Linux vulnerabilities
CVEs whose affected-version data names the Linux package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6539 CVEsRSS
CVE-2026-45917Noneipvs: do not keep dest_dst if dev is going down
In the Linux kernel, the following vulnerability has been resolved: ipvs: do not keep dest_dst if dev is going down There is race between the netdev notifier ip_vs_dst_event() and the code that caches dst with dev that is going down. A…
CVE-2026-45893Noneapparmor: Fix & Optimize table creation from possibly unaligned memory
In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix & Optimize table creation from possibly unaligned memory Source blob may come from userspace and might be unaligned. Try to optize the copying process by…
CVE-2026-45877NoneHID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients
In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients During a warm reset flow, the cl->device pointer may be NULL if the reset occurs while clients a…
CVE-2026-45943Noneerofs: fix inline data read failure for ztailpacking pclusters
In the Linux kernel, the following vulnerability has been resolved: erofs: fix inline data read failure for ztailpacking pclusters Compressed folios for ztailpacking pclusters must be valid before adding these pclusters to I/O chains. …
CVE-2026-45934Nonebtrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation I have been observing a number of systems aborting at insert_dev_extents() in btrfs_create_pend…
CVE-2026-46008Nonemm/damon/core: fix damos_walk() vs kdamond_fn() exit race
In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: fix damos_walk() vs kdamond_fn() exit race When kdamond_fn() main loop is finished, the function cancels remaining damos_walk() request and unset the da…
CVE-2026-45940Nonenet: stmmac: fix oops when split header is enabled
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix oops when split header is enabled For GMAC4, when split header is enabled, in some rare cases, the hardware does not fill buf2 of the first descriptor…
CVE-2026-45932High· 7.3bpf: Fix tcx/netkit detach permissions when prog fd isn't given
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix tcx/netkit detach permissions when prog fd isn't given This commit fixes a security issue where BPF_PROG_DETACH on tcx or netkit devices could be executed by …
CVE-2026-45949Nonehwrng: core - use RCU and work_struct to fix race condition
In the Linux kernel, the following vulnerability has been resolved: hwrng: core - use RCU and work_struct to fix race condition Currently, hwrng_fill is not cleared until the hwrng_fillfn() thread exits. Since hwrng_unregister() reads …
CVE-2026-46014NoneKVM: SVM: Add missing save/restore handling of LBR MSRs
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Add missing save/restore handling of LBR MSRs MSR_IA32_DEBUGCTLMSR and LBR MSRs are currently not enumerated by KVM_GET_MSR_INDEX_LIST, and LBR MSRs cannot b…
CVE-2026-45973NoneRDMA/mlx5: Fix UMR hang in LAG error state unload
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix UMR hang in LAG error state unload During firmware reset in LAG mode, a race condition causes the driver to hang indefinitely while waiting for UMR comp…
CVE-2026-45956High· 7.8drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()
In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() vidi_connection_ioctl() retrieves the driver_data from drm_dev->dev to obtain a struct v…
CVE-2026-46071NoneKVM: nSVM: Avoid clearing VMCB_LBR in vmcb12
In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 svm_copy_lbrs() always marks VMCB_LBR dirty in the destination VMCB. However, nested_svm_vmexit() uses it to copy LBRs to …
CVE-2026-46066Noneceph: fix num_ops off-by-one when crypto allocation fails
In the Linux kernel, the following vulnerability has been resolved: ceph: fix num_ops off-by-one when crypto allocation fails move_dirty_folio_in_page_array() may fail if the file is encrypted, the dirty folio is not the first in the b…
CVE-2026-46059NoneKVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN
In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN For guests with NRIPS disabled, L1 does not provide NextRIP when running an L2 with an injected …
CVE-2026-46078High· 7.1erofs: fix the out-of-bounds nameoff handling for trailing dirents
In the Linux kernel, the following vulnerability has been resolved: erofs: fix the out-of-bounds nameoff handling for trailing dirents Currently we already have boundary-checks for nameoffs, but the trailing dirents are special since t…
CVE-2026-46076High· 7.9KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 Explicitly synthesize a #UD for VMMCALL if L2 is active, L1 does NOT want to intercept VMMCALL, neste…
CVE-2026-46052High· 7.5ceph: only d_add() negative dentries when they are unhashed
In the Linux kernel, the following vulnerability has been resolved: ceph: only d_add() negative dentries when they are unhashed Ceph can call d_add(dentry, NULL) on a negative dentry that is already present in the primary dcache hash. …
CVE-2026-46043Critical· 9.1RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least header_size(pkt) bytes long befor…
CVE-2026-46027High· 7.5net/smc: avoid early lgr access in smc_clc_wait_msg
In the Linux kernel, the following vulnerability has been resolved: net/smc: avoid early lgr access in smc_clc_wait_msg A CLC decline can be received while the handshake is still in an early stage, before the connection has been associ…
CVE-2026-46024High· 7.5libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()
In the Linux kernel, the following vulnerability has been resolved: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() If a message of type CEPH_MSG_AUTH_REPLY contains a zero value for both protocol and result, this…
CVE-2026-45988Critical· 9.8rxrpc: Fix re-decryption of RESPONSE packets
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix re-decryption of RESPONSE packets If a RESPONSE packet gets a temporary failure during processing, it may end up in a partially decrypted state - and then g…
CVE-2026-45972Critical· 9.8smb: client: fix potential UAF and double free in smb2_open_file()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF and double free in smb2_open_file() Zero out @err_iov and @err_buftype before retrying SMB2_open() to prevent an UAF bug if @data != NUL…
CVE-2026-45970High· 7.8bonding: alb: fix UAF in rlb_arp_recv during bond up/down
In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix UAF in rlb_arp_recv during bond up/down The ALB RX path may access rx_hashtbl concurrently with bond teardown. During rapid bond up/down cycles, rlb_…
CVE-2026-45942High· 7.8ext4: fix e4b bitmap inconsistency reports
In the Linux kernel, the following vulnerability has been resolved: ext4: fix e4b bitmap inconsistency reports A bitmap inconsistency issue was observed during stress tests under mixed huge-page workloads. Ext4 reported multiple e4b bi…
CVE-2026-45959High· 7.8crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree Annotating a local pointer variable, which will be assigned with the kmalloc-family functions, with t…
CVE-2026-45955High· 7.1md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout
In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout When llbitmap_suspend_timeout() times out waiting for percpu_ref to become zero, it returns -ETIMEDOU…
CVE-2026-45944High· 7.5iommu/vt-d: Clear Present bit before tearing down context entry
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down context entry When tearing down a context entry, the current implementation zeros the entire 128-bit entry using mult…
CVE-2026-45933High· 7.8bpf: Preserve id of register in sync_linked_regs()
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve id of register in sync_linked_regs() sync_linked_regs() copies the id of known_reg to reg when propagating bounds of known_reg to reg using the off of kn…
CVE-2026-45910High· 7.8RDMA/rxe: Fix race condition in QP timer handlers
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix race condition in QP timer handlers I encontered the following warning: WARNING: drivers/infiniband/sw/rxe/rxe_task.c:249 at rxe_sched_task+0x1c8/0x238 …