Linux vulnerabilities
18,386 CVEs and advisories name Linux as an affected vendor, 14 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-98771usb: storage: sierra_ms: reject short SWoC info transfers
- CVE-2026-98770usb: gadget: midi2: Fix the jack descriptor array sizes
- CVE-2026-98769usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
- CVE-2026-98768usb: typec: anx7411 - stop the IRQ before destroying the workqueue
- CVE-2026-98767usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
- CVE-2026-98766usb: gadget: aspeed-vhub: cancel wake work on device removal
- CVE-2026-98765USB: gadget: dummy-hcd: Fix wait for outstanding request completions
- CVE-2026-98764usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC
- CVE-2026-98763usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
- CVE-2026-98762USB: dwc2: shut down wakeup timer before freeing HCD state
- CVE-2026-98761usb: typec: tcpm: recover after failure to start the frs ams
- CVE-2026-98760usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()
- CVE-2026-98759usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()
- CVE-2026-98758usb: typec: ucsi: glink: fix use-after-free of ucsi on remove
- CVE-2026-98757usb: cdns3: fix use-after-free in cdns3_gadget_exit()
- CVE-2026-98756usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
- CVE-2026-98755tty: vcc: zero-initialize control packet in vcc_send_ctl()
- CVE-2026-98754tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup
- CVE-2026-98753tty: tty_port: restore TTY_IO_ERROR on activation failure
- CVE-2026-98752tty: port: fix tty_port_tty_vhangup() race
- CVE-2026-98751tty: abort break signalling on hangup
- CVE-2026-98750tty: fix saved termios reset race
- CVE-2026-98749tty: serial: max3100: shut down timer before freeing port
- CVE-2026-98748serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
- CVE-2026-98747serial: core: fix NULL pointer dereference in serial_core_unregister_port()
- CVE-2026-98746serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()
- CVE-2026-98745arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems
- CVE-2026-98744ASoC: codecs: max98363: fix uninitialized stream_config->type
- CVE-2026-98743ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type
- CVE-2026-98742ALSA: seq: Serialize compat port-info ioctls