Linux vulnerabilities
18,386 CVEs and advisories name Linux as an affected vendor, 14 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-98560net/rds: size a connection's path set by the transport it ends up with
- CVE-2026-98559net/smc: fix UAF on lgr list traversal in smcr_port_err()
- CVE-2026-98558net: flush skb_defer_nodes in dev_cpu_dead()
- CVE-2026-98557gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO
- CVE-2026-98556gve: DQO: reject TSO packets with an out of range MSS
- CVE-2026-98555llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
- CVE-2026-98554vlan: ensure sufficient headroom in vlan_dev_hard_header()
- CVE-2026-98553autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
- CVE-2026-98552perf/core: Fix a refcount leak in attach_perf_ctx_data()
- CVE-2026-98551perf/core: Fill branch entries with a single assignment
- CVE-2026-98550tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
- CVE-2026-98549tcp: prevent collapsing skbs across boundary in rtx queue
- CVE-2026-98548sctp: discard the rest of the packet on a stale-cookie error
- CVE-2026-98547af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
- CVE-2026-98546arm64/boot: Disable trapping of PMZR_EL0 writes to EL2
- CVE-2026-98545ata: libata-scsi: bound the ATA passthru sense descriptor writes
- CVE-2026-98544bna: prevent IOC timer rearm during teardown
- CVE-2026-98543bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir
- CVE-2026-98542cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict
- CVE-2026-98541fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
- CVE-2026-98540fprobe: Terminate the fgraph_data list when the reservation is not filled
- CVE-2026-98539fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga
- CVE-2026-98538writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes
- CVE-2026-98537workqueue: Fix NULL current_pwq deref in flush dependency check
- CVE-2026-98536writeback: report a Tasks-RCU quiescent state per cgwb drain pass
- CVE-2026-98535fsl/fman: Fix clk reference leak in read_dts_node()
- CVE-2026-98534ipe: fix use-after-free when auditing a newly loaded policy
- CVE-2026-98533ipe: protect the dm-verity root hash with RCU
- CVE-2026-98532ipv6: do not let ipv6_find_hdr() return an offset past the packet end
- CVE-2026-98531ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST