Linux CVEs
18,386 CVEs and advisories name Linux as an affected vendor, 14 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-74734firewire: ohci: fix NULL pointer dereference in ar_context_release
- CVE-2026-74733gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
- CVE-2026-74731sched_ext: Skip sub-disable teardown for never-linked sub-schedulers
- CVE-2026-74730NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
- CVE-2026-74729soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
- CVE-2026-74728xfs: handle NULL b_addr in xfs_buf_free
- CVE-2026-74727ovpn: skip rehash for peers already removed from by_id
- CVE-2026-74726bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
- CVE-2026-74725enic: fix tx_hang_reset use-after-free on device removal
- CVE-2026-74724ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
- CVE-2026-74723btrfs: lzo: reject inline extents without valid headers
- CVE-2026-74722btrfs: fix memory leak in btrfs_do_encoded_write()
- CVE-2026-74721accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()
- CVE-2026-74720bpf: Preserve pointer state for commuted arithmetic
- CVE-2026-74719net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
- CVE-2026-74718devlink: fix net namespace reference leak in reload
- CVE-2026-74717net/mlx5: fw_tracer, return NULL on create error
- CVE-2026-74716accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()
- CVE-2026-74715bpf: Fix netns reference imbalance in conntrack kfuncs
- CVE-2026-74714bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
- CVE-2026-74713vhost_iotlb: bound map allocation in add_range
- CVE-2026-74712vdpa/mlx5: Fix buffer length in create_direct_keys()
- CVE-2026-74711hwmon: (pmbus) Fix type confusion in notification logic
- CVE-2026-74710xsk: require at least 16 bytes of TX metadata
- CVE-2026-74709xsk: clear metadata pointer when no timestamp is requested
- CVE-2026-74708xsk: validate launch-time metadata size
- CVE-2026-74707xsk: validate metadata when processing requests
- CVE-2026-74706bnge: Fix NULL pointer dereference in aux device release
- CVE-2026-74705udp: fix potential use-after-free in tunnel segmentation
- CVE-2026-74704net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter