# cve.now: Linux kernel

The newest entries affecting Linux kernel (up to 200). Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-99216](https://cve.now/CVE-2026-99216.md): Drivers: hv: Don't reset VMBus connection state on error/exit paths (no CVSS, Linux)
- [CVE-2026-99215](https://cve.now/CVE-2026-99215.md): power: supply: core: prevent unregistering a power supply while a callback runs (no CVSS, Linux)
- [CVE-2026-99214](https://cve.now/CVE-2026-99214.md): drm/vc4: hdmi: Move packet RAM enable to PM runtime (no CVSS, Linux)
- [CVE-2026-99213](https://cve.now/CVE-2026-99213.md): vsock: treat TCP\_CLOSING as once-established (no CVSS, Linux)
- [CVE-2026-99212](https://cve.now/CVE-2026-99212.md): net/rds: don't let the rdma\_cm destroy an id RDS still owns on route failure (no CVSS, Linux)
- [CVE-2026-99211](https://cve.now/CVE-2026-99211.md): netlink: reset skb headers before unicast and multicast filtering (no CVSS, Linux)
- [CVE-2026-99210](https://cve.now/CVE-2026-99210.md): accel/rocket: clear rdev on device init failure (no CVSS, Linux)
- [CVE-2026-99209](https://cve.now/CVE-2026-99209.md): drm/xe: skip eviction of a BO with no resource (no CVSS, Linux)
- [CVE-2026-99208](https://cve.now/CVE-2026-99208.md): drm/xe/oa: Zero OA buffer at allocation (no CVSS, Linux)
- [CVE-2026-99207](https://cve.now/CVE-2026-99207.md): scsi: target: Disable interrupts while holding delayed\_cmd\_lock (no CVSS, Linux)
- [CVE-2026-99206](https://cve.now/CVE-2026-99206.md): scsi: target: iscsi: Fix race in discovery auth updates (no CVSS, Linux)
- [CVE-2026-99205](https://cve.now/CVE-2026-99205.md): sched/core: Call wakeup\_preempt() for queued tasks during class change (no CVSS, Linux)
- [CVE-2026-99204](https://cve.now/CVE-2026-99204.md): ocfs2/dlm: Protect the recovery list during debugfs reads (no CVSS, Linux)
- [CVE-2026-99203](https://cve.now/CVE-2026-99203.md): pipe: preserve existing fasync readers on writer setup failure (no CVSS, Linux)
- [CVE-2026-99202](https://cve.now/CVE-2026-99202.md): scsi: libsas: Fix SMP IO deadlock during HA resume (no CVSS, Linux)
- [CVE-2026-99201](https://cve.now/CVE-2026-99201.md): netlink: avoid hashing the network namespace pointer (no CVSS, Linux)
- [CVE-2026-99200](https://cve.now/CVE-2026-99200.md): net: hisilicon: hisi\_femac: Move setting of netops to fix crash (no CVSS, Linux)
- [CVE-2026-99199](https://cve.now/CVE-2026-99199.md): net: hisilicon: hip04\_eth: Move setting of netops to fix crash (no CVSS, Linux)
- [CVE-2026-99198](https://cve.now/CVE-2026-99198.md): net: ethernet: actions: Move setting of netops to fix crash (no CVSS, Linux)
- [CVE-2026-99197](https://cve.now/CVE-2026-99197.md): net: mv643xx: move setting of netops to fix crash (no CVSS, Linux)
- [CVE-2026-99196](https://cve.now/CVE-2026-99196.md): net: au1000: move setting of netops to fix crash (no CVSS, Linux)
- [CVE-2026-99195](https://cve.now/CVE-2026-99195.md): net: ethoc: move setting of netops to fix crash (no CVSS, Linux)
- [CVE-2026-99194](https://cve.now/CVE-2026-99194.md): net: ethernet: aeroflex: move setting of netops to fix crash (no CVSS, Linux)
- [CVE-2026-99193](https://cve.now/CVE-2026-99193.md): net: ti: icssm-prueth: Move setting of netops to fix crash (no CVSS, Linux)
- [CVE-2026-99192](https://cve.now/CVE-2026-99192.md): net: bcmgenet: unshare the skb before writing the control block (no CVSS, Linux)
