# CVEs published 2026-08-15

924 CVEs were published on August 15, 2026: 150 critical, 400 high. Days are UTC.

- [CVE-2026-19920](https://cve.now/CVE-2026-19920.md): code-projects Online Shopping System action.php sql injection (CVSS 5.3, code-projects Online Shopping System)
- [CVE-2026-19919](https://cve.now/CVE-2026-19919.md): code-projects Online Shopping System Login login.php sql injection (CVSS 6.9, code-projects Online Shopping System)
- [CVE-2026-19918](https://cve.now/CVE-2026-19918.md): SpaceX Starlink Router Gen 3 gRPC Management get\_status access control (CVSS 5.3, SpaceX Starlink Router Gen)
- [CVE-2026-19917](https://cve.now/CVE-2026-19917.md): code-projects Online Food Order System delete\_food\_items1.php sql injection (CVSS 5.3, code-projects Online Food Order System)
- [CVE-2026-19916](https://cve.now/CVE-2026-19916.md): code-projects Online Food Order System edit\_food\_items.php cross site scripting (CVSS 5.1, code-projects Online Food Order System)
- [CVE-2026-74767](https://cve.now/CVE-2026-74767.md): Unbounded DAA Decompression in Pandora Allows Denial of Service via Decompression Bomb (CVSS 8.7, pandora-analysis pandora)
- [CVE-2026-73055](https://cve.now/CVE-2026-73055.md): Shescape before 2.1.15 and 3.0.2 Home Directory Disclosure via BusyBox (CVSS 6.3, ericcornelissen shescape)
- [CVE-2026-73054](https://cve.now/CVE-2026-73054.md): SiYuan before v3.7.4 Authentication Bypass via WebSocket (CVSS 8.7, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-73053](https://cve.now/CVE-2026-73053.md): SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji (CVSS 9.4, siyuan-note siyuan)
- [CVE-2026-73052](https://cve.now/CVE-2026-73052.md): SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names (CVSS 9.4, siyuan-note siyuan)
- [CVE-2026-73050](https://cve.now/CVE-2026-73050.md): SiYuan before v3.7.4 Stored XSS via select option color (CVSS 9.4, siyuan-note siyuan)
- [CVE-2026-73047](https://cve.now/CVE-2026-73047.md): siyuan before v3.7.4 Server-Side Template Injection via attribute-view (CVSS 8.6, siyuan-note siyuan)
- [CVE-2026-73046](https://cve.now/CVE-2026-73046.md): SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth (CVSS 9.3, siyuan-note siyuan)
- [CVE-2026-73045](https://cve.now/CVE-2026-73045.md): SiYuan before 3.7.4 Brute-Force via authFilePublishAccess (CVSS 8.7, siyuan-note siyuan)
- [CVE-2026-73044](https://cve.now/CVE-2026-73044.md): SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width (CVSS 9.4, siyuan-note siyuan)
- [CVE-2026-73043](https://cve.now/CVE-2026-73043.md): SiYuan before v3.7.4 Remote Code Execution via Template Calculation (CVSS 9.4, siyuan-note siyuan)
- [CVE-2026-73042](https://cve.now/CVE-2026-73042.md): SiYuan before v3.7.4 Remote Code Execution via Menu Metadata (CVSS 9.4, siyuan-note siyuan)
- [CVE-2026-73041](https://cve.now/CVE-2026-73041.md): SiYuan before v3.7.4 Remote Code Execution via PDF Annotations (CVSS 9.4, siyuan-note siyuan)
- [CVE-2026-74764](https://cve.now/CVE-2026-74764.md): Path Traversal in TAR Archive Extraction Allows Arbitrary File Write in Pandora (CVSS 10.0, pandora-analysis pandora)
- [CVE-2026-19906](https://cve.now/CVE-2026-19906.md): pkp pkp-lib API Key Generation APIProfileForm.php setData entropy (CVSS 6.3, pkp-lib)
- [CVE-2026-19905](https://cve.now/CVE-2026-19905.md): Jinher OA attendance\_out\_approve.aspx sql injection (CVSS 6.9, Jinher OA)
- [CVE-2026-18855](https://cve.now/CVE-2026-18855.md): Link Library \<= 7.9.4 - Unauthenticated Arbitrary File Deletion via link\_url Parameter (CVSS 9.1, jackdewey Link Library)
- [CVE-2026-19904](https://cve.now/CVE-2026-19904.md): SourceCodester Online Book Store System System Settings index.php site\_settings cross site scripting (CVSS 4.8, SourceCodester Online Book Store System)
- [CVE-2026-19903](https://cve.now/CVE-2026-19903.md): SourceCodester Online Clothing Store SQL Database Backup shopping.sql file access (CVSS 6.9, SourceCodester Online Clothing Store)
- [CVE-2026-19598](https://cve.now/CVE-2026-19598.md): Pods \<= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods\_admin' AJAX Router (CVSS 9.8, sc0ttkclark Pods – Custom Content Types and Fields)
- [CVE-2026-19901](https://cve.now/CVE-2026-19901.md): LB-LINK X-PRO easycwmp hard-coded credentials (CVSS 9.2, LB-LINK X-PRO)
- [CVE-2026-19900](https://cve.now/CVE-2026-19900.md): LB-LINK X-PRO shadow hard-coded credentials (CVSS 9.2, LB-LINK X-PRO)
- [CVE-2026-19899](https://cve.now/CVE-2026-19899.md): SourceCodester Class and Exam Timetabling System edit\_teacher.php sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-19898](https://cve.now/CVE-2026-19898.md): VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentication (CVSS 6.3, VictoriaMetrics)
- [CVE-2026-19897](https://cve.now/CVE-2026-19897.md): mangroup dtale Login Endpoint auth.py login excessive authentication (CVSS 6.3, mangroup dtale)
- [CVE-2026-19896](https://cve.now/CVE-2026-19896.md): mangroup dtale Flask Session Cookie app.py build\_secret\_key random values (CVSS 6.3, mangroup dtale)
- [CVE-2026-18165](https://cve.now/CVE-2026-18165.md): @fastify/oauth2 vulnerable to Login CSRF via plantable OAuth state cookies (CVSS 4.2, @fastify/oauth2)
- [CVE-2026-19474](https://cve.now/CVE-2026-19474.md): @fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload (CVSS 7.5, @fastify/multipart)
- [CVE-2026-19895](https://cve.now/CVE-2026-19895.md): opensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authentication (CVSS 6.3, opensourcepos Open Source Point of Sale)
- [CVE-2026-18549](https://cve.now/CVE-2026-18549.md): @fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit (CVSS 7.5, @fastify/multipart)
- [CVE-2026-15689](https://cve.now/CVE-2026-15689.md): Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in \_default\_email\_password\_reset and \_default\_welcome\_send (CVSS 9.8, ABEVERLEY Dancer2::Plugin::Auth::Extensible)
- [CVE-2026-18500](https://cve.now/CVE-2026-18500.md): @fastify/jwt vulnerable to authorization bypass via global secret overriding the per-request key (CVSS 8.1, @fastify/jwt)
- [CVE-2026-74577](https://cve.now/CVE-2026-74577.md): net: mpls: initialize rtm\_tos in mpls\_getroute() (no CVSS, Linux)
- [CVE-2026-74576](https://cve.now/CVE-2026-74576.md): mm/slab: prevent unbounded recursion in free path with new kmalloc type (CVSS 7.5, Linux)
- [CVE-2026-74575](https://cve.now/CVE-2026-74575.md): thunderbolt: Prevent XDomain delayed work use-after-free on disconnect (CVSS 8.8, Linux)
- [CVE-2026-74574](https://cve.now/CVE-2026-74574.md): dmaengine: idxd: fix fdev setup failure cleanup in idxd\_cdev\_open() (CVSS 7.8, Linux)
- [CVE-2026-74573](https://cve.now/CVE-2026-74573.md): iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE (CVSS 9.3, Linux)
- [CVE-2026-74572](https://cve.now/CVE-2026-74572.md): btrfs: zoned: fix deadlock between metadata writeback and transaction commit (CVSS 7.5, Linux)
- [CVE-2026-74571](https://cve.now/CVE-2026-74571.md): btrfs: skip global block reserve accounting for rescue mounts (no CVSS, Linux)
- [CVE-2026-74570](https://cve.now/CVE-2026-74570.md): ntfs: harden runlist realloc size calculations (CVSS 9.8, Linux)
- [CVE-2026-74569](https://cve.now/CVE-2026-74569.md): netfilter: nf\_conntrack\_sip: widen NAT rewrite delta to s32 in sip\_help\_tcp() (CVSS 9.8, Linux)
- [CVE-2026-74568](https://cve.now/CVE-2026-74568.md): KVM: arm64: vgic: Fix race between LPI release and re-registration (CVSS 9.3, Linux)
- [CVE-2026-74567](https://cve.now/CVE-2026-74567.md): keys: fix out-of-bounds read in keyring\_get\_key\_chunk() (CVSS 7.1, Linux)
- [CVE-2026-74566](https://cve.now/CVE-2026-74566.md): keys: make keyring key-chunk byte order agree with keyring\_diff\_objects() (no CVSS, Linux)
- [CVE-2026-74565](https://cve.now/CVE-2026-74565.md): netfilter: nf\_tables: make nft\_object rhltable per table (CVSS 7.8, Linux)
- [CVE-2026-74564](https://cve.now/CVE-2026-74564.md): netfilter: xt\_hashlimit: validate hashtable supports XT\_HASHLIMIT\_RATE\_MATCH (CVSS 7.1, Linux)
- [CVE-2026-74563](https://cve.now/CVE-2026-74563.md): rds: tcp: hold the RCU lock across ipv6\_chk\_addr() in rds\_tcp\_laddr\_check() (CVSS 7.8, Linux)
- [CVE-2026-74562](https://cve.now/CVE-2026-74562.md): nexthop: take nh-\>lock for f6i\_list walks in replace check and notify (CVSS 8.8, Linux)
- [CVE-2026-74561](https://cve.now/CVE-2026-74561.md): nexthop: avoid unlocked f6i\_list walk in nh\_rt\_cache\_flush (CVSS 8.8, Linux)
- [CVE-2026-74560](https://cve.now/CVE-2026-74560.md): xsk: fix buffer leak in xsk\_drop\_skb() for AF\_XDP multi-buffer Tx (no CVSS, Linux)
- [CVE-2026-74559](https://cve.now/CVE-2026-74559.md): xsk: drain continuation descs after overflow in xsk\_build\_skb() (no CVSS, Linux)
- [CVE-2026-74558](https://cve.now/CVE-2026-74558.md): xsk: reclaim invalid Tx descriptors in ZC batch path (no CVSS, Linux)
- [CVE-2026-74557](https://cve.now/CVE-2026-74557.md): scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (CVSS 7.5, Linux)
- [CVE-2026-74556](https://cve.now/CVE-2026-74556.md): scsi: libiscsi\_tcp: Bound SCSI Response data segment to the connection buffer (CVSS 9.8, Linux)
- [CVE-2026-74555](https://cve.now/CVE-2026-74555.md): scsi: libsas: Fix HA resume deadlock and hisi\_sas disk-wake race (no CVSS, Linux)
- [CVE-2026-74554](https://cve.now/CVE-2026-74554.md): wifi: ath12k: fix out-of-bounds clear\_bit in ath12k\_mac\_dp\_peer\_cleanup() (CVSS 8.8, Linux)
- [CVE-2026-74553](https://cve.now/CVE-2026-74553.md): hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (no CVSS, Linux)
- [CVE-2026-74552](https://cve.now/CVE-2026-74552.md): hwmon: (lm90) Only report alarms if driver is ready (no CVSS, Linux)
- [CVE-2026-74551](https://cve.now/CVE-2026-74551.md): hwmon: (nzxt-smart2) DMA-align output buffer (CVSS 7.8, Linux)
- [CVE-2026-74550](https://cve.now/CVE-2026-74550.md): net: do not send ICMP/NDISC Redirects when peer allocation fails (CVSS 7.5, Linux)
- [CVE-2026-74549](https://cve.now/CVE-2026-74549.md): hwmon: (nct6775-core) Prevent access to unsupported weight registers (CVSS 7.8, Linux)
- [CVE-2026-74548](https://cve.now/CVE-2026-74548.md): forcedeth: fix UAF of txrx\_stats in nv\_remove (CVSS 7.8, Linux)
- [CVE-2026-74547](https://cve.now/CVE-2026-74547.md): hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (no CVSS, Linux)
- [CVE-2026-74546](https://cve.now/CVE-2026-74546.md): hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (no CVSS, Linux)
- [CVE-2026-74545](https://cve.now/CVE-2026-74545.md): rtase: fix double free of multi-frag skb on DMA map failure (CVSS 9.8, Linux)
- [CVE-2026-74544](https://cve.now/CVE-2026-74544.md): net/sched: cls\_u32: validate offshift to prevent shift-out-of-bounds (CVSS 7.8, Linux)
- [CVE-2026-74543](https://cve.now/CVE-2026-74543.md): net: udp\_tunnel: fix memory leak in udp\_tunnel\_nic\_unregister() (no CVSS, Linux)
- [CVE-2026-74542](https://cve.now/CVE-2026-74542.md): netfs: Fix folio\_queue ENOMEM in writeback by adding a mempool (no CVSS, Linux)
- [CVE-2026-74541](https://cve.now/CVE-2026-74541.md): Bluetooth: ISO: clear iso\_data always when detaching conn from hcon (CVSS 8.8, Linux)
- [CVE-2026-74540](https://cve.now/CVE-2026-74540.md): Bluetooth: L2CAP: fix UAF in l2cap\_le\_connect\_rsp (CVSS 8.8, Linux)
- [CVE-2026-74539](https://cve.now/CVE-2026-74539.md): Bluetooth: ISO: lock sk in iso\_sock\_getname (CVSS 8.0, Linux)
- [CVE-2026-74538](https://cve.now/CVE-2026-74538.md): Bluetooth: ISO: lock sk in iso\_connect\_ind (CVSS 8.8, Linux)
- [CVE-2026-74537](https://cve.now/CVE-2026-74537.md): Bluetooth: ISO: hold sk properly in iso\_conn\_ready (CVSS 8.8, Linux)
- [CVE-2026-74536](https://cve.now/CVE-2026-74536.md): Bluetooth: ISO: fix leaking sk after socket release (no CVSS, Linux)
- [CVE-2026-74535](https://cve.now/CVE-2026-74535.md): Bluetooth: ISO: avoid deadlocks in iso\_sock\_timeout (CVSS 8.8, Linux)
- [CVE-2026-74534](https://cve.now/CVE-2026-74534.md): Bluetooth: ISO: fix refcounting of iso\_conn (CVSS 8.8, Linux)
- [CVE-2026-74533](https://cve.now/CVE-2026-74533.md): Bluetooth: ISO: fix race of kfree vs kref\_get\_unless\_zero (CVSS 8.8, Linux)
- [CVE-2026-74532](https://cve.now/CVE-2026-74532.md): Bluetooth: btintel: Validate length before parsing diagnostics TLV (no CVSS, Linux)
- [CVE-2026-74531](https://cve.now/CVE-2026-74531.md): Bluetooth: hci\_conn: hold conn reference in abort\_conn\_sync() (CVSS 8.8, Linux)
- [CVE-2026-74530](https://cve.now/CVE-2026-74530.md): Bluetooth: hci\_sync: hold conn in hci\_connect\_big\_sync() callback (CVSS 8.8, Linux)
- [CVE-2026-74529](https://cve.now/CVE-2026-74529.md): Bluetooth: hci\_sync: hold conn in hci\_connect\_pa\_sync() callback (CVSS 7.8, Linux)
- [CVE-2026-74528](https://cve.now/CVE-2026-74528.md): Bluetooth: hci\_sync: hold conn in hci\_past\_sync() callback (CVSS 8.0, Linux)
- [CVE-2026-74527](https://cve.now/CVE-2026-74527.md): octeontx2-af: Block VFs from clobbering special CGX PKIND state (CVSS 8.8, Linux)
- [CVE-2026-74526](https://cve.now/CVE-2026-74526.md): scsi: mpi3mr: Fix potential deadlock in mpi3mr\_fault\_uevent\_emit (no CVSS, Linux)
- [CVE-2026-74525](https://cve.now/CVE-2026-74525.md): net: sxgbe: free TX rings on RX allocation failure (no CVSS, Linux)
- [CVE-2026-74524](https://cve.now/CVE-2026-74524.md): riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove (no CVSS, Linux)
- [CVE-2026-74523](https://cve.now/CVE-2026-74523.md): qede: sync udp\_tunnel ports outside qede\_lock in the recovery path (CVSS 7.5, Linux)
- [CVE-2026-74522](https://cve.now/CVE-2026-74522.md): ksmbd: fix use-after-free in \_\_close\_file\_table\_ids() (CVSS 8.8, Linux)
- [CVE-2026-74521](https://cve.now/CVE-2026-74521.md): ksmbd: use memcmp() to compare ClientGUIDs (CVSS 9.1, Linux)
- [CVE-2026-74520](https://cve.now/CVE-2026-74520.md): iommu/iommufd: Fix IOPF group ownership UAF (CVSS 8.8, Linux)
- [CVE-2026-74519](https://cve.now/CVE-2026-74519.md): pinctrl: devicetree: don't free uninitialized dev\_name on error path (CVSS 7.8, Linux)
- [CVE-2026-74518](https://cve.now/CVE-2026-74518.md): mm/hugetlb: fix list corruption in allocate\_file\_region\_entries() (CVSS 7.8, Linux)
- [CVE-2026-74517](https://cve.now/CVE-2026-74517.md): KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs (CVSS 9.3, Linux)
- [CVE-2026-74516](https://cve.now/CVE-2026-74516.md): KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVSS 8.2, Linux)
- [CVE-2026-74515](https://cve.now/CVE-2026-74515.md): KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVSS 8.8, Linux)
- [CVE-2026-74514](https://cve.now/CVE-2026-74514.md): KVM: s390: pci: Fix memory accounting for pinned/unpinned pages (no CVSS, Linux)
- [CVE-2026-74513](https://cve.now/CVE-2026-74513.md): dibs: fix use-after-free of dmb\_node in loopback attach/detach/unregister (CVSS 7.8, Linux)
- [CVE-2026-74512](https://cve.now/CVE-2026-74512.md): audit: fix potential use-after-free in audit\_del\_rule() (CVSS 7.8, Linux)
- [CVE-2026-74510](https://cve.now/CVE-2026-74510.md): Bluetooth: mgmt: fix UAF in pair command cancellation (CVSS 7.8, Linux)
- [CVE-2026-74509](https://cve.now/CVE-2026-74509.md): Bluetooth: hci\_sync: Fix advertising data UAFs (CVSS 8.8, Linux)
- [CVE-2026-74508](https://cve.now/CVE-2026-74508.md): Bluetooth: HIDP: reject frames without a transaction header (CVSS 8.8, Linux)
- [CVE-2026-74507](https://cve.now/CVE-2026-74507.md): Bluetooth: HIDP: validate numbered report payloads (CVSS 7.1, Linux)
- [CVE-2026-74506](https://cve.now/CVE-2026-74506.md): afs: Fix UAF when sending a message (CVSS 7.8, Linux)
- [CVE-2026-74505](https://cve.now/CVE-2026-74505.md): ALSA: 6fire: Fix UAF at error handling during probe (no CVSS, Linux)
- [CVE-2026-74504](https://cve.now/CVE-2026-74504.md): ALSA: seq: Fix division by zero in initialize\_timer() (no CVSS, Linux)
