2026 CVEs (page 63)
Page 63 of 662 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-92523 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: validate dynamic counter attribute length RDMA_NLDEV_ATTR_STAT_HWCOUNTERS is… | |
CVE-2026-92522 | High | 7.3 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: validate MADT IOAPIC entry bounds The IOAPIC hotplug lookup parses both… |
CVE-2026-92521 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root acpi_pci_root_add()… | |
CVE-2026-92520 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Zero queue and stack outputs on lock failure Queue and stack pop/peek helpers accept… | |
CVE-2026-92519 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix memory leak in bpf_jit_free When bpf_int_jit_compile() is called for subp… | |
CVE-2026-92518 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix kernel stack corruption in tailcall with CFI When CONFIG_CFI_CLANG is ena… |
CVE-2026-92517 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf, riscv: Fix extable handling for arena load_acquire emit_atomic_ld_st() returns 1 to… | |
CVE-2026-92516 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix offset warn check for bpf_res_spin_lock Sashiko pointed out correctly that the c… | |
CVE-2026-92515 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve unique-field state across nested structs btf_find_struct_field() initialize… | |
CVE-2026-92514 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Fix CEQ tasklet use-after-free on removal Each CEQ interrupt handler only sch… | |
CVE-2026-92513 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/mana_ib: drain QP references after partial table insertion mana_table_store_ud_qp()… | |
CVE-2026-92512 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix use after free in ib_query_qp() When querying a QP via the netlink flow th… | |
CVE-2026-92511 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ib_destroy_cq_user() When accessing a CQ via t… |
CVE-2026-92510 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ib_destroy_srq_user() When accessing a SRQ via… |
CVE-2026-92509 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in counter_release() When accessing a counter via… | |
CVE-2026-92508 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ib_free_cq() When accessing a CQ via the netli… |
CVE-2026-92507 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ib_dealloc_pd_user() When accessing a PD via t… |
CVE-2026-92506 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix requested device removal race scmi_protocol_device_unrequest() dr… | |
CVE-2026-92505 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix undefined behavior in devid_write debugfs function When for_each_pci_segme… | |
CVE-2026-92504 | High | 7.0 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: thermal: intel: int3400: clean up ODVP on probe failures evaluate_odvp() creates per-ODVP… |
CVE-2026-92503 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() Syzbot/stress-ng reported an ABB… | |
CVE-2026-92502 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ext4: clear stale xarray tags on folios skipped during writeback In data=journal mode, th… | |
CVE-2026-92501 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ext4: drain in-flight DIO before buffered write fallback generic/746 started failing inte… | |
CVE-2026-92500 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ext4: use fsdata to track inline data write state and fix race Instead of checking the li… | |
CVE-2026-92499 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ext4: validate readdir offset before accessing dirent A corrupted directory can trigger t… | |
CVE-2026-92498 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: avoid buffer overreads in WMI event handlers The following WMI event handle… | |
CVE-2026-92497 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() Currently, in ath12k_wmi_op_rx(… | |
CVE-2026-92496 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() Currently, in ath11k_wmi_tl… | |
CVE-2026-92495 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap bnxt_re_mmap() rejects VM_WRITE f… | |
CVE-2026-92494 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix buffer_head leak in ext4_init_orphan_info ext4_init_orphan_info() reads orphan… | |
CVE-2026-92493 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active The crash issue m… | |
CVE-2026-92492 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks cpufreq_cpu_get() retu… | |
CVE-2026-92491 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Roll back partial protocol table registration scmi_protocol_table_reg… | |
CVE-2026-92490 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Unrequest devices if driver registration fails scmi_driver_register()… | |
CVE-2026-92489 | Critical | 9.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix skb double-free in xfrm_dev_direct_output() A return value other than 1 from lo… |
CVE-2026-92488 | High | 7.0 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: complete object teardown when the destroy command fails erdma_destroy_qp(), e… |
CVE-2026-92487 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: exfat: fix valid_size extension over a shared writable mapping When a shared writable map… | |
CVE-2026-92486 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix CFI mismatch in task work callback BPF subprograms use the bpf_callback_t ABI, b… | |
CVE-2026-92485 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix WARNING in bpf_tracing_link_release The trampoline could be corrupted by the bli… |
CVE-2026-92484 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix use-after-free in find_pos_and_ways() error path The error path releases… | |
CVE-2026-92483 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: liveupdate: Remember FLB retrieve() status LUO keeps track of successful retrieve attempt… | |
CVE-2026-92482 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip The gpio_chip is allocated… | |
CVE-2026-92481 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: free EINT resources on unbind mtk_eint_do_init() creates an IRQ domain… | |
CVE-2026-92480 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Validate string descriptors The string descriptor length includes a two-… | |
CVE-2026-92479 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags The single-doorbell com… | |
CVE-2026-92478 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Validate connected lane counts The connected lane count is used by TX eq… | |
CVE-2026-92477 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: debugfs: Reserve space for a string terminator ufs_saved_err_write() copies us… | |
CVE-2026-92476 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: crypto: keembay - Initialize completion before requesting IRQ kmb_ocs_aes_probe() request… | |
CVE-2026-90435 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix integer overflow of user QP buffer size set_user_buf_size() computes the Q… |
