2026 CVEs (page 323)
Page 323 of 689 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-64390 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2_LOCK adds each granted byte-ran… |
CVE-2026-64389 | High | 8.2 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbd_auth_ntlmv2() derives t… |
CVE-2026-64388 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership (chown) and group (chgrp… |
CVE-2026-64387 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return… |
CVE-2026-64386 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query_info() replay double-free A response-bearing attempt can return a… |
CVE-2026-64385 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return… |
CVE-2026-64384 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing attempt can return a… |
CVE-2026-64383 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_flush() replay SMB2_flush() keeps its response buffe… |
CVE-2026-64382 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_open() replay A response-bearing attempt can return… |
CVE-2026-64381 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix next buffer leak in receive_encrypted_standard() receive_encrypted_stand… |
CVE-2026-64380 | High | 8.2 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posix_info_sid_size() reads sid[1] to obtain… |
CVE-2026-64379 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active… |
CVE-2026-64378 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() When a conta… |
CVE-2026-64377 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcom_cpufreq.data is allocated with de… |
CVE-2026-64376 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: firmware_loader: fix device reference leak in firmware_upload_register() firmware_upload_… |
CVE-2026-64375 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: proc: protect ptrace_may_access() with exec_update_lock (FD links) proc_pid_get_link() an… |
CVE-2026-64374 | High | 7.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT RT migration is done aggress… |
CVE-2026-64373 | Medium | 4.7 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: Fix hotplug-suspend race during reboot During system reboot, cpufreq_suspend() i… |
CVE-2026-64372 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation pcc_cpufreq_do_osc()… |
CVE-2026-64371 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: proc: protect ptrace_may_access() with exec_update_lock (part 1) Fix the easy cases where… |
CVE-2026-64370 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path In do_cpu_nanosl… |
CVE-2026-64369 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: s390: Revert support for DCACHE_WORD_ACCESS load_unaligned_zeropad() reads eight bytes fr… |
CVE-2026-64368 | High | 8.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled When init (zer… |
CVE-2026-64367 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: HID: hid-goodix-spi: validate report size to prevent stack buffer overflow goodix_hid_set… |
CVE-2026-64366 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert wacom_wac_queue_insert… |
CVE-2026-64365 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: HID: letsketch: fix UAF on inrange_timer at driver unbind letsketch_driver does not provi… |
CVE-2026-64364 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix out-of-bounds bit access on mt_io_flags mt_io_flags is a single unsi… |
CVE-2026-64363 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: HID: appleir: fix UAF on pending key_up_timer in remove() appleir_remove() runs hid_hw_st… |
CVE-2026-64362 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: HID: lg-g15: cancel pending work on remove to fix a use-after-free lg_g15_data is allocat… |
CVE-2026-64361 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length check_and_correct_req… |
CVE-2026-64360 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: zero-initialize buffer in hfs_bnode_read hfs_bnode_read() can return early w… |
CVE-2026-64359 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers Syzbot reported a h… |
CVE-2026-64358 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: cancel workqueue on release for supported platforms only Since a recent… |
CVE-2026-64357 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchmaps reservation limit check xfs_exchmaps_estimate_overhead() adds the bmbt… |
CVE-2026-64356 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix memory leak in xfs_dqinode_metadir_create() If xfs_metadir_create() fails in xfs… |
CVE-2026-64355 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject fragmented frames in devmap Devmap broadcast redirects clone the packet for a… |
CVE-2026-64354 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Validate BTF repeated field counts before expansion btf_parse_struct_metas() walks u… |
CVE-2026-64353 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Keep dynamic inner array lookups nullable An ARRAY_OF_MAPS can use an array created… |
CVE-2026-64352 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Allow LPM map access from sleepable BPF programs trie_lookup_elem() annotates its rc… |
CVE-2026-64351 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() kalmia_rx_fixup() computes u… |
CVE-2026-64350 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() cdnsp_alloc_stream… |
CVE-2026-64349 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() The dwc3_ulpi_se… |
CVE-2026-64348 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: free iso schedules on failed submit EHCI and FOTG210 isochronous submits build an eh… |
CVE-2026-64347 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler The OTG branch of… |
CVE-2026-64346 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: Fix use-after-free in gadget_match_driver The udc structure acts as the… |
CVE-2026-64345 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_printer: take kref only for successful open printer_open() returns -EBUSY… |
CVE-2026-64344 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: idmouse: fix use-after-free on disconnect race mutex_unlock() may access the mutex s… |
CVE-2026-64343 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: ldusb: fix use-after-free on disconnect race mutex_unlock() may access the mutex str… |
CVE-2026-64342 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: iowarrior: fix use-after-free on disconnect Submitted write URBs are not stopped on… |
CVE-2026-64341 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: iowarrior: fix use-after-free on disconnect race mutex_unlock() may access the mutex… |
