2026 CVEs (page 66)
Page 66 of 662 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-90222 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: hold a reference to the request skb during send_frame __pn533_send_async() pu… | |
CVE-2026-90221 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing nci_core_init_rsp_pack… | |
CVE-2026-90220 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Don't leak the extension cell pointer in the bounce payload The bounce_error_e… | |
CVE-2026-90219 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Free debugfs on registration failure c4iw_alloc() creates the per-device debu… | |
CVE-2026-90218 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix WARNING in res_to_rt syzbot reported a WARN_ON(!res->dev) in res_to_rt() tr… | |
CVE-2026-90217 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Compare iterator types during state pruning An iterator stack slot can be MEM_RCU or… |
CVE-2026-90216 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ubi: Fix rollback for explicit UBI device numbers ubi_init_attach() rolls back module ini… | |
CVE-2026-90215 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: mtd: ubi: Release device reference on busy detach ubi_detach_mtd_dev() obtains a device r… | |
CVE-2026-90214 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ASoC: xilinx: formatter_pcm: fix stream_data leak on open error In xlnx_formatter_pcm_ope… | |
CVE-2026-90213 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix memory leak in error path of build_tree() In the error path of build_… | |
CVE-2026-90212 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: arm64/efi: Avoid voluntary preemption with efi_mm installed Gus reports a bad kernel memo… | |
CVE-2026-90211 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf, s390: Clear fetch destination on faulting arena atomic Same missing register clear a… | |
CVE-2026-90210 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in bpf_trampoline_multi_attach_free on update failure When bpf_trampoline_up… |
CVE-2026-90209 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix deadlock during unregister Unregistering an s390dbf debug area while one… | |
CVE-2026-90208 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type Samsung PWM timer might be… | |
CVE-2026-90207 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with event_input snd_midi_input_event() must no… |
CVE-2026-90206 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nvmet: fix max_qid race between configfs and controller allocation The function nvmet_sub… | |
CVE-2026-90205 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate orphan slot during inode read Patch series "ocfs2: validate active orphan… |
CVE-2026-90204 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate DIO orphan slot during inode read [BUG] A corrupted append-DIO dinode (hi… |
CVE-2026-90203 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Squashfs: check block offset is not negative If a negative offset is read off disk (for e… |
CVE-2026-90202 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers _base_release_memory_pools() un… | |
CVE-2026-90201 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race This bug was… | |
CVE-2026-90200 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix integer overflow in MFT cluster validation In ntfs_init_from_boot(), the bo… | |
CVE-2026-90199 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject out-of-range evcn in mi_enum_attr() In mi_enum_attr(), the start/end VCN… |
CVE-2026-90198 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix use-after-free in snd_card_do_free() A use-after-free was detected in snd… | |
CVE-2026-90197 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: HID: haptic: don't write an uninitialized value to unhandled usages fill_effect_buf() ini… | |
CVE-2026-90196 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer… | |
CVE-2026-90195 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args On RV64, the ABI… | |
CVE-2026-90194 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ACPI: scan: fix bus ID cleanup on device_add() failures When device_add() fails after acp… | |
CVE-2026-90193 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler qcom_cpucp_mbox_irq_fn()… | |
CVE-2026-90192 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in send_data callback mailbox_clear_channel() calls… | |
CVE-2026-90191 | High | 8.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls… |
CVE-2026-90190 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: null_blk: use DEFINE_MUTEX for the file-scope mutex In null_init(), mutex_init(&lock) cur… | |
CVE-2026-90189 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: null_blk: register configfs subsystem after creating default devices In null_init(), conf… | |
CVE-2026-90188 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: null_blk: free global tag_set on init error path If shared_tags is enabled, null_setup_ta… | |
CVE-2026-90187 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: null_blk: free zones array on device power-off null_init_zoned_dev() allocates dev->zones… | |
CVE-2026-90186 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: null_blk: reject per-device queue resize for shared tag set When shared_tags is enabled… | |
CVE-2026-90185 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: null_blk: serialize configfs attribute stores with the lock The NULLB_DEVICE_ATTR _store… | |
CVE-2026-90184 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: null_blk: serialize configfs attribute updates with device setup The attribute store meth… | |
CVE-2026-90183 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: clear delay state when freeing policy data io.latency can throttle a group… | |
CVE-2026-90182 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: blk-iocost: clear delay state when freeing policy data iocg_kick_delay() turns sufficient… | |
CVE-2026-90181 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ublk: avoid teardown retry loop on xarray allocation failure __ublk_shmem_remove_ranges()… | |
CVE-2026-90180 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: block: mtip32xx: synchronize ioctls with device removal The ioctl handlers only test REMO… | |
CVE-2026-90179 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix deadlock in complain-mode change_hat The use of change_hat when in complain… | |
CVE-2026-90178 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (coretemp) Fix core_data leak on CPUs without PTS pdata->core_data is allocated in… | |
CVE-2026-90177 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Check pointer type for all atomic RMW paths Atomic RMW verification records an instr… |
CVE-2026-90176 | High | 8.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: Do not skip lock checks for single-byte ranges check_lock_range() uses inclusive r… |
CVE-2026-90175 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer Free it unconditio… | |
CVE-2026-90174 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() ksmbd_alloc_user() copies resp->… |
CVE-2026-90173 | Critical | 9.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: free completion queues with ib_free_cq() smbdirect_connection_destroy_qp(… |
