Linux vulnerabilities
CVEs whose affected-version data names the Linux package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4584 CVEsRSS
CVE-2026-98895High· 7.0net/mlx5: HWS, Handle destroying table that has a miss table
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Handle destroying table that has a miss table If a table has a miss table that was created by 'mlx5hws_table_set_default_miss' API function, its miss_tb…
CVE-2026-98893Nonefirmware: arm_scmi: Validate SENSOR_UPDATE payload size
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Validate SENSOR_UPDATE payload size SENSOR_UPDATE carries one or more sensor readings after the fixed notification header. The parser derives the e…
CVE-2026-98892Nonefirmware: arm_scmi: Validate BASE_ERROR_EVENT payload size
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size BASE_ERROR_EVENT carries a variable number of message reports, with the count encoded in error_status. The n…
CVE-2026-98905Nonedrm/amdkfd: Properly acquire queue buffers in CRIU restore
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Properly acquire queue buffers in CRIU restore When kfd_queue_acquire_buffers() was split off from set_queue_properties_from_user(), set_queue_properties_f…
CVE-2026-98898Nonedrm/amd/pm/si: Don't schedule thermal work when queue isn't initialized
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized When DPM is turned off with the amdgpu.dpm=0 module parameter, the thermal work queue isn't ini…
CVE-2026-98897Noneksmbd: don't hold ci->m_lock while waiting for a lease break ack
In the Linux kernel, the following vulnerability has been resolved: ksmbd: don't hold ci->m_lock while waiting for a lease break ack When a cifs.ko client caches a read-handle (RH) lease via deferred close and a conflicting open arrive…
CVE-2026-98902Nonemd/raid5: let stripe batch bm_seq comparison wrap-safe
In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bm_seq comparison wrap-safe Once the 32-bit seq wraps, a newer bm_seq can look smaller than old, so .. covert to wrap-safe calculate way.
CVE-2026-98901Noneksmbd: fix lease break and ack state handling
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix lease break and ack state handling Do not skip valid lease states containing WRITE_CACHING when breaking level-II/read leases for writes and truncates. Han…
CVE-2026-98899High· 7.8netfilter: ipset: mark the rcu locked areas properly
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: mark the rcu locked areas properly When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappea…
CVE-2026-98907Nonebtrfs: protect sb_write_pointer() with invalidate lock
In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sb_write_pointer() with invalidate lock sb_write_pointer() reads the super block from the block device page cache using read_cache_page_gfp(). This has …
CVE-2026-98906Nonenet: lan966x: restore RX state on reload failure
In the Linux kernel, the following vulnerability has been resolved: net: lan966x: restore RX state on reload failure lan966x_fdma_reload() backs up rx->page_pool and rx->fdma before reallocating the RX resources for the new MTU. If the…
CVE-2026-98904Nonemailbox: imx: Use devm_pm_runtime_enable()
In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Use devm_pm_runtime_enable() sashiko complained about early usage of the device while probe isn't completed. This can be mitigated by delaying the pm_run…
CVE-2026-98900Nonexen/gntalloc: validate grant count before allocation
In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntalloc_ioctl_alloc() allocates the grant-id array before checking whether the requested count fits within the gl…
CVE-2026-98910Nonedrm/amdkfd: Unwind debug trap enable on copy_to_user failure
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copy_to_user failure If kfd_dbg_trap_enable() fails while copying runtime_info to userspace, it had already activated the trap,…
CVE-2026-98909Nonenet: cpsw_new: unregister devlink on port registration failure
In the Linux kernel, the following vulnerability has been resolved: net: cpsw_new: unregister devlink on port registration failure cpsw_probe() registers devlink before registering the CPSW ports. If cpsw_register_ports() fails, the e…
CVE-2026-98903Nonemailbox: imx: Add a channel shutdown field
In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Add a channel shutdown field sashiko complained about possible teardown problem. The scenario CPU 0 CPU 1 imx_mu_isr() …
CVE-2026-98915Nonemedia: video-i2c: use vb2_video_unregister_device on driver removal
In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: use vb2_video_unregister_device on driver removal The driver uses vb2_fop_release() as its file release operation, so vb2_video_unregister_device() s…
CVE-2026-98911High· 7.5dpaa2-switch: fix the error path in dpaa2_switch_rx()
In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2_switch_rx() In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd() function is called in order to free the FD. …
CVE-2026-98908Nonenet: microchip: sparx5: clean up PSFP resources on flower setup failure
In the Linux kernel, the following vulnerability has been resolved: net: microchip: sparx5: clean up PSFP resources on flower setup failure sparx5_tc_flower_psfp_setup() allocates PSFP stream gate, flow meter and stream filter resource…
CVE-2026-98914Nonedrm/amdgpu: cap ATOM command table nesting depth
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: cap ATOM command table nesting depth Cap nesting at 32 levels with execute_depth and return -ELOOP when exceeded.
CVE-2026-98913Nonenet: thunderx: fix PTP device ref leak in nicvf_probe()
In the Linux kernel, the following vulnerability has been resolved: net: thunderx: fix PTP device ref leak in nicvf_probe() cavium_ptp_get() acquires a reference to the PTP PCI device through pci_get_device(). If any initialization ste…
CVE-2026-98912NoneALSA: seq: oss: Reject reads that cannot fit the next event
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event snd_seq_oss_read() checks whether the next queued OSS sequencer event fits in the remaining userspace buffe…
CVE-2026-98920Nonenetfs: Fix missing alloc tagging of direct mempool allocations
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing alloc tagging of direct mempool allocations Commit 1d78d56c43ef ("netfs: Fix folio_queue ENOMEM in writeback by adding a mempool") added a mempool f…
CVE-2026-98916Nonewifi: nl80211: check link is beaconing for color change
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: check link is beaconing for color change When trying to do a color change, validate that the link is beaconing first, to avoid calling the driver with a…
CVE-2026-98921Noneovl: fix UAF in ovl_do_mkdir() debug print
In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl_do_mkdir() debug print ovl_do_mkdir() prints the input dentry with %pd after vfs_mkdir(). Since commit fe497f0759e0 ("VFS: change vfs_mkdir() to un…
CVE-2026-98917Noneparisc: Increase kernel stack size to 32kb
In the Linux kernel, the following vulnerability has been resolved: parisc: Increase kernel stack size to 32kb For 64-bit Linux kernels, increase the default kernel stack size (THREAD_SIZE_ORDER) to 32 kB, in order to avoid kernel cras…
CVE-2026-98922Nonenet: emac: move setting of netops to fix crash
In the Linux kernel, the following vulnerability has been resolved: net: emac: move setting of netops to fix crash fixes the following crash on driver initialization: |BUG: Kernel NULL pointer dereference on read at 0x00000158 |Faulti…
CVE-2026-98919Nonedrm/xe: harden adjust_idledly() against divide-by-zero and overflow
In the Linux kernel, the following vulnerability has been resolved: drm/xe: harden adjust_idledly() against divide-by-zero and overflow adjust_idledly() has several corner-case issues flagged during review: 1. If xe_gt_clock_init() …
CVE-2026-98918Nonemm/damon/ops-common: use a page-aligned address in damon_ptep_mkold()
In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold() __damon_va_prepare_access_check() picks a random byte address within the region and stores it in …
CVE-2026-98926Nonedrm/amd/display: Remove sink usage from DPMS
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove sink usage from DPMS [Why] stream->sink is optional and can be null, so should always be checked before dereference. Additionally, most of its …