Linux vulnerabilities
CVEs whose affected-version data names the Linux package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6536 CVEsRSS
CVE-2026-89726Medium· 5.5lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
In the Linux kernel, the following vulnerability has been resolved: lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Patch series "lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()", v2. This series fixes an off-b…
CVE-2026-89725High· 8.8⚖ disputedmedia: cec: stm32: prevent out-of-bounds write on RX overflow
In the Linux kernel, the following vulnerability has been resolved: media: cec: stm32: prevent out-of-bounds write on RX overflow stm32_rx_done() appends each received CEC byte to rx_msg.msg[] using rx_msg.len as the write index, incre…
CVE-2026-89724High· 7.8⚖ disputedmedia: vicodec: fix out-of-bounds write in FWHT encoder
In the Linux kernel, the following vulnerability has been resolved: media: vicodec: fix out-of-bounds write in FWHT encoder vidioc_s_fmt_vid_out() sizes the encoder CAPTURE buffer from the compressed descriptor pixfmt_fwht, whose sizei…
CVE-2026-89723High· 7.8⚖ disputednilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error in nilfs_direct_propag…
CVE-2026-89720High· 7.7⚖ disputedubifs: fix out-of-bounds read in signature length check
In the Linux kernel, the following vulnerability has been resolved: ubifs: fix out-of-bounds read in signature length check ubifs_sb_verify_signature() bounds the on-disk ubifs_sig_node->len field before handing the signature payload t…
CVE-2026-89712Critical· 9.8⚖ disputedNFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
In the Linux kernel, the following vulnerability has been resolved: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with list_for_each_entry_safe(ni, tmp, ...). …
CVE-2026-89711High· 8.2NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check
In the Linux kernel, the following vulnerability has been resolved: NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check The header for commit e75b23f9e323 ("nfsd: check d_can_lookup in fh_verify of directories") details the assumptio…
CVE-2026-89710Medium· 5.5NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path When the server returns a new layout stateid while a valid one is still held, pnfs_layout_pro…
CVE-2026-89707High· 7.5nfsd: release path refs on follow_down() error
In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on follow_down() error nfsd_cross_mnt() initializes a local struct path with mntget() and dget() before calling follow_down(). On a negative re…
CVE-2026-89704High· 7.5nfsd: sample writeback error cursor before async COPY loop
In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop _nfsd_copy_file_range() samples dst->f_wb_err into "since" after the copy loop, then uses it to detect write…
CVE-2026-89699High· 7.5⚖ disputednfsd: validate symlink target length in NFSv4 CREATE
In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4_decode_create() accepts an unbounded cr_datalen from the wire for NF4LNK symlink targets, allowing a client …
CVE-2026-89697Critical· 9.1⚖ disputednfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare() can inspect the dentr…
CVE-2026-89696High· 7.5⚖ disputednfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return success with fh_dentry and fh…
CVE-2026-89694High· 7.0nfsd: check client ownership when cancelling a copy-notify stateid
In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOAD_CANCEL path (clp != NULL), manage_cpntf_state() freed the target cpntf state without …
CVE-2026-89765Medium· 5.5timers/itimer: Zero-init old itimerval before copy to userspace
In the Linux kernel, the following vulnerability has been resolved: timers/itimer: Zero-init old itimerval before copy to userspace On native sparc64, struct __kernel_old_timeval contains a four-byte hole after tv_usec because tv_sec i…
CVE-2026-89756Medium· 5.5mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
In the Linux kernel, the following vulnerability has been resolved: mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() migrate_pages_batch() unmaps each folio before moving it, and every unmap runs the mmu_notifier …
CVE-2026-89753Medium· 5.5mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()
In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() I am seeing some rcu_tasks stalls in the Meta fleet during reclaim. INFO: rcu_tasks detected stalls …
CVE-2026-89752Medium· 5.5mm: memcg: stop reclaim when a limit update is superseded
