Linux CVEs
18,386 CVEs and advisories name Linux as an affected vendor, 14 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-53177bnxt_en: Fix NULL pointer dereference
- CVE-2026-53176IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
- CVE-2026-53175inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
- CVE-2026-53174ovl: keep err zero after successful ovl_cache_get()
- CVE-2026-53173accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()
- CVE-2026-53172accel/ethosu: fix IFM region index out-of-bounds in command stream parser
- CVE-2026-53171accel/ethosu: fix arithmetic issues in dma_length()
- CVE-2026-53170accel/ethosu: reject DMA commands with uninitialized length
- CVE-2026-53169accel/ethosu: reject NPU_OP_RESIZE commands from userspace
- CVE-2026-53168fuse: reject fuse_notify() pagecache ops on directories
- CVE-2026-53167fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
- CVE-2026-53165iomap: avoid potential null folio->mapping deref during error reporting
- CVE-2026-53164iommu/dma: Do not try to iommu_map a 0 length region in swiotlb
- CVE-2026-53163locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
- CVE-2026-53162memcg: use round-robin victim selection in refill_stock
- CVE-2026-53161misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
- CVE-2026-53160misc: fastrpc: fix use-after-free race in fastrpc_map_create
- CVE-2026-53159misc: fastrpc: fix DMA address corruption due to find_vma misuse
- CVE-2026-53158misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
- CVE-2026-53157net: phonet: free phonet_device after RCU grace period
- CVE-2026-53156nvmem: core: fix use-after-free bugs in error paths
- CVE-2026-53155mm/huge_memory: use correct flags for device private PMD entry
- CVE-2026-53154mm/hugetlb: restore reservation on error in hugetlb folio copy paths
- CVE-2026-53153mm/list_lru: drain before clearing xarray entry on reparent
- CVE-2026-53152mmc: dw_mmc-rockchip: Add missing private data for very old controllers
- CVE-2026-53151rxrpc: Fix the ACK parser to extract the SACK table for parsing
- CVE-2026-53150thunderbolt: Reject zero-length property entries in validator
- CVE-2026-53149thunderbolt: Bound root directory content to block size
- CVE-2026-53148thunderbolt: Clamp XDomain response data copy to allocation size
- CVE-2026-53147thunderbolt: Validate XDomain request packet size before type cast