- [CVE-2026-74503](https://cve.now/CVE-2026-74503.md): ALSA: timer: Clear SNDRV\_TIMER\_IFLG\_DEAD once the close completes (CVSS 7.8, Linux)
- [CVE-2026-74502](https://cve.now/CVE-2026-74502.md): ALSA: ump: fix double free of out\_cvts on rawmidi error (no CVSS, Linux)
- [CVE-2026-74501](https://cve.now/CVE-2026-74501.md): ALSA: usb-audio: fix use-after-free in ump\_to\_endpoint() (no CVSS, Linux)
- [CVE-2026-74500](https://cve.now/CVE-2026-74500.md): ALSA: usb-audio: fix stack info leak in RME Digiface status (no CVSS, Linux)
- [CVE-2026-74499](https://cve.now/CVE-2026-74499.md): ALSA: usb-audio: fix OOB write in snd\_usbmidi\_akai\_output() (no CVSS, Linux)
- [CVE-2026-74498](https://cve.now/CVE-2026-74498.md): ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill\_max is set (no CVSS, Linux)
- [CVE-2026-74497](https://cve.now/CVE-2026-74497.md): ALSA: usb-audio: Clamp frame size in implicit-feedback mode (CVSS 8.4, Linux)
- [CVE-2026-74496](https://cve.now/CVE-2026-74496.md): fou: Fix use-after-free in fou\_create() (CVSS 7.8, Linux)
- [CVE-2026-74495](https://cve.now/CVE-2026-74495.md): igbvf: Fix leak in TX DMA error cleanup (CVSS 9.8, Linux)
- [CVE-2026-74494](https://cve.now/CVE-2026-74494.md): ksmbd: reject repeated SMB2 NEGOTIATE requests (no CVSS, Linux)
- [CVE-2026-74493](https://cve.now/CVE-2026-74493.md): net/smc: fix socket use-after-free during link group termination (CVSS 9.8, Linux)
- [CVE-2026-74492](https://cve.now/CVE-2026-74492.md): netfilter: ipset: do not update comments from kernel-side hash adds (CVSS 8.4, Linux)
- [CVE-2026-74491](https://cve.now/CVE-2026-74491.md): of/address: Fix NULL bus dereference in of\_pci\_range\_parser\_one() (no CVSS, Linux)
- [CVE-2026-74490](https://cve.now/CVE-2026-74490.md): tipc: avoid use-after-free in poll trace queue dumps (CVSS 8.8, Linux)
- [CVE-2026-74489](https://cve.now/CVE-2026-74489.md): wifi: mac80211: fix tid\_tx use-after-free on BA session stop (CVSS 8.8, Linux)
- [CVE-2026-74488](https://cve.now/CVE-2026-74488.md): wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (CVSS 8.8, Linux)
- [CVE-2026-74487](https://cve.now/CVE-2026-74487.md): binfmt\_misc: restore write access when removing an entry (no CVSS, Linux)
- [CVE-2026-74486](https://cve.now/CVE-2026-74486.md): binfmt\_misc: use exe\_file\_deny\_write\_access() for the interpreter clone (no CVSS, Linux)
- [CVE-2026-74485](https://cve.now/CVE-2026-74485.md): binfmt\_misc: reject a flag character as the field delimiter (CVSS 7.1, Linux)
- [CVE-2026-74484](https://cve.now/CVE-2026-74484.md): binfmt\_misc: don't let an 'F' entry pin its own instance (no CVSS, Linux)
- [CVE-2026-74483](https://cve.now/CVE-2026-74483.md): binfmt\_misc: don't leak the user namespace when the mount fails (no CVSS, Linux)
- [CVE-2026-74482](https://cve.now/CVE-2026-74482.md): mm/huge\_memory: unlock i\_mmap\_rwsem before releasing after-split folios (CVSS 7.8, Linux)
- [CVE-2026-74481](https://cve.now/CVE-2026-74481.md): mm/page\_reporting: use system\_freezable\_wq to fix UAF during suspend (CVSS 7.8, Linux)
- [CVE-2026-74480](https://cve.now/CVE-2026-74480.md): net: bridge: stop fast-leave after deleting a port group (CVSS 9.8, Linux)
- [CVE-2026-74479](https://cve.now/CVE-2026-74479.md): net: pktgen: fix proc entry use-after-free (CVSS 7.8, Linux)
- [CVE-2026-74478](https://cve.now/CVE-2026-74478.md): um: vector: fix use-after-free in vector\_mmsg\_rx() (CVSS 9.8, Linux)
- [CVE-2026-74477](https://cve.now/CVE-2026-74477.md): uprobes: Fix NULL pointer dereference in hprobe\_expire() (no CVSS, Linux)
- [CVE-2026-74476](https://cve.now/CVE-2026-74476.md): veth: convert frag\_list skbs before running XDP (CVSS 9.1, Linux)
- [CVE-2026-74475](https://cve.now/CVE-2026-74475.md): vxlan: use neigh\_ha\_snapshot() in route\_shortcircuit() (CVSS 10.0, Linux)
- [CVE-2026-74474](https://cve.now/CVE-2026-74474.md): vxlan: use pskb\_network\_may\_pull() for transmit path header pulls (CVSS 9.8, Linux)
- [CVE-2026-74473](https://cve.now/CVE-2026-74473.md): vxlan: use pskb\_network\_may\_pull() in route\_shortcircuit() (CVSS 9.8, Linux)
- [CVE-2026-74472](https://cve.now/CVE-2026-74472.md): ublk: reset kernel-owned dev\_info fields in ublk\_ctrl\_add\_dev() (no CVSS, Linux)
- [CVE-2026-74471](https://cve.now/CVE-2026-74471.md): tracing: Check return value of \_\_register\_event() in trace\_module\_add\_events() (CVSS 7.8, Linux)
- [CVE-2026-74470](https://cve.now/CVE-2026-74470.md): scsi: scsi\_debug: Fix REPORT ZONES alloc\_len underflow OOB write (CVSS 7.8, Linux)
- [CVE-2026-74469](https://cve.now/CVE-2026-74469.md): sctp: prevent peer transport count overflow (CVSS 8.8, Linux)
- [CVE-2026-74468](https://cve.now/CVE-2026-74468.md): gpio: pch: use raw\_spinlock\_t for the register lock (no CVSS, Linux)
- [CVE-2026-74467](https://cve.now/CVE-2026-74467.md): s390/qeth: Check CAP\_NET\_ADMIN for private ioctls (CVSS 7.8, Linux)
- [CVE-2026-74466](https://cve.now/CVE-2026-74466.md): s390/zcrypt: Close speculative mem read possibility (no CVSS, Linux)
- [CVE-2026-74465](https://cve.now/CVE-2026-74465.md): net: openvswitch: fix potential UAF on meter attach failure (CVSS 7.8, Linux)
- [CVE-2026-74464](https://cve.now/CVE-2026-74464.md): net: openvswitch: fix skb leak on flow key update failure during ct (no CVSS, Linux)
- [CVE-2026-74463](https://cve.now/CVE-2026-74463.md): i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare\_lock deadlock (no CVSS, Linux)
- [CVE-2026-74462](https://cve.now/CVE-2026-74462.md): i2c: imx: mark I2C adapter when hardware is powered down (no CVSS, Linux)
- [CVE-2026-74461](https://cve.now/CVE-2026-74461.md): i2c: imx: Cancel hrtimer before clearing slave pointer (CVSS 8.4, Linux)
- [CVE-2026-74460](https://cve.now/CVE-2026-74460.md): can: ems\_usb: validate CPC message lengths (no CVSS, Linux)
- [CVE-2026-74459](https://cve.now/CVE-2026-74459.md): can: etas\_es58x: es58x\_read\_bulk\_callback(): fix RX buffer leak on URB resubmit failure (no CVSS, Linux)
- [CVE-2026-74458](https://cve.now/CVE-2026-74458.md): can: kvaser\_usb\_leaf: kvaser\_usb\_leaf\_wait\_cmd(): validate received command extents (no CVSS, Linux)
- [CVE-2026-74457](https://cve.now/CVE-2026-74457.md): can: peak\_usb: add bounds check for USB channel index (no CVSS, Linux)
- [CVE-2026-74456](https://cve.now/CVE-2026-74456.md): can: peak\_usb: peak\_usb\_start(): fix double free of transfer buffer on URB submit error (CVSS 7.8, Linux)
- [CVE-2026-74455](https://cve.now/CVE-2026-74455.md): can: peak\_usb: validate uCAN receive record lengths (no CVSS, Linux)
- [CVE-2026-74454](https://cve.now/CVE-2026-74454.md): drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (CVSS 7.8, Linux)
- [CVE-2026-74453](https://cve.now/CVE-2026-74453.md): drm/vc4: Zero the tile state data array before each BIN job (CVSS 7.8, Linux)
- [CVE-2026-74452](https://cve.now/CVE-2026-74452.md): drm/panthor: reject firmware sections with oversized data (CVSS 7.8, Linux)
- [CVE-2026-74451](https://cve.now/CVE-2026-74451.md): drm/panthor: validate firmware interface structure sizes (CVSS 7.8, Linux)
- [CVE-2026-74450](https://cve.now/CVE-2026-74450.md): drm/amd/pm: fix pptable use-after-free (CVSS 7.8, Linux)
- [CVE-2026-74449](https://cve.now/CVE-2026-74449.md): drm/amd/display: Fix divide-by-zero in calculate\_mcache\_setting on zero viewport (CVSS 7.8, Linux)
- [CVE-2026-74448](https://cve.now/CVE-2026-74448.md): drm/amdkfd: fix QID bit leak in pqm\_create\_queue() (no CVSS, Linux)
- [CVE-2026-74447](https://cve.now/CVE-2026-74447.md): drm/amdkfd: fix uint32\_t overflow in EOP ring buffer size alignment (CVSS 7.8, Linux)
- [CVE-2026-74446](https://cve.now/CVE-2026-74446.md): drm/amdkfd: hold event\_mutex while checkpointing CRIU events (CVSS 7.8, Linux)
- [CVE-2026-74445](https://cve.now/CVE-2026-74445.md): drm/vmwgfx: reject DX\_BIND\_QUERY without a DX context (no CVSS, Linux)
- [CVE-2026-74444](https://cve.now/CVE-2026-74444.md): drm/vmwgfx: validate DRAW\_PRIMITIVES header size before division (CVSS 7.8, Linux)
- [CVE-2026-74443](https://cve.now/CVE-2026-74443.md): drm/vmwgfx: bound DMA command body size against suffix pointer (CVSS 8.8, Linux)
- [CVE-2026-74442](https://cve.now/CVE-2026-74442.md): drm/vmwgfx: avoid destroy\_workqueue(NULL) on vkms init failure (no CVSS, Linux)
- [CVE-2026-74441](https://cve.now/CVE-2026-74441.md): usb: typec: ucsi: Fix race condition and ordering in port unregistration (no CVSS, Linux)
- [CVE-2026-74440](https://cve.now/CVE-2026-74440.md): drm/xe: Wait on external BO kernel fences in exec IOCTL (CVSS 7.8, Linux)
- [CVE-2026-19894](https://cve.now/CVE-2026-19894.md): itsourcecode Hospital Management System viewmedicine.php sql injection (CVSS 5.3, itsourcecode Hospital Management System)
- [CVE-2026-73194](https://cve.now/CVE-2026-73194.md): DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse (CVSS 9.1, DBI)
- [CVE-2026-73193](https://cve.now/CVE-2026-73193.md): DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse (CVSS 9.8, DBI)
- [CVE-2026-19893](https://cve.now/CVE-2026-19893.md): D-Link DIR-842 vsftpd vsftpd.conf default permission (CVSS 2.3, D-Link DIR-842)
- [CVE-2026-12248](https://cve.now/CVE-2026-12248.md): WPML Multilingual CMS \<= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter (CVSS 6.5, WPML Multilingual CMS)
- [CVE-2026-19891](https://cve.now/CVE-2026-19891.md): TRENDnet TEW-WLC100 IKE Phase 1 Aggressive Mode racoon.conf missing encryption (CVSS 6.3, TRENDnet TEW-WLC100)
- [CVE-2026-73632](https://cve.now/CVE-2026-73632.md): Apache Struts: Shared serialization state in the JSON plugin (CVSS 4.3, Apache Software Foundation Apache Struts)
- [CVE-2026-73631](https://cve.now/CVE-2026-73631.md): Apache Struts: Shared parsing state in the JSON plugin (CVSS 4.3, Apache Software Foundation Apache Struts)
- [CVE-2026-73635](https://cve.now/CVE-2026-73635.md): Apache Struts: Unbounded growth of localized-text caches driven by the request locale (CVSS 7.5, Apache Software Foundation Apache Struts)
- [CVE-2026-73634](https://cve.now/CVE-2026-73634.md): Apache Struts: Unbounded read of a Content Security Policy violation report (CVSS 7.5, Apache Software Foundation Apache Struts)
- [CVE-2026-18438](https://cve.now/CVE-2026-18438.md): Templately \<= 3.7.1 - Authenticated (Contributor+) Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Import Attachment Filename Mismatch (CVSS 8.8, wpdevteam Templately – Elementor & Gutenberg Template Libra…)
- [CVE-2026-16142](https://cve.now/CVE-2026-16142.md): TrueBooker \<= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker\_wp\_user\_id' Parameter (CVSS 9.8, themetechmount TrueBooker – Appointment Booking and Schedul…)
- [CVE-2026-15142](https://cve.now/CVE-2026-15142.md): Real Estate Manager Pro \<= 12.8.6 - Authenticated (Subscriber+) Privilege Escalation via 'user\_has\_cap' Filter ID Collision (CVSS 7.5, WebCodingPlace Real Estate Manager Pro)
- [CVE-2026-14279](https://cve.now/CVE-2026-14279.md): Wholesale Market \<= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role\_required' Parameter (CVSS 8.8, cedcommerce Wholesale Market)
- [CVE-2026-15826](https://cve.now/CVE-2026-15826.md): User Profile Builder \<= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter (CVSS 9.8, cozmoslabs User Profile Builder – Beautiful User Registrati…)
- [CVE-2026-18807](https://cve.now/CVE-2026-18807.md): ECS \< 4.3.13 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers (CVSS 4.3, ECS)
- [CVE-2026-18216](https://cve.now/CVE-2026-18216.md): Backup Migration \< 2.1.7 - Admin+ Privilege Escalation via Post-Restore Auto-Login (CVSS 6.5, Backup Migration)
- [CVE-2026-16611](https://cve.now/CVE-2026-16611.md): Product Feed PRO for WooCommerce \< 13.5.7 - Unauthenticated Feed Configuration Disclosure (CVSS 7.5, Product Feed PRO for WooCommerce by AdTribes)
- [CVE-2026-16541](https://cve.now/CVE-2026-16541.md): Simply Schedule Appointments \< 1.6.12.17 - Team Member+ User Email Disclosure via Users and Customers REST Endpoints (CVSS 6.5, Simply Schedule Appointments)
- [CVE-2026-14230](https://cve.now/CVE-2026-14230.md): ECS \< 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings (CVSS 5.4, ECS)
- [CVE-2026-14229](https://cve.now/CVE-2026-14229.md): ECS \< 4.3.8 - Unauthenticated Private Content Disclosure via ecsload (CVSS 5.3, ECS)
- [CVE-2026-74439](https://cve.now/CVE-2026-74439.md): iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (CVSS 9.3, Linux)
- [CVE-2026-74438](https://cve.now/CVE-2026-74438.md): crypto: sun4i-ss - Remove insecure and unused rng\_alg (CVSS 7.8, Linux)
- [CVE-2026-74437](https://cve.now/CVE-2026-74437.md): media: uvcvideo: Fix deadlock if uvc\_status\_stop is called from async\_ctrl.work (no CVSS, Linux)
- [CVE-2026-74436](https://cve.now/CVE-2026-74436.md): rxrpc: serialize kernel accept preallocation with socket teardown (CVSS 9.8, Linux)
- [CVE-2026-74435](https://cve.now/CVE-2026-74435.md): rxrpc: rxrpc\_verify\_data ensure rx\_dec\_buffer alloc (CVSS 7.5, Linux)
- [CVE-2026-74434](https://cve.now/CVE-2026-74434.md): rxrpc: Don't move a peeked OOB message onto the pending queue (CVSS 9.8, Linux)
- [CVE-2026-74433](https://cve.now/CVE-2026-74433.md): rxrpc: Fix UAF in rxgk\_issue\_challenge() (CVSS 9.8, Linux)
- [CVE-2026-74432](https://cve.now/CVE-2026-74432.md): rxrpc: Fix leak of released call in recvmsg(MSG\_PEEK) (no CVSS, Linux)
- [CVE-2026-74431](https://cve.now/CVE-2026-74431.md): rxrpc: Fix potential infinite loop in rxrpc\_recvmsg() (CVSS 7.5, Linux)
- [CVE-2026-74430](https://cve.now/CVE-2026-74430.md): rxrpc: Fix ACKALL packet handling (CVSS 7.5, Linux)
- [CVE-2026-74429](https://cve.now/CVE-2026-74429.md): rxrpc: Fix the reception of a reply packet before data transmission (CVSS 7.5, Linux)
- [CVE-2026-74428](https://cve.now/CVE-2026-74428.md): rxrpc: Fix double unlock in rxrpc\_recvmsg() (CVSS 9.8, Linux)
- [CVE-2026-74427](https://cve.now/CVE-2026-74427.md): afs: Fix netns teardown to cancel the preallocation charger (CVSS 9.8, Linux)
- [CVE-2026-74426](https://cve.now/CVE-2026-74426.md): afs: fix NULL pointer dereference in afs\_get\_tree() (no CVSS, Linux)
- [CVE-2026-74425](https://cve.now/CVE-2026-74425.md): afs: handle CB.InitCallBackState3 requests without a server record (CVSS 7.5, Linux)
- [CVE-2026-74424](https://cve.now/CVE-2026-74424.md): fbcon: fix NULL pointer dereference for a console without vc\_data (no CVSS, Linux)
- [CVE-2026-74423](https://cve.now/CVE-2026-74423.md): accel/amdxdna: Fix leak when pinning ubuf pages (no CVSS, Linux)
- [CVE-2026-74422](https://cve.now/CVE-2026-74422.md): drm/rockchip: inno-hdmi: Switch to drmm\_kzalloc() (no CVSS, Linux)
- [CVE-2026-74421](https://cve.now/CVE-2026-74421.md): drm/rockchip: dw\_dp: Switch to drmm\_kzalloc() (no CVSS, Linux)
- [CVE-2026-74420](https://cve.now/CVE-2026-74420.md): drm/gpusvm: Reject VMAs with VM\_IO or VM\_PFNMAP when creating SVM ranges (no CVSS, Linux)
- [CVE-2026-74419](https://cve.now/CVE-2026-74419.md): accel/amdxdna: Adjust size for copy\_to\_user() (CVSS 7.3, Linux)
- [CVE-2026-74418](https://cve.now/CVE-2026-74418.md): dma-fence: Fix potential tracepoint null pointer dereferences (no CVSS, Linux)
- [CVE-2026-74417](https://cve.now/CVE-2026-74417.md): drm/radeon: fix integer overflow in radeon\_align\_pitch() (CVSS 7.8, Linux)
- [CVE-2026-74416](https://cve.now/CVE-2026-74416.md): drm/radeon: fix memory leak in radeon\_ring\_restore() on lock failure (no CVSS, Linux)
- [CVE-2026-74415](https://cve.now/CVE-2026-74415.md): spi: atcspi200: fix use-after-free when driver unbind (no CVSS, Linux)
- [CVE-2026-74414](https://cve.now/CVE-2026-74414.md): hfsplus: Remove the duplicate attr inode dirty marking action (no CVSS, Linux)
- [CVE-2026-74413](https://cve.now/CVE-2026-74413.md): wifi: rtw89: fix wrong pci\_get\_drvdata type in AER handlers (CVSS 8.8, Linux)
- [CVE-2026-74412](https://cve.now/CVE-2026-74412.md): wifi: rtw88: fix wrong pci\_get\_drvdata type in AER handlers (CVSS 8.8, Linux)
