2026 CVEs (page 114)
Page 114 of 452 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-64030 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs IEEE80211_MLE_STA_EPCS_CONTROL_… |
CVE-2026-64029 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize UMP output teardown with event_input seq_ump_process_event() borrows… |
CVE-2026-64028 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: tracing: Avoid NULL return from hist_field_name() on truncation hist_field_name() returns… | |
CVE-2026-64027 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: shaper: rework the VALID marking (again) Recent commit changed the semantics from NO… |
CVE-2026-64026 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg This improves th… |
CVE-2026-64025 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx sk_psock_strp_data_ready() alre… |
CVE-2026-64024 | Critical | 9.4 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction Blamed commit moved the TI… |
CVE-2026-64023 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: fix a potential use-after-free On error we free aggr->lookups->dev_id b… |
CVE-2026-64022 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: remove the software node when deactivating the aggregator The dynamic s… | |
CVE-2026-64021 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix exec_queue leak on width check in stream open In xe_oa_stream_open_ioctl()… | |
CVE-2026-64020 | High | 7.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma_vecs leak on p2p memory We don't unmap P2P memory, so we don't need to… |
CVE-2026-64019 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma mapping leak on data setup error We're leaking the initial DMA mapping… | |
CVE-2026-64018 | Critical | 9.3 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rx_req_idx to prevent out-of-bounds array access In mana_hwc_rx_event… |
CVE-2026-64017 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task s… |
CVE-2026-64016 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifetime After a durable reconnect succeeds… |
CVE-2026-64015 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: security/keys: fix missed RCU read section on lookup Nicholas Carlini reports that the ke… |
CVE-2026-64014 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size nexio_read_data() p… | |
CVE-2026-64013 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ACPI: button: Fix ACPI GPE handler leak during removal Commit a7e23ec17fee ("ACPI: button… | |
CVE-2026-64012 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked When s… | |
CVE-2026-64011 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free in llcp_sock_release() llcp_sock_release() unconditionally… |
CVE-2026-64010 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() A race condition exists in the N… |
CVE-2026-64009 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: xfrm: Check for underflow in xfrm_state_mtu Leo Lin reported OOB write issue in esp compo… |
CVE-2026-64008 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in create_bo rocket_ioctl_create_bo() inser… |
CVE-2026-64007 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() re… |
CVE-2026-64006 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix dst corruption in same register operation For lshift and rshift… | |
CVE-2026-64005 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net/smc: Do not re-initialize smc hashtables INIT_HLIST_HEAD(&smc_v*_hashinfo.ht) are cal… |
CVE-2026-64004 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix locking in .getsockopt Mirror iucv_sock_setsockopt() and wrap the whole swi… |
CVE-2026-64003 | High | 7.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues While a SCS… |
CVE-2026-64002 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() ipv4… |
CVE-2026-64001 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix setup list UAF on proc write error snd_pcm_oss_proc_write() links a n… | |
CVE-2026-64000 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix potential OOB access in supervision frame handling Ensure the entire TLV he… |
CVE-2026-63999 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure rss_prepare_get() allocat… | |
CVE-2026-63998 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ethtool: module: call ethnl_ops_complete() on module flash errors When validate() fails w… | |
CVE-2026-63997 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ethtool: module: avoid leaking a netdev ref on module flash errors module_flash_fw_schedu… | |
CVE-2026-63996 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpl… |
CVE-2026-63995 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate start_cmd_payload_size from module The CMIS firmware update code… |
CVE-2026-63994 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko… |
CVE-2026-63993 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() skb_tunnel_check_… |
CVE-2026-63992 | Critical | 9.1 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() In some cases, ipt… |
CVE-2026-63991 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() The skb_clone() fu… | |
CVE-2026-63990 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: bonding: refuse to enslave CAN devices syzbot reported a kernel paging request crash in c… | |
CVE-2026-63989 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: bridge: Fix sleep in atomic context in netlink path Since the introduction of the netlink… | |
CVE-2026-63988 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: bridge: Fix sleep in atomic context in sysfs path Since the start of the git history, brp… | |
CVE-2026-63987 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES ethnl_update_profil… |
CVE-2026-63986 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure The goto err lab… | |
CVE-2026-63985 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ethtool: eeprom: add more safeties to EEPROM Netlink fallback The Netlink fallback path f… |
CVE-2026-63984 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() com… |
CVE-2026-63983 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net/sched: fix packet loop on netem when duplicate is on When netem duplicates a packet i… | |
CVE-2026-63982 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop When mirred redire… | |
CVE-2026-63981 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow tcf_mirre… | |
