Linux vulnerabilities
CVEs whose affected-version data names the Linux package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4700 CVEsRSS
CVE-2026-99010NoneBluetooth: RFCOMM: free the skb when the DLC has no owner
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcomm_recv_data() hands the skb to d->data_ready() and returns 0 without freeing it, so the callback owns th…
CVE-2026-99021Noneregulator: of: fill in supply names in of_regulator_bulk_get_all()
In the Linux kernel, the following vulnerability has been resolved: regulator: of: fill in supply names in of_regulator_bulk_get_all() of_regulator_bulk_get_all() returns an array it allocated itself, and fills in only the consumer of …
CVE-2026-99019Nonescsi: ch: Do not keep references to data transfer element devices
In the Linux kernel, the following vulnerability has been resolved: scsi: ch: Do not keep references to data transfer element devices ch_readconfig() looks up the scsi_device of every data transfer element whose SCSI id the changer rep…
CVE-2026-99013High· 7.8Bluetooth: ISO: Reject concurrent BIS listener setup
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup iso_sock_listen() drops the socket lock before calling iso_listen_bis() to preserve the hdev->lock ordering. Two c…
CVE-2026-99024Noneoptee: register TEE devices only once fully initialized
In the Linux kernel, the following vulnerability has been resolved: optee: register TEE devices only once fully initialized optee_probe() called tee_device_register() on both the client and the supplicant device before the rest of stru…
CVE-2026-99022Noneregulator: ltc3676: don't read the write-only HRST and CLIRQ registers
In the Linux kernel, the following vulnerability has been resolved: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST (0x1e) and CLIRQ (0x1f) are write-only command strobes. Writing HRST triggers a hard reset …
CVE-2026-99020Noneregulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4
In the Linux kernel, the following vulnerability has been resolved: regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 The TPS65224 BUCK2, BUCK3 and BUCK4 descriptors pass 4 as n_linear_ranges, but tps65224_bucks_2_…
CVE-2026-99026Nonenet: team: free skb when broadcast has no txable port
In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bc_transmit() sends the original skb through the last txable port. When no port is txable, it returns false witho…
CVE-2026-99025Noneopenvswitch: fix soft lockup in the netlink flow dump
In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix soft lockup in the netlink flow dump A production compute node carrying a few thousand datapath flows hit a soft lockup inside a single netlink flow d…
CVE-2026-99023Nonepower: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()
In the Linux kernel, the following vulnerability has been resolved: power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all() of_regulator_bulk_get_all() allocates the consumers array and hands it to the caller, wh…
CVE-2026-99031Nonenet: bridge: avoid recursive multicast port cleanup
In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup br_multicast_sg_del_exclude_ports() removes automatically added STAR_EXCL port groups by calling br_multicast_del_p…
CVE-2026-99028Nonenet: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop
In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the dmaengine path the driver pre-submits RX buffers and holds in-flight TX buffers whose SKBs …
CVE-2026-99029Nonenet: sparx5: free the matchall entry on destroy
In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5_tc_matchall_replace() allocates a struct sparx5_mall_entry for every offloaded matchall filter and adds it to sp…
CVE-2026-99027Nonenet: team: stop reusing skb after queue override
In the Linux kernel, the following vulnerability has been resolved: net: team: stop reusing skb after queue override A nonzero dev_queue_xmit() result does not return ownership of the skb. When an override port's qdisc drops it, the qu…
CVE-2026-99035Nonemmc: mtk-sd: Cancel request timeout work on remove
In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues req_timeout while a request is active. msdc_request_done() uses cancel_delayed_work(), which does …
CVE-2026-99034Nonemmc: sdhci-sprd: disable runtime PM on remove
In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhci_sprd_probe() enables runtime PM, while sdhci_sprd_remove() does not perform the corresponding runtime PM cleanup. …
CVE-2026-99033Nonenet/packet: guard the ll header push in packet_rcv_spkt()
In the Linux kernel, the following vulnerability has been resolved: net/packet: guard the ll header push in packet_rcv_spkt() packet_rcv_spkt() restores the link layer header with skb_push(skb, skb->data - skb_mac_header(skb)); That…
CVE-2026-99032High· 7.8net/smc: protect clcsock lifetime in smc_getname
In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smc_getname smc_getname() dereferences smc->clcsock without holding clcsock_release_lock. Link-group termination can release the C…
CVE-2026-99030High· 7.5net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() When skb_copy_and_csum_bits() reaches unreadable frags it returns 0 after copying only the linear part…
CVE-2026-99040NoneKEYS: Fix add_key() race with keyring restriction
In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix add_key() race with keyring restriction __key_create_or_update() snapshots keyring->restrict_link before taking the destination keyring's semaphore. keyring…
CVE-2026-99038Nonememstick: rtsx_usb_ms: complete requests after eject instead of dropping them
In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: complete requests after eject instead of dropping them memstick_check() can pass its host->removing check just before rtsx_usb_ms_drv_remove() s…
CVE-2026-99036Nonedm: fix reading free memory in do_resume
In the Linux kernel, the following vulnerability has been resolved: dm: fix reading free memory in do_resume When do_resume calls dm_table_get_mode(new_map), the call is done without holding any locks (it only holds a reference to the …
CVE-2026-99042High· 8.4io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
In the Linux kernel, the following vulnerability has been resolved: io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 io_connect_bpf_populate() fills connect.port and connect.v6_addr for AF_INET6 only when addr_len …
CVE-2026-99039Nonememstick: core: wait for request completion before freeing card
In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstick_alloc_card() and memstick_set_rw_addr(), wait_for_completion_timeout() is used to wait for …
CVE-2026-99037Nonedm-crypt: reject the lmk IV mode with AEAD ciphers
In the Linux kernel, the following vulnerability has been resolved: dm-crypt: reject the lmk IV mode with AEAD ciphers A "capi:" table line that pairs an AEAD cipher with the lmk IV mode, for example "capi:gcm(aes)-lmk" with the integr…
CVE-2026-99045Noneibmveth: h_free logical LAN on open-fail after register
In the Linux kernel, the following vulnerability has been resolved: ibmveth: h_free logical LAN on open-fail after register ibmveth_open() registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out_free_…
CVE-2026-99043Noneice: fix metadata_dst refcount handling on representor teardown
In the Linux kernel, the following vulnerability has been resolved: ice: fix metadata_dst refcount handling on representor teardown ice_eswitch_release_repr() uses metadata_dst_free() to release the representor's metadata_dst. metadat…
CVE-2026-99048Nonegve: fix napi_disable deadlock when attempting to disable XSK pools
In the Linux kernel, the following vulnerability has been resolved: gve: fix napi_disable deadlock when attempting to disable XSK pools When disabling XSK pools, GVE calls the unlocked versions of napi_disable and napi_enable. However,…
CVE-2026-99044Noneice: fix use-after-free in dynamic port cleanup
In the Linux kernel, the following vulnerability has been resolved: ice: fix use-after-free in dynamic port cleanup ice_dealloc_dynamic_port() uses dyn_port->vsi->idx to erase the dynamic port from pf->dyn_ports. However, it frees the …
CVE-2026-99041Noneip6_gre: remove obsolete ERSPAN PMTU update
In the Linux kernel, the following vulnerability has been resolved: ip6_gre: remove obsolete ERSPAN PMTU update A tc tunnel_key action can attach a METADATA_IP_TUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan devi…