- [CVE-2026-74411](https://cve.now/CVE-2026-74411.md): wifi: rtw89: Correct data type for scan index to avoid infinite loop (CVSS 8.8, Linux)
- [CVE-2026-74410](https://cve.now/CVE-2026-74410.md): wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (CVSS 8.1, Linux)
- [CVE-2026-74409](https://cve.now/CVE-2026-74409.md): wifi: rtw89: add bounds check on firmware mac\_id in link lookup (CVSS 8.8, Linux)
- [CVE-2026-74408](https://cve.now/CVE-2026-74408.md): wifi: ath9k: fix OOB access from firmware tx status queue ID (CVSS 8.8, Linux)
- [CVE-2026-74407](https://cve.now/CVE-2026-74407.md): wifi: ath11k: cancel SSR work items during PCI shutdown (CVSS 8.8, Linux)
- [CVE-2026-74406](https://cve.now/CVE-2026-74406.md): vxlan: Fix potential null-ptr-deref in vxlan\_gro\_prepare\_receive(). (CVSS 9.8, Linux)
- [CVE-2026-74405](https://cve.now/CVE-2026-74405.md): OPP: Fix race between OPP addition and lookup (CVSS 7.8, Linux)
- [CVE-2026-74404](https://cve.now/CVE-2026-74404.md): crypto: ccp - Fix snp\_filter\_reserved\_mem\_regions() off-by-one (CVSS 7.8, Linux)
- [CVE-2026-74403](https://cve.now/CVE-2026-74403.md): crypto: ccp - Check for page allocation failure correctly in TIO (CVSS 7.8, Linux)
- [CVE-2026-74402](https://cve.now/CVE-2026-74402.md): crypto: atmel-sha204a - fix blocking and non-blocking rng logic (no CVSS, Linux)
- [CVE-2026-74401](https://cve.now/CVE-2026-74401.md): dlm: fix add msg handle in send\_queue ordered (CVSS 9.8, Linux)
- [CVE-2026-74400](https://cve.now/CVE-2026-74400.md): bpf: fix crash in bpf\_\[set|remove\]\_dentry\_xattr for negative dentries (no CVSS, Linux)
- [CVE-2026-74399](https://cve.now/CVE-2026-74399.md): evm: terminate and bound the evm\_xattrs read buffer (no CVSS, Linux)
- [CVE-2026-74398](https://cve.now/CVE-2026-74398.md): ipv6: addrconf: bail out of dad\_failure when state is no longer POSTDAD (CVSS 9.8, Linux)
- [CVE-2026-74397](https://cve.now/CVE-2026-74397.md): IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier (CVSS 7.8, Linux)
- [CVE-2026-74396](https://cve.now/CVE-2026-74396.md): RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure (CVSS 7.5, Linux)
- [CVE-2026-74395](https://cve.now/CVE-2026-74395.md): RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (no CVSS, Linux)
- [CVE-2026-74394](https://cve.now/CVE-2026-74394.md): RDMA/srpt: fix integer overflow in immediate data length check (CVSS 9.8, Linux)
- [CVE-2026-74393](https://cve.now/CVE-2026-74393.md): drm/syncobj: Fix memory leak in drm\_syncobj\_find\_fence() (no CVSS, Linux)
- [CVE-2026-74392](https://cve.now/CVE-2026-74392.md): dm: limit target bio polling to one shot (no CVSS, Linux)
- [CVE-2026-74391](https://cve.now/CVE-2026-74391.md): tracing: Bound synthetic-field strings with seq\_buf (no CVSS, Linux)
- [CVE-2026-74390](https://cve.now/CVE-2026-74390.md): RDMA/irdma: Fix out-of-bounds write in irdma\_copy\_user\_pgaddrs (CVSS 7.8, Linux)
- [CVE-2026-74389](https://cve.now/CVE-2026-74389.md): RDMA/hns: Fix log flood after cmd\_mbox failure (no CVSS, Linux)
- [CVE-2026-74388](https://cve.now/CVE-2026-74388.md): ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (CVSS 7.8, Linux)
- [CVE-2026-74387](https://cve.now/CVE-2026-74387.md): ALSA: seq: midi: Serialize output teardown with event\_input (CVSS 7.8, Linux)
- [CVE-2026-74386](https://cve.now/CVE-2026-74386.md): nvmet-tcp: fix page fragment cache leak in error path (no CVSS, Linux)
- [CVE-2026-74385](https://cve.now/CVE-2026-74385.md): nvmet-tcp: check return value of nvmet\_tcp\_set\_queue\_sock (CVSS 7.5, Linux)
- [CVE-2026-74384](https://cve.now/CVE-2026-74384.md): nvme-multipath: fix flex array size in struct nvme\_ns\_head (CVSS 9.8, Linux)
- [CVE-2026-74383](https://cve.now/CVE-2026-74383.md): nvme-pci: fix out-of-bounds access in nvme\_setup\_descriptor\_pools (CVSS 8.4, Linux)
- [CVE-2026-74382](https://cve.now/CVE-2026-74382.md): net/sched: cls\_bpf: prevent unbounded recursion in offload rollback (no CVSS, Linux)
- [CVE-2026-74381](https://cve.now/CVE-2026-74381.md): gpu: host1x: Allow entries in BO caches to be freed (no CVSS, Linux)
- [CVE-2026-74380](https://cve.now/CVE-2026-74380.md): gpu: host1x: Fix iommu\_map\_sgtable() return value check (CVSS 8.8, Linux)
- [CVE-2026-74379](https://cve.now/CVE-2026-74379.md): dax/kmem: account for partial discontiguous resource upon removal (no CVSS, Linux)
- [CVE-2026-74378](https://cve.now/CVE-2026-74378.md): RDMA/rxe: Fix TOCTOU heap overflow in get\_srq\_wqe (CVSS 7.8, Linux)
- [CVE-2026-74377](https://cve.now/CVE-2026-74377.md): RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (CVSS 7.8, Linux)
- [CVE-2026-74376](https://cve.now/CVE-2026-74376.md): md/raid10: reset read\_slot when reusing r10bio for discard (CVSS 9.8, Linux)
- [CVE-2026-74375](https://cve.now/CVE-2026-74375.md): md/raid1,raid10: fix deadlock in read error recovery path (no CVSS, Linux)
- [CVE-2026-74374](https://cve.now/CVE-2026-74374.md): md/raid1,raid10: fix error-path detection with md\_cloned\_bio() (CVSS 7.5, Linux)
- [CVE-2026-74373](https://cve.now/CVE-2026-74373.md): md/raid1,raid10: fix bio accounting for split md cloned bios (no CVSS, Linux)
- [CVE-2026-74372](https://cve.now/CVE-2026-74372.md): raid1: fix nr\_pending leak in REQ\_ATOMIC bad-block error path (no CVSS, Linux)
- [CVE-2026-74371](https://cve.now/CVE-2026-74371.md): bpf: fix BPF\_PROG\_QUERY OOB write and cgroup backward compat (CVSS 7.8, Linux)
- [CVE-2026-74370](https://cve.now/CVE-2026-74370.md): liveupdate: fix TOCTOU race in luo\_session\_retrieve() (no CVSS, Linux)
- [CVE-2026-74369](https://cve.now/CVE-2026-74369.md): liveupdate: fix u-a-f in luo\_file\_unpreserve\_files() and luo\_file\_finish() (no CVSS, Linux)
- [CVE-2026-74368](https://cve.now/CVE-2026-74368.md): wifi: ath12k: fix memory leak in ath12k\_wifi7\_dp\_rx\_h\_verify\_tkip\_mic() (no CVSS, Linux)
- [CVE-2026-74367](https://cve.now/CVE-2026-74367.md): wifi: ath12k: fix inconsistent arvif state in vdev\_create error paths (CVSS 7.8, Linux)
- [CVE-2026-74366](https://cve.now/CVE-2026-74366.md): wifi: ath12k: fix NULL deref in change\_sta\_links for unready link (no CVSS, Linux)
- [CVE-2026-74365](https://cve.now/CVE-2026-74365.md): nvdimm/btt: Handle preemption in BTT lane acquisition (CVSS 7.3, Linux)
- [CVE-2026-74364](https://cve.now/CVE-2026-74364.md): bpf: Reject exclusive maps as inner maps in map-in-map (CVSS 7.1, Linux)
- [CVE-2026-74363](https://cve.now/CVE-2026-74363.md): bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (CVSS 7.8, Linux)
- [CVE-2026-74362](https://cve.now/CVE-2026-74362.md): ext2: fix ignored return value of generic\_write\_sync() (no CVSS, Linux)
- [CVE-2026-74361](https://cve.now/CVE-2026-74361.md): nvme: fix FDP fdpcidx bounds check (CVSS 9.8, Linux)
- [CVE-2026-74360](https://cve.now/CVE-2026-74360.md): bpf: Reject exclusive maps for bpf\_map\_elem iterators (no CVSS, Linux)
- [CVE-2026-74359](https://cve.now/CVE-2026-74359.md): configfs\_lookup(): don't leave -\>s\_dentry dangling on failure (CVSS 7.8, Linux)
- [CVE-2026-74358](https://cve.now/CVE-2026-74358.md): ext4: fix fast commit wait/wake bit mapping on 64-bit (no CVSS, Linux)
- [CVE-2026-74357](https://cve.now/CVE-2026-74357.md): drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpu\_coredump ring dump (CVSS 7.8, Linux)
- [CVE-2026-74356](https://cve.now/CVE-2026-74356.md): vhost: fix vhost\_get\_avail\_idx for a non empty ring (CVSS 7.4, Linux)
- [CVE-2026-74355](https://cve.now/CVE-2026-74355.md): iommu/vt-d: Fix RB-tree corruption in probe error path (CVSS 8.2, Linux)
- [CVE-2026-74354](https://cve.now/CVE-2026-74354.md): bpf: Take mmap\_lock in zap\_pages() (CVSS 7.8, Linux)
- [CVE-2026-74353](https://cve.now/CVE-2026-74353.md): drm/amdkfd: always resume\_all after suspend\_all (no CVSS, Linux)
- [CVE-2026-74352](https://cve.now/CVE-2026-74352.md): of: reserved\_mem: avoid post-init UAF when alloc\_reserved\_mem\_array() fails (no CVSS, Linux)
- [CVE-2026-74351](https://cve.now/CVE-2026-74351.md): ocfs2: rebase copied fsdlm LVB pointers in locking\_state (no CVSS, Linux)
- [CVE-2026-74350](https://cve.now/CVE-2026-74350.md): ocfs2: validate fast symlink target during inode read (CVSS 9.8, Linux)
- [CVE-2026-74349](https://cve.now/CVE-2026-74349.md): ocfs2: reject FITRIM ranges shorter than a cluster (CVSS 7.1, Linux)
- [CVE-2026-74348](https://cve.now/CVE-2026-74348.md): ocfs2/dlm: require a ref for locking\_state debugfs open (no CVSS, Linux)
- [CVE-2026-74347](https://cve.now/CVE-2026-74347.md): netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount (CVSS 7.8, Linux)
- [CVE-2026-74346](https://cve.now/CVE-2026-74346.md): RDMA/irdma: Fix OOB read during CQ MR registration (no CVSS, Linux)
- [CVE-2026-74345](https://cve.now/CVE-2026-74345.md): RDMA/siw: Fix endpoint/socket association handling (CVSS 9.8, Linux)
- [CVE-2026-74344](https://cve.now/CVE-2026-74344.md): bpf: Clear rb node linkage when freeing bpf\_rb\_root (CVSS 7.8, Linux)
- [CVE-2026-74343](https://cve.now/CVE-2026-74343.md): kernfs: fix xattr race condition with multiple superblocks (CVSS 7.8, Linux)
- [CVE-2026-74342](https://cve.now/CVE-2026-74342.md): kernfs: link kn to its parent before the LSM init hook (no CVSS, Linux)
- [CVE-2026-74341](https://cve.now/CVE-2026-74341.md): wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (CVSS 8.8, Linux)
- [CVE-2026-74340](https://cve.now/CVE-2026-74340.md): wifi: wcn36xx: fix OOB read from firmware count in PRINT\_REG\_INFO indication (CVSS 8.1, Linux)
- [CVE-2026-74339](https://cve.now/CVE-2026-74339.md): ALSA: seq: Clear variable event pointer on read (no CVSS, Linux)
- [CVE-2026-74338](https://cve.now/CVE-2026-74338.md): bpf: Reject sleepable BPF\_LSM\_CGROUP programs at load time (CVSS 7.8, Linux)
- [CVE-2026-74337](https://cve.now/CVE-2026-74337.md): bpf: Fix NMI/tracepoint re-entry deadlock on lru locks (no CVSS, Linux)
- [CVE-2026-74336](https://cve.now/CVE-2026-74336.md): wifi: mac80211: bound S1G TIM PVB walk to the TIM element (no CVSS, Linux)
- [CVE-2026-74335](https://cve.now/CVE-2026-74335.md): bpf: Fix NULL pointer dereference in bpf\_task\_from\_vpid() (no CVSS, Linux)
- [CVE-2026-74334](https://cve.now/CVE-2026-74334.md): RDMA/nldev: Fix locking when accessing mr-\>pd (CVSS 7.8, Linux)
- [CVE-2026-74333](https://cve.now/CVE-2026-74333.md): ASoC: amd: acp-sdw-legacy: Bound DAI link iteration (CVSS 8.4, Linux)
- [CVE-2026-74332](https://cve.now/CVE-2026-74332.md): ASoC: amd: acp-sdw-sof: Bound DAI link iteration (CVSS 8.4, Linux)
- [CVE-2026-74331](https://cve.now/CVE-2026-74331.md): firmware\_loader: Fix recursive lock in device\_cache\_fw\_images() (no CVSS, Linux)
- [CVE-2026-74330](https://cve.now/CVE-2026-74330.md): configfs: fix lockless traversals of -\>s\_children (CVSS 7.8, Linux)
- [CVE-2026-74329](https://cve.now/CVE-2026-74329.md): watchdog: unregister PM notifier on watchdog unregister (no CVSS, Linux)
- [CVE-2026-74328](https://cve.now/CVE-2026-74328.md): iommufd: Destroy the pages content after detaching from dmabuf (CVSS 8.8, Linux)
- [CVE-2026-74327](https://cve.now/CVE-2026-74327.md): vmalloc: fix NULL pointer dereference in is\_vm\_area\_hugepages() (no CVSS, Linux)
- [CVE-2026-74326](https://cve.now/CVE-2026-74326.md): wifi: mt76: mt7921: fix resource leak in probe error path (no CVSS, Linux)
- [CVE-2026-74325](https://cve.now/CVE-2026-74325.md): wifi: mt76: use kfree\_rcu for offchannel link in mt76\_put\_vif\_phy\_link (CVSS 7.8, Linux)
- [CVE-2026-74324](https://cve.now/CVE-2026-74324.md): wifi: mt76: mt7925: validate skb length in testmode query (no CVSS, Linux)
- [CVE-2026-74323](https://cve.now/CVE-2026-74323.md): wifi: mt76: mt7996: Fix possible token leak in mt7996\_tx\_prepare\_skb() (CVSS 8.8, Linux)
- [CVE-2026-74322](https://cve.now/CVE-2026-74322.md): wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996\_mac\_write\_txwi\_80211() (no CVSS, Linux)
- [CVE-2026-74321](https://cve.now/CVE-2026-74321.md): btrfs: fix invalid pointer dereference in \_\_btrfs\_run\_delayed\_refs() (CVSS 7.5, Linux)
- [CVE-2026-74320](https://cve.now/CVE-2026-74320.md): fbdev: sm501fb: Fix buffer errors in OF binding code (no CVSS, Linux)
- [CVE-2026-74319](https://cve.now/CVE-2026-74319.md): btrfs: zoned: fix deadlock waiting for ticket during data relocation (no CVSS, Linux)
- [CVE-2026-74318](https://cve.now/CVE-2026-74318.md): btrfs: fix deadlock cloning inline extent when using flushoncommit (no CVSS, Linux)
- [CVE-2026-74317](https://cve.now/CVE-2026-74317.md): ixgbe: do not configure xps for XDP queues (CVSS 7.8, Linux)
- [CVE-2026-74316](https://cve.now/CVE-2026-74316.md): NFSD: Handle layout stid in nfsd4\_drop\_revoked\_stid() (CVSS 7.5, Linux)
- [CVE-2026-74315](https://cve.now/CVE-2026-74315.md): lockd: Avoid hashing uninitialized bytes in nlm4svc\_lookup\_file() (CVSS 9.8, Linux)
- [CVE-2026-74314](https://cve.now/CVE-2026-74314.md): bpf: Cancel special fields on map value recycle (CVSS 7.8, Linux)
- [CVE-2026-74313](https://cve.now/CVE-2026-74313.md): vduse: hold vduse\_lock across IDR lookup in open path (CVSS 8.8, Linux)
- [CVE-2026-74312](https://cve.now/CVE-2026-74312.md): vhost/vdpa: validate virtqueue index in mmap and fault paths (CVSS 7.8, Linux)
- [CVE-2026-74311](https://cve.now/CVE-2026-74311.md): virtio: rtc: tear down old virtqueues before restore (CVSS 7.8, Linux)
- [CVE-2026-74310](https://cve.now/CVE-2026-74310.md): vhost/net: complete zerocopy ubufs only once (CVSS 9.3, Linux)
- [CVE-2026-74309](https://cve.now/CVE-2026-74309.md): vdpa/octeon\_ep: fix IRQ-to-ring mapping in interrupt handler (CVSS 10.0, Linux)
- [CVE-2026-74308](https://cve.now/CVE-2026-74308.md): ext4: fix kernel BUG in ext4\_write\_inline\_data\_end (no CVSS, Linux)
- [CVE-2026-74307](https://cve.now/CVE-2026-74307.md): ext4: validate donor file superblock early in EXT4\_IOC\_MOVE\_EXT (no CVSS, Linux)
- [CVE-2026-74306](https://cve.now/CVE-2026-74306.md): vfio/qat: fix f\_pos race in qat\_vf\_resume\_write() (CVSS 7.8, Linux)
- [CVE-2026-74305](https://cve.now/CVE-2026-74305.md): bpf: Tighten cgroup storage cookie checks for prog arrays (CVSS 7.8, Linux)
- [CVE-2026-74304](https://cve.now/CVE-2026-74304.md): Bluetooth: hci\_qca: fix NULL pointer dereference in qca\_setup() for non-serdev device (no CVSS, Linux)
- [CVE-2026-74303](https://cve.now/CVE-2026-74303.md): Bluetooth: hci\_qca: fix NULL pointer dereference in qca\_dmp\_hdr() for non-serdev device (no CVSS, Linux)
- [CVE-2026-74302](https://cve.now/CVE-2026-74302.md): Bluetooth: hci\_core: Fix UAF in hci\_unregister\_dev() (CVSS 7.8, Linux)
- [CVE-2026-74301](https://cve.now/CVE-2026-74301.md): Bluetooth: btmtk: fix URB leak in alloc\_mtk\_intr\_urb error path (no CVSS, Linux)
- [CVE-2026-74300](https://cve.now/CVE-2026-74300.md): Bluetooth: hci: validate codec capability element length (CVSS 8.8, Linux)
- [CVE-2026-74299](https://cve.now/CVE-2026-74299.md): RDMA/core: Fix FRMR aging push to queue error flow (no CVSS, Linux)
- [CVE-2026-74298](https://cve.now/CVE-2026-74298.md): RDMA/core: Fix FRMR set pinned push error path (no CVSS, Linux)
- [CVE-2026-74297](https://cve.now/CVE-2026-74297.md): RDMA/mlx5: Fix undefined shift of user RQ WQE size (CVSS 7.8, Linux)
- [CVE-2026-74296](https://cve.now/CVE-2026-74296.md): RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one (CVSS 7.8, Linux)
- [CVE-2026-74295](https://cve.now/CVE-2026-74295.md): ASoC: codecs: hdac\_hdmi: Validate written enum value (CVSS 7.1, Linux)
- [CVE-2026-74294](https://cve.now/CVE-2026-74294.md): ASoC: meson: aiu: Validate written enum values (CVSS 7.3, Linux)
- [CVE-2026-74293](https://cve.now/CVE-2026-74293.md): ASoC: fsl: fsl\_audmix: Validate written enum values (CVSS 7.8, Linux)
- [CVE-2026-74292](https://cve.now/CVE-2026-74292.md): ASoC: tegra: tegra210\_ahub: Validate written enum value (CVSS 7.1, Linux)
