# CVEs published 2026-07-19

464 CVEs were published on July 19, 2026: 58 critical, 205 high. Days are UTC.

- [CVE-2026-45138](https://cve.now/CVE-2026-45138.md): CI4MS: Stored XSS in Blog Content via Broken \`html\_purify\` Validation Rule (CVSS 5.4, ci4-cms-erp ci4ms · ci4-cms-erp/ci4ms)
- [CVE-2026-42566](https://cve.now/CVE-2026-42566.md): Meshtastic: Malformed UTF-8 in User.long\_name broadcast over LoRa causes mesh-wide client decode failure (CVSS 7.5, meshtastic firmware)
- [CVE-2026-44359](https://cve.now/CVE-2026-44359.md): Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull\_request\_target Fork Checkout in CI Workflow (CVSS 10.0, meshtastic firmware)
- [CVE-2026-12484](https://cve.now/CVE-2026-12484.md): Unsafe Deserialization in keras.layers.TorchModuleWrapper.from\_config (CVSS 7.8, keras-team/keras · keras)
- [CVE-2026-64186](https://cve.now/CVE-2026-64186.md): iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs (no CVSS, Linux)
- [CVE-2026-64185](https://cve.now/CVE-2026-64185.md): sysfs: don't remove existing directory on update failure (no CVSS, Linux)
- [CVE-2026-64184](https://cve.now/CVE-2026-64184.md): mm/damon/sysfs-schemes: call missing mem\_cgroup\_iter\_break() (no CVSS, Linux)
- [CVE-2026-64183](https://cve.now/CVE-2026-64183.md): efi: Allocate runtime workqueue before ACPI init (no CVSS, Linux)
- [CVE-2026-64182](https://cve.now/CVE-2026-64182.md): drivers/base/memory: fix memory block reference leak in poison accounting (no CVSS, Linux)
- [CVE-2026-64181](https://cve.now/CVE-2026-64181.md): mm: fix \_\_vm\_normal\_page() to handle missing support for pmd\_special()/pud\_special() (CVSS 7.8, Linux)
- [CVE-2026-64180](https://cve.now/CVE-2026-64180.md): mm/memory\_hotplug: fix memory block reference leak on remove (no CVSS, Linux)
- [CVE-2026-64179](https://cve.now/CVE-2026-64179.md): net: wwan: iosm: fix potential memory leaks in ipc\_imem\_init() (no CVSS, Linux)
- [CVE-2026-64178](https://cve.now/CVE-2026-64178.md): Bluetooth: bnep: Fix UAF read of dev-\>name (CVSS 8.8, Linux)
- [CVE-2026-64177](https://cve.now/CVE-2026-64177.md): phonet/pep: disable BH around forwarded sk\_receive\_skb() (no CVSS, Linux)
- [CVE-2026-64176](https://cve.now/CVE-2026-64176.md): wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVSS 8.1, Linux)
- [CVE-2026-64175](https://cve.now/CVE-2026-64175.md): wifi: iwlwifi: mld: stop TX during firmware restart (CVSS 7.5, Linux)
- [CVE-2026-64174](https://cve.now/CVE-2026-64174.md): wifi: cfg80211: advance loop vars in cfg80211\_merge\_profile() (no CVSS, Linux)
- [CVE-2026-64173](https://cve.now/CVE-2026-64173.md): tracing: Do not call map-\>ops-\>elt\_free() if elt\_alloc() fails (no CVSS, Linux)
- [CVE-2026-64172](https://cve.now/CVE-2026-64172.md): KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235) (CVSS 7.1, Linux)
- [CVE-2026-64171](https://cve.now/CVE-2026-64171.md): i2c: tegra: fix pm\_runtime leak on mutex\_lock failure (no CVSS, Linux)
- [CVE-2026-64170](https://cve.now/CVE-2026-64170.md): spi: qup: fix error pointer deref after DMA setup failure (no CVSS, Linux)
- [CVE-2026-64169](https://cve.now/CVE-2026-64169.md): spi: ep93xx: fix error pointer deref after DMA setup failure (no CVSS, Linux)
- [CVE-2026-64168](https://cve.now/CVE-2026-64168.md): spi: sprd: fix error pointer deref after DMA setup failure (no CVSS, Linux)
- [CVE-2026-64167](https://cve.now/CVE-2026-64167.md): kho: skip KHO for crash kernel (no CVSS, Linux)
- [CVE-2026-64166](https://cve.now/CVE-2026-64166.md): firmware: arm\_ffa: Check for NULL FF-A ID table while driver registration (no CVSS, Linux)
- [CVE-2026-64165](https://cve.now/CVE-2026-64165.md): ARM: integrator: Fix early initialization (no CVSS, Linux)
- [CVE-2026-64164](https://cve.now/CVE-2026-64164.md): btrfs: tracepoints: fix sleep while in atomic context in btrfs\_sync\_file() (no CVSS, Linux)
- [CVE-2026-64163](https://cve.now/CVE-2026-64163.md): test\_kprobes: clear kprobes between test runs (no CVSS, Linux)
- [CVE-2026-64162](https://cve.now/CVE-2026-64162.md): idpf: fix read\_dev\_clk\_lock spinlock init in idpf\_ptp\_init() (CVSS 9.8, Linux)
- [CVE-2026-64161](https://cve.now/CVE-2026-64161.md): net: ti: icssm-prueth: fix eth\_ports\_node leak in probe (no CVSS, Linux)
- [CVE-2026-64160](https://cve.now/CVE-2026-64160.md): netfs: Fix potential for tearing in -\>remote\_i\_size and -\>zero\_point (CVSS 9.8, Linux)
- [CVE-2026-64159](https://cve.now/CVE-2026-64159.md): netfs: Fix zeropoint update where i\_size \> remote\_i\_size (no CVSS, Linux)
- [CVE-2026-64157](https://cve.now/CVE-2026-64157.md): netfs: Fix partial invalidation of streaming-write folio (no CVSS, Linux)
- [CVE-2026-64156](https://cve.now/CVE-2026-64156.md): netfs, afs: Fix write skipping in dir/link writepages (no CVSS, Linux)
- [CVE-2026-64155](https://cve.now/CVE-2026-64155.md): wifi: ath11k: fix error path leaks in some WMI WOW calls (no CVSS, Linux)
- [CVE-2026-64154](https://cve.now/CVE-2026-64154.md): drm/msm/adreno: Fix a reference leak in a6xx\_gpu\_init() (no CVSS, Linux)
- [CVE-2026-64153](https://cve.now/CVE-2026-64153.md): drm/msm: Fix iommu\_map\_sgtable() return value check and avoid WARN (CVSS 8.8, Linux)
- [CVE-2026-64152](https://cve.now/CVE-2026-64152.md): iommu: Handle unmap error when iommu\_debug is enabled (CVSS 7.8, Linux)
- [CVE-2026-64151](https://cve.now/CVE-2026-64151.md): iommupt: Check for missing PAGE\_SIZE in the pgsize\_bitmap (CVSS 8.4, Linux)
- [CVE-2026-64150](https://cve.now/CVE-2026-64150.md): netfilter: nft\_inner: release local\_lock before re-enabling softirqs (CVSS 9.8, Linux)
- [CVE-2026-64149](https://cve.now/CVE-2026-64149.md): dma-mapping: move dma\_map\_resource() sanity check into debug code (no CVSS, Linux)
- [CVE-2026-64148](https://cve.now/CVE-2026-64148.md): pds\_core: fix error handling in pdsc\_devcmd\_wait (CVSS 7.5, Linux)
- [CVE-2026-64147](https://cve.now/CVE-2026-64147.md): pds\_core: fix debugfs\_lookup dentry leak and error handling (no CVSS, Linux)
- [CVE-2026-64146](https://cve.now/CVE-2026-64146.md): erofs: fix metabuf leak in inode xattr initialization (no CVSS, Linux)
- [CVE-2026-64145](https://cve.now/CVE-2026-64145.md): wifi: wilc1000: fix dma\_buffer leak on bus acquire failure (no CVSS, Linux)
- [CVE-2026-64144](https://cve.now/CVE-2026-64144.md): Bluetooth: btmtk: fix urb-\>setup\_packet leak in error paths (no CVSS, Linux)
- [CVE-2026-64143](https://cve.now/CVE-2026-64143.md): platform/x86: uniwill-laptop: Do not enable the charging limit even when forced (no CVSS, Linux)
- [CVE-2026-64142](https://cve.now/CVE-2026-64142.md): ksmbd: close durable scavenger races against m\_fp\_list lookups (CVSS 9.8, Linux)
- [CVE-2026-64141](https://cve.now/CVE-2026-64141.md): ksmbd: fix null pointer dereference in compare\_guid\_key() (CVSS 7.5, Linux)
- [CVE-2026-64140](https://cve.now/CVE-2026-64140.md): ksmbd: fix null pointer dereference in proc\_show\_files() (CVSS 7.5, Linux)
- [CVE-2026-64139](https://cve.now/CVE-2026-64139.md): ksmbd: fix SID memory leak in set\_posix\_acl\_entries\_dacl() on overflow (no CVSS, Linux)
- [CVE-2026-64138](https://cve.now/CVE-2026-64138.md): ksmbd: validate SID in parent security descriptor during ACL inheritance (CVSS 8.8, Linux)
- [CVE-2026-64137](https://cve.now/CVE-2026-64137.md): smb: client: require net admin for CIFS SWN netlink (CVSS 7.8, Linux)
- [CVE-2026-64136](https://cve.now/CVE-2026-64136.md): smb: client: protect tc\_count increment in smb2\_find\_smb\_sess\_tcon\_unlocked() (CVSS 9.8, Linux)
- [CVE-2026-64135](https://cve.now/CVE-2026-64135.md): hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C\_SMBUS\_BLOCK\_MAX (no CVSS, Linux)
- [CVE-2026-64134](https://cve.now/CVE-2026-64134.md): ALSA: pcm: Don't setup bogus iov\_iter for silencing (CVSS 7.8, Linux)
- [CVE-2026-64133](https://cve.now/CVE-2026-64133.md): ALSA: asihpi: Fix potential OOB array access at reading cache (CVSS 7.8, Linux)
