Linux vulnerabilities
CVEs whose affected-version data names the Linux package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4584 CVEsRSS
CVE-2026-99092Noneriscv: patch: fix handling of bpf-jit execmem addresses
In the Linux kernel, the following vulnerability has been resolved: riscv: patch: fix handling of bpf-jit execmem addresses Commit 8718e5a3090b ("riscv: patch: skip fixmap mapping when kernel text is already writable") gated the core_k…
CVE-2026-99089NoneASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
In the Linux kernel, the following vulnerability has been resolved: ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM The probe function puts the device into the runtime PM active state with only the "iis" bus clock enab…
CVE-2026-99093Nonemm: don't schedule deferred kernel page table freeing while booting
In the Linux kernel, the following vulnerability has been resolved: mm: don't schedule deferred kernel page table freeing while booting Booting with a boot-time function tracer and a filter, for example ftrace=function ftrace_filter…
CVE-2026-99088Nonenet: openvswitch: validate transport header presence in set_ipv6_addr
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: validate transport header presence in set_ipv6_addr When executing IPv6 address rewrite actions on IPv6 fragments, set_ipv6_addr() calls update_ipv6_…
CVE-2026-99094NoneBluetooth: btintel_pcie: fix TX descriptor bounds check
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: fix TX descriptor bounds check btintel_pcie_prepare_tx() uses tfd_index to access the TFD and data buffer arrays before the index is advanced …
CVE-2026-99090Nonedrm/amdgpu: serialize vblank counter reads against GPU reset
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: serialize vblank counter reads against GPU reset The vblank counter callback reads display registers and scanout position without holding reset_domain->sem…
CVE-2026-99097Nonetee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
In the Linux kernel, the following vulnerability has been resolved: tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper() tee_dyn_shm_alloc_helper() derives nr_pages from a caller-supplied size and passes it to alloc_pa…
CVE-2026-99095Nonedrm/vc4: drain the hangcheck timer and works on V3D unbind
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the job_done_work that the render-done interru…
CVE-2026-99091NoneBluetooth: MGMT: Fix status of pending commands flushed on power off
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix status of pending commands flushed on power off cmd_complete_rsp() receives a struct cmd_lookup and, for a pending command that has no cmd_complet…
CVE-2026-99099Nonex86/CPU/AMD: Fix AMD TLBI Erratum #1718
In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Fix AMD TLBI Erratum #1718 The processor may fail to invalidate a TLB entry while executing an INVLPGB/TLBSYNC instruction pair. Detect the erratum and a…
CVE-2026-99098Nonedm-integrity: fix buffer overflow in inline mode with large tag size
In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow in inline mode with large tag size In inline mode, dm_integrity_check and dm_integrity_inline_recheck compute the checksum of each bl…
CVE-2026-99096Noneio_uring/register: don't exempt disabled rings from task restrictions
In the Linux kernel, the following vulnerability has been resolved: io_uring/register: don't exempt disabled rings from task restrictions A ring created with IORING_SETUP_R_DISABLED is exempt from its register restrictions until it is …
CVE-2026-98870Medium· 6.5⚖ disputedkernel: ksmbd: remove stale channels from all sessions on teardown (CVE-2026-98870)
A flaw was found in the Linux kernel's ksmbd Server Message Block (SMB) server. A remote attacker could trigger this vulnerability by establishing and terminating bound SMB channels, leaving stale connection references attached to active s…
CVE-2026-98882Nonemedia: chips-media: wave5: Add range checks for dec_output_info
In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add range checks for dec_output_info If the driver's dec_output_info contains invalid data the driver can write in invalid memory. Add a ran…
CVE-2026-98878Noneirqchip/gic-v5: Immediately exec priority drop following activate