- [CVE-2026-74291](https://cve.now/CVE-2026-74291.md): ASoC: topology: Check PCM and DAI name strings before use (no CVSS, Linux)
- [CVE-2026-74290](https://cve.now/CVE-2026-74290.md): net/sched: cls\_flow: Dont expose folded kernel pointers (no CVSS, Linux)
- [CVE-2026-74289](https://cve.now/CVE-2026-74289.md): ipv4: fib: Don't dump dying fib\_info in fib\_leaf\_notify(). (CVSS 7.8, Linux)
- [CVE-2026-74288](https://cve.now/CVE-2026-74288.md): net: fib\_rules: Don't dump dying fib\_rule in fib\_rules\_dump(). (CVSS 7.8, Linux)
- [CVE-2026-74287](https://cve.now/CVE-2026-74287.md): sctp: validate embedded address parameter length (CVSS 9.1, Linux)
- [CVE-2026-74286](https://cve.now/CVE-2026-74286.md): net: pfcp: allocate per-cpu tstats for PFCP netdevs (no CVSS, Linux)
- [CVE-2026-74285](https://cve.now/CVE-2026-74285.md): net: Stop leased rxq before uninstalling its memory provider (CVSS 8.8, Linux)
- [CVE-2026-74284](https://cve.now/CVE-2026-74284.md): net/sched: sch\_hfsc: Don't make class passive twice (no CVSS, Linux)
- [CVE-2026-74283](https://cve.now/CVE-2026-74283.md): tipc: require net admin for TIPCv2 netlink mutators (CVSS 7.8, Linux)
- [CVE-2026-74282](https://cve.now/CVE-2026-74282.md): tipc: prevent snt\_unacked underflow on CONN\_ACK (CVSS 7.5, Linux)
- [CVE-2026-74281](https://cve.now/CVE-2026-74281.md): tipc: reject inverted service ranges from peer bindings (CVSS 7.5, Linux)
- [CVE-2026-74280](https://cve.now/CVE-2026-74280.md): crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (CVSS 10.0, Linux)
- [CVE-2026-74279](https://cve.now/CVE-2026-74279.md): crypto: cavium/cpt - fix DMA cleanup using wrong loop index (CVSS 10.0, Linux)
- [CVE-2026-74278](https://cve.now/CVE-2026-74278.md): ALSA: seq: Fix kernel heap address leak in bounce\_error\_event() (no CVSS, Linux)
- [CVE-2026-74277](https://cve.now/CVE-2026-74277.md): iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path (CVSS 8.8, Linux)
- [CVE-2026-74276](https://cve.now/CVE-2026-74276.md): spi: xilinx: use FIFO occupancy register to determine buffer size (no CVSS, Linux)
- [CVE-2026-74275](https://cve.now/CVE-2026-74275.md): cxl/region: Fix out-of-bounds access in cxl\_cancel\_auto\_attach() (CVSS 8.4, Linux)
- [CVE-2026-74274](https://cve.now/CVE-2026-74274.md): cxl/region: Fill first free targets\[\] slot during auto-discovery (no CVSS, Linux)
- [CVE-2026-74273](https://cve.now/CVE-2026-74273.md): cxl/region: Block region delete during region creation (no CVSS, Linux)
- [CVE-2026-74272](https://cve.now/CVE-2026-74272.md): cxl/region: Resolve region deletion races (no CVSS, Linux)
- [CVE-2026-74271](https://cve.now/CVE-2026-74271.md): power: supply: core: fix supplied\_from allocations (no CVSS, Linux)
- [CVE-2026-74270](https://cve.now/CVE-2026-74270.md): handshake: Require admin permission for DONE command (CVSS 7.8, Linux)
- [CVE-2026-74269](https://cve.now/CVE-2026-74269.md): bnxt: fix head underflow on XDP head-grow (CVSS 9.8, Linux)
- [CVE-2026-74268](https://cve.now/CVE-2026-74268.md): tcp: clear sock\_ops cb flags before force-closing a child socket (CVSS 9.8, Linux)
- [CVE-2026-74267](https://cve.now/CVE-2026-74267.md): net/sched: sch\_codel: Do not call qdisc\_tree\_reduce\_backlog during peek before restoring qlen (CVSS 9.8, Linux)
- [CVE-2026-74266](https://cve.now/CVE-2026-74266.md): net/sched: sch\_dualpi2: Do not call qdisc\_tree\_reduce\_backlog during peek before restoring qlen (no CVSS, Linux)
- [CVE-2026-74265](https://cve.now/CVE-2026-74265.md): net: mana: initialize gdma queue id to INVALID\_QUEUE\_ID (no CVSS, Linux)
- [CVE-2026-74264](https://cve.now/CVE-2026-74264.md): net: watchdog: fix refcount tracking races (CVSS 7.8, Linux)
- [CVE-2026-74263](https://cve.now/CVE-2026-74263.md): net: wwan: t7xx: check skb\_clone in control TX (no CVSS, Linux)
- [CVE-2026-74262](https://cve.now/CVE-2026-74262.md): kcm: use WRITE\_ONCE() when changing lower socket callbacks (CVSS 7.8, Linux)
- [CVE-2026-74261](https://cve.now/CVE-2026-74261.md): ALSA: seq: avoid stale FIFO cells during resize (no CVSS, Linux)
- [CVE-2026-74260](https://cve.now/CVE-2026-74260.md): netfilter: nf\_dup\_netdev: add nf\_dev\_xmit\_recursion\*() helpers and use them (CVSS 7.8, Linux)
- [CVE-2026-74258](https://cve.now/CVE-2026-74258.md): bpf: Guard \_\_get\_user acesss with access\_ok for uprobe\_multi data (CVSS 7.8, Linux)
- [CVE-2026-74257](https://cve.now/CVE-2026-74257.md): sockmap: Fix use-after-free in udp\_bpf\_recvmsg() (CVSS 7.8, Linux)
- [CVE-2026-74256](https://cve.now/CVE-2026-74256.md): bpf, sockmap: fix integer overflow in bpf\_msg\_pop\_data() bounds check (CVSS 8.4, Linux)
- [CVE-2026-74255](https://cve.now/CVE-2026-74255.md): tipc: fix UAF in tipc\_l2\_send\_msg() (CVSS 9.8, Linux)
- [CVE-2026-72502](https://cve.now/CVE-2026-72502.md): tcp: ipv6: clamp default adverting MSS to avoid GSO\_BY\_FRAGS (0xFFFF) (CVSS 7.5, Linux)
- [CVE-2026-72501](https://cve.now/CVE-2026-72501.md): RDMA/bnxt\_re: Initialize dpi variable to zero (no CVSS, Linux)
- [CVE-2026-72500](https://cve.now/CVE-2026-72500.md): RDMA/bnxt\_re: Free SRQ toggle page after firmware teardown (CVSS 8.8, Linux)
- [CVE-2026-72499](https://cve.now/CVE-2026-72499.md): RDMA/bnxt\_re: Free CQ toggle page after firmware teardown (CVSS 8.8, Linux)
- [CVE-2026-72498](https://cve.now/CVE-2026-72498.md): RDMA/bnxt\_re: Avoid displaying the kernel pointer (no CVSS, Linux)
- [CVE-2026-72497](https://cve.now/CVE-2026-72497.md): RDMA/bnxt\_re: Add a max slot check for SQ (CVSS 8.8, Linux)
- [CVE-2026-72496](https://cve.now/CVE-2026-72496.md): RDMA/bnxt\_re: Proper rollback if the ioremap fails (CVSS 9.2, Linux)
- [CVE-2026-72495](https://cve.now/CVE-2026-72495.md): RDMA/bnxt\_re: Avoid repeated requests to allocate WC pages (CVSS 9.3, Linux)
- [CVE-2026-72494](https://cve.now/CVE-2026-72494.md): RDMA/irdma: Replace waitqueue and flag with completion (CVSS 9.8, Linux)
- [CVE-2026-72493](https://cve.now/CVE-2026-72493.md): net: serialize netif\_running() check in enqueue\_to\_backlog() (CVSS 9.9, Linux)
- [CVE-2026-72492](https://cve.now/CVE-2026-72492.md): ksmbd: fix use-after-free in same\_client\_has\_lease() (CVSS 8.8, Linux)
- [CVE-2026-72491](https://cve.now/CVE-2026-72491.md): net/9p: fix race condition on rdma-\>state in trans\_rdma.c (CVSS 9.8, Linux)
- [CVE-2026-72490](https://cve.now/CVE-2026-72490.md): staging: rtl8723bs: fix stainfo check in rtw\_aes\_decrypt (no CVSS, Linux)
- [CVE-2026-72489](https://cve.now/CVE-2026-72489.md): staging: nvec: fix use-after-free in nvec\_rx\_completed() (CVSS 8.4, Linux)
- [CVE-2026-72488](https://cve.now/CVE-2026-72488.md): soundwire: fix bug in sdw\_add\_element\_group\_count found by syzkaller (CVSS 7.8, Linux)
- [CVE-2026-72487](https://cve.now/CVE-2026-72487.md): PCI: Check ROM header and data structure addr before accessing (CVSS 7.7, Linux)
- [CVE-2026-72486](https://cve.now/CVE-2026-72486.md): mailbox: mtk-adsp: fix UAF during device teardown (no CVSS, Linux)
- [CVE-2026-72485](https://cve.now/CVE-2026-72485.md): coresight: platform: defer connection counter increment until alloc succeeds (CVSS 7.8, Linux)
- [CVE-2026-72484](https://cve.now/CVE-2026-72484.md): staging: most: video: avoid double free on video register failure (no CVSS, Linux)
- [CVE-2026-72483](https://cve.now/CVE-2026-72483.md): usb: host: max3421: Fix shift-out-of-bounds in max3421\_hub\_control() (CVSS 7.8, Linux)
- [CVE-2026-72482](https://cve.now/CVE-2026-72482.md): gpib: fix double decrement of descriptor\_busy in command\_ioctl() (CVSS 7.8, Linux)
- [CVE-2026-72481](https://cve.now/CVE-2026-72481.md): iio: magnetometer: ak8975: fix potential kernel stack memory leak (no CVSS, Linux)
- [CVE-2026-72480](https://cve.now/CVE-2026-72480.md): iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling (CVSS 7.8, Linux)
- [CVE-2026-72479](https://cve.now/CVE-2026-72479.md): iio: accel: mma8452: handle I2C read error(s) in mma8452\_read() (no CVSS, Linux)
- [CVE-2026-72478](https://cve.now/CVE-2026-72478.md): fs/ntfs3: add bounds check to run\_get\_highest\_vcn() (CVSS 8.4, Linux)
- [CVE-2026-72477](https://cve.now/CVE-2026-72477.md): fs/ntfs3: call \_ntfs\_bad\_inode() when failing to rename (CVSS 9.8, Linux)
- [CVE-2026-72476](https://cve.now/CVE-2026-72476.md): dmaengine: Fix possible use after free (CVSS 7.8, Linux)
- [CVE-2026-72475](https://cve.now/CVE-2026-72475.md): dmaengine: dma-axi-dmac: Properly free struct axi\_dmac\_desc (no CVSS, Linux)
- [CVE-2026-72474](https://cve.now/CVE-2026-72474.md): dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor (no CVSS, Linux)
- [CVE-2026-72473](https://cve.now/CVE-2026-72473.md): xprtrdma: Decouple req recycling from RPC completion (CVSS 9.8, Linux)
- [CVE-2026-72472](https://cve.now/CVE-2026-72472.md): nfs: use nfsi-\>rwsem to protect traversal of the file lock list (CVSS 9.8, Linux)
- [CVE-2026-72471](https://cve.now/CVE-2026-72471.md): fs/ntfs3: prevent potential lcn remains uninitialized (CVSS 7.1, Linux)
- [CVE-2026-72470](https://cve.now/CVE-2026-72470.md): fs/ntfs3: resize log-\>one\_page\_buf when adopting on-disk page size (CVSS 7.8, Linux)
- [CVE-2026-72469](https://cve.now/CVE-2026-72469.md): xprtrdma: Fix ep kref imbalance on ADDR\_CHANGE (CVSS 8.8, Linux)
- [CVE-2026-72468](https://cve.now/CVE-2026-72468.md): xprtrdma: Initialize re\_id before removal registration (no CVSS, Linux)
- [CVE-2026-72467](https://cve.now/CVE-2026-72467.md): xprtrdma: Check frwr\_wp\_create() during connect (no CVSS, Linux)
- [CVE-2026-72466](https://cve.now/CVE-2026-72466.md): xprtrdma: Fix bcall rep leak and unbounded peek (CVSS 9.8, Linux)
- [CVE-2026-72465](https://cve.now/CVE-2026-72465.md): xprtrdma: Sanitize the reply credit grant after parsing (CVSS 7.5, Linux)
- [CVE-2026-72464](https://cve.now/CVE-2026-72464.md): xprtrdma: Repost Receive buffers for malformed replies (CVSS 7.5, Linux)
- [CVE-2026-72463](https://cve.now/CVE-2026-72463.md): xfrm: Fix dev use-after-free in xfrm async resumption (CVSS 9.8, Linux)
- [CVE-2026-72462](https://cve.now/CVE-2026-72462.md): apparmor: fix race in unix socket mediation when peer\_path is used (CVSS 8.8, Linux)
- [CVE-2026-72461](https://cve.now/CVE-2026-72461.md): apparmor: fix refcount leak when updating the sk\_ctx (CVSS 7.8, Linux)
- [CVE-2026-72460](https://cve.now/CVE-2026-72460.md): apparmor: check label build before no\_new\_privs test (CVSS 7.1, Linux)
- [CVE-2026-72459](https://cve.now/CVE-2026-72459.md): apparmor: aa\_label\_alloc use aa\_label\_free on alloc failure (CVSS 7.8, Linux)
- [CVE-2026-72458](https://cve.now/CVE-2026-72458.md): apparmor: fix NULL pointer dereference in unpack\_pdb (no CVSS, Linux)
- [CVE-2026-72457](https://cve.now/CVE-2026-72457.md): apparmor: fail policy unpack on accept2 allocation failure (no CVSS, Linux)
- [CVE-2026-72456](https://cve.now/CVE-2026-72456.md): apparmor: release exe file resources on path failure (no CVSS, Linux)
- [CVE-2026-72455](https://cve.now/CVE-2026-72455.md): apparmor: fix uninitialised pointer passed to audit\_log\_untrustedstring() (CVSS 7.1, Linux)
- [CVE-2026-72454](https://cve.now/CVE-2026-72454.md): i3c: mipi-i3c-hci: Fix race in i3c\_hci\_addr\_to\_dev() (CVSS 7.8, Linux)
- [CVE-2026-72453](https://cve.now/CVE-2026-72453.md): regcache: Do not overwrite error code when finalizing cache after error (no CVSS, Linux)
- [CVE-2026-72452](https://cve.now/CVE-2026-72452.md): drm/i915: clear CRTC color blob pointers after dropping refs (CVSS 7.8, Linux)
- [CVE-2026-72451](https://cve.now/CVE-2026-72451.md): xfrm: Fix xfrm state cache insertion race (CVSS 9.8, Linux)
- [CVE-2026-72450](https://cve.now/CVE-2026-72450.md): xfrm: validate selector family and prefixlen during match (CVSS 7.8, Linux)
- [CVE-2026-72449](https://cve.now/CVE-2026-72449.md): drm/amdkfd: fix list\_del corruption in kfd\_criu\_resume\_svm (CVSS 7.8, Linux)
- [CVE-2026-72448](https://cve.now/CVE-2026-72448.md): octeontx2-pf: Fix leak of SQ timestamp buffer on teardown (no CVSS, Linux)
- [CVE-2026-72447](https://cve.now/CVE-2026-72447.md): sctp: hold socket lock when dumping endpoints in sctp\_diag (no CVSS, Linux)
- [CVE-2026-72446](https://cve.now/CVE-2026-72446.md): ALSA: usb-audio: qcom: reject stream disable with no active interface (CVSS 7.8, Linux)
- [CVE-2026-72445](https://cve.now/CVE-2026-72445.md): ALSA: usb-audio: qcom: clear opened when stream enable fails (no CVSS, Linux)
- [CVE-2026-72444](https://cve.now/CVE-2026-72444.md): flow\_dissector: check device type before reading ETH\_ADDRS (CVSS 7.8, Linux)
- [CVE-2026-72443](https://cve.now/CVE-2026-72443.md): ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (no CVSS, Linux)
- [CVE-2026-72442](https://cve.now/CVE-2026-72442.md): netfilter: flowtable: fix and simplify IP6IP6 tunnel handling (CVSS 9.8, Linux)
- [CVE-2026-72441](https://cve.now/CVE-2026-72441.md): ieee802154: fix kernel-infoleak in dgram\_recvmsg() (no CVSS, Linux)
- [CVE-2026-72440](https://cve.now/CVE-2026-72440.md): md/raid1: fix writes\_pending and barrier reference leaks on write failures (CVSS 7.1, Linux)
- [CVE-2026-72439](https://cve.now/CVE-2026-72439.md): md/raid10: fix writes\_pending leak on write request failures (no CVSS, Linux)
- [CVE-2026-72438](https://cve.now/CVE-2026-72438.md): md/raid10: fix writes\_pending and barrier reference leaks on discard failures (CVSS 7.5, Linux)
- [CVE-2026-72437](https://cve.now/CVE-2026-72437.md): md/raid1: free r1\_bio when REQ\_NOWAIT is set and read would block on retry (no CVSS, Linux)
- [CVE-2026-72436](https://cve.now/CVE-2026-72436.md): netfilter: ipset: Don't use test\_bit() in lockless RCU readers in hash types (CVSS 9.8, Linux)
- [CVE-2026-72435](https://cve.now/CVE-2026-72435.md): netfilter: ipset: fix order of kfree\_rcu() and rcu\_assign\_pointer() (CVSS 7.8, Linux)
- [CVE-2026-72434](https://cve.now/CVE-2026-72434.md): netfilter: ipset: make sure gc is properly stopped (CVSS 7.8, Linux)
- [CVE-2026-72433](https://cve.now/CVE-2026-72433.md): netfilter: nft\_meta\_bridge: fix NFT\_META\_BRI\_IIFPVID stack leak (no CVSS, Linux)
- [CVE-2026-72432](https://cve.now/CVE-2026-72432.md): tpm\_crb: Check ACPI\_COMPANION() against NULL during probe (no CVSS, Linux)
- [CVE-2026-72431](https://cve.now/CVE-2026-72431.md): alloc\_tag: fix use-after-free in /proc/allocinfo after module unload (no CVSS, Linux)
- [CVE-2026-72430](https://cve.now/CVE-2026-72430.md): net/sched: act\_ct: fix nf\_connlabels leak on two error paths (no CVSS, Linux)
- [CVE-2026-72429](https://cve.now/CVE-2026-72429.md): ipv6: ioam: fix type confusion of dst\_entry (CVSS 9.8, Linux)
- [CVE-2026-72428](https://cve.now/CVE-2026-72428.md): bpf: Fix stack slot index in nospec checks (no CVSS, Linux)
- [CVE-2026-72427](https://cve.now/CVE-2026-72427.md): bpf: Fix effective prog array index with BPF\_F\_PREORDER (CVSS 7.8, Linux)
- [CVE-2026-72426](https://cve.now/CVE-2026-72426.md): bpf: Preserve pointer spill metadata during half-slot cleanup (CVSS 8.4, Linux)
- [CVE-2026-72425](https://cve.now/CVE-2026-72425.md): ice: fix FDIR CTRL VSI resource leak in ice\_reset\_all\_vfs() (CVSS 7.1, Linux)
- [CVE-2026-72424](https://cve.now/CVE-2026-72424.md): rtc: msc313: fix NULL deref in shared IRQ handler at probe (no CVSS, Linux)
- [CVE-2026-72423](https://cve.now/CVE-2026-72423.md): bpf: Guard conntrack opts error writes (CVSS 8.8, Linux)
- [CVE-2026-72422](https://cve.now/CVE-2026-72422.md): ksmbd: fix use-after-free of conn-\>preauth\_info in concurrent SMB2 NEGOTIATE (CVSS 9.8, Linux)
- [CVE-2026-72421](https://cve.now/CVE-2026-72421.md): ipv4: fib: Don't ignore error route in local/main tables. (CVSS 10.0, Linux)
- [CVE-2026-72420](https://cve.now/CVE-2026-72420.md): md/raid5: avoid R5\_Overlap races while breaking stripe batches (CVSS 8.8, Linux)
- [CVE-2026-72419](https://cve.now/CVE-2026-72419.md): netfilter: nf\_nat: avoid invalid nat\_net pointer use on failed nf\_nat\_init() (CVSS 7.8, Linux)
