Linux CVEs
18,386 CVEs and advisories name Linux as an affected vendor, 14 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-23127perf: Fix refcount warning on event->mmap_count increment
- CVE-2026-23126netdevsim: fix a race issue related to the operation on bpf_bound_progs list
- CVE-2026-23125sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
- CVE-2026-23124ipv6: annotate data-race in ndisc_router_discovery()
- CVE-2026-23123interconnect: debugfs: initialize src_node and dst_node to empty strings
- CVE-2026-23122igc: Reduce TSN TX packet buffer from 7KB to 5KB per queue
- CVE-2026-23121mISDN: annotate data-race around dev->work
- CVE-2026-23120l2tp: avoid one data-race in l2tp_tunnel_del_work()
- CVE-2026-23119bonding: provide a net pointer to __skb_flow_dissect()
- CVE-2026-23118rxrpc: Fix data-race warning and potential load/store tearing
- CVE-2026-23117ice: add missing ice_deinit_hw() in devlink reinit path
- CVE-2026-23116pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu
- CVE-2026-23115serial: Fix not set tty->port race condition
- CVE-2026-23114arm64/fpsimd: ptrace: Fix SVE writes on !SME systems
- CVE-2026-23113io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
- CVE-2025-71200mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode
- CVE-2026-23112nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
- CVE-2026-23111netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()
- CVE-2026-23110scsi: core: Wake up the error handler when final completions race against each other
- CVE-2026-23109fs/writeback: skip AS_NO_DATA_INTEGRITY mappings in wait_sb_inodes()
- CVE-2026-23108can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
- CVE-2026-23107arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA
- CVE-2026-23106timekeeping: Adjust the leap state for the correct auxiliary timekeeper
- CVE-2026-23105net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag
- CVE-2026-23104ice: fix devlink reload call trace
- CVE-2026-23103ipvlan: Make the addrs_lock be per port
- CVE-2026-23102arm64/fpsimd: signal: Fix restoration of SVE context
- CVE-2026-23101leds: led-class: Only Add LED to leds_list when it is fully ready
- CVE-2026-23100mm/hugetlb: fix hugetlb_pmd_shared()
- CVE-2026-23099bonding: limit BOND_MODE_8023AD to Ethernet devices