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v5: Immediately exec priority drop following activate With GICv5 an interrupt of equal or lower priority cannot be signalled until there has been a priorit…
CVE-2026-98875Medium· 4.4kernel: drm/nouveau/gsp: add SEC2 to GA100 chip table (CVE-2026-98875)
A flaw was found in the Linux kernel's Nouveau GPU driver. During graphics hardware initialization on systems with GA100 chipsets, the driver fails to properly configure an internal security processor entry, leaving a required pointer unin…
CVE-2026-98883Noneserial: 8250_port: recognize UPIO_AU
In the Linux kernel, the following vulnerability has been resolved: serial: 8250_port: recognize UPIO_AU My MIPS Alchemy systems generate the following warning during probe of the 8250 driver: WARNING: drivers/tty/serial/8250/8250_por…
CVE-2026-98881Nonenet: bridge: remove stale rcu_barrier() in br_multicast_dev_del()
In the Linux kernel, the following vulnerability has been resolved: net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() This rcu_barrier() came from a time call_rcu() calls were used in net/bridge/br_multicast.c. Now kfr…
CVE-2026-98884Nonemmc: core: Add validation for host-provided max_segs
In the Linux kernel, the following vulnerability has been resolved: mmc: core: Add validation for host-provided max_segs The max_segs field is of type unsigned short, and if a host driver sets an excessively large value, it may be trun…
CVE-2026-98880Nonentfs3: handle set_blocksize failures
In the Linux kernel, the following vulnerability has been resolved: ntfs3: handle set_blocksize failures ntfs3 uses buffer_heads, which don't handle block size > PAGE_SIZE well. Without this, mounting we will hit the BUG_ON(of…
CVE-2026-98879Noneisofs: handle set_blocksize failures
In the Linux kernel, the following vulnerability has been resolved: isofs: handle set_blocksize failures isofs uses buffer_heads, which don't handle block size > PAGE_SIZE well. Without this, mounting we will hit the BUG_ON(of…
CVE-2026-98891Nonewifi: mac80211: validate deauth frame length before reason access
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate deauth frame length before reason access ieee80211_rx_mgmt_deauth() reads the deauth reason code before checking that the fixed field is actua…
CVE-2026-98887Nonewifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO hwsim_tx_info_frame_received_nl() casts the HWSIM_ATTR_TX_INFO payload to a struct hwsim_tx_rate * and uncon…
CVE-2026-98886Nonedrm/gma500: return errors from Oaktrail HDMI I2C reads
In the Linux kernel, the following vulnerability has been resolved: drm/gma500: return errors from Oaktrail HDMI I2C reads xfer_read() waits for the HDMI I2C transaction to reach I2C_TRANSACTION_DONE, but it ignores both timeout and si…
CVE-2026-98890Nonewifi: libertas: reject short monitor TX frames
In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: reject short monitor TX frames In monitor mode, lbs_hard_start_xmit() casts skb->data to a radiotap TX header, skips that header, and then copies the 8…
CVE-2026-98888Nonearm64: kprobes: Allow reentering kprobes while single-stepping
In the Linux kernel, the following vulnerability has been resolved: arm64: kprobes: Allow reentering kprobes while single-stepping A kprobe can be hit while another kprobe is in KPROBE_HIT_SS state. This can happen when tracing or perf…
CVE-2026-98885Noneima: return error early if file xattr cannot be changed
In the Linux kernel, the following vulnerability has been resolved: ima: return error early if file xattr cannot be changed During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of…
CVE-2026-98896Nonethunderbolt: Keep the domain reference while processing hotplug
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tb_domain_re…
CVE-2026-98894Nonedrm/amd/ras: reset CPER ring on corrupt entry size
In the Linux kernel, the following vulnerability has been resolved: drm/amd/ras: reset CPER ring on corrupt entry size When CPER ring overflow handling advances the read pointer, it trusts the parsed entry size from the current ring co…
CVE-2026-98889High· 7.8wifi: iwlwifi: mvm: fix sched scan IE sizing
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwl_mvm_scan_fits(), so oversized IEs could be copied into the fixed preq bu…