2026 CVEs (page 106)
Page 106 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-89536 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake callback xs_tls_handshake_sync() gives xs… |
CVE-2026-89535 | High | 8.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id svc_rdma_free() caches rdma… |
CVE-2026-89534 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails When svc_rdma_listen_handler()… |
CVE-2026-89533 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in read_chunk_range svc_rdma_read_chunk_range() walks a Re… |
CVE-2026-89532 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix pcl_for_each_segment for empty chunks When a parsed chunk list contains a ch… |
CVE-2026-89531 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject connection when transport allocation fails handle_connect_req() returns w… | |
CVE-2026-89530 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client c… |
CVE-2026-89529 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject oversized Read segments at decode time The RPC/RDMA Read list decoder sto… | |
CVE-2026-89528 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Read lists that exceed the page budget Individual Read segment lengths ar… |
CVE-2026-89527 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svc_xprt_put to free listener on create failure svc_rdma_create() calls kfre… | |
CVE-2026-89526 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk posi… |
CVE-2026-89525 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses… | |
CVE-2026-89524 | High | 8.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6kl_c… |
CVE-2026-89523 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel pending mlo_pm_work If the device is reset, suspended or unreg… |
CVE-2026-89522 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: media: staging/ipu7: fix async notifier UAF on probe error path isys_register_devices() r… |
CVE-2026-89521 | High | 7.3 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sched/core: Handle pick_task() releasing the rq lock Core scheduling's pick_next_task() b… |
CVE-2026-89520 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sched/core: Make core-sched flips wait for in-flight selections Core scheduling's pick_ne… |
CVE-2026-89519 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return SCX_RQ_BAL_KEEP tells t… | |
CVE-2026-89518 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix this_rq() assumptions in dispatch kfuncs Under core scheduling, dispatch r… | |
CVE-2026-89517 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix rq->core_pick corruption under core scheduling Core scheduling's pick_next… | |
CVE-2026-89516 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users scx_bpf_dsq_reenq… | |
CVE-2026-89515 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() During fuzz testing, the f… | |
CVE-2026-89514 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock fnic_fcoe_process_vlan_resp() al… | |
CVE-2026-89513 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENT_GET_INFO stores guest-c… |
CVE-2026-89512 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Make sure to drop the referen… | |
CVE-2026-89511 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: qede: Fix NULL pointer dereference in TPA fragment processing Under memory pressure, the… |
CVE-2026-89510 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel reg_work before freeing device on remove c4iw_uld_state_change() queue… |
CVE-2026-89509 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdma_counter allocation Commit 7e53b31acc7f ("RD… | |
CVE-2026-89508 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma_set_ib_path() ucma_set_ib_path() calls ucma_event_han… |
CVE-2026-89507 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma_write_cm_event() ctx->file may only be changed under… |
CVE-2026-89506 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR The original commit missed that… | |
CVE-2026-89505 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Guard legacy bundles without method_elm The legacy write() path dispatches t… | |
CVE-2026-89504 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_nod… |
CVE-2026-89503 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() ring_buffer_alloc_… |
CVE-2026-89502 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Free cpu_buffer::free_page with subbuf_order When sub-buffers use an order g… | |
CVE-2026-89501 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf Because, ring_buffer_subbuf_ord… |
CVE-2026-89500 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page Discarding a cached reade… |
CVE-2026-89499 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Stop remote reader update when page swap fails The remote swap_reader_page c… |
CVE-2026-89498 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailer_buf on readdir copy failure On a readdir downcall, o… | |
CVE-2026-89497 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: orangefs: skip leading spaces before parsing client debug masks orangefs_prepare_cdm_arra… |
CVE-2026-89496 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: always run deallocs on copy-on-write completion Local fuzzing of 6.12.94 has found… | |
CVE-2026-89495 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlm_migrate_request_handler Patch series "ocfs2/dlm: bound peer-c… |
CVE-2026-89494 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlm_mig_lockres_handler A node receiving a DLM_MIG_LOCKRES mes… |
CVE-2026-89493 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rl_used against rl_count in refcount block validator ocfs2_find_refcount_… |
CVE-2026-89492 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2_validate_dx_leaf… |
CVE-2026-89491 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() Patch serie… | |
CVE-2026-89490 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix readdir position truncation on 32-bit kernels In ocfs2_dir_foreach_blk_el(), t… | |
CVE-2026-89489 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: openrisc: fix arbitrary kernel memory access via or1k_atomic syscall sys_or1k_atomic() (s… |
CVE-2026-89488 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state u… |
CVE-2026-89487 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skb_tx_error() a packet we are about to drop queue_userspace_packet() b… |
