Linux CVEs
18,386 CVEs and advisories name Linux as an affected vendor, 14 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-31646net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()
- CVE-2026-31645net: lan966x: fix page pool leak in error paths
- CVE-2026-31644net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()
- CVE-2026-31643rxrpc: Fix key parsing memleak
- CVE-2026-31642rxrpc: Fix call removal to use RCU safe deletion
- CVE-2026-31641rxrpc: Fix RxGK token loading to check bounds
- CVE-2026-31640rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial
- CVE-2026-31639rxrpc: Fix key reference count leak from call->key
- CVE-2026-31638rxrpc: Only put the call ref if one was acquired
- CVE-2026-31637rxrpc: reject undecryptable rxkad response tickets
- CVE-2026-31636rxrpc: fix RESPONSE authenticator parser OOB read
- CVE-2026-31635rxrpc: fix oversized RESPONSE authenticator length check
- CVE-2026-31634rxrpc: fix reference count leak in rxrpc_server_keyring()
- CVE-2026-31633rxrpc: Fix integer overflow in rxgk_verify_response()
- CVE-2026-31632rxrpc: Fix leak of rxgk context in rxgk_verify_response()
- CVE-2026-31631rxrpc: Fix buffer overread in rxgk_do_verify_authenticator()
- CVE-2026-31630rxrpc: proc: size address buffers for %pISpc output
- CVE-2026-31629nfc: llcp: add missing return after LLCP_CLOSED checks
- CVE-2026-31628x86/CPU: Fix FPDSS on Zen1
- CVE-2026-31627i2c: s3c24xx: check the size of the SMBUS message before using it
- CVE-2026-31626staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
- CVE-2026-31625HID: alps: fix NULL pointer dereference in alps_raw_event()
- CVE-2026-31624HID: core: clamp report_size in s32ton() to avoid undefined shift
- CVE-2026-31623net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
- CVE-2026-31622NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
- CVE-2026-31621bnge: return after auxiliary_device_uninit() in error path
- CVE-2026-31620ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0
- CVE-2026-31619ALSA: fireworks: bound device-supplied status before string array lookup
- CVE-2026-31618fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
- CVE-2026-31617usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()