Linux kernel vulnerabilities
The newest vulnerabilities affecting Linux kernel, up to 200. Subscribe by RSS.
- CVE-2026-99216Drivers: hv: Don't reset VMBus connection state on error/exit pathsLinux
- CVE-2026-99215power: supply: core: prevent unregistering a power supply while a callback runsLinux
- CVE-2026-99214drm/vc4: hdmi: Move packet RAM enable to PM runtimeLinux
- CVE-2026-99213vsock: treat TCP_CLOSING as once-establishedLinux
- CVE-2026-99212net/rds: don't let the rdma_cm destroy an id RDS still owns on route failureLinux
- CVE-2026-99211netlink: reset skb headers before unicast and multicast filteringLinux
- CVE-2026-99210accel/rocket: clear rdev on device init failureLinux
- CVE-2026-99209drm/xe: skip eviction of a BO with no resourceLinux
- CVE-2026-99208drm/xe/oa: Zero OA buffer at allocationLinux
- CVE-2026-99207scsi: target: Disable interrupts while holding delayed_cmd_lockLinux
- CVE-2026-99206scsi: target: iscsi: Fix race in discovery auth updatesLinux
- CVE-2026-99205sched/core: Call wakeup_preempt() for queued tasks during class changeLinux
- CVE-2026-99204ocfs2/dlm: Protect the recovery list during debugfs readsLinux
- CVE-2026-99203pipe: preserve existing fasync readers on writer setup failureLinux
- CVE-2026-99202scsi: libsas: Fix SMP IO deadlock during HA resumeLinux
- CVE-2026-99201netlink: avoid hashing the network namespace pointerLinux
- CVE-2026-99200net: hisilicon: hisi_femac: Move setting of netops to fix crashLinux
- CVE-2026-99199net: hisilicon: hip04_eth: Move setting of netops to fix crashLinux
- CVE-2026-99198net: ethernet: actions: Move setting of netops to fix crashLinux
- CVE-2026-99197net: mv643xx: move setting of netops to fix crashLinux
- CVE-2026-99196net: au1000: move setting of netops to fix crashLinux
- CVE-2026-99195net: ethoc: move setting of netops to fix crashLinux
- CVE-2026-99194net: ethernet: aeroflex: move setting of netops to fix crashLinux
- CVE-2026-99193net: ti: icssm-prueth: Move setting of netops to fix crashLinux
- CVE-2026-99192net: bcmgenet: unshare the skb before writing the control blockLinux
- CVE-2026-99191calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()Linux
- CVE-2026-99190gpiolib: fix memory leak in gpiod_set_array_value_complex() on error pathsLinux
- CVE-2026-99189gpio: mxc: fix race between chained IRQ handler install and probe completionLinux
- CVE-2026-99188net: stmmac: dwmac1000: clear the RGMII status interruptLinux
- CVE-2026-99187perf: Fix perf_pmu_migrate_context() leaving events behindLinux
- CVE-2026-99186x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()Linux
- CVE-2026-99185firewire: core: fix race condition in split transaction handlingLinux
- CVE-2026-99184accel/rocket: search every core slot when a core is removedLinux
- CVE-2026-99183accel/rocket: search every core slot when looking up a schedulerLinux
- CVE-2026-99182ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH captureLinux
- CVE-2026-99181autofs: ignore notification errors from a replaced pipeLinux
- CVE-2026-99180unicode: free the map after a grace periodLinux
- CVE-2026-99179watch_queue: Fix note pool publication race in watch_queue_set_size()Linux
- CVE-2026-99178x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI contextLinux
- CVE-2026-99177KVM: SEV: Fix page dirtying in sev_gmem_post_populate()Linux
- CVE-2026-99176KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-EntryLinux
- CVE-2026-99175fsnotify: prevent mark additions during connector teardownLinux
- CVE-2026-99174ext4: free the sbi after a grace periodLinux
- CVE-2026-99173eventfs: Free the eventfs_inode after an rcu grace period tooLinux
- CVE-2026-99172ipc: drop the mqueue mount with kern_unmount() on setup failureLinux
- CVE-2026-99171ntfs3: free the sbi after a grace periodLinux
- CVE-2026-99170namespace: a mount that copy_tree() leaves out can't take over a lockLinux
- CVE-2026-99169futex: Fix mm reuse handling for FUT_OFF_MMSHAREDLinux
- CVE-2026-99168mshv_vtl: Check per-CPU register page before mmapLinux
