Linux vulnerabilities
CVEs whose affected-version data names the Linux package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4700 CVEsRSS
CVE-2026-99050High· 7.8gpio: mpsse: fix race when arming the IRQ poll worker
In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpio_mpsse_irq_enable() arms the poll worker before publishing it: schedule_work() runs before the worker is adde…
CVE-2026-99047Nonegve: fix XSK buffer leak when rings are stopped
In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak when rings are stopped GVE does not free XSK buffers when resetting ring state as a part of stopping queues. This causes all XSK buffers which…
CVE-2026-99049Nonegpio: xilinx: fix runtime PM leak on request error path
In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: fix runtime PM leak on request error path pm_runtime_get_sync() leaves the usage counter incremented even when it fails, and xgpio_request() returns the …
CVE-2026-99046High· 7.5gve: fix XSK buffer leak on error descriptor
In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the buf_state and its attached buffer should be freed. In the c…
CVE-2026-99058Noneworkqueue: Fix NULL current_pwq deref in chained work check
In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL current_pwq deref in chained work check current_wq_worker() only tells us that %current is a kworker. It does not guarantee that the worker is curr…
CVE-2026-99055Nonetcp: reject net_iov in zerocopy receive mapping hints
In the Linux kernel, the following vulnerability has been resolved: tcp: reject net_iov in zerocopy receive mapping hints After copying a readable prefix, receive_fallback_to_copy() asks tcp_zerocopy_set_hint_for_skb() where page mappi…
CVE-2026-99052Noneselinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts
In the Linux kernel, the following vulnerability has been resolved: selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts When an NFSv4 filesystem exported with security_label is mounted a second time, sget_fc() ret…
CVE-2026-99057Nonexen/netfront: don't leak the skb when xennet_fill_frags() fails
In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennet_fill_frags() fails When a response chain has more slots than fit in the skb's frags, xennet_fill_frags() returns an error …
CVE-2026-99051High· 7.8fsverity: RCU-delay the freeing of struct fsverity_info
In the Linux kernel, the following vulnerability has been resolved: fsverity: RCU-delay the freeing of struct fsverity_info __fsverity_get_info() calls rhashtable_lookup_fast(), which just uses rcu_read_lock() and doesn't directly sync…
CVE-2026-99056High· 7.8strparser: make sure __strp_recv isn't running before tearing down the parser
In the Linux kernel, the following vulnerability has been resolved: strparser: make sure __strp_recv isn't running before tearing down the parser The comment above strp_done() claims that if strp is stopped, strp_recv will no longer be…
CVE-2026-99053High· 7.8tipc: hold a reference to nodes found by link name
In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipc_node_find_by_name() returns a node after dropping its RCU read lock without taking a reference. The LINK_SET, …
CVE-2026-99066Nonecan: dev: init_can_skb(): restore skb header initialization
In the Linux kernel, the following vulnerability has been resolved: can: dev: init_can_skb(): restore skb header initialization Commit 9f10374bb024 ("can: remove private CAN skb headroom infrastructure") removed the skb_reset_mac_heade…
CVE-2026-99054High· 7.8tipc: destroy topsrv workqueues before closing connections
In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipc_topsrv_stop() closed subscriber connections while the topology server's send and receive workqueues wer…
CVE-2026-99062Nonevsock/virtio: account only unread bytes in read_skb()
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in read_skb() After a partial stream receive, rx_bytes tracks the unread suffix while buf_used and peer credit still cover the …
CVE-2026-99060Nonewifi: mt76: mt7603: initialize global station WCID
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames …
CVE-2026-99059High· 7.7wireguard: noise: reject response consumption after intermediate initiation
In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing the identical response message, received twice. The first thre…
CVE-2026-99065Nonecgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()
In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus() With commit 2125c0034c5d ("cgroup/cpuset: Make cpuset hotplug processing synchronous"), the cpuset ho…
CVE-2026-99064High· 8.1cipso: adjust cached option offsets when removing CIPSO
In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust cached offsets for options that follow th…
CVE-2026-99061Nonewifi: brcmfmac: fix P2P device removal race in brcmf_detach()
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmf_detach() When the driver is removed while the user space process that created the P2P device (e.g. wpa_supplicant)…
CVE-2026-99069NoneInput: ati_remote2 - fix type confusion in device attribute handlers
In the Linux kernel, the following vulnerability has been resolved: Input: ati_remote2 - fix type confusion in device attribute handlers Previously, the channel_mask and mode_mask attributes were registered on the parent usb_device via…
CVE-2026-99063Nonedm ioctl: don't let data_start run past the buffer
In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let data_start run past the buffer struct dm_ioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offseto…
CVE-2026-99070Noneipv6: do not warn on route notification size race
In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later fills it with rt6_fill_node(). With nexthop c…
CVE-2026-99068NoneALSA: ctxfi: Fix memory leakage when clearing DAO input mappers
In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d ("ALSA: ctxfi: Simplify dao_clear_{left,right}_input() functions") centralized the …
CVE-2026-99067Nonebtrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() When paths_from_inode() fails, scrub_print_warning_inode() jumps to err without dropping the…
CVE-2026-99073Noneipv4: stop exception dump when nexthop group shrinks
In the Linux kernel, the following vulnerability has been resolved: ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de ("inet: switch inet_dump_fib() to RCU protection") allowed IPv4 FIB dumps to run concurrently …
CVE-2026-99072Noneipv4: stop route notification sizing when nexthop group shrinks
In the Linux kernel, the following vulnerability has been resolved: ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c ("net: ipv4: Emit notification when fib hardware flags are changed") added an RCU-o…
CVE-2026-99071Noneipv4: do not warn on route notification size race
In the Linux kernel, the following vulnerability has been resolved: ipv4: do not warn on route notification size race Commit 680aea08e78c ("net: ipv4: Emit notification when fib hardware flags are changed") added asynchronous route not…
CVE-2026-99076Noneipv6: udp: Create exceptions before socket matching
In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP packet, an…
CVE-2026-99075Nonerust_binder: reschedule node refcount update on thread exit
In the Linux kernel, the following vulnerability has been resolved: rust_binder: reschedule node refcount update on thread exit When a thread exits via BINDER_THREAD_EXIT, its pending work items are cancelled. If a thread exits while h…
CVE-2026-99081High· 7.5bnxt_en: fix DMA mapping length for padded small packets
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: fix DMA mapping length for padded small packets Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412 NetXtreme-E NICs when transmitting packets…