Linux vulnerabilities
CVEs whose affected-version data names the Linux package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4584 CVEsRSS
CVE-2026-98983Noneunshare: don't drop active namespace references that were never taken
In the Linux kernel, the following vulnerability has been resolved: unshare: don't drop active namespace references that were never taken Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a …
CVE-2026-98982High· 7.8namespace: don't let a pseudo dentry become the root of a mount
In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount d_alloc_pseudo() hands out dentries for pipes, sockets and other files that are never anyone's child or…
CVE-2026-98987Nonenamespace: look at the topmost mount for a mount namespace file
In the Linux kernel, the following vulnerability has been resolved: namespace: look at the topmost mount for a mount namespace file attach_recursive_mnt() preallocates a mountpoint for the root of the topmost mount of the source so tha…
CVE-2026-98986Nonenamespace: remove the fsnotify marks of a mount namespace in process context
In the Linux kernel, the following vulnerability has been resolved: namespace: remove the fsnotify marks of a mount namespace in process context mnt_ns_release() drops the last passive reference of a mount namespace and removes its fan…
CVE-2026-98985Nonenamespace: check the mounts before reading their parents in pivot_root()
In the Linux kernel, the following vulnerability has been resolved: namespace: check the mounts before reading their parents in pivot_root() path_pivot_root() reads the parents of new_root and of the caller's root and checks whether th…
CVE-2026-99001Nonedrm/xe/i2c: cancel the client work on remove
In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xe_i2c_notifier() stores the DesignWare adapter in i2c->adapter and schedules i2c->work when the adapter is registered und…
CVE-2026-98989Nonenamespace: check a recursive bind mount for mount namespace loops
In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops do_loopback() refuses to bind mount the file of a mount namespace that is as old as the caller's or o…
CVE-2026-98988High· 8.8namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE open_tree(OPEN_TREE_NAMESPACE) creates a new mount namespace from a copy of the tree at the given path. T…
CVE-2026-98992Nonenamespace: don't copy an unmounted mount tree
In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree may_copy_tree() accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This …
CVE-2026-98991High· 7.8namespace: queue a mount only once for mount notifications
In the Linux kernel, the following vulnerability has been resolved: namespace: queue a mount only once for mount notifications mnt_notify_add() puts a mount on notify_list. It doesn't check whether the mount is on the list already. Tha…
CVE-2026-98990Nonenamespace: check a submount for references right before unmounting it
In the Linux kernel, the following vulnerability has been resolved: namespace: check a submount for references right before unmounting it shrink_submounts() and mark_mounts_for_expiry() first collect all the mounts they are allowed to …
CVE-2026-98995High· 7.8namespace: reset the old parent's ->overmount in mnt_change_mountpoint()
In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's ->overmount in mnt_change_mountpoint() __umount_mnt() resets ->overmount of the parent when it unmounts the mount that overmounts it.…
CVE-2026-98994Nonestatmount: read the parent of an unmounted mount under mount_lock
In the Linux kernel, the following vulnerability has been resolved: statmount: read the parent of an unmounted mount under mount_lock statmount_mnt_basic() reads the ids of the parent through m->mnt_parent with namespace_sem held for r…
CVE-2026-98993High· 7.8namespace: don't inherit MNT_UMOUNT in clone_mnt()
In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNT_UMOUNT in clone_mnt() MNT_UMOUNT gets raised on a mount that umount_tree() or umount_one() has taken out of its namespace. It's never clea…
CVE-2026-99006High· 7.8drm/i915/gem: Prevent overstepping exec array boundary
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for eb_relocate_parse_slow() to call kvfree() on entries outside the original exec array during f…
CVE-2026-98997Nonedrm/amdgpu/userq: only accept doorbell BOs as queue doorbell
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpu_userq_get_doorbell_index() pins any BO passed as doorbell_handle into the doorbell domain. For a re…
CVE-2026-98996Nonefs: don't silently unmount busy mounts
In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagate_mount_busy() helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of th…
CVE-2026-99002High· 7.8drm/vmwgfx: validate pitch coming from userspace
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possibl…
CVE-2026-99000Nonedrm/xe: Fix shrinker accounting double-subtraction on nested external pins
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins xe_bo_pin_external() and xe_bo_unpin_external() support nested pins, since the underlying tt…
CVE-2026-98999High· 7.8drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin xe_bo_pin_external() and xe_bo_unpin_external() maintain the bo's pinned_link list membership …
CVE-2026-98998Nonedrm/bridge: th1520-dw-hdmi: Fix remove() callback
In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove() callback This driver stores struct th1520_hdmi * in platform drvdata, but th1520_dw_hdmi_remove() was reading it back as struc…
CVE-2026-99005Nonedrm/i915/gt: Unmask interrupts only when ACTIVE is true
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race window between intel_rps_boost() reading a stale ACTIVE state and queuing rps->work, wher…
CVE-2026-99004Nonedrm/imagination: Size page table preallocation by device address
In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 ("drm/imagination: Fix page count for page table for map() interface") passed the …
CVE-2026-99003Nonedrm/panthor: validate userspace queue count against initialized firmware slot count
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthor_drv.c:panthor_ioctl_group_create(), the queue count is validated against…
CVE-2026-99015NoneBluetooth: hci_sock: Serialize dead-device detachment
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Serialize dead-device detachment Rebinding an HCI socket after its controller is unregistered can race monitor control replay and crash the kernel…
CVE-2026-99014High· 7.8Bluetooth: hci_sync: Fix command skb lifetime during scan setup
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix command skb lifetime during scan setup During PA sync scan setup, hci_le_set_ext_scan_param_sync() gets the address used for the PA_LINK looku…
CVE-2026-99007Nonedrm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN
In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN __drm_fb_helper_initial_config_and_unlock() calls drm_client_modeset_probe() first, which alre…
CVE-2026-99016High· 7.8riscv: futex: untag the user pointer before the atomic access
In the Linux kernel, the following vulnerability has been resolved: riscv: futex: untag the user pointer before the atomic access access_ok() checks untagged_addr(uaddr), but arch_futex_atomic_op_inuser() and futex_atomic_cmpxchg_inato…
CVE-2026-99008NoneBluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown syzbot hit a NULL pointer dereference in rfcomm_dev_shutdown() when an RFCOMM tty is closed. rf…
CVE-2026-99018High· 7.8riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIG_SHADOW_CALL_STACK, handle_exception() reloads the kernel shadow call stack pointer (gp)…