- [CVE-2026-72418](https://cve.now/CVE-2026-72418.md): netfilter: nf\_conncount: prevent connlimit drops for early confirmed ct (CVSS 7.5, Linux)
- [CVE-2026-72417](https://cve.now/CVE-2026-72417.md): netfilter: flowtable: Validate iph-\>ihl in nf\_flow\_ip4\_tunnel\_proto() (CVSS 9.8, Linux)
- [CVE-2026-72416](https://cve.now/CVE-2026-72416.md): netfilter: nft\_compat: ebtables emulation must reject non-bridge targets (CVSS 7.3, Linux)
- [CVE-2026-72415](https://cve.now/CVE-2026-72415.md): ASoC: SDCA: Validate written enum value in ge\_put\_enum\_double() (CVSS 7.1, Linux)
- [CVE-2026-72414](https://cve.now/CVE-2026-72414.md): net: dsa: sja1105: round up PTP perout pin duration (no CVSS, Linux)
- [CVE-2026-72413](https://cve.now/CVE-2026-72413.md): sctp: fix err\_chunk memory leaks in INIT handling (no CVSS, Linux)
- [CVE-2026-72412](https://cve.now/CVE-2026-72412.md): s390/mm: Fix handling of \_PAGE\_UNUSED pte bit (CVSS 9.3, Linux)
- [CVE-2026-72411](https://cve.now/CVE-2026-72411.md): net: dsa: mxl862xx: fix use-after-free of DSA ports in crc\_err\_work (CVSS 7.8, Linux)
- [CVE-2026-72410](https://cve.now/CVE-2026-72410.md): octeontx2-af: Validate NIX maximum LFs correctly (CVSS 7.8, Linux)
- [CVE-2026-72409](https://cve.now/CVE-2026-72409.md): net: mvneta: re-enable percpu interrupt on resume (CVSS 7.5, Linux)
- [CVE-2026-72408](https://cve.now/CVE-2026-72408.md): geneve: gate GRO hint in geneve\_gro\_complete() on gs-\>gro\_hint (CVSS 10.0, Linux)
- [CVE-2026-72407](https://cve.now/CVE-2026-72407.md): geneve: validate inner network offset in geneve\_gro\_complete() (CVSS 10.0, Linux)
- [CVE-2026-72406](https://cve.now/CVE-2026-72406.md): net: sungem: fix probe error cleanup (CVSS 7.8, Linux)
- [CVE-2026-72405](https://cve.now/CVE-2026-72405.md): net: udp\_tunnel: prevent double queueing in udp\_tunnel\_nic\_device\_sync (CVSS 7.8, Linux)
- [CVE-2026-72404](https://cve.now/CVE-2026-72404.md): tipc: fix UAF in cleanup\_bearer() due to premature dst\_cache\_destroy() (CVSS 7.8, Linux)
- [CVE-2026-72403](https://cve.now/CVE-2026-72403.md): ALSA: FCP: Fix NULL pointer dereference in interface lookup (no CVSS, Linux)
- [CVE-2026-72402](https://cve.now/CVE-2026-72402.md): bpf: Mask pseudo pointer values in verifier logs (no CVSS, Linux)
- [CVE-2026-72401](https://cve.now/CVE-2026-72401.md): bpf: Fix insn\_aux\_data leak on verifier err\_free\_env path (no CVSS, Linux)
- [CVE-2026-72400](https://cve.now/CVE-2026-72400.md): seg6: validate SRH length before reading fixed fields (CVSS 7.8, Linux)
- [CVE-2026-72399](https://cve.now/CVE-2026-72399.md): net: enetc: check the number of BDs needed for xdp\_frame (CVSS 9.8, Linux)
- [CVE-2026-72398](https://cve.now/CVE-2026-72398.md): sctp: add INIT verification after cookie unpacking (CVSS 9.8, Linux)
- [CVE-2026-72397](https://cve.now/CVE-2026-72397.md): hwmon: (pmbus/core) honor vrm\_version in pmbus\_data2reg\_vid() (CVSS 7.1, Linux)
- [CVE-2026-72396](https://cve.now/CVE-2026-72396.md): hwmon: adm1275: Prevent reading uninitialized stack (no CVSS, Linux)
- [CVE-2026-72395](https://cve.now/CVE-2026-72395.md): hwmon: (pmbus) Fix passing events to regulator core (CVSS 7.1, Linux)
- [CVE-2026-72394](https://cve.now/CVE-2026-72394.md): hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero (no CVSS, Linux)
- [CVE-2026-72393](https://cve.now/CVE-2026-72393.md): eth: fbnic: don't cache shinfo across skb realloc (CVSS 9.8, Linux)
- [CVE-2026-72392](https://cve.now/CVE-2026-72392.md): ipv6: fib6: fix NULL deref in fib6\_walk\_continue() on multi-batch dump (no CVSS, Linux)
- [CVE-2026-72391](https://cve.now/CVE-2026-72391.md): net: phy: sfp: free mii\_bus in sfp\_i2c\_mdiobus\_destroy (no CVSS, Linux)
- [CVE-2026-72390](https://cve.now/CVE-2026-72390.md): net/sched: sch\_teql: Introduce slaves\_lock to avoid race condition and UAF (CVSS 7.8, Linux)
- [CVE-2026-72389](https://cve.now/CVE-2026-72389.md): bridge: stp: Fix a potential use-after-free when deleting a bridge (CVSS 7.8, Linux)
- [CVE-2026-72388](https://cve.now/CVE-2026-72388.md): drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock (no CVSS, Linux)
- [CVE-2026-72387](https://cve.now/CVE-2026-72387.md): drm/panthor: Fix potential invalid pointer deref in group\_process\_tiler\_oom() (no CVSS, Linux)
- [CVE-2026-72386](https://cve.now/CVE-2026-72386.md): drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced (no CVSS, Linux)
- [CVE-2026-72385](https://cve.now/CVE-2026-72385.md): tracing/fprobe: Fix NULL pointer dereference in fprobe\_fgraph\_entry() (no CVSS, Linux)
- [CVE-2026-72384](https://cve.now/CVE-2026-72384.md): irqchip/ts4800: Fix missing chained handler cleanup on remove (no CVSS, Linux)
- [CVE-2026-72383](https://cve.now/CVE-2026-72383.md): sctp: fix addr\_wq\_timer race in sctp\_free\_addr\_wq() (CVSS 7.8, Linux)
- [CVE-2026-72382](https://cve.now/CVE-2026-72382.md): ksmbd: reject undersized DACLs before parsing ACEs (CVSS 8.8, Linux)
- [CVE-2026-72381](https://cve.now/CVE-2026-72381.md): ksmbd: fix use-after-free of fp-\>owner.name in durable handle owner check (CVSS 9.8, Linux)
- [CVE-2026-72380](https://cve.now/CVE-2026-72380.md): xen/pvcalls: bound backend response req\_id before indexing rsp\[\] (CVSS 8.8, Linux)
- [CVE-2026-72379](https://cve.now/CVE-2026-72379.md): fs: refuse O\_TMPFILE creation with an unmapped fsuid or fsgid (no CVSS, Linux)
- [CVE-2026-72378](https://cve.now/CVE-2026-72378.md): afs: Fix error code in afs\_extract\_vl\_addrs() (CVSS 7.5, Linux)
- [CVE-2026-72377](https://cve.now/CVE-2026-72377.md): afs: Remove setting of AS\_RELEASE\_ALWAYS for symlinks and mountpoints (no CVSS, Linux)
- [CVE-2026-72376](https://cve.now/CVE-2026-72376.md): afs: Fix misplaced inc of net-\>cells\_outstanding (no CVSS, Linux)
- [CVE-2026-72375](https://cve.now/CVE-2026-72375.md): afs: Fix reinitialisation of the inode, in particular -\>lock\_work (CVSS 7.8, Linux)
- [CVE-2026-72374](https://cve.now/CVE-2026-72374.md): afs: Fix callback service message parsers to pass through -EAGAIN (CVSS 7.5, Linux)
- [CVE-2026-72373](https://cve.now/CVE-2026-72373.md): afs: Fix missing NULL pointer check in afs\_break\_some\_callbacks() (CVSS 7.5, Linux)
- [CVE-2026-72372](https://cve.now/CVE-2026-72372.md): afs: Fix lack of locking around modifications of net-\>cells\_dyn\_ino (CVSS 7.8, Linux)
- [CVE-2026-72371](https://cve.now/CVE-2026-72371.md): afs: Fix the volume AFS\_VOLUME\_RM\_TREE is set on (CVSS 7.8, Linux)
- [CVE-2026-72370](https://cve.now/CVE-2026-72370.md): iomap: release pages on atomic dio size mismatch (no CVSS, Linux)
- [CVE-2026-72369](https://cve.now/CVE-2026-72369.md): minix: avoid overflow in bitmap block count calculation (CVSS 7.8, Linux)
- [CVE-2026-72368](https://cve.now/CVE-2026-72368.md): cachefiles: Fix double unlock in nomem\_d\_alloc error path (CVSS 7.8, Linux)
- [CVE-2026-72367](https://cve.now/CVE-2026-72367.md): iomap: guard io\_size EOF trim against concurrent truncate underflow (CVSS 8.8, Linux)
- [CVE-2026-72366](https://cve.now/CVE-2026-72366.md): netfs: Fix netfs\_create\_write\_req() to handle async cache object creation (CVSS 9.8, Linux)
- [CVE-2026-72365](https://cve.now/CVE-2026-72365.md): netfs: Fix writethrough to use collection offload (no CVSS, Linux)
- [CVE-2026-72364](https://cve.now/CVE-2026-72364.md): netfs: Fix writeback error handling (CVSS 7.1, Linux)
- [CVE-2026-72363](https://cve.now/CVE-2026-72363.md): netfs: Fix folio state after ENOMEM whilst under writeback iteration (no CVSS, Linux)
- [CVE-2026-72362](https://cve.now/CVE-2026-72362.md): drm/xe/pt: Fix NULL pointer dereference in xe\_pt\_zap\_ptes\_entry() (no CVSS, Linux)
- [CVE-2026-72361](https://cve.now/CVE-2026-72361.md): drm/xe/hw\_engine: Fix double-free of managed BO in error path (no CVSS, Linux)
- [CVE-2026-72360](https://cve.now/CVE-2026-72360.md): drm/xe/pf: Don't attempt to process FAST\_REQ or EVENT relays (CVSS 8.4, Linux)
- [CVE-2026-72359](https://cve.now/CVE-2026-72359.md): drm/xe: fix NPD in bo\_meminfo() (no CVSS, Linux)
- [CVE-2026-72358](https://cve.now/CVE-2026-72358.md): drm/xe/pt: prevent invalid cursor access for purged BOs (CVSS 7.8, Linux)
- [CVE-2026-72357](https://cve.now/CVE-2026-72357.md): uprobes/x86: Use proper mm\_struct in \_\_in\_uprobe\_trampoline (CVSS 7.8, Linux)
- [CVE-2026-72356](https://cve.now/CVE-2026-72356.md): cifs: Fix missing credit release on failure in cifs\_issue\_read() (CVSS 7.5, Linux)
- [CVE-2026-72355](https://cve.now/CVE-2026-72355.md): netfs: Fix barriering when walking subrequest list (CVSS 9.8, Linux)
- [CVE-2026-72354](https://cve.now/CVE-2026-72354.md): ntfs: avoid stale runlist element dereference in MFT writeback (CVSS 8.8, Linux)
- [CVE-2026-72353](https://cve.now/CVE-2026-72353.md): ntfs: avoid stale runlist element dereference in fallocate (CVSS 8.8, Linux)
- [CVE-2026-72352](https://cve.now/CVE-2026-72352.md): HID: bpf: Fix hid\_bpf\_get\_data() range check (CVSS 7.8, Linux)
- [CVE-2026-72351](https://cve.now/CVE-2026-72351.md): gue: validate REMCSUM private option length (CVSS 9.8, Linux)
- [CVE-2026-72350](https://cve.now/CVE-2026-72350.md): netfilter: xt\_u32: reject invalid shift counts (CVSS 7.8, Linux)
- [CVE-2026-72349](https://cve.now/CVE-2026-72349.md): netfilter: xt\_rateest: fix u64 truncation in xt\_rateest\_mt() (no CVSS, Linux)
- [CVE-2026-72348](https://cve.now/CVE-2026-72348.md): netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (CVSS 9.1, Linux)
- [CVE-2026-72347](https://cve.now/CVE-2026-72347.md): netfilter: xt\_connmark: reject invalid shift parameters (CVSS 7.3, Linux)
- [CVE-2026-72346](https://cve.now/CVE-2026-72346.md): platform/x86: bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume (no CVSS, Linux)
- [CVE-2026-72345](https://cve.now/CVE-2026-72345.md): net/mlx5: LAG, Fix off-by-one in single-FDB error rollback (CVSS 7.8, Linux)
- [CVE-2026-72344](https://cve.now/CVE-2026-72344.md): net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable (CVSS 7.8, Linux)
- [CVE-2026-72343](https://cve.now/CVE-2026-72343.md): net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (CVSS 8.4, Linux)
- [CVE-2026-72342](https://cve.now/CVE-2026-72342.md): net/mlx5e: Fix HV VHCA stats agent registration race (CVSS 8.4, Linux)
- [CVE-2026-72341](https://cve.now/CVE-2026-72341.md): net/mlx5e: Fix publication race for priv-\>channel\_stats\[\] (no CVSS, Linux)
- [CVE-2026-72340](https://cve.now/CVE-2026-72340.md): net: microchip: vcap: fix races on the shared Super VCAP block (CVSS 7.8, Linux)
- [CVE-2026-72339](https://cve.now/CVE-2026-72339.md): qede: fix off-by-one in BD ring consumption on build\_skb failure (CVSS 9.8, Linux)
- [CVE-2026-72338](https://cve.now/CVE-2026-72338.md): net/sched: act\_pedit: fix TOCTOU heap OOB write in tc offload (CVSS 7.8, Linux)
- [CVE-2026-72337](https://cve.now/CVE-2026-72337.md): Bluetooth: 6lowpan: avoid untracked enable work (no CVSS, Linux)
- [CVE-2026-72336](https://cve.now/CVE-2026-72336.md): Bluetooth: 6lowpan: hold L2CAP conn across debugfs control (no CVSS, Linux)
- [CVE-2026-72335](https://cve.now/CVE-2026-72335.md): Bluetooth: MGMT: Fix adv monitor add failure cleanup (CVSS 7.8, Linux)
- [CVE-2026-72334](https://cve.now/CVE-2026-72334.md): Bluetooth: ISO: fix malformed ISO\_END/CONT handling (CVSS 8.8, Linux)
- [CVE-2026-72333](https://cve.now/CVE-2026-72333.md): Bluetooth: L2CAP: fix tx ident leak for commands without a response (no CVSS, Linux)
- [CVE-2026-72332](https://cve.now/CVE-2026-72332.md): accel/amdxdna: Prevent PM resume deadlock in hwctx\_sync\_debug\_bo() (no CVSS, Linux)
- [CVE-2026-72331](https://cve.now/CVE-2026-72331.md): accel/amdxdna: Fix VMA access race (CVSS 7.8, Linux)
- [CVE-2026-72330](https://cve.now/CVE-2026-72330.md): net/tls: Consume empty data records in tls\_sw\_read\_sock() (CVSS 7.5, Linux)
- [CVE-2026-72329](https://cve.now/CVE-2026-72329.md): net/liquidio: drop cached VF pci\_dev LUT (CVSS 9.3, Linux)
- [CVE-2026-72328](https://cve.now/CVE-2026-72328.md): accel/amdxdna: Fix potential amdxdna\_umap lifetime race (CVSS 7.8, Linux)
- [CVE-2026-72327](https://cve.now/CVE-2026-72327.md): drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (no CVSS, Linux)
- [CVE-2026-72326](https://cve.now/CVE-2026-72326.md): net/sched: cake: reject overhead values that underflow length (no CVSS, Linux)
- [CVE-2026-72325](https://cve.now/CVE-2026-72325.md): perf/x86/amd/core: Avoid enabling BRS from the SVM reload path (no CVSS, Linux)
- [CVE-2026-72324](https://cve.now/CVE-2026-72324.md): gpio: mvebu: free generic chips on unbind (no CVSS, Linux)
- [CVE-2026-72323](https://cve.now/CVE-2026-72323.md): ipv4: igmp: Fix potential UAF in igmp\_gq\_start\_timer() (CVSS 9.8, Linux)
- [CVE-2026-72322](https://cve.now/CVE-2026-72322.md): ipv6: mcast: Fix potential UAF in MLD delayed work (CVSS 9.8, Linux)
- [CVE-2026-72321](https://cve.now/CVE-2026-72321.md): ipv4: igmp: Fix potential memory leaks in igmp\_mod\_timer() and igmp\_stop\_timer() (no CVSS, Linux)
- [CVE-2026-72320](https://cve.now/CVE-2026-72320.md): netfilter: nft\_lookup: fix catchall element handling with inverted lookups (CVSS 9.1, Linux)
- [CVE-2026-72319](https://cve.now/CVE-2026-72319.md): ipvs: ensure inner headers in ICMP errors are in headroom (CVSS 9.8, Linux)
- [CVE-2026-72318](https://cve.now/CVE-2026-72318.md): cifs: validate DFS referral string offsets (CVSS 9.4, Linux)
- [CVE-2026-72317](https://cve.now/CVE-2026-72317.md): SUNRPC: pin upper rpc\_clnt across the TLS connect\_worker (CVSS 9.8, Linux)
- [CVE-2026-72316](https://cve.now/CVE-2026-72316.md): dm era: fix NULL pointer dereference in metadata\_open() (no CVSS, Linux)
- [CVE-2026-72315](https://cve.now/CVE-2026-72315.md): smb: client: fix busy dentry warning on unmount after DIO (CVSS 7.8, Linux)
- [CVE-2026-72314](https://cve.now/CVE-2026-72314.md): regulator: core: regulator\_lock\_two() should test for EDEADLK not EDEADLOCK (CVSS 7.8, Linux)
- [CVE-2026-72313](https://cve.now/CVE-2026-72313.md): drm/fb-helper: Only consider active CRTCs for vblank sync (no CVSS, Linux)
- [CVE-2026-72312](https://cve.now/CVE-2026-72312.md): octeontx2-af: fix VF bringup affecting PF promiscuous state (CVSS 7.9, Linux)
- [CVE-2026-72311](https://cve.now/CVE-2026-72311.md): drm/xe: free madvise VMA array on L2 flush failure (no CVSS, Linux)
- [CVE-2026-72310](https://cve.now/CVE-2026-72310.md): smb: client: fix overflow in passthrough ioctl bounds check (CVSS 8.1, Linux)
- [CVE-2026-72309](https://cve.now/CVE-2026-72309.md): tracing/remotes: Fix leak in trace\_remote\_alloc\_buffer() error path (no CVSS, Linux)
- [CVE-2026-72308](https://cve.now/CVE-2026-72308.md): mlxsw: fix refcount leak in mlxsw\_sp\_port\_lag\_join() (no CVSS, Linux)
- [CVE-2026-72307](https://cve.now/CVE-2026-72307.md): mlxsw: fix refcount leak in mlxsw\_sp\_vrs\_lpm\_tree\_replace() (no CVSS, Linux)
- [CVE-2026-72306](https://cve.now/CVE-2026-72306.md): vduse: Fix race in vduse\_dev\_msg\_sync and vduse\_dev\_read\_iter (no CVSS, Linux)
- [CVE-2026-72305](https://cve.now/CVE-2026-72305.md): VDUSE: avoid leaking information to userspace (no CVSS, Linux)
- [CVE-2026-72304](https://cve.now/CVE-2026-72304.md): ASoC: SOF: ipc4-control: Fix TOCTOU in sof\_ipc4\_bytes\_put (CVSS 7.8, Linux)
- [CVE-2026-72303](https://cve.now/CVE-2026-72303.md): ASoC: SOF: ipc4-control: Validate notification payload size (CVSS 7.8, Linux)
- [CVE-2026-72302](https://cve.now/CVE-2026-72302.md): ASoC: SOF: ipc3-control: Use overflow checks in control\_update size calc (CVSS 7.8, Linux)
- [CVE-2026-72301](https://cve.now/CVE-2026-72301.md): ASoC: SOF: ipc3-control: Fix TOCTOU in bytes\_put and bytes\_get (CVSS 7.8, Linux)
- [CVE-2026-72300](https://cve.now/CVE-2026-72300.md): ASoC: SOF: topology: validate vendor array size before parsing (no CVSS, Linux)
