2026 CVEs (page 65)
Page 65 of 662 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-90323 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ublk: validate auto buf reg before taking uring_cmd With UBLK_F_AUTO_BUF_REG, invalid sqe… | |
CVE-2026-90322 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ocfs2/cluster: keep heartbeat local node stable o2nm_node_local_store() handles local=0 b… | |
CVE-2026-90321 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate inline xattrs during inode block validation Patch series "ocfs2: validate… |
CVE-2026-90320 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate external xattr entries when reading metadata ocfs2_validate_xattr_block()… |
CVE-2026-90319 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: rapidio: clear mport->net when rio_add_net() fails rio_alloc_net() stores the newly alloc… | |
CVE-2026-90318 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: fat: release buffer head after rebuilding parent fat_scan_logstart() leaves the matching… | |
CVE-2026-90317 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Invalidate RCU pointers after final spin unlock In a sleepable BPF program, a spin l… |
CVE-2026-90316 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: drm/omap: dsi: Do not copy isr table To be able to unregister stuff from isrs, the corres… |
CVE-2026-90315 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers Currently, the legacy I/… | |
CVE-2026-90314 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() table->offset[i]… | |
CVE-2026-90313 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed A potential inva… | |
CVE-2026-90312 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Check load-acquire src ptr type before the load check_atomic_load() calls check_load… |
CVE-2026-90311 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: thermal: hwmon: Remove hwmon class device along with its parent The current code creates… | |
CVE-2026-90309 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Hold CQ references when processing EQ events EQ handlers look up CQs from dev… |
CVE-2026-90308 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Hold QP references for AE and CM processing AE QP fatal events and iWARP CM p… |
CVE-2026-90307 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ srp_recv_done() passes wc… | |
CVE-2026-90306 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ARM: 9481/2: breakpoint: CFI breakpoints only on demand This removes the stub hw_breakpoi… | |
CVE-2026-90305 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ARM: 9483/1: select HAVE_POSIX_CPU_TIMERS_TASK_WORK Commit c6e61c06d606 ("ARM: 9463/1: Al… | |
CVE-2026-90304 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ARM: 9484/1: enable interrupts when unhandled user faults are triggered PREEMPT_RT requir… | |
CVE-2026-90303 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults When CONFIG_DE… | |
CVE-2026-90302 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: synchronize heartbeat callbacks with o2net teardown Patch series "ocfs2: harden he… | |
CVE-2026-90301 | High | 8.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: o2hb: quiesce negotiate handlers and timeout work Heartbeat regions publish struct… |
CVE-2026-90300 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Clear buf on error in __bpf_get_task_stack Both bpf_get_task_stack and bpf_get_task_… | |
CVE-2026-90299 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix sleepable check for tracing/lsm prog When CONFIG_FUNCTION_ERROR_INJECTION is dis… | |
CVE-2026-90298 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: tcon: Drop TCON TOP device reference of_find_device_by_node() takes a device r… | |
CVE-2026-90297 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: crtc: Propagate layer initialization error sun4i_crtc_init() returns plain NUL… | |
CVE-2026-90296 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: imx6q: fix devres accumulation across driver rebind imx6_soc_volt is allocated w… | |
CVE-2026-90295 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: imx6q: fix out-of-bounds write when probed more than once imx6_soc_volt is alloc… | |
CVE-2026-90294 | High | 7.5 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: IB/isert: delay the final Login Response until the session is registered isert_put_login_… |
CVE-2026-90293 | High | 7.5 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registration isert_put_logi… |
CVE-2026-90292 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siw_accept() siw_accept() looks up the QP supplied by use… |
CVE-2026-90291 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmod_dup_req lifetime handling The kmod dups code uses… |
CVE-2026-90290 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: Restore DAIF state on error Sashiko AI has reported that if swsusp_mte_… | |
CVE-2026-90289 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Resize MST HDCP per-connector arrays to 32 AMDGPU_DM_MAX_DISPLAY_INDEX i… |
CVE-2026-90288 | High | 7.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure for_each_child_of… |
CVE-2026-90287 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: phy: sunplus: fix error handling in sp_uphy_init() Fix the error paths of sp_uphy_init()… | |
CVE-2026-90286 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: Use PFP on the compute queues too On GFX6, the compute rings use the sam… |
CVE-2026-90285 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path qla2x00_sysfs_read_vpd(… | |
CVE-2026-90284 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: firmware_loader: do not queue completed sysfs fallback requests fw_load_sysfs_fallback()… | |
CVE-2026-90283 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: hugetlbfs: release subpool on fill_super failure hugetlbfs_fill_super() allocates a hugep… | |
CVE-2026-90282 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend There is a sm… | |
CVE-2026-90281 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend Runtime PM mus… | |
CVE-2026-90280 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend There is a small win… | |
CVE-2026-90279 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: md/raid5: round bitmap stripes with sector division raid5_bitmap_sector_map() aligns the… | |
CVE-2026-90278 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: md: wait for behind writes before destroying bitmap __md_stop() destroyed the bitmap befo… | |
CVE-2026-90277 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: prevent create failure bitmap UAF llbitmap_create() publishes mddev->bitm… | |
CVE-2026-90276 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: stop daemon timer rearm on destroy llbitmap_destroy() deletes pending_tim… | |
CVE-2026-90275 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: md/raid1: don't set array_frozen in raid1_takeover() raid1_takeover() sets conf->array_fr… | |
CVE-2026-90274 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: coresight: etm4x: fix underflow for usage of (nrseqstate - 1) According to IHI006H Embedd… | |
