2026 CVEs (page 31)
Page 31 of 661 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-98031 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: nexthop: Initialize extack in remove_nh_grp_entry() remove_nh_grp_entry() prints the exta… | |
CVE-2026-98030 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size bcm_sf2_cfp_rule_g… |
CVE-2026-98029 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: eth: nfp: bound the ntuple rule dump by the caller's buffer size nfp_net_get_fs_loc() dum… |
CVE-2026-98028 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: eth: nfp: drop the replaced rule from the list when reprogramming fails nfp_net_fs_add()… | |
CVE-2026-98027 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size mv88e6xxx_get… |
CVE-2026-98026 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: properly convert mglist to rcu Sashiko reported a bug [1] that br_mul… | |
CVE-2026-98025 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap… | |
CVE-2026-98024 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: s390/ism: folio_put() after error dmb->cpu_addr was allocated via folio_alloc(). Use foli… | |
CVE-2026-98023 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vxlan: reject dynamic fdb entries that reference a nexthop id The commit cited in the Fix… |
CVE-2026-98022 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations Several subsystems… | |
CVE-2026-98021 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: reject oversized tx_queue_len at netlink parse time rtnl_create_link() assigns IFLA_… | |
CVE-2026-98020 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: pds_core: fix cmd_regs access racing BAR unmap on reset pdsc_reset_prepare() and pdsc_res… | |
CVE-2026-98019 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: mark a NULL call argument precise check_func_arg() allows bpf_register_is_null() for… | |
CVE-2026-98018 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: mctp: i3c: serialize probe with bus removal mctp_i3c_probe() drops busdevs_lock afte… | |
CVE-2026-98017 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTM_NEWQDISC request can make cls… |
CVE-2026-98016 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free race in sample_restore_put() Concurrent teardown of TC samp… | |
CVE-2026-98015 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put In mlx5_eswitch_termtb… | |
CVE-2026-98014 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch, prevent mc_list repopulation during vport disable In mlx5_esw_vport_d… | |
CVE-2026-98013 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: fq_pie: clamp quantum in change path fq_pie_change() accepts any quantum value… | |
CVE-2026-98012 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum in change path sfq_change() accepts any non-negative quantu… | |
CVE-2026-98011 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum in change and init paths hhf_change() accepts any quantum f… | |
CVE-2026-98010 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: drr: clamp quantum in change class drr_change_class() rejects explicit quantum… | |
CVE-2026-98009 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: clamp quantum in parse and fallback paths ets_qdisc_change() falls back t… | |
CVE-2026-98008 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: macb: fix NULL pointer dereference on unbind with fixed-link When the device tree de… | |
CVE-2026-98007 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpf_loop iteration counts bpf_loop() declares its nr_loops argumen… | |
CVE-2026-98006 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev The epq_in_urb object belonging to the ca… | |
CVE-2026-98005 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: erofs: delimit inode_share cache key components Previously, inode_share keys were encoded… | |
CVE-2026-98004 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: iommu/riscv: Serialize command queue publishing Serialize command queue publishing so sof… | |
CVE-2026-98003 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Do not reallocate GA log buffers on resume Commit c5e1a1eb9279 ("iommu/amd: Si… | |
CVE-2026-98002 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix ineffective error check in nested domain allocation amd_iommu_pdom_id_allo… |
CVE-2026-98001 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (ltc4282) Make sure clk_init_data is fully initialized The clk_init_data structure… | |
CVE-2026-98000 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: hwmon: Fix potential UAF in pec_store Sashiko reports: In pec_store(), a guard(mutex)(&h… | |
CVE-2026-97998 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: cope with concurrent instance destruction Instances are refcoun… | |
CVE-2026-97997 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: virtio_ring: fix stale descriptor flags after a failed packed add In a packed ring the AV… | |
CVE-2026-97996 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: virtio: fix use-after-free in unregister_virtio_device() device_unregister() is device_de… | |
CVE-2026-97995 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: virtio_console: do not free control-out buffers on remove __send_control_msg() publishes… | |
CVE-2026-97994 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRING_NUM larger than device max vhost_vring_set_num() accepts any non… | |
CVE-2026-97993 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx vhost_vdpa_set_conf… | |
CVE-2026-97992 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: protect config_ctx from being freed under the config callback vhost_vdpa_conf… | |
CVE-2026-97991 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_blk: reject out-of-range sector starts vdpasim_blk_check_range() logs an invalid… |
CVE-2026-97990 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_net: check TX pull result before RX copy vringh_iov_pull_iotlb() returns a signe… |
CVE-2026-97989 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vduse: validate virtqueue alignment vduse_validate_config() only checks the upper bound o… | |
CVE-2026-97988 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vhost: invalidate vring access on IOTLB transitions When VIRTIO_F_ACCESS_PLATFORM changes… | |
CVE-2026-97987 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: virtio_input: reset device if input_register_device() fails Probe marks the device DRIVER… | |
CVE-2026-97986 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: virtio_input: stop callbacks before unregistering input device virtinput_remove() unregis… | |
CVE-2026-97985 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: af_unix: Update last skb marker in manage_oob(). Fahad Alharbi reported that blocking rec… | |
CVE-2026-97984 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork… | |
CVE-2026-97983 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vduse: return compat ioctl results directly The compat handler handles VDUSE_IOTLB_GET_FD… | |
CVE-2026-97982 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Fix budget accounting The gmac_rx() function returns the remainin… | |
CVE-2026-97981 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Count dropped frames as NAPI work The RX loop only consumes budge… | |
