Linux vulnerabilities
CVEs whose affected-version data names the Linux package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6536 CVEsRSS
CVE-2026-89595Medium· 5.5fsnotify: Fix stale object mask after concurrent mark updates
In the Linux kernel, the following vulnerability has been resolved: fsnotify: Fix stale object mask after concurrent mark updates When a mark gets a new event bit, fanotify and inotify may avoid recalculating the object mask if the cac…
CVE-2026-89594High· 7.8⚖ disputedhsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
In the Linux kernel, the following vulnerability has been resolved: hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device The OMAP SSI driver uses a synthetic HSI controller device allocated via hsi_alloc_controller(…
CVE-2026-89593High· 7.1hugetlb: only adjust reservation during unmapping if mapcount is 0
In the Linux kernel, the following vulnerability has been resolved: hugetlb: only adjust reservation during unmapping if mapcount is 0 Since df7a6d1f6405, __unmap_hugepage_range can adjust reservations. In the case of folio mapped in …
CVE-2026-89587High· 7.8ACPI: pfr_update: fix stack buffer overflow in query_capability()
In the Linux kernel, the following vulnerability has been resolved: ACPI: pfr_update: fix stack buffer overflow in query_capability() query_capability() copies four ACPI buffer objects returned by the firmware _DSM into fixed-size u8[1…
CVE-2026-89586High· 8.2⚖ disputedata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes ata_scsi_write_same_xlat() translates a SCSI WRITE SAME command with the UNMAP bit set into an A…
CVE-2026-89585High· 7.8⚖ disputedauxdisplay: charlcd: cancel backlight work on registration failure
In the Linux kernel, the following vulnerability has been resolved: auxdisplay: charlcd: cancel backlight work on registration failure With CONFIG_CHARLCD_BL_FLASH, charlcd_init() schedules bl_work before charlcd_register() calls misc_…
CVE-2026-89583High· 8.1Bluetooth: eir: Fix OOB read in eir_get_service_data()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eir_get_service_data() eir_get_service_data() walks the advertising data for a Service Data field with a matching UUID. On a mismatch …
CVE-2026-89582High· 7.0bnx2x: fix double free in bnx2x_init_firmware() error path
In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix double free in bnx2x_init_firmware() error path bnx2x_init_firmware() frees bp->init_ops, bp->init_data and bp->init_ops_offsets in its error path without s…
CVE-2026-89579High· 7.8bpf: Harden bloom filter sizing and indexing on 32-bit kernels
In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloom_map_alloc() has two 32-bit-specific problems when the computed bitmap reaches the U32_MAX fallback…
CVE-2026-89576Medium· 5.5dm-era: fix shadowed superblock leak on take-snap failure
In the Linux kernel, the following vulnerability has been resolved: dm-era: fix shadowed superblock leak on take-snap failure metadata_take_snap() bumps the live superblock refcount and then dm_tm_shadow_block() allocates a new block f…
CVE-2026-89573High· 7.8⚖ disputeddm array: reject an array block whose value size is not the caller's
In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's array_block_check() can only compare the header against itself, so a block with value_size 4 and m…
CVE-2026-89569High· 8.8Bluetooth: RFCOMM: serialize security confirmation handling
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcomm_security_cfm() looks up a session on session_list and then walks its DLC list without holding rfcomm…
CVE-2026-89565Medium· 5.5ipip: fix skb leak in collect_md mode when metadata_dst allocation fails
In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collect_md mode when metadata_dst allocation fails In collect_md mode ipip_tunnel_rcv() returns 0 without freeing the skb when ip_tun_rx_dst() fa…
CVE-2026-89563High· 7.8ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() ip6_tnl_xmit() may need to expand headroom before it can push the outer IPv6 and optional encap headers. It currently …
CVE-2026-89562High· 7.8ip6_gre: fix hardware header length for NBMA tunnels
In the Linux kernel, the following vulnerability has been resolved: ip6_gre: fix hardware header length for NBMA tunnels ip6gre_tnl_link_config_route() accumulates the lower device's hardware header length into dev->hard_header_len whe…
CVE-2026-89560High· 8.4In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation Whiteout objects are used in the upper layer of an OverlayFS to indicate that the file with this na…
In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation Whiteout objects are used in the upper layer of an OverlayFS to indicate that the file with this na…
CVE-2026-89559High· 7.8libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in __nd_label_validate() The on-media namespace index field nslot is a u32 read from the DIMM label storage area. __nd_labe…
CVE-2026-89557High· 7.8md: do overflow check for sb->bblog_shift in super_1_load()
In the Linux kernel, the following vulnerability has been resolved: md: do overflow check for sb->bblog_shift in super_1_load() In super_1_load(), sb->bblog_shift is an __u8 type value loaded from on- disk superblock. It is used for ba…
CVE-2026-89555Critical· 9.8mpls: reload header after pskb_may_pull()
In the Linux kernel, the following vulnerability has been resolved: mpls: reload header after pskb_may_pull() mpls_select_multipath() calls mpls_multipath_hash() to choose a nexthop when an MPLS route has multiple nexthops. While walk…
CVE-2026-89554High· 8.2⚖ disputedmptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction mptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce, backup, join_id, token a…
CVE-2026-89553High· 7.8⚖ disputednouveau/gem: reserve the bo in the info ioctl around the vma lookup
In the Linux kernel, the following vulnerability has been resolved: nouveau/gem: reserve the bo in the info ioctl around the vma lookup In the non-uvmm path, there could be a race between the info lookup finding the vma, and the gem cl…
CVE-2026-89674Critical· 9.8⚖ disputednfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget The XDR buffer size calculation in nfsd4_ff_encode_layoutget() has multiple errors that can result in eit…
CVE-2026-89673Medium· 5.5nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo nfsd4_ff_encode_getdeviceinfo() computes the da_addr_body reservation as 16 + netid_len + addr_len, but th…
CVE-2026-89672Critical· 9.1⚖ disputednfsd: gate nfs2 setacl by argp->mask
In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp->mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_a…
CVE-2026-89671Critical· 9.1⚖ disputednfsd: gate nfs3 setacl by argp->mask
In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs3 setacl by argp->mask nfsd3_proc_setacl() calls set_posix_acl() unconditionally for both ACL_TYPE_ACCESS and ACL_TYPE_DEFAULT, passing argp->acl_access …
CVE-2026-89669Critical· 9.8⚖ disputednfsd: initialize copy-notify stateid before publishing it
In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4_copy_notify() finished initializing the cpntf state after nfs4_alloc_init_cpntf_state() had already lin…
CVE-2026-89665High· 8.2nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE
In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdr_decode_sattr(): iap->ia_atime.…
CVE-2026-89663High· 8.8nfsd: revoke copy-notify stateids before dropping their reference
In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before dropping their reference Copy-notify stateids live in the s2s_cp_stateids IDR and on their parent stid's sc_cp_list, pinned by…
CVE-2026-89662Critical· 9.8⚖ disputedNFSD: Prevent lock owner use-after-free during client teardown
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown __destroy_client() releases a client's open owners, but a lock owner whose only reference is a blocked l…
CVE-2026-89657High· 7.5libceph: validate OSD extent maps before cursor advance
In the Linux kernel, the following vulnerability has been resolved: libceph: validate OSD extent maps before cursor advance net/ceph/osd_client.c:osd_sparse_read() validates that the sparse-read data length matches the summed extent le…