CVE-2026-90172 | High | 7.5 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: destroy QP before mem pools on accept failure On the rdma_accept_failed e… |
CVE-2026-90171 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: release pending child sockets outside the handler lock smbdirect_socket_d… | |
CVE-2026-90170 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ipc response length before dereferencing its fields ipc_validate_msg() co… | |
CVE-2026-90169 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: free preauth sessions on connection teardown SMB3.1.1 multichannel binding preserv… | |
CVE-2026-90167 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize oplock close with pending break ownership close may abort an in-flight o… | |
CVE-2026-90166 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request() See the procedure belo… | |
CVE-2026-90165 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger() See the pro… | |
CVE-2026-90164 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: smb/server: abort initialization when proc setup fails ksmbd_server_init() calls ksmbd_pr… | |
CVE-2026-90163 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: smb/server: call ksmbd_proc_cleanup() on module init failure When a later initializer fai… | |
CVE-2026-90162 | High | 8.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer publishing granted locks to prevent UAF/double-free race In smb2_lock(), mid… |
CVE-2026-90161 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced ztailpacking pclusters On-disk sizes of interlaced pclusters should… |
CVE-2026-90160 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: lwt_bpf: Restore reserved headroom after xmit program ip_finish_output2() expands an skb… | |
CVE-2026-90159 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks _bpf_setsockopt() and _bp… | |
CVE-2026-90158 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: m68k: nfcon: Do not call console_is_registered() in nfcon_device() Since 7c2af0f634f1 ("t… | |
CVE-2026-90157 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative optlen in cgroup getsockopt hook A cgroup getsockopt BPF program can… | |
CVE-2026-90156 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely discard unregistered deferred locks When vfs_lock_file() defers a lock, smb… | |
CVE-2026-90155 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: detach blocked lock requests before freeing A file_lock retained by ksmbd for byte… | |
CVE-2026-90154 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: scope session state changes to bound connections ksmbd_all_conn_set_status() treat… | |
CVE-2026-90153 | High | 8.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size smb_check_perm_dacl() validates… |
CVE-2026-90152 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: smb/server: fix session leak in ksmbd_session_register() See the procedure below: smb2… | |
CVE-2026-90151 | Critical | 9.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: NFSv4: remove callback IDR entry on client allocation failure nfs4_alloc_client() allocat… |
CVE-2026-90150 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: pnfs/blocklayout: Fix device leaks on parse failure bl_parse_concat() and bl_parse_stripe… | |
CVE-2026-90149 | High | 7.5 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers flexfiles accepts NFSv4.0… |
CVE-2026-90148 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease() When nfs4… | |
CVE-2026-90147 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate() devm_clk_get_option… | |
CVE-2026-90146 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bpf, xdp: move offload check into dev_xdp_install() bpf_xdp_link_update() calls dev_xdp_i… |
CVE-2026-90145 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed Previ… |
CVE-2026-90144 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL deref in dpll_device_ops() during teardown race When the last owner of a d… | |
CVE-2026-90143 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net: kcm: Hold RCU read lock while running BPF parser kcm_parse_func_strparser() calls bp… |
CVE-2026-90142 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix resize of the RX ring When a AF_XDP socket is attached, the virtnet_rx_re… |
CVE-2026-90141 | High | 7.3 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ipvs: fix integer overflow in ftp helper port/address parsing ip_vs_ftp_get_addrport() ac… |
CVE-2026-90140 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: cuse: wait for pending RCU callbacks on module exit Since commit 053fc4f755ad ("fuse: fix… | |
CVE-2026-90139 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: fuse: check for NULL root inode in fuse_fill_super_submount fuse_iget() can return NULL w… | |
CVE-2026-90138 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: vsock: don't check the listener's sk_err in vsock_accept() Syzbot reported an issue which… | |
CVE-2026-90137 | High | 7.7 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix password encoding bounds check The password PSWD_ENCODINGS… |
CVE-2026-90136 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/hsmp: Reject negative power cap writes in hwmon hsmp_hwmon_write() takes… | |
CVE-2026-90135 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs() sashiko is reporting that t… | |
CVE-2026-90134 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ntfs: fix kmap_local_page() usage in compress Several compressed I/O paths discard the ad… | |
CVE-2026-90133 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ntfs: Fix index_root heap OOB write in ntfs_ir_to_ib() ntfs_ir_to_ib copies all entries f… |
CVE-2026-90132 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ntfs: reject unprivileged writes to reserved $LX* xattrs Reject setxattr of the reserved… |
CVE-2026-90131 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ntfs: serialize resident iomap reads with mrec_lock ntfs_read_iomap_begin_resident() walk… |
CVE-2026-90130 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: vdpa_sim: fix cleanup after worker creation failure vdpasim_create() leaves vdpasim->work… | |
CVE-2026-90129 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: virtio_balloon: quiesce balloon work before device shutdown Commit 8bd2fa086a04 ("virtio… | |
CVE-2026-90128 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: fix wrong list iterated in add_direct_chain error path In add_direct_chain()… | |
CVE-2026-90127 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: virtio: rtc: time out alarm requests RTC class operations run with rtc_device.ops_lock he… | |
CVE-2026-90126 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: rtc: pcf8563: fix clock provider leak on unbind pcf8563_clkout_register_clk() registers t… | |
CVE-2026-90125 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix request buffer leak in smb2_new_read_req() smb2_new_read_req() allocates… | |
CVE-2026-90124 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: irqchip/renesas-rzg2l: Fix loss of interrupt rzg2l_clear_irq_int() and rzg2l_clear_tint_i… | |
CVE-2026-90123 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: irqchip/ast2700-intc: Avoid allocating in the irq_domain activate() callback The interrup… | |
CVE-2026-90122 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: clk: visconti: Make sure clk_init_data is fully initialized The clk_init_data structure c… |