CVE-2026-90273 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable In the perf… | |
CVE-2026-90272 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: perf: arm_pmuv3: Zero initialize hw_id branch stack field PERF_SAMPLE_BRANCH_HW_INDEX is… | |
CVE-2026-90271 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: arm_mpam: Fix a NULL pointer dereference on unbinding after an error interrupt If a user… | |
CVE-2026-90270 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: arm_mpam: Disable driver unbind to avoid UAF When a user unbinds an MSC and that MSC is t… | |
CVE-2026-90269 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject load-acquire from pointers requiring fault protection A BPF_LOAD_ACQ is not r… | |
CVE-2026-90268 | High | 8.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix error handling in sd_probe() after large pool creation failure After device… |
CVE-2026-90267 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails sd_set_special_bv… | |
CVE-2026-90266 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: don't force read-only on transient -EAGAIN from reloc merge On a zoned FS… | |
CVE-2026-90265 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: btrfs: defrag: fix deadlock between defrag and delalloc space reservation While running f… | |
CVE-2026-90264 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: btrfs: always wait for ordered extents to avoid OE races [BUG] Syzbot reported a bug that… | |
CVE-2026-90263 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: btrfs: check if root is readonly when setting posix acl For a filesystem which has btrfs… | |
CVE-2026-90262 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: btrfs: retry verity reads for not-uptodate Merkle folios btrfs_read_merkle_tree_page() ca… | |
CVE-2026-90261 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: flush active metadata block group at btree_writepages() start btree_writepa… | |
CVE-2026-90260 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: don't clobber the extent buffer when zeroing it out On a zoned filesystem a… |
CVE-2026-90259 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() In that func… | |
CVE-2026-90258 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: airoha: add missed IRQ resource helpers Without hooking .irq_request_resources… | |
CVE-2026-90257 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtio_bt: avoid OOB read of build info string The virtbt_setup_zephyr() sends… | |
CVE-2026-90256 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind hci_conn::l2cap_… |
CVE-2026-90255 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix the SCO setup context lifetime hci_setup_sync() queues a conn_ha… |
CVE-2026-90254 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths adv_ti… | |
CVE-2026-90253 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the mesh send cancel command when it is cancelled mesh_send_cancel(… | |
CVE-2026-90252 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the HCI command when it is cancelled mgmt_hci_cmd_sync() queues the… | |
CVE-2026-90251 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MSFT: validate evt_prefix_len against the response length read_supported_featu… | |
CVE-2026-90250 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage… | |
CVE-2026-90249 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes The IIO core doe… | |
CVE-2026-90248 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: fix teardown of an adopted proto on insert-race loss In tc_new_tfilte… | |
CVE-2026-90247 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix mmap_lock leak in irq_work path stack_map_get_build_id_offset() introduced a per… | |
CVE-2026-90246 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix integer overflow in verify_tags() bounds check verify_tags() validates the… |
CVE-2026-90245 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: fbdev: kyro: Validate overlay viewport coordinates The overlay viewport end coordinates a… | |
CVE-2026-90244 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Restore locking around msi_page_list Unlike a group's default domain, which is… |
CVE-2026-90243 | High | 8.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down copied context entry copied_context_tea… |
CVE-2026-90242 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix iopf_refcount leak on RID domain replacement intel_iommu_attach_device()… | |
CVE-2026-90241 | High | 8.2 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Tear down scalable-mode context on probe failure intel_pasid_setup_sm_context… |
CVE-2026-90240 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush context cache with correct SID when tearing down aliases domain_context… |
CVE-2026-90239 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumem() isp4if_alloc_fw… | |
CVE-2026-90238 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error path isp4sd_pwron_an… | |
CVE-2026-90237 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: move custom expectation support to helper Originally, the ct expectati… |
CVE-2026-90236 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Release the export reference when reaping open stateids nfs4_put_stid() releases th… | |
CVE-2026-90235 | Critical | 9.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE xprtsock rep… |
CVE-2026-90234 | High | 7.5 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: NFS: Return a delegation the client fails to record When an NFS server grants a delegatio… |
CVE-2026-90233 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nvme-pci: release descriptor pools on probe failure The per-NUMA-node descriptor DMA pool… | |
CVE-2026-90232 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: amt: Don't support cross-netns setup. When a lower device is unregistered, amt_device_eve… | |
CVE-2026-90231 | High | 8.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unconfined user namespace restriction forced stack If a task is already con… |
CVE-2026-90230 | Critical | 9.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate() nvmet_execute_auth_send() al… |
CVE-2026-90229 | High | 7.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Destroy the admin queue on removal The admin queue is allocated with blk_mq_a… |
CVE-2026-90228 | High | 7.5 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() When a host issues… |
CVE-2026-90227 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() Unlike IO_CMD / IO64_CMD, NVME_IOCTL_… |
CVE-2026-90226 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: avoid userspace overflow on invalid optlen nfc_llcp_getsockopt() casts optval… | |
CVE-2026-90225 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: read llcp_sock->local under the socket lock in getsockopt nfc_llcp_getsockopt(… |
CVE-2026-90224 | High | 7.5 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix double completion race in nci_data_exchange_complete nci_close_device() and… |
CVE-2026-90223 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound SNL TLV parsing to the skb and add length checks nfc_llcp_recv_snl() wal… |