- [CVE-2026-99191](https://cve.now/CVE-2026-99191.md): calipso: keep BIG TCP payload\_len in calipso\_skbuff\_setattr() (no CVSS, Linux)
- [CVE-2026-99190](https://cve.now/CVE-2026-99190.md): gpiolib: fix memory leak in gpiod\_set\_array\_value\_complex() on error paths (no CVSS, Linux)
- [CVE-2026-99189](https://cve.now/CVE-2026-99189.md): gpio: mxc: fix race between chained IRQ handler install and probe completion (no CVSS, Linux)
- [CVE-2026-99188](https://cve.now/CVE-2026-99188.md): net: stmmac: dwmac1000: clear the RGMII status interrupt (no CVSS, Linux)
- [CVE-2026-99187](https://cve.now/CVE-2026-99187.md): perf: Fix perf\_pmu\_migrate\_context() leaving events behind (no CVSS, Linux)
- [CVE-2026-99186](https://cve.now/CVE-2026-99186.md): x86/insn-eval: Fix shadowed segment index in get\_seg\_reg\_override\_idx() (no CVSS, Linux)
- [CVE-2026-99185](https://cve.now/CVE-2026-99185.md): firewire: core: fix race condition in split transaction handling (no CVSS, Linux)
- [CVE-2026-99184](https://cve.now/CVE-2026-99184.md): accel/rocket: search every core slot when a core is removed (no CVSS, Linux)
- [CVE-2026-99183](https://cve.now/CVE-2026-99183.md): accel/rocket: search every core slot when looking up a scheduler (no CVSS, Linux)
- [CVE-2026-99182](https://cve.now/CVE-2026-99182.md): ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture (no CVSS, Linux)
- [CVE-2026-99181](https://cve.now/CVE-2026-99181.md): autofs: ignore notification errors from a replaced pipe (no CVSS, Linux)
- [CVE-2026-99180](https://cve.now/CVE-2026-99180.md): unicode: free the map after a grace period (no CVSS, Linux)
- [CVE-2026-99179](https://cve.now/CVE-2026-99179.md): watch\_queue: Fix note pool publication race in watch\_queue\_set\_size() (no CVSS, Linux)
- [CVE-2026-99178](https://cve.now/CVE-2026-99178.md): x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context (no CVSS, Linux)
- [CVE-2026-99177](https://cve.now/CVE-2026-99177.md): KVM: SEV: Fix page dirtying in sev\_gmem\_post\_populate() (no CVSS, Linux)
- [CVE-2026-99176](https://cve.now/CVE-2026-99176.md): KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry (no CVSS, Linux)
- [CVE-2026-99175](https://cve.now/CVE-2026-99175.md): fsnotify: prevent mark additions during connector teardown (no CVSS, Linux)
- [CVE-2026-99174](https://cve.now/CVE-2026-99174.md): ext4: free the sbi after a grace period (no CVSS, Linux)
- [CVE-2026-99173](https://cve.now/CVE-2026-99173.md): eventfs: Free the eventfs\_inode after an rcu grace period too (no CVSS, Linux)
- [CVE-2026-99172](https://cve.now/CVE-2026-99172.md): ipc: drop the mqueue mount with kern\_unmount() on setup failure (no CVSS, Linux)
- [CVE-2026-99171](https://cve.now/CVE-2026-99171.md): ntfs3: free the sbi after a grace period (no CVSS, Linux)
- [CVE-2026-99170](https://cve.now/CVE-2026-99170.md): namespace: a mount that copy\_tree() leaves out can't take over a lock (no CVSS, Linux)
- [CVE-2026-99169](https://cve.now/CVE-2026-99169.md): futex: Fix mm reuse handling for FUT\_OFF\_MMSHARED (no CVSS, Linux)
- [CVE-2026-99168](https://cve.now/CVE-2026-99168.md): mshv\_vtl: Check per-CPU register page before mmap (no CVSS, Linux)
- [CVE-2026-99167](https://cve.now/CVE-2026-99167.md): net/sched: fix use-after-free in \_\_tcf\_action\_put() (no CVSS, Linux)
