Linux vulnerabilities
CVEs whose affected-version data names the Linux package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4700 CVEsRSS
CVE-2026-98825Medium· 4.1kernel: rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() (CVE-2026-98825)
A flaw was found in the Linux kernel's Microchip PolarFire Real-Time Clock (RTC) driver. During device probing or driver initialization, this flaw can lead to a Denial of Service (DoS) through a kernel crash. The driver fails to verify whe…
CVE-2026-98830Medium· 5.5wifi: wfx: validate MIB read length before copying to caller
In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfx_hif_read_mib() copies reply->length bytes from the firmware response into the caller-provided buffer w…
CVE-2026-98835Medium· 5.5kernel: iio: accel: kionix-kx022a: Fix array boundary check (CVE-2026-98835)
A flaw was found in the Linux kernel's Kionix KX022A accelerometer driver. A local user could trigger a Denial of Service (DoS) or kernel memory disclosure due to an off-by-one array bounds validation check when converting device register …
CVE-2026-98840Medium· 4.7vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
In the Linux kernel, the following vulnerability has been resolved: vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF The reload of 'vc' added by commit 8fb9ea65c9d1 ("vc_screen: reload load of struct vc_data poi…
CVE-2026-98849Medium· 4.7kernel: pfcp: fix socket lifetime on netdevice registration failure (CVE-2026-98849)
A flaw was found in the Linux kernel's Packet Forwarding Control Protocol (PFCP) driver. When creating a PFCP network interface, a failure during device registration triggers error handling that attempts to release an internal network sock…
CVE-2026-98848Medium· 4.1kernel: rtc: ac100: Assign .num before accessing .hws (CVE-2026-98848)
A flaw was found in the Linux kernel's AC100 Real-Time Clock (RTC) driver. During device probing, the driver accesses an internal array before initializing its element counter. On systems compiled with runtime bounds checking enabled, this…
CVE-2026-98847Medium· 4.1kernel: rtc: spear: initialize IRQ state before requesting alarm IRQ (CVE-2026-98847)
A flaw was found in the Linux kernel's SPEAr Real-Time Clock (RTC) driver. The driver requests and enables an alarm interrupt before completing device initialization, specifically prior to setting up the memory-mapped I/O (MMIO) address an…
CVE-2026-98865Medium· 4.4kernel: sched_ext: Don't run ops.dequeue() with a DSQ lock held (CVE-2026-98865)
A flaw was found in the Linux kernel's sched_ext subsystem. A local attacker could cause a Denial of Service (DoS) by triggering a deadlock condition when running an extensible scheduler program that accesses a dispatch queue while a lock …
CVE-2026-98859Medium· 5.3HID: multitouch: stop the release timer from being rearmed on remove
In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: stop the release timer from being rearmed on remove mt_remove() quiesces the sticky-finger timer before stopping the hardware: timer_delete_sync(…
CVE-2026-98864Medium· 4.7kernel: sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task (CVE-2026-98864)
A flaw was found in the Linux kernel's extensible scheduler (sched_ext) subsystem. A race condition occurs when a task is re-enqueued before a prior dispatch operation has completed, allowing internal scheduling states to be improperly ove…
CVE-2026-98868Medium· 4.4kernel: dm-pcache: reject a kset that overruns its segment (CVE-2026-98868)
A flaw was found in the Linux kernel's dm-pcache driver. A local attacker capable of presenting a crafted storage device with forged metadata can cause cache operations to exceed segment boundaries. This flaw triggers a kernel assertion fa…
CVE-2026-98867Medium· 4.4kernel: dm-pcache: bound the logical key offset from persistent memory (CVE-2026-98867)
A flaw was found in the Linux kernel's Device Mapper persistent cache (dm-pcache) module. A local attacker capable of mounting or attaching a crafted persistent cache device can exploit missing boundary checks on logical key offsets. This …
CVE-2026-98438Nonemptcp: options: fix uninit-value in mptcp_write_data_fin
In the Linux kernel, the following vulnerability has been resolved: mptcp: options: fix uninit-value in mptcp_write_data_fin When sending a DATA_FIN without data, and because the DATA_FIN occupies 1 octet of the connection-level sequen…
CVE-2026-98435Medium· 4.4kernel: EDAC/altera: Use parent device for devres in altr_portb_setup() (CVE-2026-98435)
A flaw was found in the Linux kernel's Altera EDAC (Error Detection and Correction) driver. Device-managed interrupt requests and resource groups in the altr_portb_setup() function were improperly associated with a temporary per-port devic…
CVE-2026-98434Medium· 5.5kernel: sysctl: Check range in proc_dointvec_ms_jiffies_minmax (CVE-2026-98434)
A flaw was found in the Linux kernel. Due to a missing range validation check in the sysctl subsystem, configured minimum and maximum limits were not enforced during specific millisecond-to-jiffies conversions. A local user with permission…
CVE-2026-98437Nonemedia: qcom: iris: fix runtime PM reference leaks
In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: fix runtime PM reference leaks Use pm_runtime_resume_and_get() in iris_enable_power_domains() to avoid leaking a runtime PM usage count on failure. …
CVE-2026-98436High· 7.8accel/amdxdna: Disable device buffer exporting
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Disable device buffer exporting Device buffers are never intended to be exported. Disable exporting support explicitly.
