2026 CVEs (page 32)
Page 32 of 661 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-97930 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf The in04_last array in st… | |
CVE-2026-97929 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: validate URB actual_length in interrupt callback i_usx2y_in04_int() proce… | |
CVE-2026-97928 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: skip the VMID 0 flush for VRAM Clear-on-release only runs on VRAM, which amdg… | |
CVE-2026-97927 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ufs: create the root dentry after loading cylinder metadata ufs_fill_super() installed sb… | |
CVE-2026-97926 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ufs: validate cylinder group metadata before caching it ufs_read_cylinder() copies the cy… |
CVE-2026-97925 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: tick/broadcast: Plug clockevents replacement race 朱恺乾 reported and decoded the following… | |
CVE-2026-97924 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: tracing/user_events: Don't destroy fields when event removal fails destroy_user_event() d… | |
CVE-2026-97923 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram the var ref when its initialization fails create_var_ref() alloca… | |
CVE-2026-97922 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram var refs regardless of how often they are referenced Using the sa… | |
CVE-2026-97921 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram the field rejected for a bad modifier Writing a hist trigger whos… | |
CVE-2026-97920 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the entry count when the histogram stats allocation fails print_entries() u… | |
CVE-2026-97919 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: tracing: Take the reference before publishing the named histogram trigger event_hist_trig… | |
CVE-2026-97918 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: tracing: Undo the registration when enabling the histogram trigger fails Commit 6f86bdeab… | |
CVE-2026-97917 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr Add a size parameter to ivpu_t… | |
CVE-2026-97916 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate firmware log buffer metadata The tracing log headers parsed by fw_lo… | |
CVE-2026-97915 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Limit firmware log name prints to field size The name in struct vpu_tracing_b… | |
CVE-2026-97914 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix ethosu_job_open() return value A WARN_ON() returns a 0 or 1, not the o… | |
CVE-2026-97913 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure cmd stream ends with a stop op While the QSIZE register setting sho… | |
CVE-2026-97912 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM size is 0 on mapping failure On a mapping failure of the SRAM… | |
CVE-2026-97911 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM region size matches job It is possible for userspace to set th… |
CVE-2026-97910 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ASoC: sprd: validate compress buffer sizes against fixed allocations sprd_platform_compr_… |
CVE-2026-97909 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ASoC: sti: initialize IRQ lock before requesting IRQ uni_reader_init() registers the shar… | |
CVE-2026-97908 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev The command and ACL… | |
CVE-2026-97907 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 When key_id from… | |
CVE-2026-97906 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bootconfig: Fix integer overflow in initrd size check Sashiko reported that in get_boot_c… | |
CVE-2026-97905 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: zero-initialize policy cpumask before sysfs publication cpufreq_policy_alloc() a… | |
CVE-2026-97904 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: initialize policy rwsem before sysfs publication cpufreq_policy_alloc() initiali… | |
CVE-2026-97903 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: exit: hold a reference to thread_pid across proc_flush_pid Commit 0a36bad01731 ("release_… |
CVE-2026-97902 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: fs: don't return -EINVAL for successful nested thaw Commit 7366f8b6fc6a ("fs: handle free… | |
CVE-2026-97901 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: genetlink: pin family module during policy dump The generic netlink controller's policy d… | |
CVE-2026-97900 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: drm/drm_exec: fix up contended obj when num_objects is 0 drm_exec_prepare_array() silentl… | |
CVE-2026-97899 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix memory leak in query_perf_config_list() When krealloc() fails, free the ori… | |
CVE-2026-97875 | High | 8.1 | 2026-09-25 | Rojo's "rojo serve" HTTP API (default port 34872) has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all… |
CVE-2026-97621 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: analogix_dp: fix unchecked bound endpoint name length rockchip_dp_drm_encod… | |
CVE-2026-97620 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches emit_render_cache_flush… | |
CVE-2026-97619 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: io_uring/rw: end write accounting from ->ki_complete Commit b000145e9907 moved both the f… | |
CVE-2026-97618 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: io_uring/net: don't overconsume buffers when using MSG_TRUNC When a recv/recvmsg is issue… | |
CVE-2026-97617 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Check resize_disabled before publishing the new subbuf order ring_buffer_sub… | |
CVE-2026-97616 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: release all action references on NEWACTION failure When a batched RTM… | |
CVE-2026-97615 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: bridge: use option bits for CFM/MRP frame handlers CFM and MRP register a global br_… | |
CVE-2026-97614 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: dsa: tag_brcm: legacy FCS: request needed tailroom The legacy FCS tagger calculates… | |
CVE-2026-97613 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: mana: Reserve extra CQ slot for the fence completion CQE The RX completion queue is… | |
CVE-2026-97612 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear inner_protocol when the last label is popped skb_mpls_push() records the… |
CVE-2026-97611 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix use-after-free of the flow table mask array tbl_mask_array_realloc(… |
CVE-2026-97610 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix uninitialized return value in netfs_unbuffered_write() If preparation of the f… | |
CVE-2026-97609 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: prevent UAF during module unload nf_ct_set_timeout() protects the t… |
CVE-2026-97608 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: unregister loggers before per-net teardown nf_log_syslog and nfnetlink… |
CVE-2026-97607 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vdpa: ifcvf: Put device on unsupported feature error Route unsupported provisioned featur… | |