CVE-2026-89486 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() Commit 9e91f8a6c868 ("ipmi:m… |
CVE-2026-89485 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file across nlm_inspect_file lock-drop nlm_traverse_files() pins the curr… |
CVE-2026-89484 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: lockd: fix NULL dereference on lockowner allocation failure nlmclnt_locks_init_private()… | |
CVE-2026-89483 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvme_setup_discard() always maps sizeof(struct nvme_… |
CVE-2026-89482 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone Commit 25e5cb780e62… |
CVE-2026-89481 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme_tcp_handle_r2t() does… |
CVE-2026-89480 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvme_tcp_recv_data() completes a r… |
CVE-2026-89479 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctp_endpoint_bh_rcv() loo… |
CVE-2026-89478 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctp_rcv() resolves the transport once pe… |
CVE-2026-89477 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctp_process_strreset_outreq(), s… |
CVE-2026-89476 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream->outcnt underflow on duplicate RECONF responses A cached RECONF chunk ma… |
CVE-2026-89475 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-manag… | |
CVE-2026-89474 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: bq256xx: drain usb_work before freeing the charger The USB-PHY notifier qu… | |
CVE-2026-89473 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix power_supply reference leak bq25890_fw_probe() acquires a ref… | |
CVE-2026-89472 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: register regulators before exposing sysfs charger_manager… |
CVE-2026-89471 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: cros_usbpd-charger: bound the EC-reported port count cros_usbpd_charger_pr… |
CVE-2026-89470 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Currently the cros_us… |
CVE-2026-89469 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix use-after-free in lp8727_release_irq() lp8727_isr_func(), the… |
CVE-2026-89468 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8788-charger: fix use-after-free on remove lp8788_charger_remove() flush… | |
CVE-2026-89467 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: qcom_battmgr: fix use-after-free qcom_battmgr_pdr_notify() queues enable_w… | |
CVE-2026-89466 | High | 7.7 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: qcom_battmgr: terminate the strings from firmware The qcom_battmgr_sc8280x… |
CVE-2026-89465 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: quiesce delayed work before teardown The threaded IRQ handler can… |
CVE-2026-89464 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: twl4030_charger: cancel workers via devm bci is devm-allocated. Two worker… | |
CVE-2026-89463 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: ucs1002: fix use-after-free on remove ucs1002 has no remove callback, so u… | |
CVE-2026-89462 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: propagate register read errors max17040_get_vcell() and max17040… | |
CVE-2026-89461 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: synchronize work cancellation on suspend max17040_work() requeue… | |
CVE-2026-89460 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cyc… | |
CVE-2026-89459 | High | 7.0 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: s390/percpu: Fix MVIY_PERCPU() with older binutils Commit a737737cdb9c ("s390/percpu: Inf… |
CVE-2026-89458 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Do not complete a failed ESE read as successful dasd_int_handler() completes a… | |
CVE-2026-89457 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Guard sysfs discipline callbacks against unallocated private data Several sysf… | |
CVE-2026-89456 | High | 7.0 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Propagate partial completion length across ERP recovery dasd_default_erp_posta… |
CVE-2026-89455 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Fix use-after-free of event IRQs during teardown plda_pcie_irq_domain_deinit()… | |
CVE-2026-89454 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() plda_init_in… | |
CVE-2026-89453 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommu_call_iopf_notifier() looks up t… | |
CVE-2026-89452 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommu/msm: Unwind probe state on registration failure msm_iommu_probe() adds its devm-man… |
CVE-2026-89451 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle->dev before the SVA handle is visible iommu_attach_device_pasid() i… | |
CVE-2026-89450 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field tegra241_vintf_init_vs… |
CVE-2026-89449 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add iommu_moc… | |
CVE-2026-89448 | Critical | 9.3 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of reques… |
CVE-2026-89447 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Avoid locking internal accesses during unmap iommufd_access_notify_unmap() skips… | |
CVE-2026-89446 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Release current IOAS on xa_store() failure iommufd_take_all_iova_rwsem() takes a… | |
CVE-2026-89445 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGER_IOPF borrows an atta… |
CVE-2026-89444 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer set_attribute() p… | |
CVE-2026-89443 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isst_if_get_perf_level_mask() and… |
CVE-2026-89442 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in clos_assoc ioctl isst_if_clos_assoc() validates… |
CVE-2026-89441 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: cancel card-detect work on remove Disabling the device interrupt and free… |
CVE-2026-89440 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: stop card-detect handling on probe failure request_irq() registers the SD… |
CVE-2026-89439 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Add a NULL check for sst_inst[] To be consistent with other places, a… | |
CVE-2026-89438 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical… | |
CVE-2026-89437 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: int1092: Fix potential memory leak in sar_probe() The memory allocated for… |