2026 CVEs (page 107)
Page 107 of 664 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-89517 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix rq->core_pick corruption under core scheduling Core scheduling's pick_next… | |
CVE-2026-89516 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users scx_bpf_dsq_reenq… | |
CVE-2026-89515 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() During fuzz testing, the f… | |
CVE-2026-89514 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock fnic_fcoe_process_vlan_resp() al… | |
CVE-2026-89513 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENT_GET_INFO stores guest-c… |
CVE-2026-89512 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Make sure to drop the referen… | |
CVE-2026-89511 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: qede: Fix NULL pointer dereference in TPA fragment processing Under memory pressure, the… |
CVE-2026-89510 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel reg_work before freeing device on remove c4iw_uld_state_change() queue… |
CVE-2026-89509 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdma_counter allocation Commit 7e53b31acc7f ("RD… | |
CVE-2026-89508 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma_set_ib_path() ucma_set_ib_path() calls ucma_event_han… |
CVE-2026-89507 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma_write_cm_event() ctx->file may only be changed under… |
CVE-2026-89506 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR The original commit missed that… | |
CVE-2026-89505 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Guard legacy bundles without method_elm The legacy write() path dispatches t… | |
CVE-2026-89504 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_nod… |
CVE-2026-89503 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() ring_buffer_alloc_… |
CVE-2026-89502 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Free cpu_buffer::free_page with subbuf_order When sub-buffers use an order g… | |
CVE-2026-89501 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf Because, ring_buffer_subbuf_ord… |
CVE-2026-89500 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page Discarding a cached reade… |
CVE-2026-89499 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Stop remote reader update when page swap fails The remote swap_reader_page c… |
CVE-2026-89498 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailer_buf on readdir copy failure On a readdir downcall, o… | |
CVE-2026-89497 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: orangefs: skip leading spaces before parsing client debug masks orangefs_prepare_cdm_arra… |
CVE-2026-89496 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: always run deallocs on copy-on-write completion Local fuzzing of 6.12.94 has found… | |
CVE-2026-89495 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlm_migrate_request_handler Patch series "ocfs2/dlm: bound peer-c… |
CVE-2026-89494 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlm_mig_lockres_handler A node receiving a DLM_MIG_LOCKRES mes… |
CVE-2026-89493 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rl_used against rl_count in refcount block validator ocfs2_find_refcount_… |
CVE-2026-89492 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2_validate_dx_leaf… |
CVE-2026-89491 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() Patch serie… | |
CVE-2026-89490 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix readdir position truncation on 32-bit kernels In ocfs2_dir_foreach_blk_el(), t… | |
CVE-2026-89489 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: openrisc: fix arbitrary kernel memory access via or1k_atomic syscall sys_or1k_atomic() (s… |
CVE-2026-89488 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state u… |
CVE-2026-89487 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skb_tx_error() a packet we are about to drop queue_userspace_packet() b… |
CVE-2026-89486 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() Commit 9e91f8a6c868 ("ipmi:m… |
CVE-2026-89485 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file across nlm_inspect_file lock-drop nlm_traverse_files() pins the curr… |
CVE-2026-89484 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: lockd: fix NULL dereference on lockowner allocation failure nlmclnt_locks_init_private()… | |
CVE-2026-89483 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvme_setup_discard() always maps sizeof(struct nvme_… |
CVE-2026-89482 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone Commit 25e5cb780e62… |
CVE-2026-89481 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme_tcp_handle_r2t() does… |
CVE-2026-89480 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvme_tcp_recv_data() completes a r… |
CVE-2026-89479 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctp_endpoint_bh_rcv() loo… |
CVE-2026-89478 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctp_rcv() resolves the transport once pe… |
CVE-2026-89477 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctp_process_strreset_outreq(), s… |
CVE-2026-89476 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream->outcnt underflow on duplicate RECONF responses A cached RECONF chunk ma… |
CVE-2026-89475 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-manag… | |
CVE-2026-89474 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: bq256xx: drain usb_work before freeing the charger The USB-PHY notifier qu… | |
CVE-2026-89473 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix power_supply reference leak bq25890_fw_probe() acquires a ref… | |
CVE-2026-89472 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: register regulators before exposing sysfs charger_manager… |
CVE-2026-89471 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: cros_usbpd-charger: bound the EC-reported port count cros_usbpd_charger_pr… |
CVE-2026-89470 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Currently the cros_us… |
CVE-2026-89469 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix use-after-free in lp8727_release_irq() lp8727_isr_func(), the… |
CVE-2026-89468 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8788-charger: fix use-after-free on remove lp8788_charger_remove() flush… | |