In the Linux kernel, the following vulnerability has been resolved: mm: memcg: stop reclaim when a limit update is superseded kernfs serializes file operations only per open file, so separate open files can update the same memory.high …
CVE-2026-89751Medium· 5.5x86/tdx: Fix off-by-one in port I/O handling
In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handle_in() and handle_out() in arch/x86/coco/tdx/tdx.c use: u64 mask = GENMASK(BITS_PER_BYTE * size, 0); GENMASK(h,…
CVE-2026-89750High· 7.8⚖ disputedtracing/user_events: Clear copied tracing state before fork duplication
In the Linux kernel, the following vulnerability has been resolved: tracing/user_events: Clear copied tracing state before fork duplication dup_task_struct() copies user_event_mm from the parent into the child, without grabbing a refer…
CVE-2026-89749Medium· 5.5tracing: Fix crash passing ERR_PTR to kthread_stop()
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERR_PTR to kthread_stop() event_test_stuff() calls kthread_run() and unconditionally passes the returned task_struct pointer to kthread_stop…
CVE-2026-81010High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: honor task_work cancellation io_waitid_cb() may run through the fallback task_work path when task_work_add() can no longer queue work to the originati…
In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: honor task_work cancellation io_waitid_cb() may run through the fallback task_work path when task_work_add() can no longer queue work to the originati…
CVE-2026-80964Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: ALSA: virmidi: Check card index validity at probe virmidi driver blindly trusts that the given devptr->id value is within the proper card index range at probe
In the Linux kernel, the following vulnerability has been resolved: ALSA: virmidi: Check card index validity at probe virmidi driver blindly trusts that the given devptr->id value is within the proper card index range at probe. It's O…
CVE-2026-89566Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: jbd2: check need_resched() when skipping busy checkpoint buffers journal_shrink_one_cp_list() skips busy checkpoint buffers when called with JBD2_SHRINK_BUSY_SKIP
In the Linux kernel, the following vulnerability has been resolved: jbd2: check need_resched() when skipping busy checkpoint buffers journal_shrink_one_cp_list() skips busy checkpoint buffers when called with JBD2_SHRINK_BUSY_SKIP. Th…
CVE-2026-89506Medium· 4.7In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR The original commit missed that three drivers (mthca, irdma, siw) have UHW data associated with reg_mr that ca…
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR The original commit missed that three drivers (mthca, irdma, siw) have UHW data associated with reg_mr that ca…
CVE-2026-89715Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfs_uuid_add_file failure When nfs_uuid_add_file() races with nfs_uuid_put() tearing down uuid->net, it returns -ENXIO without publishing …
In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfs_uuid_add_file failure When nfs_uuid_add_file() races with nfs_uuid_put() tearing down uuid->net, it returns -ENXIO without publishing …
CVE-2026-89447Medium· 4.4In the Linux kernel, the following vulnerability has been resolved: iommufd: Avoid locking internal accesses during unmap iommufd_access_notify_unmap() skips internal accesses because they do not have an external unmap callback to invo…
In the Linux kernel, the following vulnerability has been resolved: iommufd: Avoid locking internal accesses during unmap iommufd_access_notify_unmap() skips internal accesses because they do not have an external unmap callback to invo…
CVE-2026-89518Medium· 5.5sched_ext: Fix this_rq() assumptions in dispatch kfuncs
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix this_rq() assumptions in dispatch kfuncs Under core scheduling, dispatch runs from within the core-wide pick and can target a sibling rq, so ops.dispatc…
CVE-2026-89517Medium· 5.5sched_ext: Fix rq->core_pick corruption under core scheduling
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix rq->core_pick corruption under core scheduling Core scheduling's pick_next_task() picks what to run on every SMT sibling of the core in a single pass un…
CVE-2026-89516Medium· 5.5sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users scx_bpf_dsq_reenq() queues a deferred reenq (dru) that runs from run_deferred(), not ops.dispat…