- CVE-2026-99167net/sched: fix use-after-free in __tcf_action_put()Linux
- CVE-2026-99166net: rds: fix uninitialized trans dereference in CM event handlerLinux
- CVE-2026-99165sctp: revalidate output stream after association connect waitLinux
- CVE-2026-99164spi: imx: fix slab corruption from undersized DMA bounce buffersLinux
- CVE-2026-99163tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fieldsLinux
- CVE-2026-99162gpio: shared: fix use-after-free bug when adding shared proxiesLinux
- CVE-2026-99161i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()Linux
- CVE-2026-99160ring-buffer: Do not show buffer_meta for CPUs without a bufferLinux
- CVE-2026-99159ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()Linux
- CVE-2026-99158ring-buffer: Fix false warning in ring_buffer_map_get_reader()Linux
- CVE-2026-99157scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB repliesLinux
- CVE-2026-99156scsi: st: Fix use-after-free race between st_remove() and st_open()Linux
- CVE-2026-99155scsi: xen/scsifront: Check for a NULL shadow entry on a backend responseLinux
- CVE-2026-99154scsi: libiscsi: Reject a negative task index from parse_pdu_ittLinux
- CVE-2026-99153scsi: libiscsi: Validate the ITT reflected in a Reject PDULinux
- CVE-2026-99152scsi: libiscsi: Validate the task named by a management responseLinux
- CVE-2026-99151drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functionsLinux
- CVE-2026-99150drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gprLinux
- CVE-2026-99149drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctlLinux
- CVE-2026-99148drm/amdgpu: keep the eviction fence until the last handle is closedLinux
- CVE-2026-99147drm/exec: don't immediately add prelocked obj to array of locked objsLinux
- CVE-2026-99146drm/i915/dmc: Add sanity check for DMC load addressLinux
- CVE-2026-99145drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state changeLinux
- CVE-2026-99144sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueueLinux
- CVE-2026-99143tracing: Keep the predicate limit separate from program capacityLinux
- CVE-2026-99142tracing: Check operator stack capacity before pushingLinux
- CVE-2026-99141tracing: Fix crash in print_graph_function_event()Linux
- CVE-2026-99140tracing: Fix hist trigger timestamps for buffered eventsLinux
- CVE-2026-99139tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)Linux
- CVE-2026-99138tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)Linux
- CVE-2026-99137cifs: don't update i_size in cifs_do_truncate without a cached handleLinux
- CVE-2026-99136dm-crypt: fix a tiny race condition in crypt_dec_pendingLinux
- CVE-2026-99135dm-integrity: fix infinite loop on discard with large tag sizeLinux
- CVE-2026-99134mac802154: fix data race and NULL deref on local->assoc_devLinux
- CVE-2026-99133net/iucv: fix the recvmsg window updateLinux
- CVE-2026-99132xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_bufLinux
- CVE-2026-99131xfs: fix capability check in xfsLinux
- CVE-2026-99130io_uring/cancel: don't spin on local work the task can't runLinux
- CVE-2026-99129selinux: fix BPF token permission checksLinux
- CVE-2026-99128sctp: validate chunk length in the inqueue parserLinux
- CVE-2026-99127page_pool: keep frag_offset aligned for odd-sized requestsLinux
- CVE-2026-99126s390/ctcm: Prevent XID null dereferenceLinux
- CVE-2026-99125s390/pai: Handle multiple PMU stop callback invocationsLinux
- CVE-2026-99124s390/pci: Fix leak of uninitialized kernel data in SCLP reportLinux
- CVE-2026-99123vsock/virtio: validate packet source for connected socketsLinux
- CVE-2026-99122vsock/vmci: validate packet source for connected socketsLinux
- CVE-2026-99121ipv4: avoid divide by zero in fib_rebalanceLinux
- CVE-2026-99120KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codesLinux
- CVE-2026-99119drm/amdgpu/userq: actually validate userq BOsLinux
- CVE-2026-99118drm/i915/dmc: Harden DMC firmware payload parsingLinux