- [CVE-2026-72299](https://cve.now/CVE-2026-72299.md): tipc: restrict socket queue dumps in enqueue tracepoints (CVSS 9.8, Linux)
- [CVE-2026-72298](https://cve.now/CVE-2026-72298.md): net: qrtr: fix 32-bit integer overflow in qrtr\_endpoint\_post() (CVSS 8.4, Linux)
- [CVE-2026-72297](https://cve.now/CVE-2026-72297.md): net: atm: reject out-of-range traffic classes in QoS validation (CVSS 7.1, Linux)
- [CVE-2026-72296](https://cve.now/CVE-2026-72296.md): net: ife: require ETH\_HLEN to be pullable in ife\_decode() (CVSS 9.1, Linux)
- [CVE-2026-72295](https://cve.now/CVE-2026-72295.md): LoongArch: KVM: Validate irqchip index in irqfd routing (CVSS 8.8, Linux)
- [CVE-2026-72294](https://cve.now/CVE-2026-72294.md): LoongArch: KVM: Check irq validity in kvm\_vcpu\_ioctl\_interrupt() (CVSS 8.8, Linux)
- [CVE-2026-72293](https://cve.now/CVE-2026-72293.md): KVM: s390: vsie: Add missing radix\_tree\_preload() in \_gaccess\_shadow\_fault() (no CVSS, Linux)
- [CVE-2026-72292](https://cve.now/CVE-2026-72292.md): KVM: s390: Initialize KVM\_S390\_GET\_CMMA\_BITS memory (no CVSS, Linux)
- [CVE-2026-72291](https://cve.now/CVE-2026-72291.md): KVM: s390: Fix unlikely race in try\_get\_locked\_pte() (CVSS 9.3, Linux)
- [CVE-2026-72290](https://cve.now/CVE-2026-72290.md): KVM: s390: pci: Fix GISC refcount leak on AIF enable failure (no CVSS, Linux)
- [CVE-2026-72289](https://cve.now/CVE-2026-72289.md): KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVSS 9.3, Linux)
- [CVE-2026-72288](https://cve.now/CVE-2026-72288.md): KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVSS 9.3, Linux)
- [CVE-2026-72287](https://cve.now/CVE-2026-72287.md): KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checks (CVSS 7.8, Linux)
- [CVE-2026-72286](https://cve.now/CVE-2026-72286.md): KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (CVSS 8.8, Linux)
- [CVE-2026-72285](https://cve.now/CVE-2026-72285.md): KVM: TDX: Reject concurrent change to CPUID entry count (CVSS 7.8, Linux)
- [CVE-2026-72284](https://cve.now/CVE-2026-72284.md): KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (CVSS 7.1, Linux)
- [CVE-2026-72283](https://cve.now/CVE-2026-72283.md): KVM: x86: Nullify irqfd-\>producer if updating IRTE for bypass fails (CVSS 8.8, Linux)
- [CVE-2026-72282](https://cve.now/CVE-2026-72282.md): KVM: Move kvm\_io\_bus\_get\_dev() locking responsibilities to callers (CVSS 7.8, Linux)
- [CVE-2026-72281](https://cve.now/CVE-2026-72281.md): KVM: arm64: account pKVM reclaim against the VM mm (no CVSS, Linux)
- [CVE-2026-72280](https://cve.now/CVE-2026-72280.md): KVM: arm64: nv: Drop bogus WARN for write to ZCR\_EL2 (CVSS 7.1, Linux)
- [CVE-2026-72279](https://cve.now/CVE-2026-72279.md): KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR (CVSS 9.0, Linux)
- [CVE-2026-72278](https://cve.now/CVE-2026-72278.md): KVM: arm64: nv: Re-translate VNCR before injecting abort (CVSS 9.3, Linux)
- [CVE-2026-72277](https://cve.now/CVE-2026-72277.md): KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory (CVSS 9.3, Linux)
- [CVE-2026-72276](https://cve.now/CVE-2026-72276.md): fbdev: metronomefb: fix potential memory leak in metronomefb\_probe() (no CVSS, Linux)
- [CVE-2026-72275](https://cve.now/CVE-2026-72275.md): fbdev: broadsheetfb: fix potential memory leak in broadsheetfb\_probe() (no CVSS, Linux)
- [CVE-2026-72274](https://cve.now/CVE-2026-72274.md): fbdev: hecubafb: fix potential memory leak in hecubafb\_probe() (no CVSS, Linux)
- [CVE-2026-72273](https://cve.now/CVE-2026-72273.md): fbdev: efifb: fix memory leak in efifb\_probe() (no CVSS, Linux)
- [CVE-2026-72272](https://cve.now/CVE-2026-72272.md): fbdev: radeon: fix potential memory leak in radeonfb\_pci\_register() (no CVSS, Linux)
- [CVE-2026-72271](https://cve.now/CVE-2026-72271.md): fbdev: i740fb: fix potential memory leak in i740fb\_probe() (no CVSS, Linux)
- [CVE-2026-72270](https://cve.now/CVE-2026-72270.md): fbdev: s3fb: fix potential memory leak in s3\_pci\_probe() (no CVSS, Linux)
- [CVE-2026-72269](https://cve.now/CVE-2026-72269.md): fbdev: uvesafb: fix potential memory leak in uvesafb\_probe() (no CVSS, Linux)
- [CVE-2026-72268](https://cve.now/CVE-2026-72268.md): fbdev: tdfxfb: fix potential memory leak in tdfxfb\_probe() (no CVSS, Linux)
- [CVE-2026-72267](https://cve.now/CVE-2026-72267.md): fbdev: carminefb: fix potential memory leak in alloc\_carmine\_fb() (no CVSS, Linux)
- [CVE-2026-72266](https://cve.now/CVE-2026-72266.md): fbdev: vesafb: fix memory leak in vesafb\_probe() (no CVSS, Linux)
- [CVE-2026-72265](https://cve.now/CVE-2026-72265.md): fbdev: nvidia: fix potential memory leak in nvidiafb\_probe() (no CVSS, Linux)
- [CVE-2026-72264](https://cve.now/CVE-2026-72264.md): fbdev: tridentfb: fix potential memory leak in trident\_pci\_probe() (no CVSS, Linux)
- [CVE-2026-72263](https://cve.now/CVE-2026-72263.md): ASoC: SOF: topology: fix memory leak in snd\_sof\_load\_topology (no CVSS, Linux)
- [CVE-2026-72262](https://cve.now/CVE-2026-72262.md): ASoC: SOF: ipc3-control: Fix heap overflow in bytes\_ext put/get (CVSS 7.8, Linux)
- [CVE-2026-72261](https://cve.now/CVE-2026-72261.md): ASoC: SOF: ipc3-control: Validate size in snd\_sof\_update\_control (CVSS 7.8, Linux)
- [CVE-2026-72260](https://cve.now/CVE-2026-72260.md): ASoC: mediatek: mt8192: Check runtime resume during probe (no CVSS, Linux)
- [CVE-2026-72259](https://cve.now/CVE-2026-72259.md): ASoC: mediatek: mt8192: Release reserved memory on cleanup (no CVSS, Linux)
- [CVE-2026-72258](https://cve.now/CVE-2026-72258.md): ASoC: mediatek: mt8183: Release reserved memory on cleanup (no CVSS, Linux)
- [CVE-2026-72257](https://cve.now/CVE-2026-72257.md): ASoC: qcom: q6apm: fix NULL pointer dereference in graph\_callback (no CVSS, Linux)
- [CVE-2026-72256](https://cve.now/CVE-2026-72256.md): netfilter: xt\_cluster: reject template conntracks in hash match (no CVSS, Linux)
- [CVE-2026-72255](https://cve.now/CVE-2026-72255.md): netfilter: nf\_queue: pin bridge device while NFQUEUE holds fake dst (CVSS 7.8, Linux)
- [CVE-2026-72254](https://cve.now/CVE-2026-72254.md): netfilter: nft\_fib: reject fib expression on the netdev egress hook (CVSS 7.5, Linux)
- [CVE-2026-72253](https://cve.now/CVE-2026-72253.md): netfilter: nf\_conntrack\_sip: validate skb\_dst() before accessing it (CVSS 7.5, Linux)
- [CVE-2026-72252](https://cve.now/CVE-2026-72252.md): netfilter: nft\_set\_pipapo: don't leak bad clone into future transaction (CVSS 7.8, Linux)
- [CVE-2026-72251](https://cve.now/CVE-2026-72251.md): netfilter: nf\_nat\_sip: reload possible stale data pointer (CVSS 9.8, Linux)
- [CVE-2026-72250](https://cve.now/CVE-2026-72250.md): netfilter: nf\_conntrack\_reasm: guard mac\_header adjustment after IPv6 defrag (CVSS 7.8, Linux)
- [CVE-2026-72249](https://cve.now/CVE-2026-72249.md): netfilter: flowtable: use dst in this direction when pushing IPIP header (CVSS 9.8, Linux)
- [CVE-2026-72248](https://cve.now/CVE-2026-72248.md): netfilter: flowtable: support IPIP tunnel with direct xmit (CVSS 9.8, Linux)
- [CVE-2026-72247](https://cve.now/CVE-2026-72247.md): netfilter: nf\_conncount: fix zone comparison in tuple dedup (CVSS 7.5, Linux)
- [CVE-2026-72245](https://cve.now/CVE-2026-72245.md): gpu: host1x: Fix device reference leak in host1x\_device\_parse\_dt() error path (no CVSS, Linux)
- [CVE-2026-72244](https://cve.now/CVE-2026-72244.md): gpu/buddy: bail out of try\_harder when alignment cannot be honoured (CVSS 7.8, Linux)
- [CVE-2026-72243](https://cve.now/CVE-2026-72243.md): selinux: check connect-related permissions on TCP Fast Open (CVSS 8.4, Linux)
- [CVE-2026-72242](https://cve.now/CVE-2026-72242.md): selinux: avoid sk\_socket dereference in selinux\_sctp\_bind\_connect() (CVSS 7.5, Linux)
- [CVE-2026-72241](https://cve.now/CVE-2026-72241.md): leds: uleds: Fix potential buffer overread (no CVSS, Linux)
- [CVE-2026-72240](https://cve.now/CVE-2026-72240.md): mfd: sm501: Fix reference leak on failed device registration (no CVSS, Linux)
- [CVE-2026-72239](https://cve.now/CVE-2026-72239.md): x86/virt/sev: Revert "Drop WBINVD before setting MSR\_AMD64\_SYSCFG\_SNP\_EN" (CVSS 9.3, Linux)
- [CVE-2026-72238](https://cve.now/CVE-2026-72238.md): x86/boot: Validate console=uart8250 baud rate to fix early boot hang (no CVSS, Linux)
- [CVE-2026-72237](https://cve.now/CVE-2026-72237.md): perf/x86/amd/brs: Fix kernel address leakage (no CVSS, Linux)
- [CVE-2026-72236](https://cve.now/CVE-2026-72236.md): s390/perf\_cpum\_cf: Add missing array\_index\_nospec() to \_\_hw\_perf\_event\_init() (no CVSS, Linux)
- [CVE-2026-72235](https://cve.now/CVE-2026-72235.md): batman-adv: retrieve ethhdr after potential skb realloc on RX (CVSS 8.8, Linux)
- [CVE-2026-72234](https://cve.now/CVE-2026-72234.md): batman-adv: access unicast\_ttvn skb-\>data only after skb realloc (CVSS 9.8, Linux)
- [CVE-2026-72233](https://cve.now/CVE-2026-72233.md): batman-adv: bla: reacquire gw address after skb realloc (CVSS 8.8, Linux)
- [CVE-2026-72232](https://cve.now/CVE-2026-72232.md): batman-adv: ensure minimal ethernet header on TX (CVSS 7.8, Linux)
- [CVE-2026-72231](https://cve.now/CVE-2026-72231.md): batman-adv: tt: avoid request storms during pending request (CVSS 7.5, Linux)
- [CVE-2026-72230](https://cve.now/CVE-2026-72230.md): batman-adv: frag: free unfragmentable packet (no CVSS, Linux)
- [CVE-2026-72229](https://cve.now/CVE-2026-72229.md): batman-adv: clean untagged VLAN on netdev registration failure (no CVSS, Linux)
- [CVE-2026-72228](https://cve.now/CVE-2026-72228.md): batman-adv: frag: fix primary\_if leak on failed linearization (no CVSS, Linux)
- [CVE-2026-72227](https://cve.now/CVE-2026-72227.md): batman-adv: mcast: avoid OOB read of num\_dests header (CVSS 8.1, Linux)
- [CVE-2026-72226](https://cve.now/CVE-2026-72226.md): batman-adv: tt: prevent TVLV OOB check overflow (CVSS 9.8, Linux)
- [CVE-2026-72225](https://cve.now/CVE-2026-72225.md): jbd2: fix integer underflow in jbd2\_journal\_initialize\_fast\_commit() (CVSS 7.8, Linux)
- [CVE-2026-72224](https://cve.now/CVE-2026-72224.md): nvdimm/btt: Free arenas on btt\_init() error paths (no CVSS, Linux)
- [CVE-2026-72223](https://cve.now/CVE-2026-72223.md): nvdimm/btt: Free arena sub-allocations on discover\_arenas() error path (no CVSS, Linux)
- [CVE-2026-72222](https://cve.now/CVE-2026-72222.md): sunrpc: pin svc\_xprt across the asynchronous TLS handshake callback (CVSS 9.8, Linux)
- [CVE-2026-72221](https://cve.now/CVE-2026-72221.md): sunrpc: wait for in-flight TLS handshake callback when cancel loses race (CVSS 9.8, Linux)
- [CVE-2026-72220](https://cve.now/CVE-2026-72220.md): sunrpc: harden rq\_procinfo lifecycle to prevent double-free (CVSS 9.8, Linux)
- [CVE-2026-72219](https://cve.now/CVE-2026-72219.md): lockd: Plug nlm\_file leak when nlm\_do\_fopen() fails (no CVSS, Linux)
- [CVE-2026-72218](https://cve.now/CVE-2026-72218.md): lockd: Plug nlm\_file refcount leak on cached nlm\_do\_fopen() failure (no CVSS, Linux)
- [CVE-2026-72217](https://cve.now/CVE-2026-72217.md): SUNRPC: Bound-check xdr\_buf\_to\_bvec() stores before writing (CVSS 9.8, Linux)
- [CVE-2026-72216](https://cve.now/CVE-2026-72216.md): remoteproc: qcom: Fix leak when custom dump\_segments addition fails (no CVSS, Linux)
- [CVE-2026-72215](https://cve.now/CVE-2026-72215.md): MIPS: DEC: Ensure 32-bit stack location for o32 prom\_printf() (no CVSS, Linux)
- [CVE-2026-72214](https://cve.now/CVE-2026-72214.md): power: supply: cpcap-battery: Fix missing nvmem\_device\_put() causing reference leak (no CVSS, Linux)
- [CVE-2026-72213](https://cve.now/CVE-2026-72213.md): mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (CVSS 7.1, Linux)
- [CVE-2026-72212](https://cve.now/CVE-2026-72212.md): mm/memory\_hotplug: fix incorrect altmap passing in error path (no CVSS, Linux)
- [CVE-2026-72211](https://cve.now/CVE-2026-72211.md): ntfs: grow index root value before reparent header update (CVSS 9.8, Linux)
- [CVE-2026-72210](https://cve.now/CVE-2026-72210.md): ntfs: fix off-by-one in mapping pairs decoding bounds checks (CVSS 9.8, Linux)
- [CVE-2026-72209](https://cve.now/CVE-2026-72209.md): ntfs: validate attribute values on lookup (CVSS 9.8, Linux)
- [CVE-2026-72208](https://cve.now/CVE-2026-72208.md): ntfs: add bounds check before accessing EA entries (CVSS 9.8, Linux)
- [CVE-2026-72207](https://cve.now/CVE-2026-72207.md): ntfs: not change 0-byte $DATA attribute to non-resident (CVSS 9.8, Linux)
- [CVE-2026-72206](https://cve.now/CVE-2026-72206.md): ntfs: validate index block header more strictly (CVSS 9.8, Linux)
- [CVE-2026-72205](https://cve.now/CVE-2026-72205.md): ntfs: free volume-wide resources on fill\_super failure (no CVSS, Linux)
- [CVE-2026-72204](https://cve.now/CVE-2026-72204.md): ntfs: centalize $INDEX\_ROOT header validation (CVSS 8.4, Linux)
- [CVE-2026-72203](https://cve.now/CVE-2026-72203.md): ntfs: skip extent mft records in writeback to prevent deadlock (CVSS 7.5, Linux)
- [CVE-2026-72202](https://cve.now/CVE-2026-72202.md): ntfs: avoid heap allocation for free-cluster readahead state (CVSS 7.5, Linux)
- [CVE-2026-72201](https://cve.now/CVE-2026-72201.md): ntfs: validate index entries on reading (CVSS 9.8, Linux)
- [CVE-2026-72200](https://cve.now/CVE-2026-72200.md): ntfs: detect mapping-pairs LCN accumulator overflow (CVSS 9.8, Linux)
- [CVE-2026-72199](https://cve.now/CVE-2026-72199.md): ntfs: validate resident index root values on lookup (CVSS 9.8, Linux)
- [CVE-2026-72198](https://cve.now/CVE-2026-72198.md): ntfs: reject non-resident records for resident-only attributes (CVSS 7.8, Linux)
- [CVE-2026-72197](https://cve.now/CVE-2026-72197.md): fs/ntfs3: bound DeleteIndexEntryAllocation memmove length (CVSS 8.4, Linux)
- [CVE-2026-72196](https://cve.now/CVE-2026-72196.md): fs/ntfs3: bound copy\_lcns dp-\>page\_lcns\[\] index in analysis pass (CVSS 8.4, Linux)
- [CVE-2026-72195](https://cve.now/CVE-2026-72195.md): fs/ntfs3: bound attr\_off in UpdateResidentValue against data\_off (CVSS 7.8, Linux)
- [CVE-2026-72194](https://cve.now/CVE-2026-72194.md): fs/ntfs3: add depth limit to indx\_find\_buffer to prevent stack overflow (CVSS 9.8, Linux)
- [CVE-2026-72193](https://cve.now/CVE-2026-72193.md): ntfs3: cap RESTART\_TABLE free-chain walker at rt-\>used (no CVSS, Linux)
- [CVE-2026-72192](https://cve.now/CVE-2026-72192.md): ntfs3: bound to\_move in indx\_insert\_into\_root before hdr\_insert\_head (CVSS 9.8, Linux)
- [CVE-2026-72191](https://cve.now/CVE-2026-72191.md): ntfs3: validate split-point offset in indx\_insert\_into\_buffer (CVSS 9.8, Linux)
- [CVE-2026-72190](https://cve.now/CVE-2026-72190.md): ntfs: fix mrec\_lock ABBA deadlock in rename (no CVSS, Linux)
- [CVE-2026-72189](https://cve.now/CVE-2026-72189.md): ntfs: fail attrlist updates when the superblock is inactive (no CVSS, Linux)
- [CVE-2026-72188](https://cve.now/CVE-2026-72188.md): ntfs: sanitize MFT references returned from ntfs\_lookup\_inode\_by\_name() (CVSS 9.1, Linux)
- [CVE-2026-72187](https://cve.now/CVE-2026-72187.md): ntfs: avoid self-deadlock during inode eviction (no CVSS, Linux)
- [CVE-2026-72186](https://cve.now/CVE-2026-72186.md): ntfs: make system files immutable to prevent corruption (CVSS 9.1, Linux)
- [CVE-2026-72185](https://cve.now/CVE-2026-72185.md): ntfs: fix WARN\_ON for resident attribute in ntfs\_map\_runlist\_nolock() (CVSS 9.8, Linux)
- [CVE-2026-72184](https://cve.now/CVE-2026-72184.md): ntfs: fix hole runlist memory leak in insert range error path (no CVSS, Linux)
- [CVE-2026-72183](https://cve.now/CVE-2026-72183.md): landlock: Fix LANDLOCK\_SCOPE\_SIGNAL bypass on the SIGIO path (CVSS 8.4, Linux)
- [CVE-2026-72182](https://cve.now/CVE-2026-72182.md): power: supply: charger-manager: fix refcount leak in is\_full\_charged() (no CVSS, Linux)
- [CVE-2026-72181](https://cve.now/CVE-2026-72181.md): mips: sched: Fix CPUMASK\_OFFSTACK memory corruption (CVSS 7.8, Linux)
- [CVE-2026-72180](https://cve.now/CVE-2026-72180.md): mm/huge\_memory: preserve pmd\_swp\_uffd\_wp on device-private PMD downgrade (no CVSS, Linux)