CVE-2026-97606 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: fs: autofs: fix memory leak in autofs_fill_super() In autofs_fill_super(), we create a ne… | |
CVE-2026-97605 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: erofs: preserve LZMA decoders on resize failure The pool-resize path frees each stream's… | |
CVE-2026-97604 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: fbdev: vfb: defer cleanup until the last reference FBIOGETCMAP takes a shallow snapshot o… | |
CVE-2026-97603 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: idpf: disable DIM work before freeing q_vectors idpf never drains the Tx/Rx DIM works bef… | |
CVE-2026-97602 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: inet: frags: invalidate queues before flushing them fqdir_pre_exit() flushes the skbs fro… |
CVE-2026-97601 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink TUNSETLINK allows a TUN devic… | |
CVE-2026-97600 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ieee802154: cc2520: fix FIFOP work use-after-free The FIFOP interrupt handler queues cc25… | |
CVE-2026-97599 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ieee802154: hwsim: serialize pib updates to fix double-free hwsim_update_pib() does an un… | |
CVE-2026-97598 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: bound automatic table ID allocation fib_empty_table() probes every table ID fr… | |
CVE-2026-97597 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ipv6: flowlabel: cap duplicate leases per socket ipv6_flowlabel_get() allocates an ipv6_f… | |
CVE-2026-97596 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ipvs: reject invalid states in connection template sync records IPVS sync receivers valid… | |
CVE-2026-97595 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mac802154: fix use-after-free of sdata via queued RX frames The RX softirq producer ieee8… |
CVE-2026-97594 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: landlock: Fix use-after-free of the source's parent directory current_check_refer_path()… |
CVE-2026-97593 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX When using a… | |
CVE-2026-97592 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm In function… | |
CVE-2026-97591 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix handling of EBUSY in PHMAC when req is pushed to crypto engine When a re… | |
CVE-2026-97590 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix missing scrub of temp buffers with PAES algorithm In function ctr_paes_d… | |
CVE-2026-97589 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix wrong return code to engine in asynch callbacks When crypto_finalize_has… |
CVE-2026-97588 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly When hardware persiste… | |
CVE-2026-97587 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: perf: RISC-V: store available counter mask as bitmap The available-counter mask was a sin… | |
CVE-2026-97586 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix missing kunmap in afs_dir_search_bucket() Fix afs_dir_search_bucket() to kunmap… | |
CVE-2026-97585 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix double-unmap of directory block Fix afs_edit_dir_remove() to use a cleanup funct… | |
CVE-2026-97584 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix incorrect free in candidate cleanup in afs_lookup_server() Fix afs_lookup_server… |
CVE-2026-97583 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: afs: Clear stale peer app data after address list changes afs_fs_probe_fileserver() fetch… |
CVE-2026-97582 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (gpio-fan) Fix use-after-free in alarm work fan_alarm_irq_handler() queues fan_dat… | |
CVE-2026-97581 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity prepare_tile_i… | |
CVE-2026-97580 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: bound HEVC tile loops and PPS id to the array capacity compute_tiles_unifo… |
CVE-2026-97579 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity vdec_av1_slice_s… |
CVE-2026-97578 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer rockchip_vpu981_av… |
CVE-2026-97577 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity rockchip_vpu9… |
CVE-2026-97576 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC tile counts The stateless HEVC decoders read num_tile_co… |
CVE-2026-97575 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate AV1 tile counts The stateless AV1 decoders use tile_info.tile… |
CVE-2026-97574 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Don't free the live ring's TPA state on queue restart failure bnxt_queue_mem_all… | |
CVE-2026-97573 | High | 8.1 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() bnxt_rx_ring_reset() fr… |
CVE-2026-97572 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Propagate RX ring init failures in bnxt_init_nic() bnxt_init_rx_rings() returns… | |
CVE-2026-97571 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() bnxt_alloc_on… | |
CVE-2026-97570 | High | 8.1 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Bound SW TPA IDs to prevent crashes FW supports up to 1024 concurrent TPAs, so t… |
CVE-2026-97569 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Prevent queue stop with deferred completions When the driver receives a burst of… | |
CVE-2026-97568 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mptcp: syncookies: remember the request backup flag Instead of using an uninitialised bit… | |
CVE-2026-97567 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mptcp: prevent race between disconnect() and rtx Sashiko noted that the two event can rac… | |
CVE-2026-97566 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0 The in-kernel MPTCP path manag… | |
CVE-2026-97565 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: reject short READ responses in CIFSSMBRead() CIFSSMBRead() reads DataLengthH… | |
CVE-2026-97564 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.idmap descriptions cifs.idmap key descriptions carry a… | |
CVE-2026-97563 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() The SMB1 synchronous read h… | |
CVE-2026-97562 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tcon_super_cb() stores a raw superbl… |
CVE-2026-97561 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid When the administrator… | |
CVE-2026-97560 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix one-byte OOB read in smb2_parse_native_symlink() When parsing a share-ro… | |
CVE-2026-97559 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fail DACL rewrite when the new DACL exceeds 64K replace_sids_and_copy_aces()… | |
CVE-2026-97558 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix cifsFileInfo reference leak in deferred close When cifs_close() defers a… | |
CVE-2026-97557 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount in cifs_queue_oplock_break() cifs_queue_oplock_break(… |
CVE-2026-97556 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount when cifs_sb_tlink() fails cifs_oplock_break() takes… | |
CVE-2026-97555 | High | 8.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When id_mode_to_cifs_acl rewri… |