2026 CVEs (page 196)
Page 196 of 470 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-53256 | High | 8.0 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() rfcomm_get_sock_by_channe… |
CVE-2026-53255 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate advertising TLV before type checks tlv_data_is_valid() reads ea… |
CVE-2026-53254 | High | 8.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in MCC handlers The RFCOMM MCC handlers cast skb->… |
CVE-2026-53253 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: reject short frames before parsing A BNEP peer can send a short BNEP SDU… |
CVE-2026-53252 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix memory leak in error path of hci_alloc_dev() Early failures in Bluetooth H… |
CVE-2026-53251 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync hci_get_route() ret… |
CVE-2026-53250 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() The TX metadata are… |
CVE-2026-53249 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options This patch restricts setting Loose Sourc… |
CVE-2026-53248 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix use-after-free in metadata dst teardown airoha_metadata_dst_free() runs… |
CVE-2026-53247 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() ca… |
CVE-2026-53246 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening S… |
CVE-2026-53245 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr In mrp_pdu_parse_vecat… |
CVE-2026-53244 | High | 7.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: VFS: fix possible failure to unlock in nfsd4_create_file() atomic_create() in fs/namei.c… |
CVE-2026-53243 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: rseq: Fix using an uninitialized stack variable in rseq_exit_user_update() There is an bu… |
CVE-2026-53242 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams snd_pcm_dr… |
CVE-2026-53241 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: dummy: fix UMP event stack overread The dummy sequencer port forwards events b… |
CVE-2026-53240 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload __input_process_p… |
CVE-2026-53239 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race b… |
CVE-2026-53238 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: netlabel: validate unlabeled address and mask attribute lengths netlbl_unlabel_addrinfo_g… |
CVE-2026-53237 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: gpio: mvebu: fix NULL pointer dereference in suspend/resume mvebu_pwm_suspend() and mvebu… |
CVE-2026-53236 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: tcp: restrict SO_ATTACH_FILTER to priv users This patch restricts the use of SO_ATTACH_FI… |
CVE-2026-53235 | High | 7.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: add pskb_may_pull() to skb_gro_receive_list() skb_gro_receive_list() calls skb_pull(… |
CVE-2026-53234 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: ibm: emac: Fix use-after-free during device removal The driver was using devm_regist… |
CVE-2026-53233 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: netdev: fix double-free in netdev_nl_bind_rx_doit() Sashiko flags that genlmsg_reply() al… |
CVE-2026-53232 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: phy: clean the sfp upstream if phy probing fails Sashiko reported that we don't call… |
CVE-2026-53231 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: phy: don't try to setup PHY-driven SFP cages when using genphy We don't have support… |
CVE-2026-53230 | High | 8.7 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list mlx5_query_nic_vport_ma… |
CVE-2026-53229 | High | 7.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure In the XSK branch of ml… |
CVE-2026-53228 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inn… |
CVE-2026-53227 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix possible kfree_skb of ERR_PTR After the patch in the "Fixes" tag, t… |
CVE-2026-53226 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: gpio: rockchip: fix generic IRQ chip leak on remove The driver allocates domain generic c… |
CVE-2026-53225 | Critical | 9.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sc… |
CVE-2026-53224 | Critical | 9.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie(… |
CVE-2026-53223 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue skbs skb_is_err_queue() treats PACKET_OUTG… |
CVE-2026-53222 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: fix resource freeing order Commit a60fc3294a37 ("ptp: rework ptp_clock_unregist… |
CVE-2026-53221 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an… |
CVE-2026-53220 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: revalidate bridge ports ebt_redirect_tg() dereferences br_port_get_rcu() retur… |
CVE-2026-53219 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: avoid leaking percpu counter pointers The native and compat get-entr… |
CVE-2026-53218 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag nft_exthdr_init() passes… |
CVE-2026-53217 | High | 8.6 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: sync RX data at the hardware packet offset mvpp2 programs the RX queue packet… |
CVE-2026-53216 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and… |
CVE-2026-53215 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current… |
CVE-2026-53214 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix a potential NPD in cleanup_prefix_route() addrconf_get_prefix_route() can retur… |
CVE-2026-53213 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: drm/vc4: fix krealloc() memory leak Don't just overwrite the original pointer passed to k… |
CVE-2026-53212 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() call… |
CVE-2026-53211 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register NFT_META_BRI_IIFH… |
CVE-2026-53210 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: tee: shm: fix shm leak in register_shm_helper() register_shm_helper() allocates shm befor… |
CVE-2026-53209 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Existing advertising… |
CVE-2026-53208 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig net/bluetooth/l2cap_core.c… |
CVE-2026-53207 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison Two concurr… |
CVE-2026-53206 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds check for firmware runtime memory Validate that the firmware runti… |
