2026 CVEs (page 254)
Page 254 of 693 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-74258 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: bpf: Guard __get_user acesss with access_ok for uprobe_multi data As reported by sashiko… |
CVE-2026-74257 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: sockmap: Fix use-after-free in udp_bpf_recvmsg() syzbot reported use-after-free of struct… |
CVE-2026-74256 | High | 8.4 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check start and len are u… |
CVE-2026-74255 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in tipc_l2_send_msg() Syzbot reported a slab-use-after-free in ipvlan_hard_… |
CVE-2026-72502 | High | 7.5 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) When MTU is large… |
CVE-2026-72501 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Initialize dpi variable to zero dpi is initialized only for BNXT_RE_ALLOC_W… | |
CVE-2026-72500 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown Free the toggle page only afte… |
CVE-2026-72499 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Free CQ toggle page after firmware teardown Free the toggle page only after… |
CVE-2026-72498 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Avoid displaying the kernel pointer While dumping the info on MR using the… | |
CVE-2026-72497 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Add a max slot check for SQ The variable WQE mode must be validated against… |
CVE-2026-72496 | Critical | 9.2 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Proper rollback if the ioremap fails bnxt_qplib_alloc_dpi returns success e… |
CVE-2026-72495 | Critical | 9.3 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages Applications can request multi… |
CVE-2026-72494 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Replace waitqueue and flag with completion The driver previously used a waitq… |
CVE-2026-72493 | Critical | 9.9 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net: serialize netif_running() check in enqueue_to_backlog() Syzbot reported a KASAN slab… |
CVE-2026-72492 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in same_client_has_lease() same_client_has_lease() returns an o… |
CVE-2026-72491 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net/9p: fix race condition on rdma->state in trans_rdma.c The rdma->state field is modifi… |
CVE-2026-72490 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stainfo check in rtw_aes_decrypt The null-pointer-guard was incor… | |
CVE-2026-72489 | High | 8.4 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvec_rx_completed() In nvec_rx_completed(), when an… |
CVE-2026-72488 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: soundwire: fix bug in sdw_add_element_group_count found by syzkaller The original impleme… |
CVE-2026-72487 | High | 7.7 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: PCI: Check ROM header and data structure addr before accessing We meet a crash when runni… |
CVE-2026-72486 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to init… | |
CVE-2026-72485 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresight_ad… |
CVE-2026-72484 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: staging: most: video: avoid double free on video register failure comp_register_videodev(… | |
CVE-2026-72483 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() The `max3421_hub_con… |
CVE-2026-72482 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: gpib: fix double decrement of descriptor_busy in command_ioctl() commit d1857f8296dc ("gp… |
CVE-2026-72481 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: iio: magnetometer: ak8975: fix potential kernel stack memory leak Currently in the AK8975… | |
CVE-2026-72480 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling ams_event_to_cha… |
CVE-2026-72479 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: iio: accel: mma8452: handle I2C read error(s) in mma8452_read() Currently, If i2c_smbus_r… | |
CVE-2026-72478 | High | 8.4 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add bounds check to run_get_highest_vcn() run_get_highest_vcn() parses a packed… |
CVE-2026-72477 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: call _ntfs_bad_inode() when failing to rename It is safe to call _ntfs_bad_inod… |
CVE-2026-72476 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix possible use after free In dma_release_channel(), check chan->device->priv… |
CVE-2026-72475 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc Use axi_dmac_free_desc() to f… | |
CVE-2026-72474 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor For architectures like Mi… | |
CVE-2026-72473 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Decouple req recycling from RPC completion rl_kref formerly served two distinct… |
CVE-2026-72472 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: nfs: use nfsi->rwsem to protect traversal of the file lock list Lingfeng identified a bug… |
CVE-2026-72471 | High | 7.1 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: prevent potential lcn remains uninitialized The target VCN being sought was not… |
CVE-2026-72470 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log->one_page_buf when adopting on-disk page size log_replay() allocates… |
CVE-2026-72469 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE rpcrdma_cm_event_handler() falls through t… |
CVE-2026-72468 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize re_id before removal registration rpcrdma_create_id() registers ep->… | |
CVE-2026-72467 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwr_wp_create() during connect frwr_wp_create() creates the singleton Me… | |
CVE-2026-72466 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix bcall rep leak and unbounded peek rpcrdma_is_bcall() decodes a reply's firs… |
CVE-2026-72465 | High | 7.5 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant after parsing The out_norqst exit in rpcrdma_re… |
CVE-2026-72464 | High | 7.5 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Repost Receive buffers for malformed replies rpcrdma_wc_receive() decrements th… |
CVE-2026-72463 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb->dev… |
CVE-2026-72462 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race in unix socket mediation when peer_path is used The holding a referenc… |
CVE-2026-72461 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix refcount leak when updating the sk_ctx Currently update_sk_ctx() transfers… |
CVE-2026-72460 | High | 7.1 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: apparmor: check label build before no_new_privs test aa_change_profile() builds a replace… |
CVE-2026-72459 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: apparmor: aa_label_alloc use aa_label_free on alloc failure aa_label_alloc() allocates a… |
CVE-2026-72458 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix NULL pointer dereference in unpack_pdb pdb->dfa could be NULL if unpack_dfa… | |
