Linux CVEs
18,386 CVEs and advisories name Linux as an affected vendor, 14 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-64479ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
- CVE-2026-64478ALSA: usb-audio: avoid kobject path lookup in DualSense match
- CVE-2026-64477x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled
- CVE-2026-64476vfio/pci: Latch disable_idle_d3 per device
- CVE-2026-64475vfio/pci: Release the VGA arbiter client on register_device() failure
- CVE-2026-64474vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
- CVE-2026-64473vfio: Remove device debugfs before releasing devres
- CVE-2026-64472vfio/mlx5: Fix racy bitfields and tighten struct layout
- CVE-2026-64471Bluetooth: btusb: fix use-after-free on registration failure
- CVE-2026-64470Bluetooth: btusb: fix use-after-free on marvell probe failure
- CVE-2026-64469binder: fix UAF in binder_thread_release()
- CVE-2026-64468binder: fix UAF in binder_free_transaction()
- CVE-2026-64467rust_binder: use a u64 stride when cleaning up the offsets array
- CVE-2026-64466rust_binder: clear freeze listener on node removal
- CVE-2026-64465usb: xhci: Fix sleep in atomic context in xhci_free_streams()
- CVE-2026-64464xhci: sideband: fix ring sg table pages leak
- CVE-2026-64463usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
- CVE-2026-64462PCI: altera: Fix resource leaks on probe failure
- CVE-2026-64461PCI: mediatek: Fix IRQ domain leak when port fails to enable
- CVE-2026-64460PCI/IOV: Skip VF Resizable BAR restore on read error
- CVE-2026-64459tcp: restore RCU grace period in tcp_ao_destroy_sock
- CVE-2026-64458mm/damon/ops-common: handle extreme intervals in damon_hot_score()
- CVE-2026-64457virtio_pci: fix vq info pointer lookup via wrong index
- CVE-2026-64456hwrng: virtio: clamp device-reported used.len at copy_data()
- CVE-2026-64455USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
- CVE-2026-64454usb: dwc3: run gadget disconnect from sleepable suspend context
- CVE-2026-64453usb: misc: usbio: fix disconnect UAF in client teardown
- CVE-2026-644526lowpan: fix NHC entry use-after-free on error path
- CVE-2026-64451tracing: Fix NULL pointer dereference in func_set_flag()
- CVE-2026-64450tipc: fix out-of-bounds read in broadcast Gap ACK blocks