- [CVE-2026-64132](https://cve.now/CVE-2026-64132.md): ipv6: ioam: refresh hdr pointer before ioam6\_event() (CVSS 9.8, Linux)
- [CVE-2026-64131](https://cve.now/CVE-2026-64131.md): mm/memory: fix spurious warning when unmapping device-private/exclusive pages (no CVSS, Linux)
- [CVE-2026-64130](https://cve.now/CVE-2026-64130.md): mm/page\_alloc: fix initialization of tags of the huge zero folio with init\_on\_free (no CVSS, Linux)
- [CVE-2026-64129](https://cve.now/CVE-2026-64129.md): mm/migrate\_device: fix spinlock leak in migrate\_vma\_insert\_huge\_pmd\_page (no CVSS, Linux)
- [CVE-2026-64128](https://cve.now/CVE-2026-64128.md): Bluetooth: ISO: drop ISO\_END frames received without prior ISO\_START (no CVSS, Linux)
- [CVE-2026-64127](https://cve.now/CVE-2026-64127.md): Bluetooth: L2CAP: ecred\_reconfigure: send packed pdu, not stack pointer (no CVSS, Linux)
- [CVE-2026-64126](https://cve.now/CVE-2026-64126.md): Bluetooth: MGMT: validate Add Extended Advertising Data length (CVSS 7.3, Linux)
- [CVE-2026-64125](https://cve.now/CVE-2026-64125.md): net: bcmgenet: keep RBUF EEE/PM disabled (CVSS 9.8, Linux)
- [CVE-2026-64124](https://cve.now/CVE-2026-64124.md): net: devmem: reject dma-buf bind with non-page-aligned size or SG length (CVSS 8.8, Linux)
- [CVE-2026-64123](https://cve.now/CVE-2026-64123.md): net: hsr: defer node table free until after RCU readers (CVSS 7.8, Linux)
- [CVE-2026-64122](https://cve.now/CVE-2026-64122.md): net/mlx5e: Fix use-after-free in mlx5e\_tx\_reporter\_timeout\_recover (CVSS 9.8, Linux)
- [CVE-2026-64121](https://cve.now/CVE-2026-64121.md): net: ifb: report ethtool stats over num\_tx\_queues (no CVSS, Linux)
- [CVE-2026-64120](https://cve.now/CVE-2026-64120.md): net: ethtool: fix NULL pointer dereference in phy\_reply\_size (no CVSS, Linux)
- [CVE-2026-64119](https://cve.now/CVE-2026-64119.md): l2tp: use list\_del\_rcu in l2tp\_session\_unhash (no CVSS, Linux)
- [CVE-2026-64118](https://cve.now/CVE-2026-64118.md): qed: fix double free in qed\_cxt\_tables\_alloc() (CVSS 8.4, Linux)
- [CVE-2026-64117](https://cve.now/CVE-2026-64117.md): wifi: mac80211: capture fast-RX rate before mesh reuses skb-\>cb (CVSS 8.8, Linux)
- [CVE-2026-64116](https://cve.now/CVE-2026-64116.md): ipv6: ioam: add NULL check for idev in ipv6\_hop\_ioam() (CVSS 7.5, Linux)
- [CVE-2026-64115](https://cve.now/CVE-2026-64115.md): vsock/vmci: fix UAF when peer resets connection during handshake (CVSS 8.8, Linux)
- [CVE-2026-64114](https://cve.now/CVE-2026-64114.md): ipv4: raw: reject IP\_HDRINCL packets with ihl \< 5 (CVSS 7.8, Linux)
- [CVE-2026-64113](https://cve.now/CVE-2026-64113.md): ixgbevf: fix use-after-free in VEPA multicast source pruning (CVSS 9.8, Linux)
- [CVE-2026-64112](https://cve.now/CVE-2026-64112.md): rbd: eliminate a race in lock\_dwork draining on unmap (CVSS 7.8, Linux)
- [CVE-2026-64111](https://cve.now/CVE-2026-64111.md): lsm: hold cred\_guard\_mutex for lsm\_set\_self\_attr() (CVSS 7.1, Linux)
- [CVE-2026-64110](https://cve.now/CVE-2026-64110.md): igc: fix potential skb leak in igc\_fpe\_xmit\_smd\_frame() (no CVSS, Linux)
- [CVE-2026-64109](https://cve.now/CVE-2026-64109.md): af\_unix: Fix UAF read of tail-\>len in unix\_stream\_data\_wait() (CVSS 8.8, Linux)
- [CVE-2026-64108](https://cve.now/CVE-2026-64108.md): cifs: Fix busy dentry used after unmounting (CVSS 7.8, Linux)
- [CVE-2026-64107](https://cve.now/CVE-2026-64107.md): ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512x\_overclock\_xxx\_put() (no CVSS, Linux)
- [CVE-2026-64106](https://cve.now/CVE-2026-64106.md): KVM: arm64: vgic-its: Reject restored DTE with out-of-range num\_eventid\_bits (CVSS 9.0, Linux)
- [CVE-2026-64105](https://cve.now/CVE-2026-64105.md): KVM: arm64: vgic: Free private\_irqs when init fails after allocation (no CVSS, Linux)
- [CVE-2026-64104](https://cve.now/CVE-2026-64104.md): virt: sev-guest: Explicitly leak pages in unknown state (CVSS 8.7, Linux)
- [CVE-2026-64103](https://cve.now/CVE-2026-64103.md): scsi: isci: Fix use-after-free in device removal path (no CVSS, Linux)
- [CVE-2026-64102](https://cve.now/CVE-2026-64102.md): RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CVSS 9.8, Linux)
- [CVE-2026-64101](https://cve.now/CVE-2026-64101.md): fwctl: pds: Validate RPC input size before parsing (no CVSS, Linux)
- [CVE-2026-64100](https://cve.now/CVE-2026-64100.md): drm/msm: Fix shrinker deadlock (no CVSS, Linux)
- [CVE-2026-64099](https://cve.now/CVE-2026-64099.md): drm/v3d: Fix use-after-free of CPU job query arrays on error path (CVSS 7.8, Linux)
- [CVE-2026-64098](https://cve.now/CVE-2026-64098.md): drm/virtio: use uninterruptible resv lock for plane updates (CVSS 7.8, Linux)
- [CVE-2026-64097](https://cve.now/CVE-2026-64097.md): drm/amd/display: Validate GPIO pin LUT table size before iterating (CVSS 7.8, Linux)
- [CVE-2026-64096](https://cve.now/CVE-2026-64096.md): batman-adv: mcast: fix use-after-free in orig\_node RCU release (CVSS 8.8, Linux)
- [CVE-2026-64095](https://cve.now/CVE-2026-64095.md): batman-adv: bla: avoid double decrement of bla.num\_requests (CVSS 7.1, Linux)
- [CVE-2026-64094](https://cve.now/CVE-2026-64094.md): batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface (no CVSS, Linux)
- [CVE-2026-64093](https://cve.now/CVE-2026-64093.md): batman-adv: tp\_meter: directly shut down timer on cleanup (CVSS 8.8, Linux)
- [CVE-2026-64092](https://cve.now/CVE-2026-64092.md): batman-adv: tp\_meter: fix tp\_vars reference leak in receiver shutdown (no CVSS, Linux)
- [CVE-2026-64091](https://cve.now/CVE-2026-64091.md): batman-adv: tt: fix TOCTOU race for reported vlans (CVSS 9.8, Linux)
- [CVE-2026-64090](https://cve.now/CVE-2026-64090.md): batman-adv: tt: avoid empty VLAN responses (no CVSS, Linux)
- [CVE-2026-64089](https://cve.now/CVE-2026-64089.md): batman-adv: tt: fix negative last\_changeset\_len (CVSS 9.8, Linux)
- [CVE-2026-64088](https://cve.now/CVE-2026-64088.md): batman-adv: tt: fix negative tt\_buff\_len (CVSS 8.8, Linux)
- [CVE-2026-64087](https://cve.now/CVE-2026-64087.md): hwmon: (pmbus/adm1266) reject implausible blackbox record\_count (no CVSS, Linux)
- [CVE-2026-64086](https://cve.now/CVE-2026-64086.md): hwmon: (pmbus/adm1266) include PEC byte in pmbus\_block\_xfer read buffer (CVSS 7.8, Linux)
- [CVE-2026-64085](https://cve.now/CVE-2026-64085.md): hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (no CVSS, Linux)
- [CVE-2026-64084](https://cve.now/CVE-2026-64084.md): hwmon: (pmbus/adm1266) cap PDIO scan in get\_multiple at ADM1266\_PDIO\_NR (CVSS 7.8, Linux)
- [CVE-2026-64083](https://cve.now/CVE-2026-64083.md): hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (no CVSS, Linux)
- [CVE-2026-64082](https://cve.now/CVE-2026-64082.md): riscv: Fix register corruption from uninitialized cregs on error (CVSS 7.8, Linux)
- [CVE-2026-64081](https://cve.now/CVE-2026-64081.md): firmware: arm\_ffa: Validate framework notification message layout (CVSS 8.4, Linux)
- [CVE-2026-64080](https://cve.now/CVE-2026-64080.md): firmware: arm\_ffa: Snapshot notifier callbacks under lock (CVSS 9.3, Linux)
- [CVE-2026-64079](https://cve.now/CVE-2026-64079.md): netfilter: x\_tables: allocate hook ops while under mutex (no CVSS, Linux)
- [CVE-2026-64078](https://cve.now/CVE-2026-64078.md): netfilter: x\_tables: add and use xtables\_unregister\_table\_exit (CVSS 7.8, Linux)
- [CVE-2026-64077](https://cve.now/CVE-2026-64077.md): netfilter: ebtables: move to two-stage removal scheme (CVSS 7.8, Linux)
- [CVE-2026-64076](https://cve.now/CVE-2026-64076.md): netfilter: bridge: eb\_tables: close module init race (CVSS 7.8, Linux)
- [CVE-2026-64075](https://cve.now/CVE-2026-64075.md): fprobe: Fix unregister\_fprobe() to wait for RCU grace period (no CVSS, Linux)
- [CVE-2026-64074](https://cve.now/CVE-2026-64074.md): fs/statmount: fix slab out-of-bounds write in statmount\_mnt\_idmap (CVSS 7.8, Linux)