CVE-2026-64340 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: legousbtower: fix use-after-free on disconnect race mutex_unlock() may access the mu… |
CVE-2026-64339 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: bound bulk IN response length to the received transfer usbio_bulk_msg()… |
CVE-2026-64338 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: misc: uss720: unregister parport on probe failure uss720_probe() registers a parport… |
CVE-2026-64337 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3_gadget_queue() maps the request before… |
CVE-2026-64336 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspan_pda: fix information leak The write() callback is supposed to return… |
CVE-2026-64335 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: digi_acceleport: fix broken rx after throttle If the port is closed while th… |
CVE-2026-64334 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: digi_acceleport: fix hard lockup on disconnect If submitting the OOB write u… |
CVE-2026-64333 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: digi_acceleport: fix write buffer corruption The digi_write_inb_command() is… |
CVE-2026-64332 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: ulpi: fix memory leak on registration failure The allocated device name is never fre… |
CVE-2026-64331 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vep_dequeue() vep_alloc_request() wasn't initializing vreq… |
CVE-2026-64330 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Validate SVID index in svdm_consume_modes() In svdm_consume_modes(), th… |
CVE-2026-64329 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove The threaded IRQ handler ccg_… |
CVE-2026-64328 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix DMA fence leak In ffs_dmabuf_transfer(), a ffs_dma_fence object is… |
CVE-2026-64327 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks When pars… |
CVE-2026-64326 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: block: skip sync_blockdev() on surprise removal in bdev_mark_dead() bdev_mark_dead()'s @s… |
CVE-2026-64325 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BU… |
CVE-2026-64324 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: udf: validate free block extents against the partition length udf_free_blocks() checks th… |
CVE-2026-64323 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udf_load_vat() takes the virtu… |
CVE-2026-64322 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udf_load_sparable_… |
CVE-2026-64321 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: nvme: target: rdma: fix ndev refcount leak on queue connect nvmet_rdma_queue_connect() ca… |
CVE-2026-64320 | Critical | 9.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmet_execute_disc_… |
CVE-2026-64319 | Critical | 9.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmet_auth_repl… |
CVE-2026-64318 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: partitions: aix: bound the pp_count scan to the ppe array aix_partition() reads the physi… |
CVE-2026-64317 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: isofs: bound Rock Ridge symlink components to the SL record get_symlink_chunk() and the S… |
CVE-2026-64316 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: caam - use print_hex_dump_devel to guard key hex dumps Use print_hex_dump_devel()… |
CVE-2026-64315 | High | 7.0 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: caam - use print_hex_dump_devel to guard key hex dumps Use print_hex_dump_devel()… |
CVE-2026-64314 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: chacha20poly1305 - validate poly1305 template argument chachapoly_create() still… |
CVE-2026-64313 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: ecc - Fix carry overflow in vli multiplication The carry flag calculation fails w… |
CVE-2026-64312 | High | 7.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - restore callback for non-parallel fallback pcrypt installs pcrypt_aead_d… |
CVE-2026-64311 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: loongson - Remove broken and unused loongson-rng The loongson-rng rng_alg has sev… |
CVE-2026-64310 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for SEV ioctls Sashiko notes: > if SEV initializatio… |
CVE-2026-64309 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) Sashiko notes: > if SEV initia… |
CVE-2026-64308 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) Sashiko notes: > if SEV ini… |
CVE-2026-64307 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG) Sashiko notes: > if SEV initia… |
CVE-2026-64306 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: drbg - Fix returning success on failure in CTR_DRBG drbg_ctr_generate() sometimes… |
CVE-2026-64305 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: qat - protect service table iterations with service_lock The service_table list i… |
CVE-2026-64304 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser (rsa_helper.c… |
CVE-2026-64303 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengine_prep_s… |
CVE-2026-64302 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix freeing of PMD-sized vmemmap pages Commit bf9e4e30f353 ("x86/mm: use pagetabl… |
CVE-2026-64301 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() scmi_regulator_probe… |
CVE-2026-64300 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix page UAF in map_range() map_range() reads rb->aux_pages[], rb->aux_nr_pages… |
CVE-2026-64299 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not necessar… |
CVE-2026-64298 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC POSIX requires write permiss… |
CVE-2026-64297 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of module_extend_max_pages() module_extend_max_pag… |
CVE-2026-64296 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfat_find_dir_entry() In exfat_find_dir_entry(), each TY… |
CVE-2026-64295 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access The pag… |
CVE-2026-64294 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: mm: do file ownership checks with the proper mount idmap Ever since idmapped mounts were… |
CVE-2026-64293 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read The bound-check in iommu… |
CVE-2026-64292 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Move vevent memory allocation outside spinlock The veventq memory allocation hap… |
CVE-2026-64291 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventq_depth upper bound iommufd_veventq_alloc() accepts any !0 veventq_dep… |