- [CVE-2026-99166](https://cve.now/CVE-2026-99166.md): net: rds: fix uninitialized trans dereference in CM event handler (no CVSS, Linux)
- [CVE-2026-99165](https://cve.now/CVE-2026-99165.md): sctp: revalidate output stream after association connect wait (no CVSS, Linux)
- [CVE-2026-99164](https://cve.now/CVE-2026-99164.md): spi: imx: fix slab corruption from undersized DMA bounce buffers (no CVSS, Linux)
- [CVE-2026-99163](https://cve.now/CVE-2026-99163.md): tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields (no CVSS, Linux)
- [CVE-2026-99162](https://cve.now/CVE-2026-99162.md): gpio: shared: fix use-after-free bug when adding shared proxies (no CVSS, Linux)
- [CVE-2026-99161](https://cve.now/CVE-2026-99161.md): i2c: viai2c-wmt: Fix clock leak in wmt\_i2c\_probe() (no CVSS, Linux)
- [CVE-2026-99160](https://cve.now/CVE-2026-99160.md): ring-buffer: Do not show buffer\_meta for CPUs without a buffer (no CVSS, Linux)
- [CVE-2026-99159](https://cve.now/CVE-2026-99159.md): ring-buffer: Fix the sub-buffer array base in rb\_meta\_subbuf\_idx() (no CVSS, Linux)
- [CVE-2026-99158](https://cve.now/CVE-2026-99158.md): ring-buffer: Fix false warning in ring\_buffer\_map\_get\_reader() (no CVSS, Linux)
- [CVE-2026-99157](https://cve.now/CVE-2026-99157.md): scsi: bsg: Pass reply\_len to bsg\_setup\_queue() to fit UFS ARPMB replies (no CVSS, Linux)
- [CVE-2026-99156](https://cve.now/CVE-2026-99156.md): scsi: st: Fix use-after-free race between st\_remove() and st\_open() (no CVSS, Linux)
- [CVE-2026-99155](https://cve.now/CVE-2026-99155.md): scsi: xen/scsifront: Check for a NULL shadow entry on a backend response (no CVSS, Linux)
- [CVE-2026-99154](https://cve.now/CVE-2026-99154.md): scsi: libiscsi: Reject a negative task index from parse\_pdu\_itt (no CVSS, Linux)
- [CVE-2026-99153](https://cve.now/CVE-2026-99153.md): scsi: libiscsi: Validate the ITT reflected in a Reject PDU (no CVSS, Linux)
- [CVE-2026-99152](https://cve.now/CVE-2026-99152.md): scsi: libiscsi: Validate the task named by a management response (no CVSS, Linux)
- [CVE-2026-99151](https://cve.now/CVE-2026-99151.md): drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions (no CVSS, Linux)
- [CVE-2026-99150](https://cve.now/CVE-2026-99150.md): drm/amdgpu: don't drop the runtime PM reference twice in amdgpu\_gpr (no CVSS, Linux)
- [CVE-2026-99149](https://cve.now/CVE-2026-99149.md): drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl (no CVSS, Linux)
- [CVE-2026-99148](https://cve.now/CVE-2026-99148.md): drm/amdgpu: keep the eviction fence until the last handle is closed (no CVSS, Linux)
- [CVE-2026-99147](https://cve.now/CVE-2026-99147.md): drm/exec: don't immediately add prelocked obj to array of locked objs (no CVSS, Linux)
- [CVE-2026-99146](https://cve.now/CVE-2026-99146.md): drm/i915/dmc: Add sanity check for DMC load address (no CVSS, Linux)
- [CVE-2026-99145](https://cve.now/CVE-2026-99145.md): drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change (no CVSS, Linux)
- [CVE-2026-99144](https://cve.now/CVE-2026-99144.md): sched\_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue (no CVSS, Linux)
- [CVE-2026-99143](https://cve.now/CVE-2026-99143.md): tracing: Keep the predicate limit separate from program capacity (no CVSS, Linux)
- [CVE-2026-99142](https://cve.now/CVE-2026-99142.md): tracing: Check operator stack capacity before pushing (no CVSS, Linux)