- [CVE-2026-72179](https://cve.now/CVE-2026-72179.md): riscv: cacheinfo: Fix node reference leak in populate\_cache\_leaves (no CVSS, Linux)
- [CVE-2026-72178](https://cve.now/CVE-2026-72178.md): mm/damon/core: always put unsuccessfully committed target pids (no CVSS, Linux)
- [CVE-2026-72177](https://cve.now/CVE-2026-72177.md): mm/damon/sysfs-schemes: fix dir put orders in access\_pattern\_add\_dirs() (no CVSS, Linux)
- [CVE-2026-72176](https://cve.now/CVE-2026-72176.md): mm/damon/sysfs-schemes: put stats for scheme\_add\_dirs() internal error (no CVSS, Linux)
- [CVE-2026-72175](https://cve.now/CVE-2026-72175.md): fs/proc/task\_mmu: fix make\_uffd\_wp\_huge\_pte() prot-update race (CVSS 7.1, Linux)
- [CVE-2026-72174](https://cve.now/CVE-2026-72174.md): fs/proc/task\_mmu: fix hugetlb self-deadlock in pagemap\_scan\_pte\_hole() (no CVSS, Linux)
- [CVE-2026-72173](https://cve.now/CVE-2026-72173.md): fs/proc/task\_mmu: do not warn on seeing non-migration pmd entry (no CVSS, Linux)
- [CVE-2026-72172](https://cve.now/CVE-2026-72172.md): mm/mm\_init: fix uninitialized struct pages for ZONE\_DEVICE (CVSS 7.8, Linux)
- [CVE-2026-72171](https://cve.now/CVE-2026-72171.md): mtd: slram: remove failed entries from the device list (CVSS 7.8, Linux)
- [CVE-2026-72170](https://cve.now/CVE-2026-72170.md): 9p: skip nlink update in cacheless mode to fix WARN\_ON (CVSS 7.8, Linux)
- [CVE-2026-72169](https://cve.now/CVE-2026-72169.md): kho: make sure scratch size is always aligned by CMA\_MIN\_ALIGNMENT\_BYTES (no CVSS, Linux)
- [CVE-2026-72168](https://cve.now/CVE-2026-72168.md): mtd: maps: vmu-flash: fix fault in unaligned fixup (no CVSS, Linux)
- [CVE-2026-72167](https://cve.now/CVE-2026-72167.md): mtd: rawnand: pl353: fix probe resource allocation (no CVSS, Linux)
- [CVE-2026-72166](https://cve.now/CVE-2026-72166.md): net/9p: fix infinite loop in p9\_client\_rpc on fatal signal (no CVSS, Linux)
- [CVE-2026-72165](https://cve.now/CVE-2026-72165.md): mtd: rawnand: fix condition in 'nand\_select\_target()' (CVSS 7.8, Linux)
- [CVE-2026-72164](https://cve.now/CVE-2026-72164.md): ocfs2: avoid moving extents to occupied clusters (CVSS 7.8, Linux)
- [CVE-2026-72163](https://cve.now/CVE-2026-72163.md): ocfs2: fix NULL h\_transaction deref in ocfs2\_assure\_trans\_credits (no CVSS, Linux)
- [CVE-2026-72162](https://cve.now/CVE-2026-72162.md): ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2\_sum\_rightmost\_rec (CVSS 7.8, Linux)
- [CVE-2026-72161](https://cve.now/CVE-2026-72161.md): ocfs2: add journal NULL check in ocfs2\_checkpoint\_inode() (no CVSS, Linux)
- [CVE-2026-72160](https://cve.now/CVE-2026-72160.md): ocfs2: reject dinodes with non-canonical i\_mode type (CVSS 8.8, Linux)
- [CVE-2026-72159](https://cve.now/CVE-2026-72159.md): ocfs2: reject non-inline dinodes with i\_size and zero i\_clusters (no CVSS, Linux)
- [CVE-2026-72158](https://cve.now/CVE-2026-72158.md): fpga: dfl: add bounds check in dfh\_get\_param\_size() (no CVSS, Linux)
- [CVE-2026-72157](https://cve.now/CVE-2026-72157.md): net: thunderbolt: Fix frags\[\] overflow by bounding frame\_count (CVSS 8.8, Linux)
- [CVE-2026-72156](https://cve.now/CVE-2026-72156.md): fpga: microchip-spi: fix zero header\_size OOB read in mpf\_ops\_parse\_header() (no CVSS, Linux)
- [CVE-2026-72155](https://cve.now/CVE-2026-72155.md): mtd: spi-nor: swp: Improve locking user experience (no CVSS, Linux)
- [CVE-2026-72154](https://cve.now/CVE-2026-72154.md): openrisc: Fix jump\_label smp syncing (CVSS 7.8, Linux)
- [CVE-2026-72153](https://cve.now/CVE-2026-72153.md): irqchip/crossbar: Use correct index in crossbar\_domain\_free() (no CVSS, Linux)
- [CVE-2026-72152](https://cve.now/CVE-2026-72152.md): tpm: tpm\_tis\_spi: Use wait\_woken() in wait\_for\_tmp\_stat() (no CVSS, Linux)
- [CVE-2026-72151](https://cve.now/CVE-2026-72151.md): tpm: tpm2-sessions: wait for async KPP completion in tpm\_buf\_append\_salt (CVSS 8.4, Linux)
- [CVE-2026-72150](https://cve.now/CVE-2026-72150.md): sunrpc: fix uninitialized xprt\_create\_args structure (no CVSS, Linux)
- [CVE-2026-72149](https://cve.now/CVE-2026-72149.md): dmaengine: tegra: Fix burst size calculation (CVSS 7.5, Linux)
- [CVE-2026-72148](https://cve.now/CVE-2026-72148.md): dmaengine: dw-edma: Add spinlock to protect DONE\_INT\_MASK and ABORT\_INT\_MASK (CVSS 8.8, Linux)
- [CVE-2026-72147](https://cve.now/CVE-2026-72147.md): dmaengine: dw-edma-pcie: Reject devices without driver data (no CVSS, Linux)
- [CVE-2026-72146](https://cve.now/CVE-2026-72146.md): dmaengine: sh: rz-dmac: Move interrupt request after everything is set up (CVSS 8.4, Linux)
- [CVE-2026-72145](https://cve.now/CVE-2026-72145.md): platform/x86/intel/tpmi: use cleanup helpers in mem\_write() (no CVSS, Linux)
- [CVE-2026-72144](https://cve.now/CVE-2026-72144.md): platform/x86: dell-laptop: fix missing cleanups in init error path (CVSS 7.8, Linux)
- [CVE-2026-72143](https://cve.now/CVE-2026-72143.md): platform/x86: ISST: Restore SST-PP control to all domains (CVSS 7.1, Linux)
- [CVE-2026-72142](https://cve.now/CVE-2026-72142.md): i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (no CVSS, Linux)
- [CVE-2026-72141](https://cve.now/CVE-2026-72141.md): i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (CVSS 7.5, Linux)
- [CVE-2026-72140](https://cve.now/CVE-2026-72140.md): i2c: mlxbf: Fix use-after-free in mlxbf\_i2c\_init\_resource() (no CVSS, Linux)
- [CVE-2026-72139](https://cve.now/CVE-2026-72139.md): tcp: defer md5sig\_info kfree past RCU grace period in tcp\_connect (CVSS 9.8, Linux)
- [CVE-2026-72138](https://cve.now/CVE-2026-72138.md): xen/gntdev: fix error handling in ioctl (no CVSS, Linux)
- [CVE-2026-72137](https://cve.now/CVE-2026-72137.md): xfrm: nat\_keepalive: avoid double free on send error (CVSS 9.8, Linux)
- [CVE-2026-72136](https://cve.now/CVE-2026-72136.md): xfrm: xfrm\_interface: require CAP\_NET\_ADMIN in the device netns for changelink (CVSS 8.8, Linux)
- [CVE-2026-72135](https://cve.now/CVE-2026-72135.md): tpm: Make the TPM character devices non-seekable (CVSS 7.8, Linux)
- [CVE-2026-72134](https://cve.now/CVE-2026-72134.md): spi: imx: reconfigure for PIO when DMA cannot be started (CVSS 7.8, Linux)
- [CVE-2026-72133](https://cve.now/CVE-2026-72133.md): spi: uniphier: Fix completion initialization order before devm\_request\_irq() (CVSS 8.4, Linux)
- [CVE-2026-72132](https://cve.now/CVE-2026-72132.md): NFS: Charge unstable writes by request size, not folio size (no CVSS, Linux)
- [CVE-2026-72131](https://cve.now/CVE-2026-72131.md): nvme-apple: Prevent shared tags across queues on Apple A11 (no CVSS, Linux)
- [CVE-2026-72130](https://cve.now/CVE-2026-72130.md): nvmet-auth: reject short AUTH\_RECEIVE buffers (CVSS 9.8, Linux)
- [CVE-2026-72129](https://cve.now/CVE-2026-72129.md): nvmet-rdma: handle inline data with a nonzero offset (CVSS 9.8, Linux)
- [CVE-2026-72128](https://cve.now/CVE-2026-72128.md): nvmet: fix refcount leak in nvmet\_sq\_create() (no CVSS, Linux)
- [CVE-2026-72127](https://cve.now/CVE-2026-72127.md): netdev-genl: report NAPI thread PID in the caller's pid namespace (no CVSS, Linux)
- [CVE-2026-72126](https://cve.now/CVE-2026-72126.md): can: isotp: use unconditional synchronize\_rcu() in isotp\_release() (CVSS 7.8, Linux)
- [CVE-2026-72125](https://cve.now/CVE-2026-72125.md): can: isotp: fix use-after-free race with concurrent NETDEV\_UNREGISTER (CVSS 7.8, Linux)
- [CVE-2026-72124](https://cve.now/CVE-2026-72124.md): can: isotp: serialize TX state transitions under so-\>rx\_lock (CVSS 8.8, Linux)
- [CVE-2026-72123](https://cve.now/CVE-2026-72123.md): can: bcm: defer rx\_op deallocation to workqueue to fix thrtimer UAF (CVSS 7.8, Linux)
- [CVE-2026-72122](https://cve.now/CVE-2026-72122.md): can: bcm: fix lockless bound/ifindex race and silent RX\_SETUP failure (CVSS 7.3, Linux)
- [CVE-2026-72121](https://cve.now/CVE-2026-72121.md): can: bcm: add locking when updating filter and timer values (CVSS 8.8, Linux)
- [CVE-2026-72120](https://cve.now/CVE-2026-72120.md): can: bcm: add missing rcu list annotations and operations (CVSS 7.8, Linux)
- [CVE-2026-72119](https://cve.now/CVE-2026-72119.md): can: bcm: extend bcm\_tx\_lock usage for data and timer updates (CVSS 7.8, Linux)
- [CVE-2026-72118](https://cve.now/CVE-2026-72118.md): can: bcm: fix CAN frame rx/tx statistics (no CVSS, Linux)
- [CVE-2026-72117](https://cve.now/CVE-2026-72117.md): can: bcm: fix data race on rx\_stamp/rx\_ifindex in bcm\_rx\_handler() (no CVSS, Linux)
- [CVE-2026-72116](https://cve.now/CVE-2026-72116.md): can: bcm: fix stale rx/tx ops after device removal (CVSS 7.1, Linux)
- [CVE-2026-72115](https://cve.now/CVE-2026-72115.md): can: bcm: track a single source interface for ANYDEV timeout/throttle ops (CVSS 8.1, Linux)
- [CVE-2026-72114](https://cve.now/CVE-2026-72114.md): can: bcm: validate frame length in bcm\_rx\_setup() for RTR replies (CVSS 7.8, Linux)
- [CVE-2026-72113](https://cve.now/CVE-2026-72113.md): can: bcm: add missing device refcount for CAN filter removal (CVSS 7.8, Linux)
- [CVE-2026-72112](https://cve.now/CVE-2026-72112.md): io\_uring/bpf-ops: reject re-registration of an already-bound ops (CVSS 7.8, Linux)
- [CVE-2026-72111](https://cve.now/CVE-2026-72111.md): bpf: Reset register bounds before narrowing retval range in check\_mem\_access() (CVSS 8.8, Linux)
- [CVE-2026-72110](https://cve.now/CVE-2026-72110.md): bpf,fork: wipe -\>bpf\_storage before bailouts that access it (CVSS 7.8, Linux)
- [CVE-2026-72109](https://cve.now/CVE-2026-72109.md): net: sparx5: unregister blocking notifier on init failure (CVSS 7.8, Linux)
- [CVE-2026-72108](https://cve.now/CVE-2026-72108.md): dm thin metadata: fix metadata snapshot consistency on commit failure (CVSS 7.8, Linux)
- [CVE-2026-72107](https://cve.now/CVE-2026-72107.md): dm era: fix out-of-bounds memory access for non-zero start sector (CVSS 8.8, Linux)
- [CVE-2026-72106](https://cve.now/CVE-2026-72106.md): dm-ioctl: fix a possible overflow in list\_version\_get\_info (no CVSS, Linux)
- [CVE-2026-72105](https://cve.now/CVE-2026-72105.md): dm-log: fix a bitset\_size overflow on 32bit machines (CVSS 7.8, Linux)
- [CVE-2026-72104](https://cve.now/CVE-2026-72104.md): dm-pcache: reject option groups without values (no CVSS, Linux)
- [CVE-2026-72103](https://cve.now/CVE-2026-72103.md): dm: avoid leaking the caller's thread keyring via the table device file (CVSS 7.3, Linux)
- [CVE-2026-72102](https://cve.now/CVE-2026-72102.md): dm\_early\_create: fix freeing used table on dm\_resume failure (CVSS 7.8, Linux)
- [CVE-2026-72101](https://cve.now/CVE-2026-72101.md): dm-integrity: fix leaking uninitialized kernel memory (no CVSS, Linux)
- [CVE-2026-72100](https://cve.now/CVE-2026-72100.md): dm-integrity: fix a bug if the bio is out of limits (CVSS 8.8, Linux)
- [CVE-2026-72099](https://cve.now/CVE-2026-72099.md): dm-integrity: don't increment hash\_offset twice (CVSS 7.1, Linux)
- [CVE-2026-72098](https://cve.now/CVE-2026-72098.md): dm-verity: fix buffer overflow in FEC calculation (CVSS 9.8, Linux)
- [CVE-2026-72097](https://cve.now/CVE-2026-72097.md): dm-verity: fix a possible NULL pointer dereference (no CVSS, Linux)
- [CVE-2026-72096](https://cve.now/CVE-2026-72096.md): dm-verity: make error counter atomic (no CVSS, Linux)
- [CVE-2026-72095](https://cve.now/CVE-2026-72095.md): dma-fence: Make dma\_fence\_dedup\_array() robust against 0-count input (CVSS 7.8, Linux)
- [CVE-2026-72094](https://cve.now/CVE-2026-72094.md): dma-buf: dma-fence: Fix potential NULL pointer dereference (no CVSS, Linux)
- [CVE-2026-72093](https://cve.now/CVE-2026-72093.md): accel/amdxdna: Fix use-after-free in amdxdna\_gem\_dmabuf\_mmap() (CVSS 7.8, Linux)
- [CVE-2026-72092](https://cve.now/CVE-2026-72092.md): accel/amdxdna: reject command submission on devices without a submit op (no CVSS, Linux)
- [CVE-2026-72091](https://cve.now/CVE-2026-72091.md): accel/amdxdna: reject user command submission without a command BO (no CVSS, Linux)
- [CVE-2026-72090](https://cve.now/CVE-2026-72090.md): accel/amdxdna: Use caller client for debug BO sync (CVSS 7.8, Linux)
- [CVE-2026-72089](https://cve.now/CVE-2026-72089.md): accel/ivpu: Reject firmware log with size smaller than header (CVSS 7.1, Linux)
- [CVE-2026-72088](https://cve.now/CVE-2026-72088.md): scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path (no CVSS, Linux)
- [CVE-2026-72087](https://cve.now/CVE-2026-72087.md): scsi: lpfc: Fix memory leak in lpfc\_sli4\_driver\_resource\_setup() (no CVSS, Linux)
- [CVE-2026-72086](https://cve.now/CVE-2026-72086.md): scsi: xen: scsiback: Free the command tag on the TMR submit-failure path (no CVSS, Linux)
- [CVE-2026-72085](https://cve.now/CVE-2026-72085.md): scsi: xen: scsiback: Free unsubmitted command instead of double-putting it (CVSS 9.3, Linux)
- [CVE-2026-72084](https://cve.now/CVE-2026-72084.md): scsi: target: Bound PR-OUT TransportID parsing to the received buffer (CVSS 9.8, Linux)
- [CVE-2026-72083](https://cve.now/CVE-2026-72083.md): scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVSS 9.8, Linux)
- [CVE-2026-72082](https://cve.now/CVE-2026-72082.md): scsi: elx: efct: Fix refcount leak in efct\_hw\_io\_abort() (no CVSS, Linux)
- [CVE-2026-72081](https://cve.now/CVE-2026-72081.md): scsi: elx: efct: Fix I/O leak on unsupported additional CDB (no CVSS, Linux)
- [CVE-2026-72080](https://cve.now/CVE-2026-72080.md): fs/resctrl: Fix use-after-free during unmount (CVSS 7.8, Linux)
- [CVE-2026-72079](https://cve.now/CVE-2026-72079.md): Input: ims-pcu - fix use-after-free and double-free in disconnect (no CVSS, Linux)
- [CVE-2026-72078](https://cve.now/CVE-2026-72078.md): Input: ims-pcu - validate control endpoint type (no CVSS, Linux)
- [CVE-2026-72077](https://cve.now/CVE-2026-72077.md): Input: ims-pcu - fix firmware leak in async update (no CVSS, Linux)
- [CVE-2026-72076](https://cve.now/CVE-2026-72076.md): Input: ims-pcu - fix out-of-bounds read in ims\_pcu\_irq() debug logging (no CVSS, Linux)
- [CVE-2026-72075](https://cve.now/CVE-2026-72075.md): Input: ims-pcu - fix race condition in reset\_device sysfs callback (no CVSS, Linux)
- [CVE-2026-72074](https://cve.now/CVE-2026-72074.md): Input: ims-pcu - fix type confusion in CDC union descriptor parsing (no CVSS, Linux)
- [CVE-2026-72073](https://cve.now/CVE-2026-72073.md): mmc: vub300: fix use-after-free on probe failure (no CVSS, Linux)
- [CVE-2026-72072](https://cve.now/CVE-2026-72072.md): net/mlx5e: macsec: fix use-after-free of metadata\_dst on RX SC delete (CVSS 7.8, Linux)
- [CVE-2026-72071](https://cve.now/CVE-2026-72071.md): tracing/user\_events: Fix use-after-free in user\_event\_mm\_dup() (CVSS 7.8, Linux)
- [CVE-2026-72070](https://cve.now/CVE-2026-72070.md): wifi: libertas\_tf: fix use-after-free in lbtf\_free\_adapter() (no CVSS, Linux)
- [CVE-2026-72069](https://cve.now/CVE-2026-72069.md): locking/rt: Fix the incorrect RCU protection in rt\_spin\_unlock() (CVSS 9.8, Linux)
- [CVE-2026-72068](https://cve.now/CVE-2026-72068.md): posix-cpu-timers: Use u64 multiplication in update\_rlimit\_cpu() (no CVSS, Linux)
- [CVE-2026-72067](https://cve.now/CVE-2026-72067.md): cpu: hotplug: Preserve per instance callback errors (CVSS 7.8, Linux)
- [CVE-2026-72066](https://cve.now/CVE-2026-72066.md): cpu: hotplug: Bound hotplug states sysfs output (CVSS 7.8, Linux)
- [CVE-2026-72065](https://cve.now/CVE-2026-72065.md): net: mana: Validate the packet length reported by the NIC (CVSS 9.8, Linux)
- [CVE-2026-72064](https://cve.now/CVE-2026-72064.md): net: mana: Sync page pool RX frags for CPU (CVSS 9.8, Linux)
- [CVE-2026-72063](https://cve.now/CVE-2026-72063.md): gpio: tegra: do not call pinctrl for GPIO direction (no CVSS, Linux)
- [CVE-2026-72062](https://cve.now/CVE-2026-72062.md): gpio: mt7621: avoid corruption of shared interrupt trigger state (no CVSS, Linux)