CVE-2026-53205 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds checks for firmware log indices Add validation that read and write… |
CVE-2026-53204 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in probe rsu_send_msg()… |
CVE-2026-53203 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add buffer overflow check in MS get_info_ioctl Add validation that the info s… |
CVE-2026-53202 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix signed integer truncation in IPC receive Fix potential buffer overflow wh… |
CVE-2026-53201 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Revert "drm/xe: Skip exec queue schedule toggle if queue is idle during suspend" This rev… |
CVE-2026-53200 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX XN has already been extracted from i… |
CVE-2026-53199 | High | 7.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf netvsc_copy_to_send_buf() copie… |
CVE-2026-53198 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL A deferred byte-r… |
CVE-2026-53197 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state() iptfs_destroy_state() calls hrtim… |
CVE-2026-53196 | Medium | 6.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf_info() reads le16_to_… |
CVE-2026-53195 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() build_i2c_fw_hdr() allocates… |
CVE-2026-53194 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: kl5kusb105: fix bulk-out buffer overflow klsi_105_prepare_write_buffer() is… |
CVE-2026-53193 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Forcibly close timer instances at closing When snd_timer object is freed via… |
CVE-2026-53192 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a… |
CVE-2026-53191 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries When a bundle recv… |
CVE-2026-53190 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() dma_fence… |
CVE-2026-53189 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: update file PMD counter before folio_put() __split_huge_pmd_locked() upda… |
CVE-2026-53188 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Validate the passed in fops for ib_get_ucaps() Sashiko pointed out it is not s… |
CVE-2026-53187 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc The cpu_id attribute supplied… |
CVE-2026-53186 | Critical | 9.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense… |
CVE-2026-53185 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or… |
CVE-2026-53184 | High | 7.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: udp: clear skb->dev before running a sockmap verdict On the UDP receive path skb->dev is… |
CVE-2026-53183 | High | 7.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: mptcp: allow subflow rcv wnd to shrink In MPTCP connection, the `window` field in the TCP… |
CVE-2026-53182 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject oversized EMA RNR lists nl80211_parse_rnr_elems() stores the parsed… |
CVE-2026-53181 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix sk_ack_backlog leak on failed handshake When vmci_transport_recv_connecti… |
CVE-2026-53180 | High | 7.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: timers/migration: Fix livelock in tmigr_handle_remote_up() tmigr_handle_remote_cpu() skip… |
CVE-2026-53179 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix buffer over-read in rtw_update_protection rtw_update_protection()… |
CVE-2026-53178 | High | 8.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction Add guards t… |
CVE-2026-53177 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix NULL pointer dereference PCIe errors detected by a Root Port or Downstream P… |
CVE-2026-53176 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert… |
CVE-2026-53175 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, f… |
CVE-2026-53174 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ovl: keep err zero after successful ovl_cache_get() ovl_iterate_merged() stores PTR_ERR(c… |
CVE-2026-53173 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate() The command strea… |
CVE-2026-53172 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix IFM region index out-of-bounds in command stream parser NPU_SET_IFM_REG… |
CVE-2026-53171 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix arithmetic issues in dma_length() dma_length() derives DMA region usage… |
CVE-2026-53170 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: reject DMA commands with uninitialized length cmd_state_init() initializes… |
CVE-2026-53169 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: reject NPU_OP_RESIZE commands from userspace NPU_OP_RESIZE is a U85-only co… |
CVE-2026-53168 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: fuse: reject fuse_notify() pagecache ops on directories The operations FUSE_NOTIFY_STORE… |
CVE-2026-53167 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios FUSE_NOTIFY_RETRIEVE must be limited… |
CVE-2026-53165 | High | 7.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: iomap: avoid potential null folio->mapping deref during error reporting When a buffered r… |
CVE-2026-53164 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Do not try to iommu_map a 0 length region in swiotlb iommu_dma_iova_link_swiot… |
CVE-2026-53163 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued syzbot triggered the fo… |
CVE-2026-53162 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: memcg: use round-robin victim selection in refill_stock Harry Yoo reported that get_rando… |
CVE-2026-53161 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context There is a race be… |
CVE-2026-53160 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free race in fastrpc_map_create fastrpc_map_lookup returns a… |
CVE-2026-53159 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix DMA address corruption due to find_vma misuse fastrpc_get_args() uses… |
CVE-2026-53158 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix NULL pointer dereference in rpmsg callback A NULL pointer dereference… |
CVE-2026-53157 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: phonet: free phonet_device after RCU grace period phonet_device_destroy() removes a… |
CVE-2026-53156 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: nvmem: core: fix use-after-free bugs in error paths Fix several instances of error paths… |