- [CVE-2026-99141](https://cve.now/CVE-2026-99141.md): tracing: Fix crash in print\_graph\_function\_event() (no CVSS, Linux)
- [CVE-2026-99140](https://cve.now/CVE-2026-99140.md): tracing: Fix hist trigger timestamps for buffered events (no CVSS, Linux)
- [CVE-2026-99139](https://cve.now/CVE-2026-99139.md): tcp: fix use-after-free in do\_tcp\_getsockopt(TCP\_CONGESTION) (no CVSS, Linux)
- [CVE-2026-99138](https://cve.now/CVE-2026-99138.md): tcp: fix use-after-free in do\_tcp\_getsockopt(TCP\_CC\_INFO) (no CVSS, Linux)
- [CVE-2026-99137](https://cve.now/CVE-2026-99137.md): cifs: don't update i\_size in cifs\_do\_truncate without a cached handle (no CVSS, Linux)
- [CVE-2026-99136](https://cve.now/CVE-2026-99136.md): dm-crypt: fix a tiny race condition in crypt\_dec\_pending (no CVSS, Linux)
- [CVE-2026-99135](https://cve.now/CVE-2026-99135.md): dm-integrity: fix infinite loop on discard with large tag size (no CVSS, Linux)
- [CVE-2026-99134](https://cve.now/CVE-2026-99134.md): mac802154: fix data race and NULL deref on local-\>assoc\_dev (no CVSS, Linux)
- [CVE-2026-99133](https://cve.now/CVE-2026-99133.md): net/iucv: fix the recvmsg window update (no CVSS, Linux)
- [CVE-2026-99132](https://cve.now/CVE-2026-99132.md): xfs: don't hold buffer locks across sync transaction commit in xfs\_sync\_sb\_buf (no CVSS, Linux)
- [CVE-2026-99131](https://cve.now/CVE-2026-99131.md): xfs: fix capability check in xfs (no CVSS, Linux)
- [CVE-2026-99130](https://cve.now/CVE-2026-99130.md): io\_uring/cancel: don't spin on local work the task can't run (no CVSS, Linux)
- [CVE-2026-99129](https://cve.now/CVE-2026-99129.md): selinux: fix BPF token permission checks (no CVSS, Linux)
- [CVE-2026-99128](https://cve.now/CVE-2026-99128.md): sctp: validate chunk length in the inqueue parser (no CVSS, Linux)
- [CVE-2026-99127](https://cve.now/CVE-2026-99127.md): page\_pool: keep frag\_offset aligned for odd-sized requests (no CVSS, Linux)
- [CVE-2026-99126](https://cve.now/CVE-2026-99126.md): s390/ctcm: Prevent XID null dereference (no CVSS, Linux)
- [CVE-2026-99125](https://cve.now/CVE-2026-99125.md): s390/pai: Handle multiple PMU stop callback invocations (no CVSS, Linux)
- [CVE-2026-99124](https://cve.now/CVE-2026-99124.md): s390/pci: Fix leak of uninitialized kernel data in SCLP report (no CVSS, Linux)
- [CVE-2026-99123](https://cve.now/CVE-2026-99123.md): vsock/virtio: validate packet source for connected sockets (no CVSS, Linux)
- [CVE-2026-99122](https://cve.now/CVE-2026-99122.md): vsock/vmci: validate packet source for connected sockets (no CVSS, Linux)
- [CVE-2026-99121](https://cve.now/CVE-2026-99121.md): ipv4: avoid divide by zero in fib\_rebalance (no CVSS, Linux)
- [CVE-2026-99120](https://cve.now/CVE-2026-99120.md): KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes (no CVSS, Linux)
- [CVE-2026-99119](https://cve.now/CVE-2026-99119.md): drm/amdgpu/userq: actually validate userq BOs (no CVSS, Linux)
- [CVE-2026-99118](https://cve.now/CVE-2026-99118.md): drm/i915/dmc: Harden DMC firmware payload parsing (no CVSS, Linux)
- [CVE-2026-99117](https://cve.now/CVE-2026-99117.md): net: bridge: mcast: don't truncate the port group walk on teardown (no CVSS, Linux)
- [CVE-2026-99116](https://cve.now/CVE-2026-99116.md): net: psp: do not inherit the Rx association on clone (no CVSS, Linux)
