Linux vulnerabilities
CVEs whose affected-version data names the Linux package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4700 CVEsRSS
CVE-2026-98458NoneBluetooth: ISO: release unused CIS holds after channel attach
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hci_bind_cis() and hci_connect_cis() return one hci_conn hold for the ISO layer. A new channel associati…
CVE-2026-98461NoneBluetooth: hci_sock: validate event length before filtering
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: validate event length before filtering is_filtered_packet() reads the event code from skb->data[0] without first checking that the skb is nonempty…
CVE-2026-98459NoneBluetooth: ISO: balance the parent hold in hci_bind_bis()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hci_bind_bis() hci_conn_link() takes a lifetime reference to its parent with hci_conn_get(), but only takes an operational h…
CVE-2026-98467NoneKVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race Commit 7270cc9157f4 ("KVM: arm64: nv: Handle VNCR_EL2 invalidation from MMU notifiers") introduced…
CVE-2026-98465Medium· 5.3kernel: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration (CVE-2026-98465)
A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem for the RISC-V architecture. Due to missing synchronization between interrupt controller device operations and virtual CPU (vCPU) execution, a local user w…
CVE-2026-98464Medium· 5.6⚖ disputedkernel: RISC-V: KVM: Synchronize hrtimer callback during teardown (CVE-2026-98464)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) implementation for the RISC-V architecture. This vulnerability can lead to a Denial of Service (DoS) or host system crash due to a use-after-free memory issue during…
CVE-2026-98463Nonesched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags schedule_deferred_locked() skips scheduling a deferred action while SCX_RQ_IN_WAKEUP is set and relies o…
CVE-2026-98480Low· 1.9kernel: nfc: trf7970a: power down on startup RX gain failure (CVE-2026-98480)
A flaw was found in the Linux kernel's Near Field Communication (NFC) TRF7970A driver. This vulnerability can lead to a denial of service (DoS) or improper hardware state due to unreleased power resources. If a communication error occurs w…
CVE-2026-98478Medium· 4.7kernel: scsi: ufs: core: Keep internal commands dispatchable during error handling (CVE-2026-98478)
A flaw was found in the Linux kernel's Universal Flash Storage (UFS) driver. During device error recovery, the driver pauses all command queues, which inadvertently prevents internal recovery commands from being dispatched. This condition …
CVE-2026-98481Medium· 6.2kernel: nfc: port100: reject frames whose declared length exceeds the received data (CVE-2026-98481)
A flaw was found in the Linux kernel's Near Field Communication (NFC) Port-100 driver. An attacker connecting a malicious USB device can provide a response frame whose declared length exceeds the actual received data size. This flaw causes…
CVE-2026-98483Medium· 5.5kernel: nfc: fix use-after-free in nfc_get_local_general_bytes (CVE-2026-98483)
A flaw was found in the Linux kernel's Near Field Communication (NFC) subsystem. A reference counting error in the nfc_get_local_general_bytes() function causes memory to be freed prematurely while callers still access the returned pointer…
CVE-2026-98482Medium· 6.5kernel: nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (CVE-2026-98482)
A flaw was found in the Linux kernel's Near Field Communication (NFC) subsystem. The Logical Link Control Protocol (LLCP) implementation does not verify the length of incoming network packets before reading sequence information. An attacke…
CVE-2026-98477Medium· 5.5perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()
In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() perf_pmu_sched_task() returns early when cpuctx->task_ctx is set, and cpc->task_epc is only non-NULL while a ta…
CVE-2026-98486Nonenet: ena: fix MMIO read buffer leak on probe failure
In the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer leak on probe failure ena_device_init() initializes the MMIO read mechanism with ena_com_mmio_reg_read_request_init(), which allocates a…
CVE-2026-98488Nonenet: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
In the Linux kernel, the following vulnerability has been resolved: net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read Same issue as atl1c (see the first commit in this series, "net: atl1c: fix soft lockup on out-of-rang…
CVE-2026-98484Low· 3.4netfilter: nf_tables: skip expired catchall elements on insert and delete
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: skip expired catchall elements on insert and delete nft_setelem_catchall_insert() looks up duplicates with nft_set_elem_active() only, while nft_…
CVE-2026-98494Nonenet: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
In the Linux kernel, the following vulnerability has been resolved: net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read Same issue as atl1c (see the first commit in this series, "net: atl1c: fix soft lockup on out-of-…
CVE-2026-98493Nonenet: ipconfig: bound DHCP option construction
In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction ic_dhcp_init_options() appends the hostname (option 12), vendor-class (option 60) and client-ID (option 61) options into …
CVE-2026-98496Nonenet: airoha: npu: cancel wdt_work after releasing the WDT IRQ
In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdt_work after releasing the WDT IRQ airoha_npu_remove() calls cancel_work_sync() on each core's wdt_work, but the watchdog IRQ that queues it…
CVE-2026-98489Nonenet: atl1c: fix soft lockup on out-of-range tpd_cons read
In the Linux kernel, the following vulnerability has been resolved: net: atl1c: fix soft lockup on out-of-range tpd_cons read The hardware can report an out-of-range tpd_cons (seen as 0xffff) while the PCIe link/MAC is resetting. An ou…
CVE-2026-98505Nonemm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()
In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() damon_hugetlb_mkold() reads the page table entry into a local variable, unsets the accessed bi…
CVE-2026-98500NoneHID: hid-oxp: use cancel_delayed_work_sync() in remove
In the Linux kernel, the following vulnerability has been resolved: HID: hid-oxp: use cancel_delayed_work_sync() in remove oxp_hid_remove() uses cancel_delayed_work() for all three delayed work items. cancel_delayed_work() only dequeu…
CVE-2026-98495Nonenet: arp: terminate device name before lookup
In the Linux kernel, the following vulnerability has been resolved: net: arp: terminate device name before lookup The ARP ioctl copies a user-provided struct arpreq into a stack object. Its arp_dev field may contain IFNAMSIZ bytes with…
CVE-2026-98492Nonenet: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths
In the Linux kernel, the following vulnerability has been resolved: net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths Fix 3 leaks in macb_alloc() error paths: - Tx buffer allocated but crossing a 4G boundary: Tx leak…
CVE-2026-98514Nonedrm/nouveau: Fix gem reference leak in validate_init()
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validate_init() On the ttm_bo_reserve() failure and "vma not found" error paths, the loop breaks without adding the looked-up ob…
CVE-2026-98498Nonenet/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() When the reverse entry is found but its counter is already being released, refcount_inc_not_z…
CVE-2026-98508Nonedrm/virtio: fix NULL pointer dereference on fence allocation failure
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference on fence allocation failure virtio_gpu_fence_alloc() can fail due to memory pressure and return NULL, but its caller like virt…
CVE-2026-98502NoneHID: alps: unregister DualPoint Stick input device on remove
In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on remove alps_input_configured() allocates a second input device ("DualPoint Stick") with input_allocate_device() a…
CVE-2026-98506Nonemm/hugetlb: do not dissolve gigantic pages without runtime support
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not dissolve gigantic pages without runtime support dissolve_free_hugetlb_folio() doesn't check hstate_is_gigantic_no_runtime(h) though remove_hugetlb_f…
CVE-2026-98504NonePCI: of_property: Omit bus properties without a subordinate bus
In the Linux kernel, the following vulnerability has been resolved: PCI: of_property: Omit bus properties without a subordinate bus A bridge (a device with a Type 1 header) may not have a secondary bus allocated (pdev->subordinate), e.…