CVE-2026-89467 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: qcom_battmgr: fix use-after-free qcom_battmgr_pdr_notify() queues enable_w… | |
CVE-2026-89466 | High | 7.7 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: qcom_battmgr: terminate the strings from firmware The qcom_battmgr_sc8280x… |
CVE-2026-89465 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: quiesce delayed work before teardown The threaded IRQ handler can… |
CVE-2026-89464 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: twl4030_charger: cancel workers via devm bci is devm-allocated. Two worker… | |
CVE-2026-89463 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: ucs1002: fix use-after-free on remove ucs1002 has no remove callback, so u… | |
CVE-2026-89462 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: propagate register read errors max17040_get_vcell() and max17040… | |
CVE-2026-89461 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: synchronize work cancellation on suspend max17040_work() requeue… | |
CVE-2026-89460 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cyc… | |
CVE-2026-89459 | High | 7.0 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: s390/percpu: Fix MVIY_PERCPU() with older binutils Commit a737737cdb9c ("s390/percpu: Inf… |
CVE-2026-89458 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Do not complete a failed ESE read as successful dasd_int_handler() completes a… | |
CVE-2026-89457 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Guard sysfs discipline callbacks against unallocated private data Several sysf… | |
CVE-2026-89456 | High | 7.0 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Propagate partial completion length across ERP recovery dasd_default_erp_posta… |
CVE-2026-89455 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Fix use-after-free of event IRQs during teardown plda_pcie_irq_domain_deinit()… | |
CVE-2026-89454 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() plda_init_in… | |
CVE-2026-89453 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommu_call_iopf_notifier() looks up t… | |
CVE-2026-89452 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommu/msm: Unwind probe state on registration failure msm_iommu_probe() adds its devm-man… |
CVE-2026-89451 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle->dev before the SVA handle is visible iommu_attach_device_pasid() i… | |
CVE-2026-89450 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field tegra241_vintf_init_vs… |
CVE-2026-89449 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add iommu_moc… | |
CVE-2026-89448 | Critical | 9.3 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of reques… |
CVE-2026-89447 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Avoid locking internal accesses during unmap iommufd_access_notify_unmap() skips… | |
CVE-2026-89446 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Release current IOAS on xa_store() failure iommufd_take_all_iova_rwsem() takes a… | |
CVE-2026-89445 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGER_IOPF borrows an atta… |
CVE-2026-89444 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer set_attribute() p… | |
CVE-2026-89443 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isst_if_get_perf_level_mask() and… |
CVE-2026-89442 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in clos_assoc ioctl isst_if_clos_assoc() validates… |
CVE-2026-89441 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: cancel card-detect work on remove Disabling the device interrupt and free… |
CVE-2026-89440 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: stop card-detect handling on probe failure request_irq() registers the SD… |
CVE-2026-89439 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Add a NULL check for sst_inst[] To be consistent with other places, a… | |
CVE-2026-89438 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical… | |
CVE-2026-89437 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: int1092: Fix potential memory leak in sar_probe() The memory allocated for… | |
CVE-2026-89436 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[] acpi_pcc_retrieve_bio… |
CVE-2026-89332 | Medium | 5.5 | 2026-09-11 | Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthentic… |
CVE-2026-81916 | Medium | 4.3 | 2026-09-11 | Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identi… |
CVE-2026-81915 | Medium | 5.3 | 2026-09-11 | Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit() dashboard controller loaded and… |
CVE-2026-81913 | Medium | 6.1 | 2026-09-11 | Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain… |
CVE-2026-81912 | Medium | 5.7 | 2026-09-11 | Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm() endp… |
CVE-2026-81911 | Medium | 5.4 | 2026-09-11 | Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The custom_slot save_template endpoint authorizes the request onl… |
CVE-2026-81018 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Free system certificate signatures Multi-certificate support als… | |
CVE-2026-81017 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carrie… |
CVE-2026-81016 | High | 7.7 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Propagate SMU errors and validate S2D address amd_stb_s2d_init() di… |
CVE-2026-81015 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails amd_pmc_probe() regi… |
CVE-2026-81014 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() sk_store() and… | |
CVE-2026-81013 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validate_password_inp… | |
CVE-2026-81012 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() hp_get_stri… |
CVE-2026-81011 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type pa… |
CVE-2026-81010 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: honor task_work cancellation io_waitid_cb() may run through the fallback… |
CVE-2026-81009 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: io_uring/query: cap user size passed to copy_struct_to_user io_handle_query_entry() clamp… | |
CVE-2026-81008 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: interconnect: Fix use after free in icc_get() and of_icc_get_by_index() In of_icc_get_by_… |
CVE-2026-81007 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmb_write() read message fields before validat… |