- [CVE-2026-99115](https://cve.now/CVE-2026-99115.md): ksmbd: fill in FileSysIdentifier in FS\_POSIX\_INFORMATION (no CVSS, Linux)
- [CVE-2026-99114](https://cve.now/CVE-2026-99114.md): ksmbd: initialize FileSystemControlFlags in FS\_CONTROL\_INFORMATION (no CVSS, Linux)
- [CVE-2026-99113](https://cve.now/CVE-2026-99113.md): ksmbd: zero the FS\_OBJECT\_ID\_INFORMATION buffer before filling it in (no CVSS, Linux)
- [CVE-2026-99112](https://cve.now/CVE-2026-99112.md): net/sched: cls\_flower: validate mask pointer after nla\_next() (no CVSS, Linux)
- [CVE-2026-99111](https://cve.now/CVE-2026-99111.md): smb: client: fix data corruption with concurrent writes and O\_TRUNC (no CVSS, Linux)
- [CVE-2026-99110](https://cve.now/CVE-2026-99110.md): smb: client: fix heap overflow in cifs\_do\_set\_acl() (no CVSS, Linux)
- [CVE-2026-99109](https://cve.now/CVE-2026-99109.md): smb: client: reject SetEA requests that do not fit the request buffer (no CVSS, Linux)
- [CVE-2026-99108](https://cve.now/CVE-2026-99108.md): ntfs: fix FITRIM range alignment (no CVSS, Linux)
- [CVE-2026-99107](https://cve.now/CVE-2026-99107.md): ntfs: fix incorrect MFT record pointer passed to ntfs\_attr\_record\_resize (no CVSS, Linux)
- [CVE-2026-99106](https://cve.now/CVE-2026-99106.md): drm/amdgpu: free the userptr ranges when a CS fails after parser\_bos (no CVSS, Linux)
- [CVE-2026-99105](https://cve.now/CVE-2026-99105.md): sched\_ext: Fix stall when a task enqueued with SCX\_ENQ\_LAST lands back on its CPU's local DSQ (no CVSS, Linux)
- [CVE-2026-99104](https://cve.now/CVE-2026-99104.md): sched\_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor (no CVSS, Linux)
- [CVE-2026-99103](https://cve.now/CVE-2026-99103.md): workqueue: Fix unbound pool lifetime for pending pwqs (no CVSS, Linux)
- [CVE-2026-99102](https://cve.now/CVE-2026-99102.md): ntfs: take invalidate\_lock in ntfs\_setattr\_size() (no CVSS, Linux)
- [CVE-2026-99101](https://cve.now/CVE-2026-99101.md): ntfs: move attribute payload before shrinking its record (no CVSS, Linux)
- [CVE-2026-99100](https://cve.now/CVE-2026-99100.md): wifi: p54: validate firmware record lengths (no CVSS, Linux)
- [CVE-2026-99099](https://cve.now/CVE-2026-99099.md): x86/CPU/AMD: Fix AMD TLBI Erratum #1718 (no CVSS, Linux)
- [CVE-2026-99098](https://cve.now/CVE-2026-99098.md): dm-integrity: fix buffer overflow in inline mode with large tag size (no CVSS, Linux)
- [CVE-2026-99097](https://cve.now/CVE-2026-99097.md): tee: shm: reject zero-sized allocations in tee\_dyn\_shm\_alloc\_helper() (no CVSS, Linux)
- [CVE-2026-99096](https://cve.now/CVE-2026-99096.md): io\_uring/register: don't exempt disabled rings from task restrictions (no CVSS, Linux)
- [CVE-2026-99095](https://cve.now/CVE-2026-99095.md): drm/vc4: drain the hangcheck timer and works on V3D unbind (no CVSS, Linux)
- [CVE-2026-99094](https://cve.now/CVE-2026-99094.md): Bluetooth: btintel\_pcie: fix TX descriptor bounds check (no CVSS, Linux)
- [CVE-2026-99093](https://cve.now/CVE-2026-99093.md): mm: don't schedule deferred kernel page table freeing while booting (no CVSS, Linux)
- [CVE-2026-99092](https://cve.now/CVE-2026-99092.md): riscv: patch: fix handling of bpf-jit execmem addresses (no CVSS, Linux)
- [CVE-2026-99091](https://cve.now/CVE-2026-99091.md): Bluetooth: MGMT: Fix status of pending commands flushed on power off (no CVSS, Linux)