- [CVE-2026-64073](https://cve.now/CVE-2026-64073.md): irq\_work: Fix use-after-free in irq\_work\_single() on PREEMPT\_RT (CVSS 7.8, Linux)
- [CVE-2026-64072](https://cve.now/CVE-2026-64072.md): nvme: fix bio leak on mapping failure (no CVSS, Linux)
- [CVE-2026-64071](https://cve.now/CVE-2026-64071.md): nvme-pci: fix use-after-free in nvme\_free\_host\_mem() (no CVSS, Linux)
- [CVE-2026-64070](https://cve.now/CVE-2026-64070.md): powerpc/hv-gpci: fix preempt count leak in sysfs show paths (no CVSS, Linux)
- [CVE-2026-64069](https://cve.now/CVE-2026-64069.md): netfs: Fix cancellation of a DIO and single read subrequests (CVSS 9.8, Linux)
- [CVE-2026-64068](https://cve.now/CVE-2026-64068.md): netfs: Fix missing locking around retry adding new subreqs (CVSS 9.8, Linux)
- [CVE-2026-64067](https://cve.now/CVE-2026-64067.md): netfs: Fix missing barriers when accessing stream-\>subrequests locklessly (CVSS 9.8, Linux)
- [CVE-2026-64066](https://cve.now/CVE-2026-64066.md): netfs: Fix netfs\_read\_to\_pagecache() to pause on subreq failure (CVSS 9.8, Linux)
- [CVE-2026-64065](https://cve.now/CVE-2026-64065.md): netfs: fix VM\_BUG\_ON\_FOLIO() issue in netfs\_write\_begin() call (no CVSS, Linux)
- [CVE-2026-64064](https://cve.now/CVE-2026-64064.md): netfs: Fix netfs\_invalidate\_folio() to clear dirty bit if all changes gone (no CVSS, Linux)
- [CVE-2026-64063](https://cve.now/CVE-2026-64063.md): netfs: Fix streaming write being overwritten (no CVSS, Linux)
- [CVE-2026-64062](https://cve.now/CVE-2026-64062.md): netfs: Fix potential deadlock in write-through mode (no CVSS, Linux)
- [CVE-2026-64061](https://cve.now/CVE-2026-64061.md): netfs: Fix early put of sink folio in netfs\_read\_gaps() (CVSS 9.8, Linux)
- [CVE-2026-64060](https://cve.now/CVE-2026-64060.md): netfs: Fix leak of request in netfs\_write\_begin() error handling (no CVSS, Linux)
- [CVE-2026-64059](https://cve.now/CVE-2026-64059.md): netfs: Fix folio-\>private handling in netfs\_perform\_write() (no CVSS, Linux)
- [CVE-2026-64058](https://cve.now/CVE-2026-64058.md): netfs: Fix netfs\_read\_folio() to wait on writeback (CVSS 7.8, Linux)
- [CVE-2026-64057](https://cve.now/CVE-2026-64057.md): afs: Fix the locking used by afs\_get\_link() (CVSS 7.8, Linux)
- [CVE-2026-64056](https://cve.now/CVE-2026-64056.md): net: ethernet: cortina: Make RX SKB per-port (CVSS 9.8, Linux)
- [CVE-2026-64055](https://cve.now/CVE-2026-64055.md): net: ethernet: cortina: Carry over frag counter (CVSS 9.8, Linux)
- [CVE-2026-64054](https://cve.now/CVE-2026-64054.md): net: shaper: reject duplicate leaves in GROUP request (no CVSS, Linux)
- [CVE-2026-64053](https://cve.now/CVE-2026-64053.md): block: don't overwrite bip\_vcnt in bio\_integrity\_copy\_user() (CVSS 7.8, Linux)
- [CVE-2026-64052](https://cve.now/CVE-2026-64052.md): block: bio-integrity: Fix null-ptr-deref in bio\_integrity\_map\_user() (no CVSS, Linux)
- [CVE-2026-64051](https://cve.now/CVE-2026-64051.md): accel/qaic: Add overflow check to remap\_pfn\_range during mmap (CVSS 7.8, Linux)
- [CVE-2026-64050](https://cve.now/CVE-2026-64050.md): drm/msm/dpu: don't mix devm and drmm functions (CVSS 7.8, Linux)
- [CVE-2026-64049](https://cve.now/CVE-2026-64049.md): drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx (no CVSS, Linux)
- [CVE-2026-64048](https://cve.now/CVE-2026-64048.md): net/smc: reject CHID-0 ACCEPT that matches an empty ism\_dev slot (CVSS 7.5, Linux)
- [CVE-2026-64047](https://cve.now/CVE-2026-64047.md): net: tls: fix off-by-one in sg\_chain entry count for wrapped sk\_msg ring (CVSS 9.8, Linux)
- [CVE-2026-64046](https://cve.now/CVE-2026-64046.md): net: tls: prevent chain-after-chain in plain text SG (CVSS 9.8, Linux)
- [CVE-2026-64045](https://cve.now/CVE-2026-64045.md): ovpn: tcp - use cached peer pointer in ovpn\_tcp\_close() (CVSS 8.4, Linux)
- [CVE-2026-64044](https://cve.now/CVE-2026-64044.md): ovpn: respect peer refcount in CMD\_NEW\_PEER error path (CVSS 7.8, Linux)
- [CVE-2026-64043](https://cve.now/CVE-2026-64043.md): ovpn: fix race between deleting interface and adding new peer (no CVSS, Linux)
- [CVE-2026-64042](https://cve.now/CVE-2026-64042.md): vfio/pci: Check BAR resources before exporting a DMABUF (CVSS 8.8, Linux)
- [CVE-2026-64041](https://cve.now/CVE-2026-64041.md): ASoC: codecs: fs210x: fix possible buffer overflow (CVSS 7.8, Linux)
- [CVE-2026-64040](https://cve.now/CVE-2026-64040.md): cachefiles: Fix error return when vfs\_mkdir() fails (no CVSS, Linux)
- [CVE-2026-64039](https://cve.now/CVE-2026-64039.md): drm/msm/snapshot: fix dumping of the unaligned regions (CVSS 7.7, Linux)
- [CVE-2026-64038](https://cve.now/CVE-2026-64038.md): hwmon: (lm90) Stop work before releasing hwmon device (no CVSS, Linux)
- [CVE-2026-64037](https://cve.now/CVE-2026-64037.md): wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVSS 9.8, Linux)
- [CVE-2026-64036](https://cve.now/CVE-2026-64036.md): cgroup/rstat: validate cpu before css\_rstat\_cpu() access (CVSS 7.8, Linux)
- [CVE-2026-64035](https://cve.now/CVE-2026-64035.md): igc: set tx buffer type for SMD frames (CVSS 9.8, Linux)
- [CVE-2026-64034](https://cve.now/CVE-2026-64034.md): net: mana: Fix TOCTOU double-fetch of hwc\_msg\_id from DMA buffer (CVSS 9.3, Linux)
- [CVE-2026-64033](https://cve.now/CVE-2026-64033.md): RDMA/rtrs: Fix use-after-free in path file creation cleanup (CVSS 9.8, Linux)
- [CVE-2026-64032](https://cve.now/CVE-2026-64032.md): bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVSS 7.8, Linux)
- [CVE-2026-64031](https://cve.now/CVE-2026-64031.md): erofs: fix managed cache race for unaligned extents (CVSS 7.8, Linux)
- [CVE-2026-64030](https://cve.now/CVE-2026-64030.md): wifi: mac80211: bounds-check link\_id in ieee80211\_ml\_epcs (CVSS 8.8, Linux)
- [CVE-2026-64029](https://cve.now/CVE-2026-64029.md): ALSA: seq: Serialize UMP output teardown with event\_input (CVSS 7.8, Linux)
- [CVE-2026-64028](https://cve.now/CVE-2026-64028.md): tracing: Avoid NULL return from hist\_field\_name() on truncation (no CVSS, Linux)
- [CVE-2026-64027](https://cve.now/CVE-2026-64027.md): net: shaper: rework the VALID marking (again) (CVSS 7.8, Linux)
- [CVE-2026-64026](https://cve.now/CVE-2026-64026.md): rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (CVSS 7.8, Linux)
- [CVE-2026-64025](https://cve.now/CVE-2026-64025.md): bpf, skmsg: fix verdict sk\_data\_ready racing with ktls rx (CVSS 9.8, Linux)
- [CVE-2026-64024](https://cve.now/CVE-2026-64024.md): tcp: fix stale per-CPU tcp\_tw\_isn leak enabling ISN prediction (CVSS 9.4, Linux)
- [CVE-2026-64023](https://cve.now/CVE-2026-64023.md): gpio: aggregator: fix a potential use-after-free (CVSS 7.8, Linux)
- [CVE-2026-64022](https://cve.now/CVE-2026-64022.md): gpio: aggregator: remove the software node when deactivating the aggregator (no CVSS, Linux)
- [CVE-2026-64021](https://cve.now/CVE-2026-64021.md): drm/xe/oa: Fix exec\_queue leak on width check in stream open (no CVSS, Linux)
- [CVE-2026-64020](https://cve.now/CVE-2026-64020.md): nvme-pci: fix dma\_vecs leak on p2p memory (CVSS 7.5, Linux)
- [CVE-2026-64019](https://cve.now/CVE-2026-64019.md): nvme-pci: fix dma mapping leak on data setup error (no CVSS, Linux)
- [CVE-2026-64018](https://cve.now/CVE-2026-64018.md): net: mana: validate rx\_req\_idx to prevent out-of-bounds array access (CVSS 9.3, Linux)
- [CVE-2026-64017](https://cve.now/CVE-2026-64017.md): blk-mq: pop cached request if it is usable (CVSS 7.8, Linux)
- [CVE-2026-64016](https://cve.now/CVE-2026-64016.md): ksmbd: fix durable reconnect error path file lifetime (CVSS 9.8, Linux)
- [CVE-2026-64015](https://cve.now/CVE-2026-64015.md): security/keys: fix missed RCU read section on lookup (CVSS 7.8, Linux)
- [CVE-2026-64014](https://cve.now/CVE-2026-64014.md): Input: usbtouchscreen - clamp NEXIO data\_len/x\_len to URB buffer size (no CVSS, Linux)
- [CVE-2026-64013](https://cve.now/CVE-2026-64013.md): ACPI: button: Fix ACPI GPE handler leak during removal (no CVSS, Linux)