CVE-2026-98439Nonesmb/server: cancel async requests when closing connection
In the Linux kernel, the following vulnerability has been resolved: smb/server: cancel async requests when closing connection An async request may still be waiting when a connection is closed. This can stop the connection from closing.…
CVE-2026-98446Nonexfs: don't let hidden_space go negative in xfs_metafile_resv_init
In the Linux kernel, the following vulnerability has been resolved: xfs: don't let hidden_space go negative in xfs_metafile_resv_init LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes be…
CVE-2026-98444Nonexfs: drop dquot flush lock when we can't find a buffer to flush
In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when we can't find a buffer to flush LOLLM noticed that xfs_qm_flush_one fails to drop the dquot flush lock if it can't grab the buffer asso…
CVE-2026-98448Nonexfs: release orphanage dir inode if chown fails
In the Linux kernel, the following vulnerability has been resolved: xfs: release orphanage dir inode if chown fails LOLLM points out that we leak the igrab'd reference to the orphanage directory inode if chowning it fails. Fix that.
CVE-2026-98447Nonexfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots
In the Linux kernel, the following vulnerability has been resolved: xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots LOLLM noticed that the inode btree root formatting methods copy too many bytes -- there's onl…
CVE-2026-98450Nonesmb: client: close completed creates on compound wait errors
In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait errors compound_send_recv() waits for responses in order. If a later wait is interrupted, or if a later MID fails…
CVE-2026-98445Nonexfs: don't let memory failures leak blocks and kill repairs
In the Linux kernel, the following vulnerability has been resolved: xfs: don't let memory failures leak blocks and kill repairs LOLLM complains that a memory allocation failure in xrep_newbt_add_blocks results in online repair leaking …
CVE-2026-98457NoneBluetooth: L2CAP: validate frame length before control and FCS access
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2cap_data_rcv() unpacks either a two-byte or four-byte control field without first ensuring that…
CVE-2026-98455NoneBluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO The RFCOMM_CONNINFO getsockopt handler accepts a socket that is not connected as long as def…
CVE-2026-98449Nonesmb: client: delete compound mids on send failure before unlock
In the Linux kernel, the following vulnerability has been resolved: smb: client: delete compound mids on send failure before unlock When sending a compound request fails, smb_send_rqst() kicks off a reconnect. compound_send_recv() stil…
CVE-2026-98453Nonesmb: client: close handle after create-context parsing failure
In the Linux kernel, the following vulnerability has been resolved: smb: client: close handle after create-context parsing failure SMB2_open() accounts a successful CREATE response as a remote open before parsing its create contexts. …
CVE-2026-98452Nonesmb: client: clean up failed cached directory opens
In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens open_cached_dir() sends CREATE and QUERY_INFO as a compound request. If the CREATE succeeds but a later command ret…
CVE-2026-98460NoneBluetooth: hci_sock: reject out-of-range OCF values
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: reject out-of-range OCF values The raw HCI socket security filter has 128 OCF bits per supported OGF, but masks the 10-bit OCF with 127 before loo…