- [CVE-2026-99090](https://cve.now/CVE-2026-99090.md): drm/amdgpu: serialize vblank counter reads against GPU reset (no CVSS, Linux)
- [CVE-2026-99089](https://cve.now/CVE-2026-99089.md): ASoC: samsung: i2s: enable op\_clk in probe to balance runtime PM (no CVSS, Linux)
- [CVE-2026-99088](https://cve.now/CVE-2026-99088.md): net: openvswitch: validate transport header presence in set\_ipv6\_addr (no CVSS, Linux)
- [CVE-2026-99018](https://cve.now/CVE-2026-99018.md): riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp (CVSS 7.8, Linux)
- [CVE-2026-99017](https://cve.now/CVE-2026-99017.md): riscv: errata: select RISCV\_ALTERNATIVE\_EARLY for THEAD GHOSTWRITE (CVSS 7.0, Linux)
- [CVE-2026-99014](https://cve.now/CVE-2026-99014.md): Bluetooth: hci\_sync: Fix command skb lifetime during scan setup (CVSS 7.8, Linux)
- [CVE-2026-99011](https://cve.now/CVE-2026-99011.md): Bluetooth: SCO: serialise sco\_conn lifetime against sco\_recv\_scodata() (CVSS 7.1, Linux)
- [CVE-2026-98999](https://cve.now/CVE-2026-98999.md): drm/xe: Fix stale pinned\_link entry when fb-pin performs the final unpin (CVSS 7.8, Linux)
- [CVE-2026-98995](https://cve.now/CVE-2026-98995.md): namespace: reset the old parent's -\>overmount in mnt\_change\_mountpoint() (CVSS 7.8, Linux)
- [CVE-2026-98993](https://cve.now/CVE-2026-98993.md): namespace: don't inherit MNT\_UMOUNT in clone\_mnt() (CVSS 7.8, Linux)
- [CVE-2026-98988](https://cve.now/CVE-2026-98988.md): namespace: keep covered mounts covered in OPEN\_TREE\_NAMESPACE (CVSS 8.8, Linux)
- [CVE-2026-98982](https://cve.now/CVE-2026-98982.md): namespace: don't let a pseudo dentry become the root of a mount (CVSS 7.8, Linux)
- [CVE-2026-98981](https://cve.now/CVE-2026-98981.md): namespace: unhash a dentry before detaching the mounts on it (CVSS 8.8, Linux)
- [CVE-2026-98980](https://cve.now/CVE-2026-98980.md): namei: don't reveal overmounted entries in refwalk (CVSS 8.8, Linux)
- [CVE-2026-98978](https://cve.now/CVE-2026-98978.md): namespace: never expire a locked mount (CVSS 8.4, Linux)
- [CVE-2026-98976](https://cve.now/CVE-2026-98976.md): namespace: keep the lock on a mount that a propagated copy is moved beneath (CVSS 7.8, Linux)
- [CVE-2026-98975](https://cve.now/CVE-2026-98975.md): xfs: stop exchanging reflink flags when exchanging mappings (CVSS 7.8, Linux)
- [CVE-2026-98974](https://cve.now/CVE-2026-98974.md): xfs: fix exchange-range-to-eof file size exchange (CVSS 7.8, Linux)
- [CVE-2026-98968](https://cve.now/CVE-2026-98968.md): amt: send the relay's General Query directly from the receive path (CVSS 8.1, Linux)
- [CVE-2026-98965](https://cve.now/CVE-2026-98965.md): ice: Restore Ordered MMIO Writes for Tx Doorbells (CVSS 7.5, Linux)
- [CVE-2026-98964](https://cve.now/CVE-2026-98964.md): nvmet: use the local P2P device on metadata allocation failure (CVSS 7.5, Linux)
- [CVE-2026-98959](https://cve.now/CVE-2026-98959.md): btrfs: fix xattr replace when multiple xattrs are packed in the same item (CVSS 9.8, Linux)
- [CVE-2026-98952](https://cve.now/CVE-2026-98952.md): pfcp: make sure the SEID is linear before reading it (CVSS 7.3, Linux)
- [CVE-2026-98945](https://cve.now/CVE-2026-98945.md): HID: steam: Rearrange teardown sequence (CVSS 7.8, Linux)
- [CVE-2026-98944](https://cve.now/CVE-2026-98944.md): HID: steam: Refactor registration (CVSS 7.8, Linux)