- [CVE-2026-64012](https://cve.now/CVE-2026-64012.md): net/sched: sch\_sfb: Replace direct dequeue call with peek and qdisc\_dequeue\_peeked (no CVSS, Linux)
- [CVE-2026-64011](https://cve.now/CVE-2026-64011.md): nfc: llcp: Fix use-after-free in llcp\_sock\_release() (CVSS 7.8, Linux)
- [CVE-2026-64010](https://cve.now/CVE-2026-64010.md): nfc: llcp: Fix use-after-free race in nfc\_llcp\_recv\_cc() (CVSS 8.8, Linux)
- [CVE-2026-64009](https://cve.now/CVE-2026-64009.md): xfrm: Check for underflow in xfrm\_state\_mtu (CVSS 7.8, Linux)
- [CVE-2026-64008](https://cve.now/CVE-2026-64008.md): accel/rocket: fix UAF via dangling GEM handle in create\_bo (CVSS 7.8, Linux)
- [CVE-2026-64007](https://cve.now/CVE-2026-64007.md): netfilter: synproxy: refresh tcphdr after skb\_ensure\_writable (CVSS 9.8, Linux)
- [CVE-2026-64006](https://cve.now/CVE-2026-64006.md): netfilter: nf\_tables: fix dst corruption in same register operation (no CVSS, Linux)
- [CVE-2026-64005](https://cve.now/CVE-2026-64005.md): net/smc: Do not re-initialize smc hashtables (CVSS 7.8, Linux)
- [CVE-2026-64004](https://cve.now/CVE-2026-64004.md): net/iucv: fix locking in .getsockopt (CVSS 7.8, Linux)
- [CVE-2026-64003](https://cve.now/CVE-2026-64003.md): scsi: core: Run queues for all non-SDEV\_DEL devices from scsi\_run\_host\_queues (CVSS 7.5, Linux)
- [CVE-2026-64002](https://cve.now/CVE-2026-64002.md): ipv4: free net-\>ipv4.sysctl\_local\_reserved\_ports after unregister\_net\_sysctl\_table() (CVSS 7.8, Linux)
- [CVE-2026-64001](https://cve.now/CVE-2026-64001.md): ALSA: pcm: oss: Fix setup list UAF on proc write error (no CVSS, Linux)
- [CVE-2026-64000](https://cve.now/CVE-2026-64000.md): net: hsr: fix potential OOB access in supervision frame handling (CVSS 9.8, Linux)
- [CVE-2026-63999](https://cve.now/CVE-2026-63999.md): ethtool: rss: fix indir\_table and hkey leak on get\_rxfh failure (no CVSS, Linux)
- [CVE-2026-63998](https://cve.now/CVE-2026-63998.md): ethtool: module: call ethnl\_ops\_complete() on module flash errors (no CVSS, Linux)
- [CVE-2026-63997](https://cve.now/CVE-2026-63997.md): ethtool: module: avoid leaking a netdev ref on module flash errors (no CVSS, Linux)
- [CVE-2026-63996](https://cve.now/CVE-2026-63996.md): ethtool: cmis: require exact CDB reply length (CVSS 7.8, Linux)
- [CVE-2026-63995](https://cve.now/CVE-2026-63995.md): ethtool: cmis: validate start\_cmd\_payload\_size from module (CVSS 7.8, Linux)
- [CVE-2026-63994](https://cve.now/CVE-2026-63994.md): tunnels: load network headers after skb\_cow() in iptunnel\_pmtud\_build\_icmp\[v6\]() (CVSS 9.8, Linux)
- [CVE-2026-63993](https://cve.now/CVE-2026-63993.md): vxlan: do not reuse cached ip\_hdr() value after skb\_tunnel\_check\_pmtu() (CVSS 9.8, Linux)
- [CVE-2026-63992](https://cve.now/CVE-2026-63992.md): tunnels: do not assume transport header in iptunnel\_pmtud\_check\_icmp() (CVSS 9.1, Linux)
- [CVE-2026-63991](https://cve.now/CVE-2026-63991.md): Bluetooth: 6lowpan: check skb\_clone() return value in send\_mcast\_pkt() (no CVSS, Linux)
- [CVE-2026-63990](https://cve.now/CVE-2026-63990.md): bonding: refuse to enslave CAN devices (no CVSS, Linux)
- [CVE-2026-63989](https://cve.now/CVE-2026-63989.md): bridge: Fix sleep in atomic context in netlink path (no CVSS, Linux)
- [CVE-2026-63988](https://cve.now/CVE-2026-63988.md): bridge: Fix sleep in atomic context in sysfs path (no CVSS, Linux)
- [CVE-2026-63987](https://cve.now/CVE-2026-63987.md): ethtool: coalesce: cap profile updates at NET\_DIM\_PARAMS\_NUM\_PROFILES (CVSS 7.8, Linux)
- [CVE-2026-63986](https://cve.now/CVE-2026-63986.md): ethtool: tsinfo: don't pass ERR\_PTR to genlmsg\_cancel on prepare failure (no CVSS, Linux)
- [CVE-2026-63985](https://cve.now/CVE-2026-63985.md): ethtool: eeprom: add more safeties to EEPROM Netlink fallback (CVSS 7.8, Linux)
- [CVE-2026-63984](https://cve.now/CVE-2026-63984.md): ipv6: rpl: fix hdrlen overflow in ipv6\_rpl\_srh\_decompress() (CVSS 9.8, Linux)
- [CVE-2026-63983](https://cve.now/CVE-2026-63983.md): net/sched: fix packet loop on netem when duplicate is on (no CVSS, Linux)
- [CVE-2026-63982](https://cve.now/CVE-2026-63982.md): net/sched: Fix ethx:ingress -\> ethy:egress -\> ethx:ingress mirred loop (no CVSS, Linux)
- [CVE-2026-63981](https://cve.now/CVE-2026-63981.md): net/sched: act\_mirred: Fix blockcast recursion bypass leading to stack overflow (no CVSS, Linux)
- [CVE-2026-63980](https://cve.now/CVE-2026-63980.md): net/handshake: Use spin\_lock\_bh for hn\_lock (CVSS 7.5, Linux)
- [CVE-2026-63979](https://cve.now/CVE-2026-63979.md): net/handshake: hand off the pinned file reference to accept\_doit (CVSS 9.8, Linux)
- [CVE-2026-63978](https://cve.now/CVE-2026-63978.md): net/handshake: Drain pending requests at net namespace exit (CVSS 9.8, Linux)
- [CVE-2026-63977](https://cve.now/CVE-2026-63977.md): dpll: zl3073x: use \_\_dpll\_device\_change\_ntf() and remove change\_work (CVSS 7.8, Linux)
- [CVE-2026-63976](https://cve.now/CVE-2026-63976.md): Bluetooth: l2cap: clear chan-\>ident on ECRED reconfiguration success (CVSS 8.8, Linux)
- [CVE-2026-63975](https://cve.now/CVE-2026-63975.md): Bluetooth: L2CAP: Fix possible crash on l2cap\_ecred\_conn\_rsp (CVSS 8.8, Linux)
- [CVE-2026-63974](https://cve.now/CVE-2026-63974.md): Bluetooth: hci\_sync: Set HCI\_CMD\_DRAIN\_WORKQUEUE during device close (CVSS 8.8, Linux)
- [CVE-2026-63973](https://cve.now/CVE-2026-63973.md): net: mana: Add NULL guards in teardown path to prevent panic on attach failure (no CVSS, Linux)
- [CVE-2026-63972](https://cve.now/CVE-2026-63972.md): net: mana: Skip redundant detach on already-detached port (CVSS 7.5, Linux)
- [CVE-2026-63971](https://cve.now/CVE-2026-63971.md): sctp: fix race between sctp\_wait\_for\_connect and peeloff (CVSS 7.8, Linux)
- [CVE-2026-63970](https://cve.now/CVE-2026-63970.md): vsock/virtio: bind uarg before filling zerocopy skb (CVSS 7.8, Linux)
- [CVE-2026-63969](https://cve.now/CVE-2026-63969.md): ipv6: fix possible infinite loop in rt6\_fill\_node() (no CVSS, Linux)
- [CVE-2026-63968](https://cve.now/CVE-2026-63968.md): ipv6: fix possible infinite loop in fib6\_select\_path() (CVSS 7.5, Linux)
- [CVE-2026-63967](https://cve.now/CVE-2026-63967.md): iio: imu: st\_lsm6dsx: fix stack leak in tagged FIFO buffer (no CVSS, Linux)
- [CVE-2026-63966](https://cve.now/CVE-2026-63966.md): iio: imu: adis16550: fix stack leak in trigger handler (no CVSS, Linux)
- [CVE-2026-63965](https://cve.now/CVE-2026-63965.md): iio: pressure: bmp280: fix stack leak in bmp580 trigger handler (no CVSS, Linux)
- [CVE-2026-63964](https://cve.now/CVE-2026-63964.md): usb: typec: ucsi: ccg: reject firmware images without a ':' record header (no CVSS, Linux)
- [CVE-2026-63963](https://cve.now/CVE-2026-63963.md): usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (no CVSS, Linux)
- [CVE-2026-63962](https://cve.now/CVE-2026-63962.md): usb: typec: tcpm: bound altmode\_desc\[\] per iteration in svdm\_consume\_modes() (no CVSS, Linux)
- [CVE-2026-63961](https://cve.now/CVE-2026-63961.md): usb: typec: altmodes/displayport: validate count before reading Status Update VDO (no CVSS, Linux)
- [CVE-2026-63960](https://cve.now/CVE-2026-63960.md): usb: typec: wcove: don't write past struct pd\_message in wcove\_read\_rx\_buffer() (no CVSS, Linux)
- [CVE-2026-63959](https://cve.now/CVE-2026-63959.md): usb: typec: tcpm/tcpci\_maxim: validate header NDO against RX\_BYTE\_CNT (no CVSS, Linux)
- [CVE-2026-63958](https://cve.now/CVE-2026-63958.md): usb: typec: ucsi: validate connector number in ucsi\_connector\_change() (no CVSS, Linux)
- [CVE-2026-63957](https://cve.now/CVE-2026-63957.md): USB: serial: safe\_serial: fix memory corruption with small endpoint (no CVSS, Linux)
- [CVE-2026-63956](https://cve.now/CVE-2026-63956.md): USB: serial: cypress\_m8: fix memory corruption with small endpoint (no CVSS, Linux)
- [CVE-2026-63955](https://cve.now/CVE-2026-63955.md): mm/vmalloc: do not trigger BUG() on BH disabled context (CVSS 7.5, Linux)
- [CVE-2026-63954](https://cve.now/CVE-2026-63954.md): hpfs: fix a crash if hpfs\_map\_dnode\_bitmap fails (CVSS 7.8, Linux)
- [CVE-2026-63953](https://cve.now/CVE-2026-63953.md): mm/migrate\_device: fix pgtable leak in migrate\_vma\_insert\_huge\_pmd\_page (no CVSS, Linux)
- [CVE-2026-63952](https://cve.now/CVE-2026-63952.md): memfd: deny writeable mappings when implying SEAL\_WRITE (CVSS 8.4, Linux)
- [CVE-2026-63951](https://cve.now/CVE-2026-63951.md): zram: fix use-after-free in zram\_writeback\_endio (CVSS 7.8, Linux)
- [CVE-2026-63950](https://cve.now/CVE-2026-63950.md): mm/rmap: initialize nr\_pages to 1 at loop start in try\_to\_unmap\_one (CVSS 7.8, Linux)
- [CVE-2026-63949](https://cve.now/CVE-2026-63949.md): auxdisplay: line-display: fix OOB read on zero-length message\_store() (no CVSS, Linux)
- [CVE-2026-63948](https://cve.now/CVE-2026-63948.md): Bluetooth: L2CAP: fix chan ref leak in l2cap\_chan\_timeout() on !conn (no CVSS, Linux)
- [CVE-2026-63947](https://cve.now/CVE-2026-63947.md): Bluetooth: HIDP: fix missing length checks in hidp\_input\_report() (CVSS 8.8, Linux)
- [CVE-2026-63946](https://cve.now/CVE-2026-63946.md): Bluetooth: ISO: fix UAF in iso\_recv\_frame (CVSS 8.8, Linux)
- [CVE-2026-63945](https://cve.now/CVE-2026-63945.md): Bluetooth: ISO: serialize iso\_sock\_clear\_timer with socket lock (CVSS 7.8, Linux)
- [CVE-2026-63944](https://cve.now/CVE-2026-63944.md): Bluetooth: hci\_sync: fix UAF in hci\_le\_create\_cis\_sync (CVSS 8.8, Linux)
- [CVE-2026-63943](https://cve.now/CVE-2026-63943.md): Input: xpad - fix out-of-bounds access for Share button (no CVSS, Linux)
- [CVE-2026-63942](https://cve.now/CVE-2026-63942.md): parport: Fix race between port and client registration (CVSS 7.8, Linux)
- [CVE-2026-63941](https://cve.now/CVE-2026-63941.md): KVM: arm64: Correctly cap ZCR\_EL2 provided by a guest hypervisor (CVSS 8.8, Linux)
- [CVE-2026-63940](https://cve.now/CVE-2026-63940.md): KVM: SEV: Ignore Port I/O requests of length '0' (CVSS 9.3, Linux)
- [CVE-2026-63939](https://cve.now/CVE-2026-63939.md): KVM: SEV: Compute the correct max length of the in-GHCB scratch area (CVSS 9.3, Linux)
- [CVE-2026-63938](https://cve.now/CVE-2026-63938.md): KVM: SEV: Check PSC request indices against the actual size of the buffer (CVSS 9.3, Linux)
- [CVE-2026-63937](https://cve.now/CVE-2026-63937.md): KVM: SEV: Use READ\_ONCE() when reading entries/indices from PSC buffer (CVSS 8.8, Linux)
- [CVE-2026-63936](https://cve.now/CVE-2026-63936.md): iio: adc: mt6359: fix unchecked return value in mt6358\_read\_imp (no CVSS, Linux)
- [CVE-2026-63935](https://cve.now/CVE-2026-63935.md): iio: adc: nxp-sar-adc: fix division by zero in write\_raw (no CVSS, Linux)
- [CVE-2026-63934](https://cve.now/CVE-2026-63934.md): iio: gyro: itg3200: fix i2c read into the wrong stack location (no CVSS, Linux)
- [CVE-2026-63933](https://cve.now/CVE-2026-63933.md): iio: gyro: adis16260: fix division by zero in write\_raw (no CVSS, Linux)
- [CVE-2026-63932](https://cve.now/CVE-2026-63932.md): iio: chemical: mhz19b: reject oversized serial replies (no CVSS, Linux)
- [CVE-2026-63931](https://cve.now/CVE-2026-63931.md): iio: chemical: scd30: fix division by zero in write\_raw (no CVSS, Linux)
- [CVE-2026-63930](https://cve.now/CVE-2026-63930.md): iio: buffer: hw-consumer: fix use-after-free in error path (CVSS 7.8, Linux)
- [CVE-2026-63929](https://cve.now/CVE-2026-63929.md): iio: buffer: Fix DMA fence leak in iio\_buffer\_enqueue\_dmabuf() (no CVSS, Linux)
- [CVE-2026-63928](https://cve.now/CVE-2026-63928.md): USB: serial: omninet: fix memory corruption with small endpoint (no CVSS, Linux)
- [CVE-2026-63927](https://cve.now/CVE-2026-63927.md): usb: dwc2: Fix use after free in debug code (CVSS 7.8, Linux)
- [CVE-2026-63926](https://cve.now/CVE-2026-63926.md): bpf: sockmap: fix tail fragment offset in bpf\_msg\_push\_data (CVSS 8.4, Linux)
- [CVE-2026-63925](https://cve.now/CVE-2026-63925.md): macsec: fix replay protection at XPN lower-PN wrap (CVSS 8.1, Linux)
- [CVE-2026-63924](https://cve.now/CVE-2026-63924.md): ipv6: exthdrs: refresh nh pointer after ipv6\_hop\_jumbo() (CVSS 9.8, Linux)
- [CVE-2026-63923](https://cve.now/CVE-2026-63923.md): octeontx2-af: validate body pcifunc in rvu\_mbox\_handler\_rep\_event\_notify (CVSS 8.8, Linux)
- [CVE-2026-63922](https://cve.now/CVE-2026-63922.md): ipv6: exthdrs: refresh nh after handling HAO option (CVSS 9.8, Linux)
- [CVE-2026-63921](https://cve.now/CVE-2026-63921.md): ip6: vti: Use ip6\_tnl.net in vti6\_siocdevprivate(). (CVSS 8.8, Linux)
- [CVE-2026-63920](https://cve.now/CVE-2026-63920.md): ipv6: validate extension header length before copying to cmsg (CVSS 7.1, Linux)
- [CVE-2026-63919](https://cve.now/CVE-2026-63919.md): xfrm: input: hold netns during deferred transport reinjection (CVSS 8.8, Linux)
- [CVE-2026-63918](https://cve.now/CVE-2026-63918.md): l2tp: use refcount\_inc\_not\_zero in l2tp\_session\_get\_by\_ifname (CVSS 7.8, Linux)
- [CVE-2026-63917](https://cve.now/CVE-2026-63917.md): ip6: vti: Use ip6\_tnl.net in vti6\_changelink(). (CVSS 8.8, Linux)
- [CVE-2026-63916](https://cve.now/CVE-2026-63916.md): HID: wacom: Fix OOB write in wacom\_hid\_set\_device\_mode() (CVSS 8.8, Linux)
- [CVE-2026-63915](https://cve.now/CVE-2026-63915.md): nfc: hci: fix out-of-bounds read in HCP header parsing (CVSS 8.8, Linux)
- [CVE-2026-63914](https://cve.now/CVE-2026-63914.md): xfrm: route MIGRATE notifications to caller's netns (CVSS 7.3, Linux)
- [CVE-2026-63913](https://cve.now/CVE-2026-63913.md): netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVSS 8.2, Linux)
- [CVE-2026-63912](https://cve.now/CVE-2026-63912.md): xfrm: esp: restore combined single-frag length gate (CVSS 9.8, Linux)
- [CVE-2026-63911](https://cve.now/CVE-2026-63911.md): xfrm: iptfs: reset runtime state when cloning SAs (CVSS 7.8, Linux)
- [CVE-2026-63910](https://cve.now/CVE-2026-63910.md): dma-buf: fix UAF in dma\_buf\_fd() tracepoint (CVSS 7.8, Linux)
- [CVE-2026-63909](https://cve.now/CVE-2026-63909.md): ksmbd: OOB read regression in smb\_check\_perm\_dacl() ACE-walk loops (CVSS 8.1, Linux)
- [CVE-2026-63908](https://cve.now/CVE-2026-63908.md): Input: atmel\_mxt\_ts - fix boundary check in mxt\_prepare\_cfg\_mem (no CVSS, Linux)
- [CVE-2026-63907](https://cve.now/CVE-2026-63907.md): uio: uio\_pci\_generic\_sva: fix double free of devm\_kzalloc() memory (no CVSS, Linux)
- [CVE-2026-63906](https://cve.now/CVE-2026-63906.md): usb: musb: omap2430: Fix use-after-free in omap2430\_probe() (CVSS 8.4, Linux)
- [CVE-2026-63905](https://cve.now/CVE-2026-63905.md): usbip: vudc: Fix use after free bug in vudc\_remove due to race condition (no CVSS, Linux)
- [CVE-2026-63904](https://cve.now/CVE-2026-63904.md): usb: usbtmc: check URB actual\_length for interrupt-IN notifications (no CVSS, Linux)
- [CVE-2026-63903](https://cve.now/CVE-2026-63903.md): USB: serial: belkin\_sa: validate interrupt status length (no CVSS, Linux)
- [CVE-2026-63902](https://cve.now/CVE-2026-63902.md): USB: serial: cypress\_m8: validate interrupt packet headers (no CVSS, Linux)
- [CVE-2026-63901](https://cve.now/CVE-2026-63901.md): USB: serial: digi\_acceleport: fix memory corruption with small endpoints (no CVSS, Linux)
- [CVE-2026-63900](https://cve.now/CVE-2026-63900.md): USB: serial: keyspan: fix missing indat transfer sanity check (no CVSS, Linux)
- [CVE-2026-63899](https://cve.now/CVE-2026-63899.md): USB: serial: mxuport: fix memory corruption with small endpoint (no CVSS, Linux)
- [CVE-2026-63898](https://cve.now/CVE-2026-63898.md): USB: serial: mct\_u232: fix memory corruption with small endpoint (no CVSS, Linux)
- [CVE-2026-63897](https://cve.now/CVE-2026-63897.md): USB: serial: mct\_u232: fix missing interrupt-in transfer sanity check (no CVSS, Linux)
- [CVE-2026-63896](https://cve.now/CVE-2026-63896.md): usb: gadget: composite: fix integer underflow in WebUSB GET\_URL handling (no CVSS, Linux)
- [CVE-2026-63895](https://cve.now/CVE-2026-63895.md): usb: gadget: f\_fs: copy only received bytes on short ep0 read (no CVSS, Linux)
- [CVE-2026-63894](https://cve.now/CVE-2026-63894.md): usb: gadget: f\_fs: serialize DMABUF cancel against request completion (CVSS 7.8, Linux)
- [CVE-2026-63893](https://cve.now/CVE-2026-63893.md): thunderbolt: property: Reject u32 wrap in tb\_property\_entry\_valid() (CVSS 8.1, Linux)
- [CVE-2026-63892](https://cve.now/CVE-2026-63892.md): thunderbolt: property: Reject dir\_len \< 4 to prevent size\_t underflow (no CVSS, Linux)
- [CVE-2026-63891](https://cve.now/CVE-2026-63891.md): thunderbolt: property: Cap recursion depth in \_\_tb\_property\_parse\_dir() (no CVSS, Linux)
- [CVE-2026-63890](https://cve.now/CVE-2026-63890.md): scsi: fcoe: Reject FIP descriptors with zero fip\_dlen in CVL walker (no CVSS, Linux)
- [CVE-2026-63889](https://cve.now/CVE-2026-63889.md): scsi: scsi\_transport\_fc: Widen FPIN pname walker counter to u32 (CVSS 8.1, Linux)
- [CVE-2026-63888](https://cve.now/CVE-2026-63888.md): scsi: target: iscsi: Fix CRC overread and double-free in iscsit\_handle\_text\_cmd() (CVSS 9.8, Linux)
- [CVE-2026-63887](https://cve.now/CVE-2026-63887.md): scsi: target: iscsi: Bound iscsi\_encode\_text\_output() appends to rsp\_buf (CVSS 9.8, Linux)
- [CVE-2026-63886](https://cve.now/CVE-2026-63886.md): scsi: target: iscsi: Validate CHAP\_R length before base64 decode (CVSS 9.8, Linux)
- [CVE-2026-63885](https://cve.now/CVE-2026-63885.md): drm/gem: fix race between change\_handle and handle\_delete (CVSS 8.8, Linux)
- [CVE-2026-63884](https://cve.now/CVE-2026-63884.md): drm/i915: Fix potential UAF in TTM object purge (CVSS 7.8, Linux)
- [CVE-2026-63883](https://cve.now/CVE-2026-63883.md): serial: qcom\_geni: fix kfifo underflow when flush precedes DMA completion IRQ (CVSS 7.3, Linux)
- [CVE-2026-63882](https://cve.now/CVE-2026-63882.md): drm/amdkfd: fix NULL pointer bug in svm\_range\_set\_attr (no CVSS, Linux)
- [CVE-2026-63881](https://cve.now/CVE-2026-63881.md): drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (CVSS 7.8, Linux)
- [CVE-2026-63880](https://cve.now/CVE-2026-63880.md): drm/amdgpu: fix lock leak on ENOMEM in AMDGPU\_GEM\_OP\_GET\_MAPPING\_INFO (no CVSS, Linux)
- [CVE-2026-63879](https://cve.now/CVE-2026-63879.md): drm/amdgpu: fix amdgpu\_hmm\_range\_get\_pages (CVSS 7.8, Linux)
- [CVE-2026-63878](https://cve.now/CVE-2026-63878.md): drm/amdgpu: check num\_entries in GEM\_OP GET\_MAPPING\_INFO (no CVSS, Linux)
- [CVE-2026-63877](https://cve.now/CVE-2026-63877.md): serial: dz: Convert to use a platform device (no CVSS, Linux)
- [CVE-2026-63876](https://cve.now/CVE-2026-63876.md): serial: zs: Convert to use a platform device (no CVSS, Linux)
- [CVE-2026-63875](https://cve.now/CVE-2026-63875.md): arm64: tlb: Flush walk cache when unsharing PMD tables (CVSS 7.8, Linux)
- [CVE-2026-63874](https://cve.now/CVE-2026-63874.md): net: mctp: usb: fix race between urb completion and rx\_retry cancellation (CVSS 7.8, Linux)
- [CVE-2026-63873](https://cve.now/CVE-2026-63873.md): accel/amdxdna: Fix mm\_struct reference leak in aie2\_populate\_range() (no CVSS, Linux)
- [CVE-2026-63871](https://cve.now/CVE-2026-63871.md): Bluetooth: ISO: Fix data-race on iso\_pi fields in hci\_get\_route calls (no CVSS, Linux)
- [CVE-2026-63870](https://cve.now/CVE-2026-63870.md): ieee802154: 6lowpan: only accept IPv6 packets in lowpan\_xmit() (CVSS 7.8, Linux)
- [CVE-2026-63869](https://cve.now/CVE-2026-63869.md): wifi: mac80211: limit injected antenna index in ieee80211\_parse\_tx\_radiotap (CVSS 7.6, Linux)
- [CVE-2026-63868](https://cve.now/CVE-2026-63868.md): net: garp: fix unsigned integer underflow in garp\_pdu\_parse\_attr (no CVSS, Linux)
- [CVE-2026-63867](https://cve.now/CVE-2026-63867.md): mptcp: close TOCTOU race while computing rcv\_wnd (CVSS 8.2, Linux)
- [CVE-2026-16221](https://cve.now/CVE-2026-16221.md): fast-uri vulnerable to host confusion via literal backslash authority delimiter (CVSS 7.5, fast-uri)
- [CVE-2026-63866](https://cve.now/CVE-2026-63866.md): wifi: mt76: mt7996: Clear wcid pointer in mt7996\_mac\_sta\_deinit\_link() (CVSS 8.8, Linux)
- [CVE-2026-63865](https://cve.now/CVE-2026-63865.md): bpf: Drop task\_to\_inode and inet\_conn\_established from lsm sleepable hooks (CVSS 8.8, Linux)
- [CVE-2026-63864](https://cve.now/CVE-2026-63864.md): bpf: Propagate error from visit\_tailcall\_insn (CVSS 8.4, Linux)
- [CVE-2026-63863](https://cve.now/CVE-2026-63863.md): drm/gpusvm: Fix unbalanced unlock in drm\_gpusvm\_scan\_mm() (CVSS 8.8, Linux)
- [CVE-2026-63862](https://cve.now/CVE-2026-63862.md): PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found (no CVSS, Linux)
- [CVE-2026-63861](https://cve.now/CVE-2026-63861.md): spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback (no CVSS, Linux)
- [CVE-2026-63860](https://cve.now/CVE-2026-63860.md): RDMA/core: Prefer NLA\_NUL\_STRING (CVSS 8.4, Linux)
- [CVE-2026-63859](https://cve.now/CVE-2026-63859.md): net: airoha: Add missing bits in airoha\_qdma\_cleanup\_tx\_queue() (no CVSS, Linux)
- [CVE-2026-63858](https://cve.now/CVE-2026-63858.md): netfilter: nf\_tables: add hook transactions for device deletions (CVSS 7.8, Linux)
- [CVE-2026-63857](https://cve.now/CVE-2026-63857.md): net: airoha: Do not read uninitialized fragment address in airoha\_dev\_xmit() (CVSS 9.8, Linux)
- [CVE-2026-63856](https://cve.now/CVE-2026-63856.md): drm/amdgpu/vcn: set no\_user\_fence for VCN v2.0 enc/dec rings (CVSS 7.8, Linux)
- [CVE-2026-63855](https://cve.now/CVE-2026-63855.md): drm/amdgpu/vcn: set no\_user\_fence for VCN v2.5 enc/dec rings (CVSS 7.8, Linux)
- [CVE-2026-63854](https://cve.now/CVE-2026-63854.md): drm/amdgpu/vcn: set no\_user\_fence for VCN v3.0 enc/dec rings (CVSS 7.8, Linux)
- [CVE-2026-63853](https://cve.now/CVE-2026-63853.md): drm/amdgpu/vcn: set no\_user\_fence for VCN v4.0 enc ring (CVSS 7.8, Linux)
- [CVE-2026-63852](https://cve.now/CVE-2026-63852.md): drm/amdgpu/vcn: set no\_user\_fence for VCN v4.0.3 enc ring (CVSS 7.8, Linux)
- [CVE-2026-63851](https://cve.now/CVE-2026-63851.md): drm/amdgpu/vcn: set no\_user\_fence for VCN v4.0.5 enc ring (CVSS 7.8, Linux)
- [CVE-2026-63850](https://cve.now/CVE-2026-63850.md): drm/amdgpu/vcn: set no\_user\_fence for VCN v5.0.0 enc ring (CVSS 7.8, Linux)
- [CVE-2026-63849](https://cve.now/CVE-2026-63849.md): drm/amdgpu/vcn: set no\_user\_fence for VCN v5.0.1 enc ring (CVSS 7.8, Linux)
- [CVE-2026-63848](https://cve.now/CVE-2026-63848.md): drm/amdgpu/jpeg: set no\_user\_fence for JPEG v2.0 ring (CVSS 7.8, Linux)
- [CVE-2026-63847](https://cve.now/CVE-2026-63847.md): drm/amdgpu/jpeg: set no\_user\_fence for JPEG v2.5 ring (CVSS 7.8, Linux)
- [CVE-2026-63846](https://cve.now/CVE-2026-63846.md): drm/amdgpu/jpeg: set no\_user\_fence for JPEG v3.0 ring (CVSS 7.8, Linux)
- [CVE-2026-63845](https://cve.now/CVE-2026-63845.md): drm/amdgpu/jpeg: set no\_user\_fence for JPEG v4.0 ring (CVSS 7.8, Linux)
- [CVE-2026-63844](https://cve.now/CVE-2026-63844.md): drm/amdgpu/jpeg: set no\_user\_fence for JPEG v4.0.3 ring (CVSS 7.8, Linux)
- [CVE-2026-63843](https://cve.now/CVE-2026-63843.md): drm/amdgpu/jpeg: set no\_user\_fence for JPEG v4.0.5 ring (CVSS 7.8, Linux)
- [CVE-2026-63842](https://cve.now/CVE-2026-63842.md): drm/amdgpu/jpeg: set no\_user\_fence for JPEG v5.0.0 ring (CVSS 7.8, Linux)
- [CVE-2026-63841](https://cve.now/CVE-2026-63841.md): drm/amdgpu/jpeg: set no\_user\_fence for JPEG v5.0.1 ring (CVSS 7.8, Linux)
- [CVE-2026-63840](https://cve.now/CVE-2026-63840.md): drm/amdgpu/jpeg: set no\_user\_fence for JPEG v5.3.0 ring (CVSS 7.8, Linux)
- [CVE-2026-63839](https://cve.now/CVE-2026-63839.md): platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi\_dev\_evaluate\_int() (no CVSS, Linux)
- [CVE-2026-63838](https://cve.now/CVE-2026-63838.md): ASoC: rsnd: Fix potential out-of-bounds access of component\_dais\[\] (no CVSS, Linux)