CVE-2026-90434 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: isofs: release zisofs block pointer buffer head zisofs_fill_pages() reads the compressed… | |
CVE-2026-90433 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: spi: oc-tiny: switch to managed controller allocation The controller is allocated with th… | |
CVE-2026-90432 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Abort directly from the hardlockup handler scx_hardlockup() defers the abort t… | |
CVE-2026-90431 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: remoteproc: Prevent crash handling to race with rproc_del() There's no synchronization be… | |
CVE-2026-90430 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized tegra241_vintf… | |
CVE-2026-90429 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init A user VINTF is to… |
CVE-2026-90428 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs __tegra241_cmdq… | |
CVE-2026-90427 | High | 7.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() __tegra241_cm… |
CVE-2026-90426 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs tegra241_cmdqv_remove… | |
CVE-2026-90425 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID tegra241_vintf_init_vsid()… |
CVE-2026-90424 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path tegra241_cmdqv_init_struct… | |
CVE-2026-90423 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix UAF in ODP init error-handling path rxe_odp_mr_init_user() stores &umem_odp… |
CVE-2026-90422 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path When mtk_clk_re… | |
CVE-2026-90421 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: PCI: Fix UAF when probe runs concurrent to dyn ID removal Dynamic IDs are only guaranteed… | |
CVE-2026-90420 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix infinite loop in nilfs_clean_segments() syzbot reported a hung task in nilfs_… | |
CVE-2026-90419 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: prevent out-of-bounds read in super root block parsing super-root inode metadata… |
CVE-2026-90418 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch Syzbot reported a ker… | |
CVE-2026-90417 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() When the device is in… | |
CVE-2026-90416 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs get_param() reads a congesti… | |
CVE-2026-90415 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: free STAG index when TPT entry write fails write_tpt_entry() allocates a new… | |
CVE-2026-90414 | Critical | 9.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject PDUs declaring more data than was received isert_recv_done() hands each… |
CVE-2026-90413 | Critical | 9.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject login PDUs declaring more data than was received isert_login_recv_done()… |
CVE-2026-90412 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nvmet: fix return status of RMI log page on allocation failure nvmet_execute_get_log_page… | |
CVE-2026-90411 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request __nvme_fc_init_reques… | |
CVE-2026-90410 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: spi: davinci: switch to managed controller allocation The controller is allocated with th… | |
CVE-2026-90409 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Add vm_bind region with kbo range overlap check When a VM is created, caller… | |
CVE-2026-90408 | High | 7.7 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() There is no po… |
CVE-2026-90407 | High | 7.7 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() There is no po… |
CVE-2026-90406 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: handle runtime PM resume failure in core deinit Check the return value… | |
CVE-2026-90405 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: media: stm32: dcmi: fix some error handling bugs in probe() There are a few issues here: … | |
CVE-2026-90404 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: platform/chrome: cros_ec_debugfs: Unregister panic notifier cros_ec_debugfs_probe() regis… | |
CVE-2026-90403 | High | 7.0 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix error path in rtl_pci_probe() In the last error path in rtl_pci_p… |
CVE-2026-90402 | High | 7.0 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Fix controller cleanup on EDL sysfs failure mhi_register_controller() add… |
CVE-2026-90401 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: md: remove REQ_NOWAIT support from raid1/10/456 REQ_NOWAIT support in md personalities th… |
CVE-2026-90400 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: md: recheck spare changes before starting sync remove_spares() and remove_and_add_spares(… | |
CVE-2026-90399 | High | 8.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() Currently, in ath12k_wmi_mac_ph… |
CVE-2026-90398 | High | 8.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() Currently, in ath11k_wmi_tlv_ma… |
CVE-2026-90397 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published In qco… | |
CVE-2026-90396 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: block: fix dio leak on metadata mapping error A failed integrity mapping holds a dio refe… | |
CVE-2026-90395 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: power: supply: isp1704_charger: cancel work on remove The USB notifier and initial VBUS d… | |
CVE-2026-90394 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: power: supply: sc2731_charger: cancel work on remove The USB notifier and initial charger… | |
CVE-2026-90393 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF in bpf_netns_link_update_prog In bpf_netns_link_update_prog, the c… | |
CVE-2026-90392 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF when reading bpf link info In bpf_link_show_fdinfo and bpf_link_ge… |
CVE-2026-90391 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone dmirror_fault() is called… | |
CVE-2026-90390 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: md/bitmap: resume array on backlog_store() error path backlog_store() suspends the array… | |
CVE-2026-90389 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: md: scope memalloc_noio to allocation critical sections Storing a memalloc_noio_save() to… | |
CVE-2026-90388 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Check atomic pool allocation result directly The non-blocking, non-coherent al… |
CVE-2026-90387 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: swiotlb: Preserve allocation virtual address for dynamic pools swiotlb_alloc_tlb() can al… |
CVE-2026-90386 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices On an empty bus ENTDAA ass… | |
CVE-2026-90385 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: md/raid1: create serial pool adding rdev to array with serialize_policy=1 The following b… | |
CVE-2026-90384 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iomap: release the folio batch on iomap callback failures A sashiko review of an unrelate… |