Linux CVEs
18,386 CVEs and advisories name Linux as an affected vendor, 14 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-31525bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN
- CVE-2026-31524HID: asus: avoid memory leak in asus_report_fixup()
- CVE-2026-31523nvme-pci: ensure we're polling a polled queue
- CVE-2026-31522HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
- CVE-2026-31521module: Fix kernel panic when a symbol st_shndx is out of bounds
- CVE-2026-31520HID: apple: avoid memory leak in apple_report_fixup()
- CVE-2026-31519btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create
- CVE-2026-31518esp: fix skb leak with espintcp and async crypto
- CVE-2026-31517xfrm: iptfs: fix skb_put() panic on non-linear skb during reassembly
- CVE-2026-31516xfrm: prevent policy_hthresh.work from racing with netns teardown
- CVE-2026-31515af_key: validate families in pfkey_send_migrate()
- CVE-2026-31514erofs: set fileio bio failed in short read case
- CVE-2026-31513Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
- CVE-2026-31512Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
- CVE-2026-31511Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
- CVE-2026-31510Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
- CVE-2026-31509nfc: nci: fix circular locking dependency in nci_close_device
- CVE-2026-31508net: openvswitch: Avoid releasing netdev before teardown completes
- CVE-2026-31507net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
- CVE-2026-31506net: bcmasp: fix double free of WoL irq
- CVE-2026-31505iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
- CVE-2026-31504net: fix fanout UAF in packet_release() via NETDEV_UP race
- CVE-2026-31503udp: Fix wildcard bind conflict check when using hash2
- CVE-2026-31502team: fix header_ops type confusion with non-Ethernet ports
- CVE-2026-31501net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
- CVE-2026-31500Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock
- CVE-2026-31499Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
- CVE-2026-31498Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
- CVE-2026-31497Bluetooth: btusb: clamp SCO altsetting table indices
- CVE-2026-31496netfilter: nf_conntrack_expect: skip expectations in other netns via proc