CVE-2026-97980 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debug_set_level() Commit a2cec6863709 ("s390/… | |
CVE-2026-97979 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ice: add missing xa_destroy for sched_node_ids Commit 16dfa49406bc ("ice: Introduce new p… | |
CVE-2026-97978 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: eth: ice: don't dereference pointers from TP_printk() After forwarding net-next during th… | |
CVE-2026-97977 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: Fix UAF of btusb_data by rx_work btusb_close() and btusb_flush() cancel… | |
CVE-2026-97976 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: validate packet_len before skb_put_data btintel_pcie_submit_rx_w… | |
CVE-2026-97975 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() A NULL pointer derefer… | |
CVE-2026-97974 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings() syzbot reported a… | |
CVE-2026-97973 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: macb: destroy the phylink instance on the probe error path macb_mii_init() creates a… | |
CVE-2026-97972 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: macb: put the "mdio" child node reference on success macb_mii_init() holds the refer… | |
CVE-2026-97971 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: nstree: check listing permission before taking a namespace reference legitimize_ns() take… |
CVE-2026-97970 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Avoid division by zero clk_get_rate() could return 0. Avoid a divisio… | |
CVE-2026-97969 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Fix clock leak and spurious timer in settimeout() msc313e_wdt_settimeo… | |
CVE-2026-97968 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Create debugfs entries after hwmon registration ccp_debugfs_init()… | |
CVE-2026-97967 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Remove debugfs entries when probe fails ccp_debugfs_init() register… | |
CVE-2026-97966 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: reset HTB scheduler topology before freeing queues HTB offload programs NIX… | |
CVE-2026-97965 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vxlan: initialize _md in vxlan_xmit_one() If a VXLAN device is configured with both VXLAN… | |
CVE-2026-97964 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ppp_synctty: ensure a writeable skb header ppp_sync_txmunge() checks headroom before prep… | |
CVE-2026-97963 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: stmmac: initialize ptp_lock at probe time priv->ptp_lock is only initialized in stmm… | |
CVE-2026-97962 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Move representor vnic reporter to eswitch devlink port The representor vnic de… | |
CVE-2026-97961 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: perf/core: Allow list_del during perf_event_overflow() A PMU might use perf_sched_cb_inc(… | |
CVE-2026-97960 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Prevent drain_pebs() reentry The PEBS buffer is shared by all events on a… | |
CVE-2026-97959 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_route: free emptied bucket on filter move route4_change can move an existi… | |
CVE-2026-97958 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). If a netlink socket send… | |
CVE-2026-97957 | High | 8.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: hinic: fix mailbox segment buffer overflow check_mbox_seq_id_and_seg_len() validates… |
CVE-2026-97956 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: net_failover: Fix the deadlock in net_failover_slave_name_change() This is a sibling… | |
CVE-2026-97955 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: mana: restore the XDP program pointer when pre-allocation fails mana_xdp_set() publi… | |
CVE-2026-97954 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/rds: fix tcp stream corruption with large pages rds_message_map_pages() assigns PAGE_… | |
CVE-2026-97953 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmac_tso_xmit() estim… |
CVE-2026-97952 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: sunvdc: unmap LDC cookies when the descriptor send fails __send_request() maps the reques… | |
CVE-2026-97951 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands When a LUN_RESET aborts… | |
CVE-2026-97950 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: configfs: pin the symlink target's dirent instead of chasing ->ci_dentry create_link() re… | |
CVE-2026-97949 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: configfs: unhash the dentry before dropping the item in rmdir configfs_get_config_item()… | |
CVE-2026-97948 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver The commit 101… | |
CVE-2026-97947 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: x86/amd_node: Fix potential NULL pointer dereference amd_smn_read/write() are exported fu… | |
CVE-2026-97946 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: x86/amd_node: Fix PCI device reference counting in amd_smn_init() The local "root" pointe… | |
CVE-2026-97945 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix user-space data loss with MADV_FREE and THP Some of users of Polars (a data a… | |
CVE-2026-97944 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash() The switch of the FineIBT preambl… | |
CVE-2026-97943 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF x86 implements page attri… | |
CVE-2026-97942 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: x86/alternatives: Exclude text poking against change_page_attr() From time to time, the f… | |
CVE-2026-97941 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race Commit ba7425312… |
CVE-2026-97940 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop ipv6_route_iter_active() treats a walker in FWS_U a… |
CVE-2026-97939 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ipmr: account multicast table and route memory A netadmin in a user+net namespace can cre… | |
CVE-2026-97938 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: reboot: fix cad_pid use-after-free race cad_pid is a single kernel-wide struct pid pointe… | |
CVE-2026-97937 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ftrace: fork: Initialize function graph state before copy_exec_state() dup_task_struct()… |
CVE-2026-97936 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory corruption from the histogram stacktrace modifier parse_field() sets… | |
CVE-2026-97935 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: tracing: Set the trace clock before registering the histogram trigger hist_register_trigg… | |
CVE-2026-97934 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory corruption from a "STACKTRACE" histogram key "cpu", "CPU", "stacktrac… | |
CVE-2026-97933 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: tracing: Take trace_array reference when opening a tracer options file When a tracer opti… | |
CVE-2026-97932 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: tracing: Don't dereference trace_event_file in deferred trigger free The enable_event tri… | |
CVE-2026-97931 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Prevent write upgrades for read mappings The hwdep mmap callback rejects re… |