE-2026-89551 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow xdr_buf_trim() trims `len` bytes… |
CVE-2026-89550 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: enforce krb5 token minimum length svcauth_gss_unwrap_priv() validate… |
CVE-2026-89549 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svc_pool_for_cpu() svc_set_num_threads() spreads the… |
CVE-2026-89548 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cache_cleaner before destroying a cache_detail sunrpc_destroy_cache_… |
CVE-2026-89547 | High | 8.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation __svc_create() initializes three per-poo… |
CVE-2026-89546 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can co… |
CVE-2026-89545 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rq_argp and rq_resp free until after RCU grace period svc_rqst_free() frees… |
CVE-2026-89544 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssx_dec_option_array error path bugs Four coupled defects in the gssx XDR op… |
CVE-2026-89543 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir Norma… | |
CVE-2026-89542 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens gss_krb5_unwrap_v2() reads the EC… |
CVE-2026-89541 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_unwrap_resp_priv length checks gss_unwrap_resp_priv() validates the RP… |
CVE-2026-89540 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sunrpc: init gssp_lock before publishing proc entry create_use_gss_proxy_proc_entry() pub… |
CVE-2026-89539 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: reject duplicate CREDS_VALUE options gssx_dec_option_array() walks the wire-suppl… | |
CVE-2026-89538 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field gss_krb5_unwrap_v2() sets buf-… |
CVE-2026-89537 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 gss_krb5_verify_mic_v2… |