CVE-2026-63980 | High | 7.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spin_lock_bh for hn_lock nvmet_tcp_state_change(), a socket callback t… |
CVE-2026-63979 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to accept_doit handshake_req_next() rem… |
CVE-2026-63978 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending requests at net namespace exit The arguments to list_splice_… |
CVE-2026-63977 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work The change_work was… |
CVE-2026-63976 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success l2cap_ecred_reconf_r… |
CVE-2026-63975 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp If dcid is received for an a… |
CVE-2026-63974 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Since hci_dev_close_… |
CVE-2026-63973 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: mana: Add NULL guards in teardown path to prevent panic on attach failure When queue… | |
CVE-2026-63972 | High | 7.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: mana: Skip redundant detach on already-detached port When mana_per_port_queue_reset_… |
CVE-2026-63971 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctp_wait_for_connect and peeloff sctp_wait_for_connect() drops an… |
CVE-2026-63970 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: bind uarg before filling zerocopy skb virtio_transport_send_pkt_info() allo… |
CVE-2026-63969 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in rt6_fill_node() Sashiko reported this issue [1]. Appl… | |
CVE-2026-63968 | High | 7.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in fib6_select_path() Found while auditing the same patt… |
CVE-2026-63967 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer The tagged FIFO path declares… | |
CVE-2026-63966 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16550: fix stack leak in trigger handler adis16550_trigger_handler() declar… | |
CVE-2026-63965 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: iio: pressure: bmp280: fix stack leak in bmp580 trigger handler bmp580_trigger_handler()… | |
CVE-2026-63964 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: reject firmware images without a ':' record header do_flash() loca… | |
CVE-2026-63963 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Properly validate… | |
CVE-2026-63962 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() svdm_consume… | |
CVE-2026-63961 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: validate count before reading Status Update VDO A broke… | |
CVE-2026-63960 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() wcove_rea… | |
CVE-2026-63959 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT A broken/malicious… | |
CVE-2026-63958 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsi_connector_change() The connector numb… | |
CVE-2026-63957 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: safe_serial: fix memory corruption with small endpoint Make sure that the bu… | |
CVE-2026-63956 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypress_m8: fix memory corruption with small endpoint Make sure that the int… | |
CVE-2026-63955 | High | 7.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: do not trigger BUG() on BH disabled context __get_vm_area_node() currently tr… |
CVE-2026-63954 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: hpfs: fix a crash if hpfs_map_dnode_bitmap fails If hpfs_map_dnode_bitmap fails, the code… |
CVE-2026-63953 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page When migrate_vma_… | |
CVE-2026-63952 | High | 8.4 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEAL_WRITE When SEAL_EXEC is added, SEAL_WRI… |
CVE-2026-63951 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_writeback_endio A crash was observed in zram_writeback_e… |
CVE-2026-63950 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one Initialize nr_pages t… |
CVE-2026-63949 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: auxdisplay: line-display: fix OOB read on zero-length message_store() linedisp_display()… | |
CVE-2026-63948 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn __set_chan_timer() t… | |
CVE-2026-63947 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidp_input_report() hidp_input_report() rea… |
CVE-2026-63946 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in iso_recv_frame iso_recv_frame reads conn->sk under iso_conn_lo… |
CVE-2026-63945 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock iso_sock_close() calls is… |
CVE-2026-63944 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync hci_le_create_cis_sync() dereferen… |
CVE-2026-63943 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Input: xpad - fix out-of-bounds access for Share button xpadone_process_packet() receives… | |
CVE-2026-63942 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: parport: Fix race between port and client registration The parport subsystem registers po… |
CVE-2026-63941 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor ZCR_EL2 can be updated b… |
CVE-2026-63940 | Critical | 9.3 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of l… |
CVE-2026-63939 | Critical | 9.3 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Compute the correct max length of the in-GHCB scratch area When setting the len… |
CVE-2026-63938 | Critical | 9.3 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request indices against the actual size of the buffer When processing… |
CVE-2026-63937 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer Use READ_ONCE() wh… |
CVE-2026-63936 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: mt6359: fix unchecked return value in mt6358_read_imp In mt6358_read_imp(), the… | |
CVE-2026-63935 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: nxp-sar-adc: fix division by zero in write_raw Add a validation check for the s… | |
CVE-2026-63934 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: iio: gyro: itg3200: fix i2c read into the wrong stack location itg3200_read_all_channels(… | |
CVE-2026-63933 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: iio: gyro: adis16260: fix division by zero in write_raw Add a validation check for the sa… | |
CVE-2026-63932 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: iio: chemical: mhz19b: reject oversized serial replies mhz19b_receive_buf() appends each… | |
CVE-2026-63931 | | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: fix division by zero in write_raw Add a zero check for val2 before… |