Linux CVEs
18,386 CVEs and advisories name Linux as an affected vendor, 14 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-90152smb/server: fix session leak in ksmbd_session_register()
- CVE-2026-90151NFSv4: remove callback IDR entry on client allocation failure
- CVE-2026-90150pnfs/blocklayout: Fix device leaks on parse failure
- CVE-2026-90149NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers
- CVE-2026-90148NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()
- CVE-2026-90147clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate()
- CVE-2026-90146bpf, xdp: move offload check into dev_xdp_install()
- CVE-2026-90145hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed
- CVE-2026-90144dpll: fix NULL deref in dpll_device_ops() during teardown race
- CVE-2026-90143net: kcm: Hold RCU read lock while running BPF parser
- CVE-2026-90142virtio_net: Fix resize of the RX ring
- CVE-2026-90141ipvs: fix integer overflow in ftp helper port/address parsing
- CVE-2026-90140cuse: wait for pending RCU callbacks on module exit
- CVE-2026-90139fuse: check for NULL root inode in fuse_fill_super_submount
- CVE-2026-90138vsock: don't check the listener's sk_err in vsock_accept()
- CVE-2026-90137platform/x86: hp-bioscfg: fix password encoding bounds check
- CVE-2026-90136platform/x86/amd/hsmp: Reject negative power cap writes in hwmon
- CVE-2026-90135net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()
- CVE-2026-90134ntfs: fix kmap_local_page() usage in compress
- CVE-2026-90133ntfs: Fix index_root heap OOB write in ntfs_ir_to_ib()
- CVE-2026-90132ntfs: reject unprivileged writes to reserved $LX* xattrs
- CVE-2026-90131ntfs: serialize resident iomap reads with mrec_lock
- CVE-2026-90130vdpa_sim: fix cleanup after worker creation failure
- CVE-2026-90129virtio_balloon: quiesce balloon work before device shutdown
- CVE-2026-90128vdpa/mlx5: fix wrong list iterated in add_direct_chain error path
- CVE-2026-90127virtio: rtc: time out alarm requests
- CVE-2026-90126rtc: pcf8563: fix clock provider leak on unbind
- CVE-2026-90125smb: client: fix request buffer leak in smb2_new_read_req()
- CVE-2026-90124irqchip/renesas-rzg2l: Fix loss of interrupt
- CVE-2026-90123irqchip/ast2700-intc: Avoid allocating in the irq_domain activate() callback