- CVE-2026-99117net: bridge: mcast: don't truncate the port group walk on teardownLinux
- CVE-2026-99116net: psp: do not inherit the Rx association on cloneLinux
- CVE-2026-99115ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATIONLinux
- CVE-2026-99114ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATIONLinux
- CVE-2026-99113ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it inLinux
- CVE-2026-99112net/sched: cls_flower: validate mask pointer after nla_next()Linux
- CVE-2026-99111smb: client: fix data corruption with concurrent writes and O_TRUNCLinux
- CVE-2026-99110smb: client: fix heap overflow in cifs_do_set_acl()Linux
- CVE-2026-99109smb: client: reject SetEA requests that do not fit the request bufferLinux
- CVE-2026-99108ntfs: fix FITRIM range alignmentLinux
- CVE-2026-99107ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resizeLinux
- CVE-2026-99106drm/amdgpu: free the userptr ranges when a CS fails after parser_bosLinux
- CVE-2026-99105sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQLinux
- CVE-2026-99104sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestorLinux
- CVE-2026-99103workqueue: Fix unbound pool lifetime for pending pwqsLinux
- CVE-2026-99102ntfs: take invalidate_lock in ntfs_setattr_size()Linux
- CVE-2026-99101ntfs: move attribute payload before shrinking its recordLinux
- CVE-2026-99100wifi: p54: validate firmware record lengthsLinux
- CVE-2026-99099x86/CPU/AMD: Fix AMD TLBI Erratum #1718Linux
- CVE-2026-99098dm-integrity: fix buffer overflow in inline mode with large tag sizeLinux
- CVE-2026-99097tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()Linux
- CVE-2026-99096io_uring/register: don't exempt disabled rings from task restrictionsLinux
- CVE-2026-99095drm/vc4: drain the hangcheck timer and works on V3D unbindLinux
- CVE-2026-99094Bluetooth: btintel_pcie: fix TX descriptor bounds checkLinux
- CVE-2026-99093mm: don't schedule deferred kernel page table freeing while bootingLinux
- CVE-2026-99092riscv: patch: fix handling of bpf-jit execmem addressesLinux
- CVE-2026-99091Bluetooth: MGMT: Fix status of pending commands flushed on power offLinux
- CVE-2026-99090drm/amdgpu: serialize vblank counter reads against GPU resetLinux
- CVE-2026-99089ASoC: samsung: i2s: enable op_clk in probe to balance runtime PMLinux
- CVE-2026-99088net: openvswitch: validate transport header presence in set_ipv6_addrLinux
- CVE-2026-99018riscv: entry: gate shadow call stack reload on sstatus.SPP, not tpLinux
- CVE-2026-99014Bluetooth: hci_sync: Fix command skb lifetime during scan setupLinux
- CVE-2026-99011Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()Linux
- CVE-2026-98999drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpinLinux
- CVE-2026-98995namespace: reset the old parent's ->overmount in mnt_change_mountpoint()Linux
- CVE-2026-98993namespace: don't inherit MNT_UMOUNT in clone_mnt()Linux
- CVE-2026-98988namespace: keep covered mounts covered in OPEN_TREE_NAMESPACELinux
- CVE-2026-98982namespace: don't let a pseudo dentry become the root of a mountLinux
- CVE-2026-98981namespace: unhash a dentry before detaching the mounts on itLinux
- CVE-2026-98980namei: don't reveal overmounted entries in refwalkLinux
- CVE-2026-98978namespace: never expire a locked mountLinux
- CVE-2026-98976namespace: keep the lock on a mount that a propagated copy is moved beneathLinux
- CVE-2026-98975xfs: stop exchanging reflink flags when exchanging mappingsLinux
- CVE-2026-98974xfs: fix exchange-range-to-eof file size exchangeLinux
- CVE-2026-98968amt: send the relay's General Query directly from the receive pathLinux
- CVE-2026-98965ice: Restore Ordered MMIO Writes for Tx DoorbellsLinux
- CVE-2026-98964nvmet: use the local P2P device on metadata allocation failureLinux
- CVE-2026-98959btrfs: fix xattr replace when multiple xattrs are packed in the same itemLinux
- CVE-2026-98952pfcp: make sure the SEID is linear before reading itLinux
- CVE-2026-98945HID: steam: Rearrange teardown sequenceLinux
