Linux vulnerabilities
CVEs whose affected-version data names the Linux package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4700 CVEsRSS
CVE-2026-98565Medium· 4.4kernel: net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 (CVE-2026-98565)
A flaw was found in the Linux kernel's MediaTek MT7530 network switch driver. This flaw allows a local user with administrative privileges to cause a Denial of Service (DoS) through a kernel crash. The issue occurs during driver unbinding …
CVE-2026-98561Medium· 5.9kernel: nfp: hold IPsec RX state under the XArray lock (CVE-2026-98561)
A flaw was found in the Linux kernel's Netronome Flow Processor (nfp) network driver. A race condition occurs when incoming Internet Protocol Security (IPsec) network packets are processed concurrently with the removal of security associat…
CVE-2026-98564Medium· 4.1kernel: net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq (CVE-2026-98564)
A flaw was found in the Linux kernel's MediaTek MT7530 DSA (Distributed Switch Architecture) driver. During device removal or driver unbinding, interrupt mappings are prematurely disposed while the parent interrupt is still active. A local…
CVE-2026-98562Medium· 4.7kernel: net: libwx: fix races in Tx timestamp handling (CVE-2026-98562)
A flaw was found in the Linux kernel's Wangxun network driver library (libwx). This vulnerability allows a local user to cause a Denial of Service (DoS) through memory corruption. A race condition in the Precision Time Protocol (PTP) trans…
CVE-2026-98570Medium· 5.9kernel: net: ipv6: keep room for the mac header in dst_dev_overhead() (CVE-2026-98570)
A flaw was found in the Linux kernel's IPv6 networking subsystem. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending network traffic through an affected IPv6 tunnel interface. Due to insufficient buffer alloc…
CVE-2026-98566Medium· 5.5kernel: drm/imagination: clamp freelist reconstruction requests (CVE-2026-98566)
A flaw was found in the Linux kernel's drm/imagination GPU driver. The driver fails to properly validate and bound the firmware reconstruction count against the fixed protocol array capacity when processing freelist reconstruction requests…
CVE-2026-98572Medium· 4.4kernel: bpf: Fix immediate JMP JEQ/JNE on MIPS32 (CVE-2026-98572)
A flaw was found in the Linux kernel's extended Berkeley Packet Filter (eBPF) Just-In-Time (JIT) compiler on 32-bit MIPS systems. An instruction generation error during 64-bit jump comparisons causes negative numeric constants to be incorr…
CVE-2026-98571Medium· 5.9kernel: net: stmmac: clear stale buf->page after recycling on skb build failure (CVE-2026-98571)
A flaw was found in the Linux kernel's stmmac network driver. This vulnerability can lead to a Denial of Service (DoS) or memory corruption when processing incoming network traffic under resource constraints. When the driver fails to alloc…
CVE-2026-98577Medium· 5.3kernel: nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (CVE-2026-98577)
A flaw was found in the Linux kernel's Near Field Communication (NFC) subsystem. In the Logical Link Control Protocol (LLCP) implementation, the kernel validates service names using only the length of the provided name instead of verifying…
CVE-2026-98574Medium· 4.1kernel: net: bcmgenet: stop Tx NAPI before disabling the queues (CVE-2026-98574)
A flaw was found in the Linux kernel's Broadcom GENET network driver. Improper synchronization between disabling transmission queues and stopping completion polling during interface shutdown or suspend operations can prematurely re-enable …
CVE-2026-98579Low· 3.3kernel: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (CVE-2026-98579)
A flaw was found in the Linux kernel's NFC (Near Field Communication) subsystem. Error handling routines in the netlink interface fail to properly release allocated memory when processing service discovery requests encounters a failure. A …
CVE-2026-98576Medium· 5.3kernel: nfc: llcp: fix slab-out-of-bounds reads when logging service names (CVE-2026-98576)
A flaw was found in the Linux kernel's Near Field Communication (NFC) subsystem. When processing certain service names and requests, the kernel attempts to log strings that lack null-termination using an unbounded format specifier. A local…
CVE-2026-98575Medium· 6.2kernel: nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (CVE-2026-98575)
A flaw was found in the Linux kernel's PN533 NFC (Near Field Communication) driver. An attacker capable of connecting a malicious or malfunctioning USB device can supply a crafted response frame with an arbitrary data length value. Because…
CVE-2026-98580Medium· 5.5kernel: nfc: llcp: Fix race condition in accept_queue lifecycle (CVE-2026-98580)
