Linux vulnerabilities
CVEs whose affected-version data names the Linux package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4700 CVEsRSS
CVE-2026-98750Medium· 4.7tty: fix saved termios reset race
In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device an…
CVE-2026-98749Medium· 4.7tty: serial: max3100: shut down timer before freeing port
In the Linux kernel, the following vulnerability has been resolved: tty: serial: max3100: shut down timer before freeing port max3100_shutdown() stops the polling timer but returns early during system suspend. If the SPI device is unbo…
CVE-2026-98748Medium· 4.1serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
In the Linux kernel, the following vulnerability has been resolved: serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() brcmuart_handle_irq() starts priv->hrt to work around a receive-timeout quirk of the 8250 core when hardw…
CVE-2026-98754High· 7.0tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup
In the Linux kernel, the following vulnerability has been resolved: tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup vcc_cleanup() sets port->tty to NULL without holding port->lock, racing with vcc_event() LDC callback…
CVE-2026-98758Medium· 4.1kernel: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (CVE-2026-98758)
A flaw was found in the Linux kernel's USB Type-C Connector System Software Interface (UCSI) GLINK driver. A local attacker with administrative privileges could trigger this flaw during device removal, leading to a Denial of Service (DoS) …
CVE-2026-98755Low· 3.3tty: vcc: zero-initialize control packet in vcc_send_ctl()
In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vcc_send_ctl() The stack-allocated struct vio_vcc pkt was partially initialized, leaving the tag.stype_env field uninitiali…
CVE-2026-98765Medium· 4.1kernel: USB: gadget: dummy-hcd: Fix wait for outstanding request completions (CVE-2026-98765)
A flaw was found in the Linux kernel's USB dummy Host Controller Driver (dummy-hcd). This vulnerability occurs because the driver fails to properly wait for active request completion callbacks before unbinding or unloading the module. A lo…
CVE-2026-98766Medium· 4.1kernel: usb: gadget: aspeed-vhub: cancel wake work on device removal (CVE-2026-98766)
A flaw was found in the Linux kernel's Aspeed virtual hub (vhub) driver. When a device is removed, scheduled wakeup tasks are not properly canceled, allowing background work to run after the associated memory structures have been freed. A …
CVE-2026-98762Medium· 4.7USB: dwc2: shut down wakeup timer before freeing HCD state
In the Linux kernel, the following vulnerability has been resolved: USB: dwc2: shut down wakeup timer before freeing HCD state dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the wakeup timer. dwc2_hcd_free() current…
CVE-2026-98768Medium· 4.7usb: typec: anx7411 - stop the IRQ before destroying the workqueue
In the Linux kernel, the following vulnerability has been resolved: usb: typec: anx7411 - stop the IRQ before destroying the workqueue The IRQ is devm-managed, so it can still queue plat->work while remove() is tearing the queue down. …
CVE-2026-98764Medium· 4.4kernel: usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (CVE-2026-98764)
A flaw was found in the Linux kernel's USB (Universal Serial Bus) FunctionFS gadget subsystem. A local user can cause a Denial of Service (DoS) by triggering a kernel crash when querying endpoint descriptors on a USB gadget configured with…
CVE-2026-98770Medium· 4.4kernel: usb: gadget: midi2: Fix the jack descriptor array sizes (CVE-2026-98770)
A flaw was found in the Linux kernel's USB gadget MIDI 2.0 driver. Under-sized descriptor arrays allow a local user to trigger an out-of-bounds memory access when setting up a large number of MIDI jacks through the configuration filesystem…
CVE-2026-98769High· 8.4kernel: usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (CVE-2026-98769)
A flaw was found in the Linux kernel's Universal Serial Bus (USB) audio gadget driver. A connected USB host can send a specially crafted audio control request with an invalid command index, causing an out-of-bounds heap memory read and wri…
CVE-2026-98774Low· 3.3kernel: rust_binder: cancel deferred work items in thread exit (CVE-2026-98774)
A flaw was found in the Linux kernel's Rust Binder driver. When a thread terminates while handling an active outgoing transaction, deferred work items on the thread's task list are not properly cleaned up during thread release. A local att…
CVE-2026-98778Medium· 5.5kernel: binder: fix is_failure flag for superseded transaction cleanup (CVE-2026-98778)
A flaw was found in the Linux kernel's Android Binder driver. This vulnerability allows a local user to cause a Denial of Service (DoS) or application disruption by triggering the unexpected closure of unrelated file descriptors in a targe…