- [CVE-2026-98941](https://cve.now/CVE-2026-98941.md): ext4: don't enable large folios on encrypted inodes (CVSS 7.0, Linux)
- [CVE-2026-98932](https://cve.now/CVE-2026-98932.md): EDAC/altera: Fix use-after-free in error paths (CVSS 7.4, Linux)
- [CVE-2026-98927](https://cve.now/CVE-2026-98927.md): KVM: arm64: nv: Fix life cycle of the nested\_mmus array (CVSS 7.0, Linux)
- [CVE-2026-98911](https://cve.now/CVE-2026-98911.md): dpaa2-switch: fix the error path in dpaa2\_switch\_rx() (CVSS 7.5, Linux)
- [CVE-2026-98899](https://cve.now/CVE-2026-98899.md): netfilter: ipset: mark the rcu locked areas properly (CVSS 7.8, Linux)
- [CVE-2026-98895](https://cve.now/CVE-2026-98895.md): net/mlx5: HWS, Handle destroying table that has a miss table (CVSS 7.0, Linux)
- [CVE-2026-98889](https://cve.now/CVE-2026-98889.md): wifi: iwlwifi: mvm: fix sched scan IE sizing (CVSS 7.8, Linux)
- [CVE-2026-98870](https://cve.now/CVE-2026-98870.md): ksmbd: remove stale channels from all sessions on teardown (CVSS 8.8, Linux)
- [CVE-2023-7356](https://cve.now/CVE-2023-7356.md): Bluetooth: ISO: Copy BASE if service data matches EIR\_BAA\_SERVICE\_UUID (CVSS 8.8, Linux)
- [CVE-2026-98869](https://cve.now/CVE-2026-98869.md): bpf: Infer zext\_dst based on static register liveness analysis (CVSS 7.8, Linux)
- [CVE-2026-98555](https://cve.now/CVE-2026-98555.md): llc: fix skb UAF and leaks on llc\_mac\_hdr\_init() failure (CVSS 7.5, Linux)
- [CVE-2026-98550](https://cve.now/CVE-2026-98550.md): tipc: reject invalid and unexpected GRP\_ACK\_MSG to prevent bc\_ackers underflow (CVSS 7.5, Linux)
- [CVE-2026-98548](https://cve.now/CVE-2026-98548.md): sctp: discard the rest of the packet on a stale-cookie error (CVSS 9.8, Linux)
- [CVE-2026-98543](https://cve.now/CVE-2026-98543.md): bpf: fs/xattr: don't assume the inode is locked in path\_unlink/path\_rmdir (CVSS 7.3, Linux)
- [CVE-2026-98532](https://cve.now/CVE-2026-98532.md): ipv6: do not let ipv6\_find\_hdr() return an offset past the packet end (CVSS 8.1, Linux)
- [CVE-2026-98524](https://cve.now/CVE-2026-98524.md): rds: ib: Clear the sg list when mapping an MR fails (CVSS 7.8, Linux)
- [CVE-2026-98520](https://cve.now/CVE-2026-98520.md): drm/amdkfd: fix use-after-free and multi-container gap in kfd\_dev\_mapping (CVSS 7.8, Linux)
- [CVE-2026-98518](https://cve.now/CVE-2026-98518.md): drm/nouveau/dmem: pin VRAM for the whole registered range (CVSS 7.0, Linux)
- [CVE-2026-98515](https://cve.now/CVE-2026-98515.md): drm/nouveau: fix double-free in nvif\_vmm\_dtor (CVSS 7.8, Linux)
- [CVE-2026-98512](https://cve.now/CVE-2026-98512.md): drm/nouveau: RCU-free the scheduler-containing nouveau\_sched (CVSS 7.1, Linux)
- [CVE-2026-98510](https://cve.now/CVE-2026-98510.md): drm/xe/vm: nuke PTs only after unlinking contested VMAs (CVSS 7.8, Linux)
- [CVE-2026-98501](https://cve.now/CVE-2026-98501.md): HID: alps: fix use-after-free on input2 registration failure (CVSS 7.1, Linux)
- [CVE-2026-98499](https://cve.now/CVE-2026-98499.md): HID: wacom: fix OOB read in wacom\_wac\_pen\_serial\_enforce() (CVSS 8.1, Linux)
- [CVE-2026-98497](https://cve.now/CVE-2026-98497.md): net/mlx5e: fix swapped IPv6 IPsec policy masks (CVSS 7.5, Linux)
- [CVE-2026-98491](https://cve.now/CVE-2026-98491.md): net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry (CVSS 7.8, Linux)