A flaw was found in the Linux kernel's Near Field Communication (NFC) Logical Link Control Protocol (LLCP) implementation. A race condition occurs during concurrent socket release and connection accept operations due to improper lock synch…
CVE-2026-98578Medium· 6.5kernel: nfc: st21nfca: validate ISO15693 inventory length (CVE-2026-98578)
A flaw was found in the Linux kernel's ST21NFCA Near Field Communication (NFC) driver. This vulnerability allows a Denial of Service (DoS) when the system encounters malformed wireless NFC responses. A nearby attacker with a crafted NFC de…
CVE-2026-98582Medium· 6.5kernel: nfc: st21nfca: validate received frame size (CVE-2026-98582)
A flaw was found in the Linux kernel's ST21NFCA Near Field Communication (NFC) driver. The driver fails to properly validate the length of received frames when processing escape sequences. An attacker capable of sending crafted NFC frames …
CVE-2026-98581Medium· 4.7kernel: nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (CVE-2026-98581)
A flaw was found in the Linux kernel's Near Field Communication (NFC) Logical Link Control Protocol (LLCP) implementation. When handling specific disconnection packets, the kernel fails to properly lock and unlink sockets before updating t…
CVE-2026-98583Medium· 4.4kernel: nfc: nfcmrvl: validate helper command length before pull (CVE-2026-98583)
A flaw was found in the Linux kernel's Marvell NFC (Near Field Communication) driver. During firmware download operations, the driver removes packet headers and reads command data before verifying that the received packet length is valid. …
CVE-2026-98585Medium· 4.4kernel: eth: fbnic: Avoid rounding zero ring sizes (CVE-2026-98585)
A flaw was found in the Linux kernel's fbnic network driver. A local user with administrative privileges could trigger a denial of service (DoS) and crash the system by configuring a network ring buffer size of zero. Because the driver fai…
CVE-2026-98601NoneBluetooth: btintel_pcie: validate device-supplied DMA indices
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: validate device-supplied DMA indices In btintel_pcie_msix_rx_handle(), the driver processes RX completion descriptors (urbd1) written by the P…
CVE-2026-98604Noneovpn: replace bind when learning local endpoint
In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpn_bind is published through peer->bind with RCU, but local endpoint learning updates bind->local in place und…
CVE-2026-98602NoneBluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough Fix multiple out-of-bounds reads in Bluetooth BNEP frame processing: 1. In bnep…
CVE-2026-98605Nonedrm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach
In the Linux kernel, the following vulnerability has been resolved: drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach When the Exynos DSI driver was generalized into samsung-dsim, the TE GPIO acquisition was switched from …
CVE-2026-98609Nonedrm/virtio: fix object leak when drm_gem_handle_create() fails
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak when drm_gem_handle_create() fails virtio_gpu_gem_create() owns the reference taken by virtio_gpu_object_create(). On the drm_gem_handle_cr…
CVE-2026-98606Nonedrm/virtio: release the GEM object on virtio_gpu_vram_create() errors
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: release the GEM object on virtio_gpu_vram_create() errors virtio_gpu_vram_create() frees the object with a bare kfree(vram) on both error paths after drm_g…
CVE-2026-98608Nonedrm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() virtio_gpu_resource_create_ioctl() calls drm_gem_object_release() on the drm_gem_handle_create() erro…
CVE-2026-98619Nonenet: ethtool: keep rtnl_lock for the ioctl self test
In the Linux kernel, the following vulnerability has been resolved: net: ethtool: keep rtnl_lock for the ioctl self test An offline self test that brings the interface down and back up with netif_close() / netif_open() requires rtnl_lo…
CVE-2026-98607Nonedrm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() virtio_gpu_resource_create_blob_ioctl() calls drm_gem_object_release() on both the virtio_gpu_r…
CVE-2026-98617Medium· 4.1kernel: eth: fbnic: use the Rx queue napi pointer to find the napi vector (CVE-2026-98617)
A flaw was found in the Linux kernel's Meta Host Network Interface (fbnic) driver. The driver incorrectly associates receive queues with network processing vectors and fails to verify whether the datapath is active before allocating queue …
CVE-2026-98621Nonenet: gue: reject invalid REMCSUM offsets
In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gue_remcsum() passes them to skb_remcsum_proc…