Linux vulnerabilities
18,386 CVEs and advisories name Linux as an affected vendor, 14 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-98411power: sequencing: fix NULL-pointer dereference in pwrseq_device_register()
- CVE-2026-98410watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog
- CVE-2026-98409watchdog: rtd119x: Avoid division by zero
- CVE-2026-98408watchdog: rzv2h: Avoid division by zero
- CVE-2026-98407wifi: rsi: fix heap OOB write on key removal
- CVE-2026-98406wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
- CVE-2026-98405smb: client: fix missing iov bounds check in parse_posix_sids()
- CVE-2026-98404drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
- CVE-2026-98403s390/boot: Avoid IPL parameter append past command line
- CVE-2026-98402net: icmp: avoid invalid transport header access in icmp_send tracepoint
- CVE-2026-98401net: iptunnel: fix stale transport header during tunnel decapsulation
- CVE-2026-98400s390/ipl: Fix NULL deref in kdump without re-IPL parm block
- CVE-2026-98399s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block
- CVE-2026-98398locking/lockdep: Invalidate stale class_cache entries for zapped classes
- CVE-2026-98397platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown
- CVE-2026-98396powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()
- CVE-2026-98395powerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exit
- CVE-2026-98394af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.
- CVE-2026-98393net: ipv4: Fix UDP length overflow with PMTU discover and big MTU
- CVE-2026-98392Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one
- CVE-2026-98391drm/xe: Guard page-fault worker with runtime PM check
- CVE-2026-98390x86/amd_node: Avoid divide by zero on virtualized systems
- CVE-2026-98389drm/amdgpu: skip gfx switch_power_profile during GPU reset
- CVE-2026-98388exec: do_close_on_exec() before taking exec_update_lock
- CVE-2026-98387s390/crypto: Fix skcipher_walk return code handling in aes_s390
- CVE-2026-98386scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
- CVE-2026-98385sched/cache: Decouple sched_cache_group from mm to fix UAF
- CVE-2026-98384bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
- CVE-2026-98383bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
- CVE-2026-98382bpf: Reject dev-bound-only programs on other devices