- [CVE-2026-98487](https://cve.now/CVE-2026-98487.md): net: bridge: mdb: restart port group walk after deletion (CVSS 7.8, Linux)
- [CVE-2026-98485](https://cve.now/CVE-2026-98485.md): netfilter: ip6t\_rt: fix zero-address non-strict match out-of-bounds read (CVSS 7.1, Linux)
- [CVE-2026-98479](https://cve.now/CVE-2026-98479.md): scsi: libiscsi\_tcp: Check the data direction of a Data-In PDU (CVSS 7.5, Linux)
- [CVE-2026-98471](https://cve.now/CVE-2026-98471.md): KVM: SEV: Do cache maintenance on the source VM during intra-host migration (CVSS 7.1, Linux)
- [CVE-2026-98469](https://cve.now/CVE-2026-98469.md): KVM: arm64: Fix AArch32 DBGBXVR\<n\> handling (CVSS 7.1, Linux)
- [CVE-2026-98466](https://cve.now/CVE-2026-98466.md): KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVSS 8.2, Linux)
- [CVE-2026-98464](https://cve.now/CVE-2026-98464.md): RISC-V: KVM: Synchronize hrtimer callback during teardown (CVSS 9.3, Linux)
- [CVE-2026-98456](https://cve.now/CVE-2026-98456.md): Bluetooth: mgmt: fix race in read\_unconf\_index\_list() (CVSS 7.0, Linux)
- [CVE-2026-98454](https://cve.now/CVE-2026-98454.md): smb: client: fix create context out-of-bounds reads (CVSS 8.1, Linux)
- [CVE-2026-98440](https://cve.now/CVE-2026-98440.md): KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction (CVSS 7.0, Linux)
- [CVE-2026-98436](https://cve.now/CVE-2026-98436.md): accel/amdxdna: Disable device buffer exporting (CVSS 7.8, Linux)
- [CVE-2026-98432](https://cve.now/CVE-2026-98432.md): ipv4: free inet\_opt and ireq\_opt after an RCU grace period (CVSS 9.8, Linux)
- [CVE-2026-98419](https://cve.now/CVE-2026-98419.md): drop\_monitor: fix out-of-bounds write in reset\_per\_cpu\_data() (CVSS 7.0, Linux)
- [CVE-2026-98405](https://cve.now/CVE-2026-98405.md): smb: client: fix missing iov bounds check in parse\_posix\_sids() (CVSS 8.1, Linux)
- [CVE-2026-98401](https://cve.now/CVE-2026-98401.md): net: iptunnel: fix stale transport header during tunnel decapsulation (CVSS 7.5, Linux)
- [CVE-2026-98385](https://cve.now/CVE-2026-98385.md): sched/cache: Decouple sched\_cache\_group from mm to fix UAF (CVSS 7.8, Linux)
- [CVE-2026-98383](https://cve.now/CVE-2026-98383.md): bpf: Disallow bpf\_skb\_pull\_data() for LWT\_SEG6LOCAL (CVSS 7.8, Linux)
- [CVE-2026-98382](https://cve.now/CVE-2026-98382.md): bpf: Reject dev-bound-only programs on other devices (CVSS 7.8, Linux)
- [CVE-2026-98381](https://cve.now/CVE-2026-98381.md): veth: manage XDP program pointers during channel resize (CVSS 7.8, Linux)
- [CVE-2026-98378](https://cve.now/CVE-2026-98378.md): bpf: Skip unsettled links in link iterator (CVSS 7.8, Linux)
- [CVE-2026-98376](https://cve.now/CVE-2026-98376.md): bpf: Use array\_map\_meta\_equal for percpu array inner map replacement (CVSS 7.8, Linux)
- [CVE-2026-98374](https://cve.now/CVE-2026-98374.md): tcp: fix use-after-free of retransmit\_skb\_hint in tcp\_send\_synack() (CVSS 8.8, Linux)
- [CVE-2026-97555](https://cve.now/CVE-2026-97555.md): smb: client: fix heap overflow in DACL owner/group rewrite (CVSS 8.8, Linux)
- [CVE-2026-46300](https://cve.now/CVE-2026-46300.md): net: skbuff: preserve shared-frag marker during coalescing (CVSS 7.8, KEV, Linux)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/tech/linux-kernel
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.