2026 CVEs (page 251)
Page 251 of 692 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-74544 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds u32_change() copies… |
CVE-2026-74543 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() syzbot reported a memory… | |
CVE-2026-74542 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio_queue ENOMEM in writeback by adding a mempool Fix the handling of folio_… | |
CVE-2026-74541 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: clear iso_data always when detaching conn from hcon When setting conn->hc… |
CVE-2026-74540 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp l2cap_le_connect_rsp() obtains a channe… |
CVE-2026-74539 | High | 8.0 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso_sock_getname Accessing iso_pi(sk)->conn requires lock_sock… |
CVE-2026-74538 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso_connect_ind Accessing iso_pi(sk)->conn requires lock_sock… |
CVE-2026-74537 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in iso_conn_ready sk deref in iso_conn_ready must be don… |
CVE-2026-74536 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix leaking sk after socket release iso_sock_kill() tests !sock_flag(sk… | |
CVE-2026-74535 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid deadlocks in iso_sock_timeout iso_sock_timeout() takes lock_sock, s… |
CVE-2026-74534 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting of iso_conn iso_conn_del() and iso_chan_del() have a race… |
CVE-2026-74533 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero hci_conn::iso_data is accessed… |
CVE-2026-74532 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Validate length before parsing diagnostics TLV btintel_diagnostics()… | |
CVE-2026-74531 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: hold conn reference in abort_conn_sync() There is theoretical UAF if… |
CVE-2026-74530 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback There is theoretical UA… |
CVE-2026-74529 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback There is theoretical UAF… |
CVE-2026-74528 | High | 8.0 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_past_sync() callback Avoids giving freed pointers t… |
CVE-2026-74527 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Block VFs from clobbering special CGX PKIND state PF and VF NIX LFs that sh… |
CVE-2026-74526 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit mpi3mr_fault_uevent_emit… | |
CVE-2026-74525 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net: sxgbe: free TX rings on RX allocation failure When RX descriptor ring allocation fai… | |
CVE-2026-74524 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove remove_pud_mapping(… | |
CVE-2026-74523 | High | 7.5 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: qede: sync udp_tunnel ports outside qede_lock in the recovery path A TX timeout on a qede… |
CVE-2026-74522 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __close_file_table_ids() A ksmbd_file can remain alive after… |
CVE-2026-74521 | Critical | 9.1 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp() to compare ClientGUIDs ClientGUID is a fixed-size binary value and ca… |
CVE-2026-74520 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopf_group_alloc() links each last-page IOPF… |
CVE-2026-74519 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: don't free uninitialized dev_name on error path dt_remember_or_free_… |
CVE-2026-74518 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix list corruption in allocate_file_region_entries() allocate_file_region_en… |
CVE-2026-74517 | Critical | 9.3 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs Cancel (and flush)… |
CVE-2026-74516 | High | 8.2 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Always upd… |
CVE-2026-74515 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled The MPCIFC instruc… |
CVE-2026-74514 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix memory accounting for pinned/unpinned pages The account_mem() and una… | |
CVE-2026-74513 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister dibs_lo_attach_… |
CVE-2026-74512 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: audit: fix potential use-after-free in audit_del_rule() `audit_del_rule()` destroys `e->r… |
CVE-2026-74510 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix UAF in pair command cancellation The pairing completion and authenti… |
CVE-2026-74509 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix advertising data UAFs hci_find_adv_instance() returns an adv_inf… |
CVE-2026-74508 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: reject frames without a transaction header hidp_recv_ctrl_frame() and hi… |
CVE-2026-74507 | High | 7.1 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: validate numbered report payloads When hidp_get_raw_report() waits for a… |
CVE-2026-74506 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix UAF when sending a message In afs_make_call(), there's a race with async call re… |
CVE-2026-74505 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: Fix UAF at error handling during probe Although 6fire driver had a few fixes… | |
CVE-2026-74504 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix division by zero in initialize_timer() A userspace-driven ALSA timer (SND_… | |
CVE-2026-74503 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes snd_timer_close_locked(… |
CVE-2026-74502 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of out_cvts on rawmidi error snd_ump_attach_legacy_rawmidi() a… | |
CVE-2026-74501 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix use-after-free in ump_to_endpoint() create_midi2_ump() registers a c… | |
CVE-2026-74500 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix stack info leak in RME Digiface status snd_rme_digiface_read_status(… | |
CVE-2026-74499 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() snd_usbmidi_akai_output() com… | |
CVE-2026-74498 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set When a USB audio… | |
CVE-2026-74497 | High | 8.4 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode snd_usb_handle_sync_urb() sca… |
CVE-2026-74496 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: fou: Fix use-after-free in fou_create() fou_create() publishes struct fou through sk_user… |
CVE-2026-74495 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: igbvf: Fix leak in TX DMA error cleanup If an error is encountered while mapping TX buffe… |
CVE-2026-74494 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject repeated SMB2 NEGOTIATE requests Unauthenticated client can send multiple s… | |
CVE-2026-74493 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket use-after-free during link group termination __smc_lgr_terminate() dr… |
CVE-2026-74492 | High | 8.4 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: do not update comments from kernel-side hash adds mtype_resize() copies… |
CVE-2026-74491 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: of/address: Fix NULL bus dereference in of_pci_range_parser_one() The bus matching rework… | |
CVE-2026-74490 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: tipc: avoid use-after-free in poll trace queue dumps TIPC socket tracepoints dump queue s… |
CVE-2026-74489 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix tid_tx use-after-free on BA session stop ieee80211_stop_tx_ba_cb() ha… |
CVE-2026-74488 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames mwifiex_11n_dispat… |
CVE-2026-74487 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: restore write access when removing an entry Registering an entry with the MI… | |
CVE-2026-74486 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: use exe_file_deny_write_access() for the interpreter clone For MISC_FMT_OPEN… | |
CVE-2026-74485 | High | 7.1 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: reject a flag character as the field delimiter The registration string start… |
CVE-2026-74484 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: don't let an 'F' entry pin its own instance An entry registered with 'F' ope… | |
CVE-2026-74483 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: don't leak the user namespace when the mount fails bm_get_tree() takes a ref… | |
CVE-2026-74482 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios __folio_split() k… |
CVE-2026-74481 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: mm/page_reporting: use system_freezable_wq to fix UAF during suspend During PM freeze (e… |
CVE-2026-74480 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after deleting a port group br_multicast_leave_group() itera… |
CVE-2026-74479 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net: pktgen: fix proc entry use-after-free pktgen_change_name() replaces pkt_dev->entry w… |
CVE-2026-74478 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vector_mmsg_rx() When vector_mmsg_rx() discards a packe… |
CVE-2026-74477 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: uprobes: Fix NULL pointer dereference in hprobe_expire() Forking a task that has a pendin… | |
CVE-2026-74476 | Critical | 9.1 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: veth: convert frag_list skbs before running XDP A frag_list skb can reach veth with data_… |
CVE-2026-74475 | Critical | 10.0 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: vxlan: use neigh_ha_snapshot() in route_shortcircuit() The neighbour hardware address n->… |
CVE-2026-74474 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() for transmit path header pulls In vxlan_xmit(), arp_re… |
CVE-2026-74473 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() in route_shortcircuit() route_shortcircuit() currently… |
CVE-2026-74472 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() ublk_ctrl_add_dev() memcp… | |
CVE-2026-74471 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: tracing: Check return value of __register_event() in trace_module_add_events() trace_modu… |
CVE-2026-74470 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write resp_report_zones() size… |
CVE-2026-74469 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the associat… |
CVE-2026-74468 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: gpio: pch: use raw_spinlock_t for the register lock pch_irq_type() is registered as the i… | |
CVE-2026-74467 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: s390/qeth: Check CAP_NET_ADMIN for private ioctls Gate the SIOCDEVPRIVATE ioctl commands… |
CVE-2026-74466 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a… | |
CVE-2026-74465 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix potential UAF on meter attach failure While attaching a newly creat… |
CVE-2026-74464 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix skb leak on flow key update failure during ct ovs_ct_execute() alwa… | |
CVE-2026-74463 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock Fix a se… | |
CVE-2026-74462 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: i2c: imx: mark I2C adapter when hardware is powered down On some i.MX platforms, certain… | |
CVE-2026-74461 | High | 8.4 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2c_imx_unreg_slave(), the slav… |
CVE-2026-74460 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: validate CPC message lengths ems_usb_read_bulk_callback() walks CPC message… | |
CVE-2026-74459 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure e… | |
CVE-2026-74458 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents The w… | |
CVE-2026-74457 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: add bounds check for USB channel index The channel control index ctrl_idx… | |
CVE-2026-74456 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error I… |
CVE-2026-74455 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: validate uCAN receive record lengths pcan_usb_fd_decode_buf() walks uCAN r… | |
CVE-2026-74454 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size vc4_overflow_me… |
CVE-2026-74453 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16M… |
CVE-2026-74452 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthor_fw_load_section_entr… |
CVE-2026-74451 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes iface_fw_to_cpu_addr() only chec… |
CVE-2026-74450 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix pptable use-after-free amdgpu_dpm_get_pp_table() returns a pointer to a d… |
CVE-2026-74449 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport If a pla… |
CVE-2026-74448 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix QID bit leak in pqm_create_queue() When MES is enabled and amdgpu_amdkfd_… | |
CVE-2026-74447 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment eop_ring_buffer_size… |
CVE-2026-74446 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: hold event_mutex while checkpointing CRIU events kfd_criu_checkpoint_events()… |
CVE-2026-74445 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: reject DX_BIND_QUERY without a DX context vmw_cmd_dx_bind_query() uncondition… | |
CVE-2026-74444 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division vmw_cmd_draw() computes … |