- CVE-2026-98944HID: steam: Refactor registrationLinux
- CVE-2026-98941ext4: don't enable large folios on encrypted inodesLinux
- CVE-2026-98932EDAC/altera: Fix use-after-free in error pathsLinux
- CVE-2026-98927KVM: arm64: nv: Fix life cycle of the nested_mmus arrayLinux
- CVE-2026-98911dpaa2-switch: fix the error path in dpaa2_switch_rx()Linux
- CVE-2026-98899netfilter: ipset: mark the rcu locked areas properlyLinux
- CVE-2026-98895net/mlx5: HWS, Handle destroying table that has a miss tableLinux
- CVE-2026-98889wifi: iwlwifi: mvm: fix sched scan IE sizingLinux
- CVE-2026-98870ksmbd: remove stale channels from all sessions on teardownLinux
- CVE-2023-7356Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUIDLinux
- CVE-2026-98869bpf: Infer zext_dst based on static register liveness analysisLinux
- CVE-2026-98555llc: fix skb UAF and leaks on llc_mac_hdr_init() failureLinux
- CVE-2026-98550tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflowLinux
- CVE-2026-98548sctp: discard the rest of the packet on a stale-cookie errorLinux
- CVE-2026-98543bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdirLinux
- CVE-2026-98532ipv6: do not let ipv6_find_hdr() return an offset past the packet endLinux
- CVE-2026-98524rds: ib: Clear the sg list when mapping an MR failsLinux
- CVE-2026-98520drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mappingLinux
- CVE-2026-98518drm/nouveau/dmem: pin VRAM for the whole registered rangeLinux
- CVE-2026-98515drm/nouveau: fix double-free in nvif_vmm_dtorLinux
- CVE-2026-98512drm/nouveau: RCU-free the scheduler-containing nouveau_schedLinux
- CVE-2026-98510drm/xe/vm: nuke PTs only after unlinking contested VMAsLinux
- CVE-2026-98501HID: alps: fix use-after-free on input2 registration failureLinux
- CVE-2026-98499HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()Linux
- CVE-2026-98497net/mlx5e: fix swapped IPv6 IPsec policy masksLinux
- CVE-2026-98491net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entryLinux
- CVE-2026-98487net: bridge: mdb: restart port group walk after deletionLinux
- CVE-2026-98485netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds readLinux
- CVE-2026-98479scsi: libiscsi_tcp: Check the data direction of a Data-In PDULinux
- CVE-2026-98471KVM: SEV: Do cache maintenance on the source VM during intra-host migrationLinux
- CVE-2026-98469KVM: arm64: Fix AArch32 DBGBXVR<n> handlingLinux
- CVE-2026-98466KVM: arm64: Transfer the hyp stack pages out of the host stage-2Linux
- CVE-2026-98464RISC-V: KVM: Synchronize hrtimer callback during teardownLinux
- CVE-2026-98456Bluetooth: mgmt: fix race in read_unconf_index_list()Linux
- CVE-2026-98454smb: client: fix create context out-of-bounds readsLinux
- CVE-2026-98440KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destructionLinux
- CVE-2026-98436accel/amdxdna: Disable device buffer exportingLinux
- CVE-2026-98432ipv4: free inet_opt and ireq_opt after an RCU grace periodLinux
- CVE-2026-98419drop_monitor: fix out-of-bounds write in reset_per_cpu_data()Linux
- CVE-2026-98405smb: client: fix missing iov bounds check in parse_posix_sids()Linux
- CVE-2026-98401net: iptunnel: fix stale transport header during tunnel decapsulationLinux
- CVE-2026-98385sched/cache: Decouple sched_cache_group from mm to fix UAFLinux
- CVE-2026-98383bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCALLinux
- CVE-2026-98382bpf: Reject dev-bound-only programs on other devicesLinux
- CVE-2026-98381veth: manage XDP program pointers during channel resizeLinux
- CVE-2026-98378bpf: Skip unsettled links in link iteratorLinux
- CVE-2026-98376bpf: Use array_map_meta_equal for percpu array inner map replacementLinux
- CVE-2026-98374tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()Linux
- CVE-2026-98260exec: Cleanup POSIX timers right after de_thread()Linux
- CVE-2026-97555smb: client: fix heap overflow in DACL owner/group rewriteLinux
- CVE-2026-46300net: skbuff: preserve shared-frag marker during coalescingLinux