Linux vulnerabilities
18,386 CVEs and advisories name Linux as an affected vendor, 14 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-99191calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()
- CVE-2026-99190gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths
- CVE-2026-99189gpio: mxc: fix race between chained IRQ handler install and probe completion
- CVE-2026-99188net: stmmac: dwmac1000: clear the RGMII status interrupt
- CVE-2026-99187perf: Fix perf_pmu_migrate_context() leaving events behind
- CVE-2026-99186x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()
- CVE-2026-99185firewire: core: fix race condition in split transaction handling
- CVE-2026-99184accel/rocket: search every core slot when a core is removed
- CVE-2026-99183accel/rocket: search every core slot when looking up a scheduler
- CVE-2026-99182ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture
- CVE-2026-99181autofs: ignore notification errors from a replaced pipe
- CVE-2026-99180unicode: free the map after a grace period
- CVE-2026-99179watch_queue: Fix note pool publication race in watch_queue_set_size()
- CVE-2026-99178x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context
- CVE-2026-99177KVM: SEV: Fix page dirtying in sev_gmem_post_populate()
- CVE-2026-99176KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry
- CVE-2026-99175fsnotify: prevent mark additions during connector teardown
- CVE-2026-99174ext4: free the sbi after a grace period
- CVE-2026-99173eventfs: Free the eventfs_inode after an rcu grace period too
- CVE-2026-99172ipc: drop the mqueue mount with kern_unmount() on setup failure
- CVE-2026-99171ntfs3: free the sbi after a grace period
- CVE-2026-99170namespace: a mount that copy_tree() leaves out can't take over a lock
- CVE-2026-99169futex: Fix mm reuse handling for FUT_OFF_MMSHARED
- CVE-2026-99168mshv_vtl: Check per-CPU register page before mmap
- CVE-2026-99167net/sched: fix use-after-free in __tcf_action_put()
- CVE-2026-99166net: rds: fix uninitialized trans dereference in CM event handler
- CVE-2026-99165sctp: revalidate output stream after association connect wait
- CVE-2026-99164spi: imx: fix slab corruption from undersized DMA bounce buffers
- CVE-2026-99163tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields
- CVE-2026-99162gpio: shared: fix use-after-free bug when adding shared proxies