- [CVE-2026-72061](https://cve.now/CVE-2026-72061.md): net: sit: require CAP\_NET\_ADMIN in the device netns for changelink (CVSS 8.8, Linux)
- [CVE-2026-72060](https://cve.now/CVE-2026-72060.md): net: ethernet: ti: icssg: guard PA stat lookups (no CVSS, Linux)
- [CVE-2026-72059](https://cve.now/CVE-2026-72059.md): net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (no CVSS, Linux)
- [CVE-2026-72058](https://cve.now/CVE-2026-72058.md): net: ixp4xx\_hss: fix duplicate HDLC netdev allocation (no CVSS, Linux)
- [CVE-2026-72057](https://cve.now/CVE-2026-72057.md): net/sched: act\_ct: preserve tc\_skb\_cb across defragmentation (CVSS 8.2, Linux)
- [CVE-2026-72056](https://cve.now/CVE-2026-72056.md): net: ena: clean up XDP TX queues when regular TX setup fails (no CVSS, Linux)
- [CVE-2026-72055](https://cve.now/CVE-2026-72055.md): net: ip6\_vti: require CAP\_NET\_ADMIN in the device netns for changelink (CVSS 8.8, Linux)
- [CVE-2026-72054](https://cve.now/CVE-2026-72054.md): net: ip\_vti: require CAP\_NET\_ADMIN in the device netns for changelink (CVSS 8.8, Linux)
- [CVE-2026-72053](https://cve.now/CVE-2026-72053.md): net: ipip: require CAP\_NET\_ADMIN in the device netns for changelink (CVSS 8.8, Linux)
- [CVE-2026-72052](https://cve.now/CVE-2026-72052.md): net: ip6\_gre: require CAP\_NET\_ADMIN in the device netns for changelink (CVSS 8.8, Linux)
- [CVE-2026-72051](https://cve.now/CVE-2026-72051.md): net: ip6\_tunnel: require CAP\_NET\_ADMIN in the device netns for changelink (CVSS 8.8, Linux)
- [CVE-2026-72050](https://cve.now/CVE-2026-72050.md): octeontx2-af: Free BPID bitmap on setup failure (no CVSS, Linux)
- [CVE-2026-72049](https://cve.now/CVE-2026-72049.md): ieee802154: admin-gate legacy LLSEC dump operations (CVSS 7.1, Linux)
- [CVE-2026-72048](https://cve.now/CVE-2026-72048.md): ieee802154: ca8210: fix cas\_ctl leak on spi\_async failure (no CVSS, Linux)
- [CVE-2026-72047](https://cve.now/CVE-2026-72047.md): ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (no CVSS, Linux)
- [CVE-2026-72046](https://cve.now/CVE-2026-72046.md): gve: fix header buffer corruption with header-split and HW-GRO (CVSS 9.8, Linux)
- [CVE-2026-72045](https://cve.now/CVE-2026-72045.md): octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (CVSS 8.8, Linux)
- [CVE-2026-72043](https://cve.now/CVE-2026-72043.md): LoongArch: Fix missing dirty page tracking in {pte,pmd}\_wrprotect() (CVSS 7.1, Linux)
- [CVE-2026-72042](https://cve.now/CVE-2026-72042.md): ipmi: Fix user refcount underflow in event delivery (CVSS 7.8, Linux)
- [CVE-2026-72041](https://cve.now/CVE-2026-72041.md): espintcp: use sk\_msg\_free\_partial to fix partial send (CVSS 9.8, Linux)
- [CVE-2026-72040](https://cve.now/CVE-2026-72040.md): ipmi: fix refcount leak in i\_ipmi\_request() (no CVSS, Linux)
- [CVE-2026-72039](https://cve.now/CVE-2026-72039.md): bnx2x: fix potential memory leak in bnx2x\_alloc\_mem\_bp() (no CVSS, Linux)
- [CVE-2026-72038](https://cve.now/CVE-2026-72038.md): net: liquidio: fix BAR resource leak on PF number failure (no CVSS, Linux)
- [CVE-2026-72037](https://cve.now/CVE-2026-72037.md): net: lan743x: Initialize eth\_syslock spinlock before use (no CVSS, Linux)
- [CVE-2026-72036](https://cve.now/CVE-2026-72036.md): net/sched: sch\_multiq: Replace direct dequeue call with peek and qdisc\_dequeue\_peeked (CVSS 7.8, Linux)
- [CVE-2026-72035](https://cve.now/CVE-2026-72035.md): net/sched: sch\_taprio: Replace direct dequeue call with peek and qdisc\_dequeue\_peeked (CVSS 8.2, Linux)
- [CVE-2026-72034](https://cve.now/CVE-2026-72034.md): fhandle: reject detached mounts in capable\_wrt\_mount() (CVSS 7.8, Linux)
- [CVE-2026-72033](https://cve.now/CVE-2026-72033.md): orangefs: keep the readdir entry size 64-bit in fill\_from\_part() (CVSS 9.8, Linux)
- [CVE-2026-72032](https://cve.now/CVE-2026-72032.md): net/mlx5: HWS, fix matcher leak on resize target setup failure (no CVSS, Linux)
- [CVE-2026-72031](https://cve.now/CVE-2026-72031.md): ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD (no CVSS, Linux)
- [CVE-2026-72030](https://cve.now/CVE-2026-72030.md): ata: libata-core: Reject an invalid concurrent positioning ranges count (no CVSS, Linux)
- [CVE-2026-72029](https://cve.now/CVE-2026-72029.md): net: wwan: iosm: bound device offsets in the MUX downlink decoder (CVSS 8.8, Linux)
- [CVE-2026-72028](https://cve.now/CVE-2026-72028.md): riscv: probes: save original sp in rethook trampoline (no CVSS, Linux)
- [CVE-2026-72027](https://cve.now/CVE-2026-72027.md): mm/compaction: handle free\_pages\_prepare() properly in compaction\_free() (CVSS 7.8, Linux)
- [CVE-2026-72026](https://cve.now/CVE-2026-72026.md): irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure (no CVSS, Linux)
- [CVE-2026-72025](https://cve.now/CVE-2026-72025.md): s390/monwriter: Reject buffer reuse with different data length (no CVSS, Linux)
- [CVE-2026-72024](https://cve.now/CVE-2026-72024.md): mac802154: remove interfaces with RCU list deletion (CVSS 7.8, Linux)
- [CVE-2026-72023](https://cve.now/CVE-2026-72023.md): octeontx2-pf: fix SQB pointer leak on init failure (no CVSS, Linux)
- [CVE-2026-72022](https://cve.now/CVE-2026-72022.md): llc: fix SAP refcount leak in llc\_ui\_autobind() (no CVSS, Linux)
- [CVE-2026-72021](https://cve.now/CVE-2026-72021.md): ipvs: use parsed transport offset in SCTP state lookup (CVSS 8.2, Linux)
- [CVE-2026-72020](https://cve.now/CVE-2026-72020.md): ipvs: reset full ip\_vs\_seq structs in ip\_vs\_conn\_new (CVSS 9.8, Linux)
- [CVE-2026-72019](https://cve.now/CVE-2026-72019.md): macsec: don't read an unset MAC header in macsec\_encrypt() (CVSS 7.3, Linux)
- [CVE-2026-72018](https://cve.now/CVE-2026-72018.md): dibs: loopback: validate offset and size in move\_data() (CVSS 7.8, Linux)
- [CVE-2026-72017](https://cve.now/CVE-2026-72017.md): net: macb: drop in-flight Tx SKBs on close (no CVSS, Linux)
- [CVE-2026-72016](https://cve.now/CVE-2026-72016.md): cpu/hotplug: Fix NULL kobject warning in cpuhp\_smt\_enable() (no CVSS, Linux)
- [CVE-2026-72015](https://cve.now/CVE-2026-72015.md): fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (no CVSS, Linux)
- [CVE-2026-72014](https://cve.now/CVE-2026-72014.md): drbd: reject data replies with an out-of-range payload size (CVSS 9.8, Linux)
- [CVE-2026-72013](https://cve.now/CVE-2026-72013.md): riscv: Prevent NULL pointer dereference in machine\_kexec\_prepare() (no CVSS, Linux)
- [CVE-2026-72012](https://cve.now/CVE-2026-72012.md): tracing/osnoise: Call synchronize\_rcu() when unregistering (CVSS 7.8, Linux)
- [CVE-2026-72011](https://cve.now/CVE-2026-72011.md): s390/diag: Add missing array\_index\_nospec() call to memtop\_get\_page\_count() (no CVSS, Linux)
- [CVE-2026-72010](https://cve.now/CVE-2026-72010.md): cgroup/cpuset: rebind mm mempolicy to effective\_mems, not mems\_allowed (no CVSS, Linux)
- [CVE-2026-72009](https://cve.now/CVE-2026-72009.md): pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI (CVSS 7.8, Linux)
- [CVE-2026-72008](https://cve.now/CVE-2026-72008.md): pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check (no CVSS, Linux)
- [CVE-2026-72007](https://cve.now/CVE-2026-72007.md): pmdomain: imx: Fix i.MX8MP VC8000E power up sequence (no CVSS, Linux)
- [CVE-2026-72006](https://cve.now/CVE-2026-72006.md): net/mlx5: free mlx5\_st\_idx\_data on final dealloc (no CVSS, Linux)
- [CVE-2026-72005](https://cve.now/CVE-2026-72005.md): wifi: rt2x00: avoid full teardown before work setup in probe (CVSS 7.8, Linux)
- [CVE-2026-72004](https://cve.now/CVE-2026-72004.md): wifi: mac80211: fix memory leak in ieee80211\_register\_hw() (no CVSS, Linux)
- [CVE-2026-72003](https://cve.now/CVE-2026-72003.md): wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (CVSS 8.8, Linux)
- [CVE-2026-68479](https://cve.now/CVE-2026-68479.md): Bluetooth: btrtl: validate firmware patch bounds (CVSS 7.8, Linux)
- [CVE-2026-68478](https://cve.now/CVE-2026-68478.md): memstick: ms\_block: reject a card that reports too many blocks (no CVSS, Linux)
- [CVE-2026-68477](https://cve.now/CVE-2026-68477.md): ipvs: fix more places with wrong ipv6 transport offsets (CVSS 9.8, Linux)
- [CVE-2026-68476](https://cve.now/CVE-2026-68476.md): ipvs: reload ip header after head reallocation (CVSS 9.8, Linux)
- [CVE-2026-68475](https://cve.now/CVE-2026-68475.md): reset: sunxi: fix memory region leak on ioremap failure (no CVSS, Linux)
- [CVE-2026-68474](https://cve.now/CVE-2026-68474.md): powerpc/spufs: fix out-of-bounds access in spufs\_mem\_mmap\_access() (CVSS 7.8, Linux)
- [CVE-2026-68473](https://cve.now/CVE-2026-68473.md): powerpc/uaccess: correct check for CONFIG\_PPC\_E500 in mask\_user\_address() (CVSS 7.8, Linux)
- [CVE-2026-68472](https://cve.now/CVE-2026-68472.md): wifi: cfg80211: validate EHT MLE before MLD ID read (CVSS 8.1, Linux)
- [CVE-2026-68471](https://cve.now/CVE-2026-68471.md): wifi: ieee80211: validate MLE common info length (CVSS 8.8, Linux)
- [CVE-2026-68470](https://cve.now/CVE-2026-68470.md): wifi: mac80211: validate extension-frame layout before RX (CVSS 8.8, Linux)
- [CVE-2026-68469](https://cve.now/CVE-2026-68469.md): wifi: mwifiex: fix permanently busy scans after multiple roam iterations (no CVSS, Linux)
- [CVE-2026-68468](https://cve.now/CVE-2026-68468.md): mtd: virt-concat: free duplicate generated name (no CVSS, Linux)
- [CVE-2026-68467](https://cve.now/CVE-2026-68467.md): mtd: mchp23k256: use SPI match data for chip caps (CVSS 7.8, Linux)
- [CVE-2026-68466](https://cve.now/CVE-2026-68466.md): mtd: rawnand: lpc32xx\_slc: fail DMA transfer on completion timeout (CVSS 8.8, Linux)
- [CVE-2026-68465](https://cve.now/CVE-2026-68465.md): mmc: sdhci-esdhc-imx: fix esdhc\_change\_pinstate() to allow default state restore (no CVSS, Linux)
- [CVE-2026-68464](https://cve.now/CVE-2026-68464.md): mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (no CVSS, Linux)
- [CVE-2026-68463](https://cve.now/CVE-2026-68463.md): mmc: sdhci-esdhc-imx: use pm\_runtime\_resume\_and\_get() in suspend (no CVSS, Linux)
- [CVE-2026-68462](https://cve.now/CVE-2026-68462.md): bpf: Reject negative const offsets for buffer pointers (CVSS 7.8, Linux)
- [CVE-2026-68461](https://cve.now/CVE-2026-68461.md): device property: initialize the remaining fields of fwnode\_handle in fwnode\_init() (CVSS 7.8, Linux)
- [CVE-2026-68460](https://cve.now/CVE-2026-68460.md): f2fs: fix potential deadlock in f2fs\_balance\_fs() (no CVSS, Linux)
- [CVE-2026-68459](https://cve.now/CVE-2026-68459.md): f2fs: fix potential deadlock in gc\_merge path of f2fs\_balance\_fs() (no CVSS, Linux)
- [CVE-2026-68458](https://cve.now/CVE-2026-68458.md): binder: cache secctx size before release zeroes it (CVSS 7.8, Linux)
- [CVE-2026-68457](https://cve.now/CVE-2026-68457.md): ksmbd: use opener credentials for FSCTL mutations (CVSS 9.1, Linux)
- [CVE-2026-68456](https://cve.now/CVE-2026-68456.md): usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() (no CVSS, Linux)
- [CVE-2026-68455](https://cve.now/CVE-2026-68455.md): liveupdate: validate session type before performing operation (no CVSS, Linux)
- [CVE-2026-16007](https://cve.now/CVE-2026-16007.md): Authenticated SQL Injection in AppFlowy (CVSS 7.1, AppFlowy-IO AppFlowy-Cloud)
- [CVE-2026-16145](https://cve.now/CVE-2026-16145.md): Invisible Anti-Spam & CAPTCHA \<= 5.1 - Unauthenticated Stored Cross-Site Scripting via 'action' Parameter (CVSS 7.2, matthiasnordwig Invisible Anti-Spam & CAPTCHA — reCAPTCHA A…)
- [CVE-2026-13360](https://cve.now/CVE-2026-13360.md): Cookie Banner for GDPR / CCPA \<= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter (CVSS 7.2, wplegalpages WPLP Cookie Consent – Cookie Banner & Consent…)
- [CVE-2026-16146](https://cve.now/CVE-2026-16146.md): Invisible Anti-Spam & CAPTCHA \<= 5.1 - Authenticated (Editor+) SQL Injection via Pattern JSON Keys/Values (CVSS 4.9, matthiasnordwig Invisible Anti-Spam & CAPTCHA — reCAPTCHA A…)
- [CVE-2026-15948](https://cve.now/CVE-2026-15948.md): Hydra Booking \<= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first\_name' Parameter (CVSS 6.4, themefic Hydra Booking — Appointment Scheduling & Booking C…)
- [CVE-2026-15453](https://cve.now/CVE-2026-15453.md): KiviCare \<= 4.5.1 - Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter (CVSS 6.5, iqonicdesign KiviCare – Clinic & Patient Management System)
- [CVE-2026-16094](https://cve.now/CVE-2026-16094.md): Invisible Anti-Spam & CAPTCHA \<= 5.1 - Authenticated (Editor+) SQL Injection via 'key' Parameter (CVSS 4.9, matthiasnordwig Invisible Anti-Spam & CAPTCHA — reCAPTCHA A…)
- [CVE-2026-16586](https://cve.now/CVE-2026-16586.md): Contest Gallery \<= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg\_multiple\_files\_for\_post' -\> 'cgRealId' (CVSS 6.5, contest-gallery Contest Gallery – Upload & Vote Photos, Med…)
- [CVE-2026-15993](https://cve.now/CVE-2026-15993.md): Form Maker by 10Web \<= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause (CVSS 5.3, Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…)
- [CVE-2026-17090](https://cve.now/CVE-2026-17090.md): Beaver Builder Page Builder \<= 2.10.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter (CVSS 6.4, beaverbuilder Beaver Builder Page Builder – Drag and Drop W…)
- [CVE-2026-18387](https://cve.now/CVE-2026-18387.md): Groundhogg \<= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag\_query' Parameter (CVSS 6.5, trainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…)
- [CVE-2026-12128](https://cve.now/CVE-2026-12128.md): Pinpoint Booking System \<= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart\_data' Parameter (CVSS 5.3, dotonpaper Pinpoint Booking System –)
- [CVE-2026-15341](https://cve.now/CVE-2026-15341.md): User Session Synchronizer \<= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters (CVSS 9.8, rafasashi User Session Synchronizer)
- [CVE-2026-15001](https://cve.now/CVE-2026-15001.md): bLoyal: Loyalty & Promotions by bLoyal \<= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings (CVSS 8.8, connectordev bLoyal: Loyalty & Promotions by bLoyal)
- [CVE-2026-15303](https://cve.now/CVE-2026-15303.md): 6Storage Rentals \<= 2.27.0 - Unauthenticated Account Takeover via 'email' Parameter (CVSS 9.8, sixstorage 6Storage Rentals)
- [CVE-2026-8840](https://cve.now/CVE-2026-8840.md): Booking calendar, Appointment Booking System \<= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart\_payment AJAX Action (CVSS 5.3, wpdevart Booking calendar, Appointment Booking System)
- [CVE-2026-15162](https://cve.now/CVE-2026-15162.md): Object Sync for Salesforce \<= 2.2.13 - Unauthenticated SQL Injection (CVSS 7.5, minnpost Object Sync for Salesforce)
- [CVE-2026-15965](https://cve.now/CVE-2026-15965.md): MaxUpload \<= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter (CVSS 8.8, sadathimel MaxUpload – Big File Uploads – Increase Maximum…)
- [CVE-2026-15312](https://cve.now/CVE-2026-15312.md): Propovoice: All-in-One Client Management System \<= 1.7.8 - Authenticated (ndpv\_manager+) Privilege Escalation via 'role' Parameter (CVSS 8.8, fassionstorage Propovoice: All-in-One Client Management Sys…)
- [CVE-2026-14484](https://cve.now/CVE-2026-14484.md): RapiSafe \<= 1.0.4 - Unauthenticated Arbitrary File Deletion via 'rsmfcf7\_session' and 'file\_name' Parameters (CVSS 9.1, pietror91 RapiSafe – Secure Multi File Upload for Contact F…)
- [CVE-2026-16080](https://cve.now/CVE-2026-16080.md): Image Uploader for Welcart \<= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post\_title' Parameter (CVSS 6.5, fishpie Image Uploader for Welcart)
- [CVE-2026-14433](https://cve.now/CVE-2026-14433.md): Online Booking & Scheduling Calendar for WordPress by vcita \<= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business\_id' Parameter (CVSS 7.2, Online Booking & Scheduling Calendar by vcita)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-08-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.