Linux CVEs
18,386 CVEs and advisories name Linux as an affected vendor, 14 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-93127bpf: Drop scalar id on sign-extending narrowing stack fills
- CVE-2026-93126remoteproc: qcom_q6v5_adsp: Fix reference leak for device node
- CVE-2026-93125bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max
- CVE-2026-93124platform/x86: asus-wireless: Fail probe when there is no ACPI match
- CVE-2026-93123serial: qcom-geni: do not advance stale DMA completions
- CVE-2026-93122usb: gadget: uac: validate rate list length before storing
- CVE-2026-93121usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths
- CVE-2026-93120usb: gadget: configfs: fix out-of-bounds read of qw_sign
- CVE-2026-93119usb: ljca: bound bank_num in ljca_enumerate_gpio()
- CVE-2026-93118usb: gadget: aspeed_udc: check endpoint DMA allocation
- CVE-2026-93117usb: fix UAF when probe runs concurrent to dyn ID removal
- CVE-2026-93116platform/x86: asus-wmi: fix resource leaks on probe failure
- CVE-2026-93115platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL
- CVE-2026-93114platform/surface: acpi-notify: Check ACPI companion before use
- CVE-2026-93113clk: qcom: camcc-sc8280xp: unregister CAMCC_GDSC_CLK
- CVE-2026-93112bpf: Require a BPF cpumask for bpf_cpumask_populate()
- CVE-2026-93111bpf: Mark tracing_multi trampolines as ftrace managed
- CVE-2026-93110RDMA/core: Wait for RCU callbacks before unloading ib_core
- CVE-2026-93109RDMA/mlx5: Drain RCU callbacks during module teardown
- CVE-2026-93108RDMA/ipoib: Drain RCU callbacks during module teardown
- CVE-2026-93107RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state
- CVE-2026-93106crash_dump: release keyring reference at the correct time
- CVE-2026-93105esp: do not unref managed frag pages in esp_ssg_unref()
- CVE-2026-93104RDMA/rvt: Return NULL after port allocation failure
- CVE-2026-93103RDMA/hfi1: Preserve unit 0 on allocation failure
- CVE-2026-93102RDMA/hfi1: Free RX data on late probe failure
- CVE-2026-93101media: v4l2-async: Unregister sub-device if asc_list is empty
- CVE-2026-93100fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()
- CVE-2026-93099fs/resctrl: Fix UAF from worker threads when domains are removed
- CVE-2026-93098rpmsg: glink: fix deadlock in endpoint destroy during driver detach