CVE-2026-72457 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fail policy unpack on accept2 allocation failure unpack_pdb() may need to alloc… | |
CVE-2026-72456 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: apparmor: release exe file resources on path failure get_current_exe_path() takes both an… | |
CVE-2026-72455 | High | 7.1 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix uninitialised pointer passed to audit_log_untrustedstring() Commit 4a134723… |
CVE-2026-72454 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() i3c_hci_addr_to_dev() walks bus->dev… |
CVE-2026-72453 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: regcache: Do not overwrite error code when finalizing cache after error During regcache i… | |
CVE-2026-72452 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/i915: clear CRTC color blob pointers after dropping refs intel_crtc_put_color_blobs()… |
CVE-2026-72451 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix xfrm state cache insertion race The xfrm input state cache insertion code check… |
CVE-2026-72450 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: xfrm: validate selector family and prefixlen during match syzbot reported a shift-out-of-… |
CVE-2026-72449 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm The cleanup tail of kfd_criu_r… |
CVE-2026-72448 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown The send-queue timestamp ring i… | |
CVE-2026-72447 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: sctp: hold socket lock when dumping endpoints in sctp_diag SCTP_DIAG endpoint dumping was… | |
CVE-2026-72446 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: reject stream disable with no active interface handle_uaudio_strea… |
CVE-2026-72445 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: clear opened when stream enable fails On enable, subs->opened is s… | |
CVE-2026-72444 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: flow_dissector: check device type before reading ETH_ADDRS __skb_flow_dissect() unconditi… |
CVE-2026-72443 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints MIDI 2.0 input URBs are star… | |
CVE-2026-72442 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix and simplify IP6IP6 tunnel handling Fix nf_flow_ip6_tunnel_prot… |
CVE-2026-72441 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ieee802154: fix kernel-infoleak in dgram_recvmsg() KMSAN reported a kernel-infoleak in mo… | |
CVE-2026-72440 | High | 7.1 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: md/raid1: fix writes_pending and barrier reference leaks on write failures raid1_make_req… |
CVE-2026-72439 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writes_pending leak on write request failures raid10_make_request() acquir… | |
CVE-2026-72438 | High | 7.5 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writes_pending and barrier reference leaks on discard failures raid10_make… |
CVE-2026-72437 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry When a read is… | |
CVE-2026-72436 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types Sashiko poin… |
CVE-2026-72435 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() Sashiko pointed out t… |
CVE-2026-72434 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped Sashiko noticed that when destroying a… |
CVE-2026-72433 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak This needs to test for no… | |
CVE-2026-72432 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: tpm_crb: Check ACPI_COMPANION() against NULL during probe Every platform driver can be fo… | |
CVE-2026-72431 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: alloc_tag: fix use-after-free in /proc/allocinfo after module unload allocinfo_start() on… | |
CVE-2026-72430 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix nf_connlabels leak on two error paths tcf_ct_fill_params() calls n… | |
CVE-2026-72429 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix type confusion of dst_entry IOAM uses a dummy dst_entry(null_dst) to mark… |
CVE-2026-72428 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack slot index in nospec checks check_stack_write_fixed_off() computes the byt… | |
CVE-2026-72427 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix effective prog array index with BPF_F_PREORDER replace_effective_prog() and purg… |
CVE-2026-72426 | High | 8.4 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer spill metadata during half-slot cleanup __clean_func_state() cleans… |
CVE-2026-72425 | High | 7.1 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() Resetting all VFs causes reso… |
CVE-2026-72424 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313_rtc_probe() calls devm_… | |
CVE-2026-72423 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an… |
CVE-2026-72422 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE conn->preaut… |
CVE-2026-72421 | Critical | 10.0 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't ignore error route in local/main tables. When CONFIG_IP_MULTIPLE_TABLES… |
CVE-2026-72420 | High | 8.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: md/raid5: avoid R5_Overlap races while breaking stripe batches KCSAN report a race in bre… |
CVE-2026-72419 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() We ran into… |
CVE-2026-72418 | High | 7.5 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: prevent connlimit drops for early confirmed ct Commit 69894e5b4c… |
CVE-2026-72417 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto() Add sanity check fo… |
CVE-2026-72416 | High | 7.3 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_compat: ebtables emulation must reject non-bridge targets xtables targets… |
CVE-2026-72415 | High | 7.1 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Validate written enum value in ge_put_enum_double() ge_put_enum_double() pass… |
CVE-2026-72414 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: round up PTP perout pin duration pin_duration is converted from the us… | |
CVE-2026-72413 | | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix err_chunk memory leaks in INIT handling When sctp_verify_init() encounters unre… | |
CVE-2026-72412 | Critical | 9.3 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: s390/mm: Fix handling of _PAGE_UNUSED pte bit The _PAGE_UNUSED softbit should not really… |
CVE-2026-72411 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: fix use-after-free of DSA ports in crc_err_work Upon an MDIO CRC erro… |
CVE-2026-72410 | High | 7.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Validate NIX maximum LFs correctly NIX maximum number of LFs can be set via… |
CVE-2026-72409 | High | 7.5 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net: mvneta: re-enable percpu interrupt on resume On Marvell MPIC platforms (Armada 370/X… |
CVE-2026-72408 | Critical | 10.0 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint geneve_gro_receive() reads… |
CVE-2026-72407 | Critical | 10.0 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: geneve: validate inner network offset in geneve_gro_complete() Even with both paths gated… |