Linux vulnerabilities
CVEs whose affected-version data names the Linux package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6536 CVEsRSS
CVE-2026-89533Critical· 9.8⚖ disputedsvcrdma: Fix offset arithmetic in read_chunk_range
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in read_chunk_range svc_rdma_read_chunk_range() walks a Read chunk's segment list to build a sub-range starting at byte offset and spann…
CVE-2026-89532Critical· 9.1⚖ disputedsvcrdma: Fix pcl_for_each_segment for empty chunks
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix pcl_for_each_segment for empty chunks When a parsed chunk list contains a chunk whose ch_segcount is zero, pcl_for_each_segment computes its inclusive upp…
CVE-2026-89525Medium· 5.5udf: reject VAT indexes equal to the entry count
In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. s_num_entries stores the numbe…
CVE-2026-89524High· 8.1⚖ disputedwifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6kl_cfg80211_connect_event() subtracts fixed IE offsets from assoc_req_len (-= 4) a…
CVE-2026-89515Medium· 5.5scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() During fuzz testing, the following issue was discovered: BUG: KMSAN: uninit-value in __dma_map_sg_attrs…
CVE-2026-89512Medium· 5.5remoteproc: scp: Fix device reference leak on failed lookup
In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Make sure to drop the reference taken to the SCP device when attempting to look up its driver data before t…
CVE-2026-89511High· 7.5⚖ disputedqede: Fix NULL pointer dereference in TPA fragment processing
In the Linux kernel, the following vulnerability has been resolved: qede: Fix NULL pointer dereference in TPA fragment processing Under memory pressure, the qede driver encounters NULL pointer dereferences when processing TPA continuat…
CVE-2026-89510High· 7.8RDMA/cxgb4: Cancel reg_work before freeing device on remove
In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel reg_work before freeing device on remove c4iw_uld_state_change() queues reg_work to register the RDMA device. c4iw_remove() can free ctx->dev while …
CVE-2026-89508High· 7.8⚖ disputedRDMA/ucma: Lock the handler in ucma_set_ib_path()
In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma_set_ib_path() ucma_set_ib_path() calls ucma_event_handler() straight from the write() path, without the handler lock that keeps ctx…
CVE-2026-89504High· 8.4⚖ disputedregulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer
In the Linux kernel, the following vulnerability has been resolved: regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer In as3722_get_regulator_dt_data(), of_get_child_by_name() acquires …
CVE-2026-89498Medium· 5.5orangefs: fix double-free of trailer_buf on readdir copy failure
In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailer_buf on readdir copy failure On a readdir downcall, orangefs_devreq_write_iter() frees op->downcall.trailer_buf with vfree() when c…
CVE-2026-89497High· 7.8orangefs: skip leading spaces before parsing client debug masks
In the Linux kernel, the following vulnerability has been resolved: orangefs: skip leading spaces before parsing client debug masks orangefs_prepare_cdm_array() sizes each client debug keyword buffer with strcspn(cds_head, " "), but th…
CVE-2026-89496Medium· 5.5ocfs2: always run deallocs on copy-on-write completion
In the Linux kernel, the following vulnerability has been resolved: ocfs2: always run deallocs on copy-on-write completion Local fuzzing of 6.12.94 has found the following memory leak caused by doing 'copy_file_range()' within the same…
CVE-2026-89495Critical· 9.8⚖ disputedocfs2: bound namelen in dlm_migrate_request_handler
In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlm_migrate_request_handler Patch series "ocfs2/dlm: bound peer-controlled lengths in the o2dlm". The o2dlm receive handlers trust u8 length a…
CVE-2026-89494Critical· 9.8⚖ disputedocfs2: validate lengths in dlm_mig_lockres_handler
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlm_mig_lockres_handler A node receiving a DLM_MIG_LOCKRES message trusts several fields of the peer-supplied dlm_migratable_lockres without…
CVE-2026-89493High· 8.8⚖ disputedocfs2: validate rl_used against rl_count in refcount block validator
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rl_used against rl_count in refcount block validator ocfs2_find_refcount_rec_in_rl() walks the on-disk refcount record array with: for (; i < le16_to…
CVE-2026-89491Medium· 5.5ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()
In the Linux kernel, the following vulnerability has been resolved: ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() Patch series "ocfs2: cluster: o2hb_region_pin() fixes", v2. This series fixes three rela…
CVE-2026-89489High· 7.8⚖ disputedopenrisc: fix arbitrary kernel memory access via or1k_atomic syscall
In the Linux kernel, the following vulnerability has been resolved: openrisc: fix arbitrary kernel memory access via or1k_atomic syscall sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user pointers, v1 and v2, and swaps th…
CVE-2026-89488High· 7.8openvswitch: Fix CT limit teardown use-after-free
In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovs_mutex. The CT limit …
CVE-2026-89487High· 7.8openvswitch: only skb_tx_error() a packet we are about to drop
In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skb_tx_error() a packet we are about to drop queue_userspace_packet() borrows the packet skb -- it only copies it into a private netlink message (use…
CVE-2026-89485Critical· 9.8⚖ disputedlockd: pin next file across nlm_inspect_file lock-drop
In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file across nlm_inspect_file lock-drop nlm_traverse_files() pins the current file with f_count++ across a mutex_unlock for nlm_inspect_file(), but noth…
CVE-2026-89483High· 7.5⚖ disputednvme: zero the discard fallback page
In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvme_setup_discard() always maps sizeof(struct nvme_dsm_range) * NVME_DSM_MAX_RANGES = 4096 bytes as the DSM payload however many …
CVE-2026-89607High· 7.8ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet parse_tag_3_packet() set encrypted_key_size from the Tag 3 packet body without bounding it against …
CVE-2026-89606High· 7.8ecryptfs: reject too-small tag 70 packets
In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject too-small tag 70 packets ecryptfs_parse_tag_70_packet() subtracts fixed metadata fields from the parsed packet body size to derive the encrypted filen…
CVE-2026-89605High· 7.8⚖ disputedecryptfs: release message context on send failure
In the Linux kernel, the following vulnerability has been resolved: ecryptfs: release message context on send failure ecryptfs_send_message_locked() moves a message context from the free list to the allocated list before sending the re…
CVE-2026-89604Medium· 5.5efivarfs: Rate limit statfs() handler
In the Linux kernel, the following vulnerability has been resolved: efivarfs: Rate limit statfs() handler Ravi reports that statfs() may be called by unprivileged users on the efivarfs mount point, which may result in a flood of calls …
CVE-2026-89599High· 8.4⚖ disputedfbdev: omapfb: panel-dsi-cm: initialize lock before registering display
In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: panel-dsi-cm: initialize lock before registering display dsicm_probe() registers the display before initializing ddata->lock. Once omapdss_register_disp…
CVE-2026-89598Medium· 5.5fbdev: ssd1307fb: defer I2C transfers from damage callbacks
In the Linux kernel, the following vulnerability has been resolved: fbdev: ssd1307fb: defer I2C transfers from damage callbacks The fbdev damage callbacks may run from fbcon while printk has disabled preemption. They currently update …
CVE-2026-89597High· 7.8⚖ disputedfbdev: uvesafb: unregister connector callback on init failure
In the Linux kernel, the following vulnerability has been resolved: fbdev: uvesafb: unregister connector callback on init failure uvesafb_init() registers the v86d connector callback before registering the platform driver. If platform_…
CVE-2026-89596High· 7.1forcedeth: fix off-by-one when saving/restoring non-PCI config space
In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nv_suspend() and nv_resume() walk the non-PCI configuration space with for (i = 0; i <= np->regi…