CVE-2026-98777Low· 3.3kernel: binder: fix leaked fd fixups on TF_UPDATE_TXN supersede (CVE-2026-98777)
A flaw was found in the Linux kernel's Android Binder inter-process communication (IPC) driver. When an asynchronous transaction supersedes an earlier pending transaction in a frozen process, the kernel frees the outdated transaction witho…
CVE-2026-98782Low· 2.3kernel: drm/mediatek: Fix ovl adaptor platform device leak (CVE-2026-98782)
A flaw was found in the Linux kernel's MediaTek DRM (Direct Rendering Manager) driver. When device initialization fails or during driver removal, the driver fails to unregister an allocated overlay adaptor platform device. A local user cou…
CVE-2026-98781Low· 2.3kernel: drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (CVE-2026-98781)
A flaw was found in the Linux kernel's MediaTek DRM (Direct Rendering Manager) driver. When binding non-master display devices, the driver fails to release a device reference acquired during initialization. A local user could exploit this …
CVE-2026-98784Low· 2.3drm/amdgpu/gfx6: fix firmware leak on teardown
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: fix firmware leak on teardown The firmware requested in gfx_v6_0_init_microcode() is not released when the GFX block is torn down, leaking the firmwar…
CVE-2026-98783Medium· 4.1kernel: drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (CVE-2026-98783)
A flaw was found in the Linux kernel's MediaTek DRM (Direct Rendering Manager) driver. The driver fails to verify whether the display overlay adaptor platform device is successfully registered during initialization. If the registration fai…
CVE-2026-98788Nonefutex: Fix private hash use-after-free on resize
In the Linux kernel, the following vulnerability has been resolved: futex: Fix private hash use-after-free on resize poll_state_synchronize_rcu(mm->futex.phash.batches) is used by futex_ref_drop() to check that a grace period has passe…
CVE-2026-98787Medium· 4.1kernel: bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch() (CVE-2026-98787)
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. Missing CPU migration protection during batch lookup and delete operations on hash tables allows a task to migrate between processors while freeing memory. A lo…
CVE-2026-98796Medium· 4.1kernel: net: ethernet: mtk_eth_soc: allocate dummy netdev sooner (CVE-2026-98796)
A flaw was found in the Linux kernel's MediaTek Ethernet driver. This vulnerability allows a local user with network administration privileges to cause a Denial of Service (DoS) through a kernel crash. Due to an ordering issue during devic…
CVE-2026-98795Medium· 4.4kernel: net: sparx5: skip ptp deinit if init was skipped (CVE-2026-98795)
A flaw was found in the Linux kernel's Microchip Sparx5 network driver. When operating on devices where Precision Time Protocol (PTP) initialization is skipped, the driver does not check if PTP was initialized before executing its deinitia…
CVE-2026-98803Medium· 6.5kernel: net: stmmac: fix rx Scatter-Gather support (CVE-2026-98803)
A flaw was found in the Linux kernel's stmmac ethernet driver. When receiving network frames larger than the primary buffer size, the Direct Memory Access (DMA) engine attempts to write excess data into a secondary receive buffer that is n…
CVE-2026-98808Medium· 6.7kernel: net: systemport: Fix buffer overflow in bcm_sysport_get_stats() (CVE-2026-98808)
A flaw was found in the Linux kernel's Broadcom SYSTEMPORT driver. This vulnerability can lead to a Denial of Service (DoS) or memory corruption when a local user queries network device statistics on systems with SYSTEMPORT Lite hardware. …
CVE-2026-98812Medium· 5.5kernel: net/mctp: publish the mctp_dev only after it is initialised (CVE-2026-98812)
A flaw was found in the Linux kernel's Management Component Transport Protocol (MCTP) subsystem. This vulnerability allows a local user to cause a Denial of Service (DoS) by triggering a kernel crash. During device setup, the kernel expose…
CVE-2026-98813Medium· 4.4kernel: bpf: Hold map BTF for the memory allocator destructor record (CVE-2026-98813)
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. During the teardown of certain BPF hash maps, the memory allocator destructor failed to retain a reference to the map's BPF Type Format (BTF) metadata, allowing…
CVE-2026-98815Medium· 4.1nvme: fix cdev lifetime
In the Linux kernel, the following vulnerability has been resolved: nvme: fix cdev lifetime Sashiko bot reported a potential problem for the cdev lifetime in [0] - the code there is heavily based on the NVMe code. Currently the NS hea…
CVE-2026-98817NoneASoC: SDCA: Add better pm_runtime error handling in func probe
In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add better pm_runtime error handling in func probe Add a common error path in probe that balances the runtime PM reference.