Linux CVEs
18,386 CVEs and advisories name Linux as an affected vendor, 14 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-68344usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
- CVE-2026-68343smb: client: validate DFS referral PathConsumed
- CVE-2026-68342ovpn: avoid putting unrelated P2P peer on socket release
- CVE-2026-68341ovpn: fix use after free in unlock_ovpn()
- CVE-2026-68340hwmon: occ: validate poll response sensor blocks
- CVE-2026-68339Bluetooth: btusb: validate Realtek vendor event length
- CVE-2026-68338net/packet: avoid fanout hook re-registration after unregister
- CVE-2026-68337bpf: Reject redirect helpers without a bpf_net_context
- CVE-2026-68336bonding: fix devconf_all NULL dereference when IPv6 is disabled
- CVE-2026-68335rds: drop incoming messages that cross network namespace boundaries
- CVE-2026-68334rxrpc: fix io_thread race in rxrpc_wake_up_io_thread()
- CVE-2026-68333dpaa2-switch: put MAC endpoint device on disconnect
- CVE-2026-68332net: airoha: Fix potential use-after-free in airoha_ppe_deinit()
- CVE-2026-68331dpaa2-eth: put MAC endpoint device on disconnect
- CVE-2026-68330net: airoha: Fix DMA direction for NPU mailbox buffer
- CVE-2026-68329iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()
- CVE-2026-68328nfp: Check resource mutex allocation
- CVE-2026-68327wan: wanxl: Only reset hardware after BAR mapping
- CVE-2026-68326wifi: mwifiex: bound uAP association event IEs to the event buffer
- CVE-2026-68325iommu/amd: Bound the early ACPI HID map
- CVE-2026-68324iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()
- CVE-2026-68323tipc: serialize udp bearer replicast list updates
- CVE-2026-68322rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
- CVE-2026-68321net: txgbe: fix FDIR filter leak on remove
- CVE-2026-68320sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
- CVE-2026-68319pds_core: fix deadlock between reset thread and remove
- CVE-2026-68318pds_core: fix use-after-free on workqueue during remove
- CVE-2026-68317pds_core: fix auxiliary device add/del races
- CVE-2026-68316accel: ethosu: Fix element size accounting for cmd stream validation
- CVE-2026-68315sctp: validate stream count in sctp_process_strreset_inreq()