- [CVE-2026-63837](https://cve.now/CVE-2026-63837.md): net: ena: PHC: Check return code before setting timestamp output (no CVSS, Linux)
- [CVE-2026-63836](https://cve.now/CVE-2026-63836.md): batman-adv: tp\_meter: avoid divide-by-zero for dec\_cwnd (no CVSS, Linux)
- [CVE-2026-63835](https://cve.now/CVE-2026-63835.md): batman-adv: v: prevent OGM aggregation on disabled hardif (no CVSS, Linux)
- [CVE-2026-63834](https://cve.now/CVE-2026-63834.md): batman-adv: tp\_meter: restrict number of unacked list entries (no CVSS, Linux)
- [CVE-2026-63833](https://cve.now/CVE-2026-63833.md): ntfs3: reject direct userspace writes to reserved $LX\* xattrs (CVSS 7.1, Linux)
- [CVE-2026-63832](https://cve.now/CVE-2026-63832.md): wifi: mt76: add wcid publish check in mt76\_sta\_add (CVSS 8.8, Linux)
- [CVE-2026-63831](https://cve.now/CVE-2026-63831.md): mac802154: llsec: add skb\_cow\_data() before in-place crypto (CVSS 8.8, Linux)
- [CVE-2026-63830](https://cve.now/CVE-2026-63830.md): net: skmsg: preserve sg.copy across SG transforms (CVSS 9.4, Linux)
- [CVE-2026-63829](https://cve.now/CVE-2026-63829.md): net: ip\_gre: require CAP\_NET\_ADMIN in the device netns for changelink (CVSS 8.8, Linux)
- [CVE-2026-63828](https://cve.now/CVE-2026-63828.md): apparmor: mediate the implicit connect of TCP fast open sendmsg (CVSS 8.4, Linux)
- [CVE-2026-63827](https://cve.now/CVE-2026-63827.md): apparmor: fix use-after-free in rawdata dedup loop (CVSS 7.8, Linux)
- [CVE-2026-63826](https://cve.now/CVE-2026-63826.md): fbdev: fix use-after-free in store\_modes() (no CVSS, Linux)
- [CVE-2026-63825](https://cve.now/CVE-2026-63825.md): gcov: use atomic counter updates to fix concurrent access crashes (CVSS 9.8, Linux)
- [CVE-2026-63824](https://cve.now/CVE-2026-63824.md): KEYS: fix overflow in keyctl\_pkey\_params\_get\_2() (CVSS 7.8, Linux)
- [CVE-2026-63823](https://cve.now/CVE-2026-63823.md): keys: Pin request\_key\_auth payload in instantiate paths (CVSS 7.8, Linux)
- [CVE-2026-63822](https://cve.now/CVE-2026-63822.md): wifi: ath11k: fix warning when unbinding (no CVSS, Linux)
- [CVE-2026-63821](https://cve.now/CVE-2026-63821.md): wifi: rtw88: usb: fix memory leaks on USB write failures (no CVSS, Linux)
- [CVE-2026-63820](https://cve.now/CVE-2026-63820.md): f2fs: fix missing read bio submission on large folio error (no CVSS, Linux)
- [CVE-2026-63819](https://cve.now/CVE-2026-63819.md): f2fs: fix to do sanity check on f2fs\_get\_node\_folio\_ra() (CVSS 7.8, Linux)
- [CVE-2026-63818](https://cve.now/CVE-2026-63818.md): f2fs: validate orphan inode entry count (CVSS 8.4, Linux)
- [CVE-2026-63817](https://cve.now/CVE-2026-63817.md): f2fs: validate compress cache inode only when enabled (CVSS 7.8, Linux)
- [CVE-2026-63816](https://cve.now/CVE-2026-63816.md): f2fs: atomic: fix UAF issue on f2fs\_inode\_info.atomic\_inode (CVSS 7.8, Linux)
- [CVE-2026-63815](https://cve.now/CVE-2026-63815.md): f2fs: bound i\_inline\_xattr\_size for non-inline-xattr inodes (CVSS 8.4, Linux)
- [CVE-2026-63814](https://cve.now/CVE-2026-63814.md): f2fs: validate ACL entry sizes in f2fs\_acl\_from\_disk() (CVSS 7.8, Linux)
- [CVE-2026-63813](https://cve.now/CVE-2026-63813.md): Revert "f2fs: remove non-uptodate folio from the page cache in move\_data\_block" (CVSS 7.8, Linux)
- [CVE-2026-63812](https://cve.now/CVE-2026-63812.md): f2fs: fix incorrect FI\_NO\_EXTENT handling in \_\_destroy\_extent\_node() (CVSS 7.8, Linux)
- [CVE-2026-63811](https://cve.now/CVE-2026-63811.md): f2fs: read COW data with the original inode during atomic write (no CVSS, Linux)
- [CVE-2026-63810](https://cve.now/CVE-2026-63810.md): block: Avoid mounting the bdev pseudo-filesystem in userspace (no CVSS, Linux)
- [CVE-2026-63809](https://cve.now/CVE-2026-63809.md): bpf: use kvfree() for replaced sysctl write buffer (CVSS 7.8, Linux)
- [CVE-2026-63808](https://cve.now/CVE-2026-63808.md): exfat: fix potential use-after-free in exfat\_find\_dir\_entry() (CVSS 9.8, Linux)
- [CVE-2026-63807](https://cve.now/CVE-2026-63807.md): KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (CVSS 8.8, Linux)
- [CVE-2026-63806](https://cve.now/CVE-2026-63806.md): KVM: Replace guest-triggerable BUG\_ON() in ioeventfd datamatch with get\_unaligned() (CVSS 7.1, Linux)
- [CVE-2026-63805](https://cve.now/CVE-2026-63805.md): crypto: nx - fix nx\_crypto\_ctx\_exit argument (CVSS 7.8, Linux)
- [CVE-2026-63804](https://cve.now/CVE-2026-63804.md): gfs2: fix use-after-free in gfs2\_qd\_dealloc (no CVSS, Linux)
- [CVE-2026-63803](https://cve.now/CVE-2026-63803.md): hdlc\_ppp: sync per-proto timers before freeing hdlc state (CVSS 7.8, Linux)
- [CVE-2026-63802](https://cve.now/CVE-2026-63802.md): blk-cgroup: fix UAF in \_\_blkcg\_rstat\_flush() (CVSS 7.8, Linux)
- [CVE-2026-63801](https://cve.now/CVE-2026-63801.md): tipc: fix slab-use-after-free Read in tipc\_aead\_decrypt\_done (CVSS 8.8, Linux)
- [CVE-2026-63800](https://cve.now/CVE-2026-63800.md): pNFS: Fix use-after-free in pnfs\_update\_layout() (CVSS 9.8, Linux)
- [CVE-2026-63799](https://cve.now/CVE-2026-63799.md): sched/mmcid: Fix OOB clear\_bit when CID is MM\_CID\_UNSET in fixup path (CVSS 7.8, Linux)
- [CVE-2026-63798](https://cve.now/CVE-2026-63798.md): irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove (no CVSS, Linux)
- [CVE-2026-63797](https://cve.now/CVE-2026-63797.md): rpmsg: char: Fix use-after-free on probe error path (CVSS 8.4, Linux)
- [CVE-2026-63796](https://cve.now/CVE-2026-63796.md): ocfs2: reject oversized group bitmap descriptors (CVSS 8.8, Linux)
- [CVE-2026-63795](https://cve.now/CVE-2026-63795.md): 9p: avoid putting oldfid in p9\_client\_walk() error path (CVSS 10.0, Linux)
- [CVE-2026-63794](https://cve.now/CVE-2026-63794.md): KVM: SVM: Fix page overflow in sev\_dbg\_crypt() for ENCRYPT path (no CVSS, Linux)
- [CVE-2026-63793](https://cve.now/CVE-2026-63793.md): ntfs: serialize volume label accesses (CVSS 7.8, Linux)
- [CVE-2026-53403](https://cve.now/CVE-2026-53403.md): fbdev: Fix fb\_new\_modelist to prevent null-ptr-deref in fb\_videomode\_to\_var (no CVSS, Linux)
- [CVE-2026-53402](https://cve.now/CVE-2026-53402.md): fbdev: fbcon: fix out-of-bounds read in err\_out of fbcon\_do\_set\_font() (CVSS 7.1, Linux)
- [CVE-2026-53401](https://cve.now/CVE-2026-53401.md): fbdev: omap2: fix use-after-free in omapfb\_mmap (CVSS 7.8, Linux)
- [CVE-2026-53400](https://cve.now/CVE-2026-53400.md): i2c: core: fix adapter registration race (CVSS 7.8, Linux)
- [CVE-2026-53399](https://cve.now/CVE-2026-53399.md): nfsd: release layout stid on setlease failure (CVSS 9.8, Linux)
- [CVE-2026-53398](https://cve.now/CVE-2026-53398.md): NFSD: Fix SECINFO\_NO\_NAME decode error cleanup (CVSS 9.8, Linux)
- [CVE-2026-53397](https://cve.now/CVE-2026-53397.md): nfsd: fix posix\_acl leak on SETACL decode failure (CVSS 7.5, Linux)
- [CVE-2026-53396](https://cve.now/CVE-2026-53396.md): nfsd: fix posix\_acl leak and ignored error in nfsd4\_create\_file (CVSS 7.1, Linux)
- [CVE-2026-53395](https://cve.now/CVE-2026-53395.md): nfsd: fix dead ACL conflict guard in nfsd4\_create (CVSS 7.5, Linux)
- [CVE-2026-53394](https://cve.now/CVE-2026-53394.md): nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (CVSS 7.5, Linux)
- [CVE-2026-53393](https://cve.now/CVE-2026-53393.md): nfsd: reset write verifier on deferred writeback errors (no CVSS, Linux)
- [CVE-2026-53392](https://cve.now/CVE-2026-53392.md): NFSv4/flexfiles: reject zero filehandle version count (CVSS 7.5, Linux)
- [CVE-2026-53391](https://cve.now/CVE-2026-53391.md): NFSv4/pNFS: reject zero-length r\_addr in nfs4\_decode\_mp\_ds\_addr (CVSS 7.5, Linux)
- [CVE-2026-53390](https://cve.now/CVE-2026-53390.md): ksmbd: fix out-of-bounds read in smb\_check\_perm\_dacl() (CVSS 8.1, Linux)
- [CVE-2026-53389](https://cve.now/CVE-2026-53389.md): net/tcp-ao: fix use-after-free of key in del\_async path (CVSS 7.8, Linux)
- [CVE-2026-53388](https://cve.now/CVE-2026-53388.md): fuse: re-lock request before replacing page cache folio (CVSS 7.8, Linux)
- [CVE-2026-53387](https://cve.now/CVE-2026-53387.md): iio: light: veml6075: add bounds check to veml6075\_it\_ms index (CVSS 7.1, Linux)
- [CVE-2026-53386](https://cve.now/CVE-2026-53386.md): iio: adc: ti-ads1298: add bounds check to pga\_settings index (CVSS 7.8, Linux)
- [CVE-2026-53385](https://cve.now/CVE-2026-53385.md): vc\_screen: fix null-ptr-deref in vcs\_notifier() during concurrent vcs\_write (no CVSS, Linux)
- [CVE-2026-53384](https://cve.now/CVE-2026-53384.md): serial: 8250\_dw: unregister 8250 port if clk\_notifier\_register() fails (CVSS 9.8, Linux)
- [CVE-2026-53383](https://cve.now/CVE-2026-53383.md): ksmbd: reject non-VALID session in compound request branch (CVSS 7.5, Linux)
- [CVE-2026-53382](https://cve.now/CVE-2026-53382.md): media: vidtv: fix NULL pointer dereference in vidtv\_mux\_push\_si (no CVSS, Linux)
- [CVE-2026-53381](https://cve.now/CVE-2026-53381.md): virtiofs: fix UAF on submount umount (CVSS 7.8, Linux)
- [CVE-2026-53380](https://cve.now/CVE-2026-53380.md): media: rzv2h-ivc: Fix concurrent buffer list access (CVSS 7.8, Linux)
- [CVE-2026-53379](https://cve.now/CVE-2026-53379.md): media: i2c: ov8856: free control handler on error in ov8856\_init\_controls() (no CVSS, Linux)
- [CVE-2026-53378](https://cve.now/CVE-2026-53378.md): drm/colorop: Fix blob property reference tracking in state lifecycle (no CVSS, Linux)
- [CVE-2026-53377](https://cve.now/CVE-2026-53377.md): drm/msm: always recover the gpu (no CVSS, Linux)
- [CVE-2026-53376](https://cve.now/CVE-2026-53376.md): drm/amdkfd: Add upper bound check for num\_of\_nodes (no CVSS, Linux)
- [CVE-2026-53375](https://cve.now/CVE-2026-53375.md): drm/amdgpu/vce: Prevent partial address patches (CVSS 8.8, Linux)
- [CVE-2026-53374](https://cve.now/CVE-2026-53374.md): drm/amdgpu: zero-initialize GART table on allocation (CVSS 8.8, Linux)
- [CVE-2026-53373](https://cve.now/CVE-2026-53373.md): mm/vma: do not try to unmap a VMA if mmap\_prepare() invoked from mmap() (CVSS 7.8, Linux)
- [CVE-2026-16229](https://cve.now/CVE-2026-16229.md): itsourcecode Courier Management System index.php cross site scripting (CVSS 5.3, itsourcecode Courier Management System)
- [CVE-2026-16228](https://cve.now/CVE-2026-16228.md): SourceCodester Class and Exam Timetabling System edit\_schoolyr.php sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-16227](https://cve.now/CVE-2026-16227.md): SourceCodester Class and Exam Timetabling System edit\_subject.php sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-53372](https://cve.now/CVE-2026-53372.md): iommu/vt-d: Block PASID attachment to nested domain with dirty tracking (no CVSS, Linux)
- [CVE-2026-53371](https://cve.now/CVE-2026-53371.md): RDMA/ionic: bound node\_desc sysfs read with %.64s (no CVSS, Linux)
- [CVE-2026-53370](https://cve.now/CVE-2026-53370.md): perf/x86/intel: Improve validation and configuration of ACR masks (no CVSS, Linux)
- [CVE-2026-53369](https://cve.now/CVE-2026-53369.md): udf: reject descriptors with oversized CRC length (CVSS 8.4, Linux)
- [CVE-2026-53368](https://cve.now/CVE-2026-53368.md): f2fs: fix fsck inconsistency caused by incorrect nat\_entry flag usage (CVSS 7.1, Linux)
- [CVE-2026-53367](https://cve.now/CVE-2026-53367.md): selinux: fix avdcache auditing (no CVSS, Linux)
- [CVE-2026-16226](https://cve.now/CVE-2026-16226.md): SourceCodester Pizzafy Ecommerce System admin\_class\_novo.php save\_settings unrestricted upload (CVSS 5.1, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-16225](https://cve.now/CVE-2026-16225.md): davenardella snap7 s7\_peer.cpp NegotiatePDULength out-of-bounds write (CVSS 5.3, davenardella snap7)
- [CVE-2026-16224](https://cve.now/CVE-2026-16224.md): jxxghp MoviePilot Application API improper authorization (CVSS 5.3, jxxghp MoviePilot)
- [CVE-2026-16223](https://cve.now/CVE-2026-16223.md): 1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery (CVSS 5.3, 1Panel-dev CordysCRM)
- [CVE-2026-16222](https://cve.now/CVE-2026-16222.md): 1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery (CVSS 5.3, 1Panel-dev CordysCRM)
- [CVE-2026-16220](https://cve.now/CVE-2026-16220.md): code-projects Online Examination System account.php cross site scripting (CVSS 5.3, code-projects Online Examination System)
- [CVE-2026-16219](https://cve.now/CVE-2026-16219.md): Croogo CMS Admin File Manager FileManager.php isEditable path traversal (CVSS 5.3, Croogo CMS)
- [CVE-2026-16218](https://cve.now/CVE-2026-16218.md): hunvreus devpush Storage Reset Failure storage.py reset\_storage improper check or handling of exceptional conditions (CVSS 2.1, hunvreus devpush)
- [CVE-2026-16217](https://cve.now/CVE-2026-16217.md): guohongze adminset Delivery Deployment Endpoint deli.py authorization (CVSS 5.3, guohongze adminset)
- [CVE-2026-16216](https://cve.now/CVE-2026-16216.md): geex-arts django-jet OAuth cross-site request forgery (CVSS 5.3, geex-arts django-jet)
- [CVE-2026-16215](https://cve.now/CVE-2026-16215.md): geex-arts django-jet OAuth Credential Revoke authorization (CVSS 6.9, geex-arts django-jet)
- [CVE-2026-16214](https://cve.now/CVE-2026-16214.md): geex-arts django-jet Dashboard views.py authorization (CVSS 5.3, geex-arts django-jet)
- [CVE-2026-16213](https://cve.now/CVE-2026-16213.md): Fantomas42 django-blog-zinnia Protected Entry Password entry\_protection.py cleartext storage (CVSS 4.8, Fantomas42 django-blog-zinnia)
- [CVE-2026-16212](https://cve.now/CVE-2026-16212.md): awesto django-shop Purchase Stock inventory.py race condition (CVSS 2.3, awesto django-shop)
- [CVE-2026-16211](https://cve.now/CVE-2026-16211.md): allegro Hostname Allocation assets.py AssetLastHostname.increment\_hostname race condition (CVSS 2.1, allegro)
- [CVE-2026-16210](https://cve.now/CVE-2026-16210.md): newpanjing simpleui AjaxAdmin AJAX Endpoint admin.py self.get\_action missing authentication (CVSS 6.9, newpanjing simpleui)
- [CVE-2026-16209](https://cve.now/CVE-2026-16209.md): Gerapy Project Upload Endpoint views.py missing authentication (CVSS 6.9, Gerapy)
- [CVE-2026-16208](https://cve.now/CVE-2026-16208.md): django-tastypie throttle.py CacheDBThrottle race condition (CVSS 2.3, django-tastypie)
- [CVE-2026-16207](https://cve.now/CVE-2026-16207.md): django-tastypie authentication.py ApiKeyAuthentication get request method with sensitive query strings (CVSS 6.3, django-tastypie)
- [CVE-2026-16206](https://cve.now/CVE-2026-16206.md): django-oauth django-oauth-toolkit oauth2\_validators.py \_load\_id\_token session expiration (CVSS 5.3, django-oauth-toolkit)
- [CVE-2026-16205](https://cve.now/CVE-2026-16205.md): Pluck CMS Albums albums.admin.php htmlspecialchars\_decode cross site scripting (CVSS 4.8, Pluck CMS)
- [CVE-2026-16204](https://cve.now/CVE-2026-16204.md): zevorn rt-claw Telegram-to-AI Tool Execution Flow script.c tool\_run\_script\_execute code injection (CVSS 5.3, zevorn rt-claw)
- [CVE-2026-16203](https://cve.now/CVE-2026-16203.md): SourceCodester Class and Exam Timetabling System forCYS.php cross site scripting (CVSS 5.1, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-16202](https://cve.now/CVE-2026-16202.md): SourceCodester Class and Exam Timetabling System CYS.php cross site scripting (CVSS 5.1, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-16201](https://cve.now/CVE-2026-16201.md): zevorn rt-claw http\_request net.c claw\_net\_post information disclosure (CVSS 6.9, zevorn rt-claw)
- [CVE-2026-16200](https://cve.now/CVE-2026-16200.md): zevorn rt-claw RPC swarm.c claw\_tool\_invoke authorization (CVSS 6.9, zevorn rt-claw)
- [CVE-2026-16199](https://cve.now/CVE-2026-16199.md): nextlevelbuilder GoClaw credentialed\_exec.go ExecTool.Execute improper authorization (CVSS 5.3, nextlevelbuilder GoClaw)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-07-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.