Linux vulnerabilities
CVEs whose affected-version data names the Linux package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4700 CVEsRSS
CVE-2026-98706Nonewifi: mac80211: drain PS delivery work during station teardown
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drain PS delivery work during station teardown Removing an AP or mesh station can notify the driver and wake TXQs after the station has already been re…
CVE-2026-98705Nonewifi: mac80211: account proxy paths against the mesh path limit
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: account proxy paths against the mesh path limit Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed…
CVE-2026-98704Nonewifi: mac80211: keep fallback association elements alive
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep fallback association elements alive Associating to a non-transmitted MBSSID profile reads freed memory while determining the operating channel and…
CVE-2026-98710Nonewifi: iwlegacy: 3945: free EEPROM data on remove
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPROM data on remove il3945_pci_probe() calls il_eeprom_init(), which allocates memory for the EEPROM data. The probe failure paths release…
CVE-2026-98708Medium· 4.7wifi: mac80211: keep paired old chanctx alive
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old chanctx alive An in-place replacement keeps reciprocal replace_ctx pointers between the old WILL_BE_REPLACED chanctx and the new REPLAC…
CVE-2026-98707Nonewifi: mac80211: shut down RX BA session timer on teardown
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: shut down RX BA session timer on teardown Tearing down an RX BA session can leave the session timer queued on a freed tid_rx. Later timer-wheel process…
CVE-2026-98713NoneKVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT FGUs don't actually require hardware support, so don't gate fgt trap config insertion on FGT. This is the on…
CVE-2026-98711Medium· 4.6wifi: cw1200: fix TX padding OOB read leaking heap data to device
In the Linux kernel, the following vulnerability has been resolved: wifi: cw1200: fix TX padding OOB read leaking heap data to device The TX path rounds the transfer size up to the bus alignment (align_size(), up to 511 bytes for SDIO,…
CVE-2026-98709Nonewifi: mac80211: count only matching reservations in reserved switch
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: count only matching reservations in reserved switch ieee80211_vif_use_reserved_switch() validates a replacement by counting assigned links on ctx->repl…
CVE-2026-98715NoneKVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN Don't reset the VMCB's TLB control back to "do nothing" on a failed VMRUN, as empirical testing…
CVE-2026-98714NoneKVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded Leave control.erap_ctl and control.clean as-is in the VMCS if VMRUN fails, because as per AMD…
CVE-2026-98712NoneKVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq Referencing the last interrupt inserted in an LR is rather fragile, as this interrupt can vanish if…
CVE-2026-98720NoneKVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified Force a refresh of the vmcs02 MSR bitmap during nested VM-Enter if the runtime eVMCS control…
CVE-2026-98719NoneKVM: SEV: Nullify "have run CPUs" mask pointer when freeing it
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it Nullify have_run_cpus when freeing the mask, particularly in the error path of __sev_guest_init(), so th…
CVE-2026-98717NoneKVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i…
CVE-2026-98716NoneKVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted Use the MSR permission bitmap of the active VMCB instead of assuming that KVM is always …
CVE-2026-98722Nonemtd: block2mtd: Fix divide error when erase_size is zero
In the Linux kernel, the following vulnerability has been resolved: mtd: block2mtd: Fix divide error when erase_size is zero The erase size is parsed from the "block2mtd" module parameter and can be set to zero. add_device() then evalu…
CVE-2026-98721Nonemtd: rawnand: cadence: Initialize IRQ state before requesting IRQ
In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ The Cadence NAND interrupt handler uses both the IRQ lock and completion object. Registering the IRQ …
CVE-2026-98718NoneKVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state Explicitly flush caches after intra-host migration before clearing "SEV active" on the sour…
CVE-2026-98725Nonenvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() nvmet_auth_challenge() receives its output buffer as a void pointer. sizeof(*d) therefore evaluates to on…
CVE-2026-98724Nonenvmet: pci-epf: reject too-short SGL segments
In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: reject too-short SGL segments The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nr_descs zero, so nvmet…
CVE-2026-98723Nonenvmet: copy the hostid into the ctrl before creating PR pc_refs
In the Linux kernel, the following vulnerability has been resolved: nvmet: copy the hostid into the ctrl before creating PR pc_refs Commit 6202783184bf ("nvmet: Improve nvmet_alloc_ctrl() interface and implementation") added a second u…
CVE-2026-98734NoneBluetooth: hci_core: Serialize SCO and ISO scheduling with teardown
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown hci_low_sent() selects a connection under RCU but drops the read lock before calculating its quota …
CVE-2026-98733High· 7.0Bluetooth: hci_core: Serialize fragmented ISO packet queueing
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Serialize fragmented ISO packet queueing The fragmented path in hci_queue_iso() calls __skb_queue_tail() without holding conn->data_q.lock. The so…
CVE-2026-98740Medium· 4.1kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety (CVE-2026-98740)
A flaw was found in the Linux kernel's Altera Error Detection and Correction (EDAC) driver. Certain setup functions were incorrectly designated as temporary initialization routines that are released from memory after startup. When device r…
CVE-2026-98738Medium· 5.1Bluetooth: Serialize SMP remote OOB data access
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Serialize SMP remote OOB data access build_pairing_cmd() looks up remote OOB data and copies its contents without holding hdev->lock, which serializes the l…
CVE-2026-98737Medium· 4.7Bluetooth: hci_sync: Fix inquiry cache use-after-free
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix inquiry cache use-after-free The sync command worker holds hdev->req_lock, but inquiry-cache updates and flushes use hdev->lock. Both hci_acl_…
CVE-2026-98743Medium· 5.5kernel: ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type (CVE-2026-98743)
A flaw was found in the Linux kernel's rt1017 SDCA audio codec driver. The driver fails to initialize stream configuration data before passing it to the sound subsystem, leaving configuration fields populated with uninitialized memory. A l…
CVE-2026-98742Medium· 4.7ALSA: seq: Serialize compat port-info ioctls
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize compat port-info ioctls The native sequencer ioctl path serializes handler calls with client->ioctl_mutex, but the translated port-info compat pat…
CVE-2026-98746Low· 2.3kernel: serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() (CVE-2026-98746)
A flaw was found in the Linux kernel's ma35d1 serial driver. This flaw allows a local user to cause a Denial of Service (DoS) through resource exhaustion. The driver fails to release clock references during probe error handling or when the…