Linux CVEs
18,386 CVEs and advisories name Linux as an affected vendor, 14 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-74312vhost/vdpa: validate virtqueue index in mmap and fault paths
- CVE-2026-74311virtio: rtc: tear down old virtqueues before restore
- CVE-2026-74310vhost/net: complete zerocopy ubufs only once
- CVE-2026-74309vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
- CVE-2026-74308ext4: fix kernel BUG in ext4_write_inline_data_end
- CVE-2026-74307ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT
- CVE-2026-74306vfio/qat: fix f_pos race in qat_vf_resume_write()
- CVE-2026-74305bpf: Tighten cgroup storage cookie checks for prog arrays
- CVE-2026-74304Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev device
- CVE-2026-74303Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device
- CVE-2026-74302Bluetooth: hci_core: Fix UAF in hci_unregister_dev()
- CVE-2026-74301Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path
- CVE-2026-74300Bluetooth: hci: validate codec capability element length
- CVE-2026-74299RDMA/core: Fix FRMR aging push to queue error flow
- CVE-2026-74298RDMA/core: Fix FRMR set pinned push error path
- CVE-2026-74297RDMA/mlx5: Fix undefined shift of user RQ WQE size
- CVE-2026-74296RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one
- CVE-2026-74295ASoC: codecs: hdac_hdmi: Validate written enum value
- CVE-2026-74294ASoC: meson: aiu: Validate written enum values
- CVE-2026-74293ASoC: fsl: fsl_audmix: Validate written enum values
- CVE-2026-74292ASoC: tegra: tegra210_ahub: Validate written enum value
- CVE-2026-74291ASoC: topology: Check PCM and DAI name strings before use
- CVE-2026-74290net/sched: cls_flow: Dont expose folded kernel pointers
- CVE-2026-74289ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().
- CVE-2026-74288net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().
- CVE-2026-74287sctp: validate embedded address parameter length
- CVE-2026-74286net: pfcp: allocate per-cpu tstats for PFCP netdevs
- CVE-2026-74285net: Stop leased rxq before uninstalling its memory provider
- CVE-2026-74284net/sched: sch_hfsc: Don't make class passive twice
- CVE-2026-74283tipc: require net admin for TIPCv2 netlink mutators