Linux vulnerabilities
18,386 CVEs and advisories name Linux as an affected vendor, 14 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-99131xfs: fix capability check in xfs
- CVE-2026-99130io_uring/cancel: don't spin on local work the task can't run
- CVE-2026-99129selinux: fix BPF token permission checks
- CVE-2026-99128sctp: validate chunk length in the inqueue parser
- CVE-2026-99127page_pool: keep frag_offset aligned for odd-sized requests
- CVE-2026-99126s390/ctcm: Prevent XID null dereference
- CVE-2026-99125s390/pai: Handle multiple PMU stop callback invocations
- CVE-2026-99124s390/pci: Fix leak of uninitialized kernel data in SCLP report
- CVE-2026-99123vsock/virtio: validate packet source for connected sockets
- CVE-2026-99122vsock/vmci: validate packet source for connected sockets
- CVE-2026-99121ipv4: avoid divide by zero in fib_rebalance
- CVE-2026-99120KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
- CVE-2026-99119drm/amdgpu/userq: actually validate userq BOs
- CVE-2026-99118drm/i915/dmc: Harden DMC firmware payload parsing
- CVE-2026-99117net: bridge: mcast: don't truncate the port group walk on teardown
- CVE-2026-99116net: psp: do not inherit the Rx association on clone
- CVE-2026-99115ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION
- CVE-2026-99114ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
- CVE-2026-99113ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in
- CVE-2026-99112net/sched: cls_flower: validate mask pointer after nla_next()
- CVE-2026-99111smb: client: fix data corruption with concurrent writes and O_TRUNC
- CVE-2026-99110smb: client: fix heap overflow in cifs_do_set_acl()
- CVE-2026-99109smb: client: reject SetEA requests that do not fit the request buffer
- CVE-2026-99108ntfs: fix FITRIM range alignment
- CVE-2026-99107ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize
- CVE-2026-99106drm/amdgpu: free the userptr ranges when a CS fails after parser_bos
- CVE-2026-99105sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ
- CVE-2026-99104sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor
- CVE-2026-99103workqueue: Fix unbound pool lifetime for pending pwqs
- CVE-2026-99102ntfs: take invalidate_lock in ntfs_setattr_size()