Linux CVEs
18,386 CVEs and advisories name Linux as an affected vendor, 14 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-89489openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
- CVE-2026-89488openvswitch: Fix CT limit teardown use-after-free
- CVE-2026-89487openvswitch: only skb_tx_error() a packet we are about to drop
- CVE-2026-89486ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()
- CVE-2026-89485lockd: pin next file across nlm_inspect_file lock-drop
- CVE-2026-89484lockd: fix NULL dereference on lockowner allocation failure
- CVE-2026-89483nvme: zero the discard fallback page
- CVE-2026-89482nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
- CVE-2026-89481nvme-tcp: fix host memory disclosure on R2T for a read command
- CVE-2026-89480nvme-tcp: reject a read that transferred too few bytes
- CVE-2026-89479sctp: stop processing a packet once its association is deleted
- CVE-2026-89478sctp: drop a chunk if its transport was removed
- CVE-2026-89477sctp: fix NULL deref on untransmitted RECONF completion
- CVE-2026-89476sctp: fix stream->outcnt underflow on duplicate RECONF responses
- CVE-2026-89475power: supply: bq24257: fix use-after-free on remove
- CVE-2026-89474power: supply: bq256xx: drain usb_work before freeing the charger
- CVE-2026-89473power: supply: bq25890: Fix power_supply reference leak
- CVE-2026-89472power: supply: charger-manager: register regulators before exposing sysfs
- CVE-2026-89471power: supply: cros_usbpd-charger: bound the EC-reported port count
- CVE-2026-89470power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
- CVE-2026-89469power: supply: lp8727: fix use-after-free in lp8727_release_irq()
- CVE-2026-89468power: supply: lp8788-charger: fix use-after-free on remove
- CVE-2026-89467power: supply: qcom_battmgr: fix use-after-free
- CVE-2026-89466power: supply: qcom_battmgr: terminate the strings from firmware
- CVE-2026-89465power: supply: rt9455: quiesce delayed work before teardown
- CVE-2026-89464power: supply: twl4030_charger: cancel workers via devm
- CVE-2026-89463power: supply: ucs1002: fix use-after-free on remove
- CVE-2026-89462power: supply: max17040: propagate register read errors
- CVE-2026-89461power: supply: max17040: synchronize work cancellation on suspend
- CVE-2026-89460s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks