Linux vulnerabilities
CVEs whose affected-version data names the Linux package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6539 CVEsRSS
CVE-2026-45894High· 7.8iommu/vt-d: Clear Present bit before tearing down PASID entry
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down PASID entry The Intel VT-d Scalable Mode PASID table entry consists of 512 bits (64 bytes). When tearing down an entr…
CVE-2026-45862High· 7.8iommu/vt-d: Flush cache for PASID table before using it
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush cache for PASID table before using it When writing the address of a freshly allocated zero-initialized PASID table to a PASID directory entry, do tha…
CVE-2026-45878High· 7.8drm/amdkfd: Fix watch_id bounds checking in debug address watch v2
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 The address watch clear code receives watch_id as an unsigned value (u32), but some helper functions…
CVE-2026-45859High· 7.5netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation Ulrich reports a regression with nfqueue: If an application did not set the 'F_GSO' capabi…
CVE-2026-45861High· 7.8gfs2: Fix slab-use-after-free in qd_put
In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix slab-use-after-free in qd_put Commit a475c5dd16e5 ("gfs2: Free quota data objects synchronously") started freeing quota data objects during filesystem shutdo…
CVE-2026-45898Critical· 9.8RDMA/iwcm: Fix workqueue list corruption by removing work_list
In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix workqueue list corruption by removing work_list The commit e1168f0 ("RDMA/iwcm: Simplify cm_event_handler()") changed the work submission logic to uncon…
CVE-2026-43494High· 7.8PoCnet/rds: reset op_nents when zerocopy page pin fails
In the Linux kernel, the following vulnerability has been resolved: net/rds: reset op_nents when zerocopy page pin fails When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), …
CVE-2026-43491Nonenet: qrtr: ns: Limit the maximum server registration per node
In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Limit the maximum server registration per node Current code does no bound checking on the number of servers added per node. A malicious client can flood…
CVE-2026-43490High· 8.8ksmbd: validate inherited ACE SID length
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate inherited ACE SID length smb_inherit_dacl() walks the parent directory DACL loaded from the security descriptor xattr. It verifies that each ACE contai…
CVE-2026-43477Nonedrm/i915/vrr: Configure VRR timings after enabling TRANS_DDI_FUNC_CTL
In the Linux kernel, the following vulnerability has been resolved: drm/i915/vrr: Configure VRR timings after enabling TRANS_DDI_FUNC_CTL Apparently ICL may hang with an MCE if we write TRANS_VRR_VMAX/FLIPLINE before enabling TRANS_DDI…
CVE-2026-43483NoneKVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated Explicitly set/clear CR8 write interception when AVIC is (de)activated to fix a bug where KVM lea…
CVE-2026-43478NoneASoC: codecs: rt1011: Use component to get the dapm context in spk_mode_put
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt1011: Use component to get the dapm context in spk_mode_put The correct helper to use in rt1011_recv_spk_mode_put() to retrieve the DAPM context is snd…
CVE-2026-43484Nonemmc: core: Avoid bitfield RMW for claim/retune flags
In the Linux kernel, the following vulnerability has been resolved: mmc: core: Avoid bitfield RMW for claim/retune flags Move claimed and retune control flags out of the bitfield word to avoid unrelated RMW side effects in asynchronous…
CVE-2026-43487Noneata: libata-core: Disable LPM on ST1000DM010-2EP102
In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Disable LPM on ST1000DM010-2EP102 According to a user report, the ST1000DM010-2EP102 has problems with LPM, causing random system freezes. The drive …
CVE-2026-43488Noneusb: xhci: Prevent interrupt storm on host controller error (HCE)
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Prevent interrupt storm on host controller error (HCE) The xHCI controller reports a Host Controller Error (HCE) in UAS Storage Device plug/unplug scenarios…
CVE-2026-43485Nonenouveau/gsp: drop WARN_ON in ACPI probes
In the Linux kernel, the following vulnerability has been resolved: nouveau/gsp: drop WARN_ON in ACPI probes These WARN_ONs seem to trigger a lot, and we don't seem to have a plan to fix them, so just drop them, as they are most likely…
CVE-2026-43289Nonekexec: derive purgatory entry from symbol
In the Linux kernel, the following vulnerability has been resolved: kexec: derive purgatory entry from symbol kexec_load_purgatory() derives image->start by locating e_entry inside an SHF_EXECINSTR section. If the purgatory object con…
CVE-2026-43292Nonemm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node
In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node When CONFIG_PAGE_OWNER is enabled, freeing KASAN shadow pages during vmalloc cleanup triggers expensive st…
CVE-2026-43287Nonedrm: Account property blob allocations to memcg
In the Linux kernel, the following vulnerability has been resolved: drm: Account property blob allocations to memcg DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized property blobs backed by kernel memory. Cur…
CVE-2026-43305Nonedrm/amd/display: Fix mismatched unlock for DMUB HW lock in HWSS fast path
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix mismatched unlock for DMUB HW lock in HWSS fast path [Why] The evaluation for whether we need to use the DMUB HW lock isn't the same as whether we…
CVE-2026-43313NoneACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()
In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE device and th…
CVE-2026-43314Nonedm: remove fake timeout to avoid leak request
In the Linux kernel, the following vulnerability has been resolved: dm: remove fake timeout to avoid leak request Since commit 15f73f5b3e59 ("blk-mq: move failure injection out of blk_mq_complete_request"), drivers are responsible for …
CVE-2026-43318Nonedrm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify Invalidating a dmabuf will impact other users of the shared BO. In the scenario where process A moves the B…
CVE-2026-43315NoneKVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding
In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding Drop the WARN in svm_set_nested_state() on nested_svm_load_cr3() failing as it is trivial…
CVE-2026-43319Nonespi: spidev: fix lock inversion between spi_lock and buf_lock
In the Linux kernel, the following vulnerability has been resolved: spi: spidev: fix lock inversion between spi_lock and buf_lock The spidev driver previously used two mutexes, spi_lock and buf_lock, but acquired them in different orde…
CVE-2026-43323Nonesched/fair: Fix zero_vruntime tracking fix
In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix zero_vruntime tracking fix John reported that stress-ng-yield could make his machine unhappy and managed to bisect it to commit b3d99f43c72b ("sched/fa…
CVE-2026-43320Nonedrm/amd/display: Fix dsc eDP issue
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dsc eDP issue [why] Need to add function hook check before use
CVE-2026-43333Nonebpf: reject direct access to nullable PTR_TO_BUF pointers
In the Linux kernel, the following vulnerability has been resolved: bpf: reject direct access to nullable PTR_TO_BUF pointers check_mem_access() matches PTR_TO_BUF via base_type() which strips PTR_MAYBE_NULL, allowing direct dereferenc…
CVE-2026-43328Nonecpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
In the Linux kernel, the following vulnerability has been resolved: cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path When kobject_init_and_add() fails, cpufreq_dbs_governor_init() calls kobject_put(&dbs_data…
CVE-2026-43361Nonebtrfs: fix transaction abort when snapshotting received subvolumes
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort when snapshotting received subvolumes Currently a user can trigger a transaction abort by snapshotting a previously received snapshot a bu…