linux vulnerabilities
CVEs whose affected-version data names the linux package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4700 CVEsRSS
CVE-2026-99161Nonei2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()
In the Linux kernel, the following vulnerability has been resolved: i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe() In wmt_i2c_probe(), i2c->clk is acquired using of_clk_get(). If any subsequent operation fails or when the module is…
CVE-2026-99158Nonering-buffer: Fix false warning in ring_buffer_map_get_reader()
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix false warning in ring_buffer_map_get_reader() The mmap reader can warn when it catches up with a writer that is still committing events. rb_get_reader…
CVE-2026-99163Nonetracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields
In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields In check_synth_field(), when a synthetic event field is a stacktrace (field->is_stack)…
CVE-2026-99162Nonegpio: shared: fix use-after-free bug when adding shared proxies
In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix use-after-free bug when adding shared proxies The GPIO lookup table can stay alive for longer than the kobject whose name string's address we're assi…
CVE-2026-99164Nonespi: imx: fix slab corruption from undersized DMA bounce buffers
In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e ("spi: imx: support dynamic burst length for ECSPI DMA mode"), the driver al…
CVE-2026-99168Nonemshv_vtl: Check per-CPU register page before mmap
In the Linux kernel, the following vulnerability has been resolved: mshv_vtl: Check per-CPU register page before mmap Register-page setup is optional for each CPU. If allocation or registration fails, mshv_vtl_configure_reg_page() warn…
CVE-2026-99166Nonenet: rds: fix uninitialized trans dereference in CM event handler
In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM event handler rds_rdma_cm_event_handler_cmn() assigns trans only when the RDMA device is an InfiniBand CA (RDMA_NOD…
CVE-2026-99167Nonenet/sched: fix use-after-free in __tcf_action_put()
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in __tcf_action_put() __tcf_action_put() decrements the reference count before decrementing the binding count. Another thread can free th…
CVE-2026-99171Nonentfs3: free the sbi after a grace period
In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the "nocase" mount option ntfs3 uses custom hash and dentry compare functions. Both access ntfs3 superblock private informa…
CVE-2026-99169Nonefutex: Fix mm reuse handling for FUT_OFF_MMSHARED
In the Linux kernel, the following vulnerability has been resolved: futex: Fix mm reuse handling for FUT_OFF_MMSHARED A FUT_OFF_MMSHARED futex is a shared futex that refers to an MM. It is possible for a process to wait on a shared fut…
CVE-2026-99170Nonenamespace: a mount that copy_tree() leaves out can't take over a lock
In the Linux kernel, the following vulnerability has been resolved: namespace: a mount that copy_tree() leaves out can't take over a lock Since commit c62a4766937e ("move_mount: transfer MNT_LOCKED") a mount can be moved beneath a lock…
CVE-2026-99172Noneipc: drop the mqueue mount with kern_unmount() on setup failure
In the Linux kernel, the following vulnerability has been resolved: ipc: drop the mqueue mount with kern_unmount() on setup failure mq_init_ns() creates the mqueue mount with fc_mount_longterm(), so its ->mnt_ns is MNT_NS_INTERNAL. Whe…
CVE-2026-99177NoneKVM: SEV: Fix page dirtying in sev_gmem_post_populate()
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sev_gmem_post_populate() set_page_dirty() requires that the caller holds some kind of lock to ensure that the page's mapping does not co…
CVE-2026-99175Nonefsnotify: prevent mark additions during connector teardown
In the Linux kernel, the following vulnerability has been resolved: fsnotify: prevent mark additions during connector teardown fsnotify_destroy_marks() keeps a reference to its current mark while it drops conn->lock to destroy the mark…
CVE-2026-99173Noneeventfs: Free the eventfs_inode after an rcu grace period too
In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfs_inode after an rcu grace period too tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that dentry->d_fsdata points to, and ->d_rev…
CVE-2026-99176NoneKVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry Reset the vCPU's MMU pointer back to the root MMU if loading L2 state fails in the "n…
CVE-2026-99174Noneext4: free the sbi after a grace period
In the Linux kernel, the following vulnerability has been resolved: ext4: free the sbi after a grace period ext4_get_link() follows a symlink that keeps its target in a data block in rcu pathwalk mode with ext4_getblk(EXT4_GET_BLOCKS_C…
CVE-2026-99182NoneASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When ch_count is smaller than blob->alh_cfg.device_count (e.g. a mono capture stream, such…
CVE-2026-99178Nonex86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context
In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context An async #PF "page not present" event arrives through the #PF vector, and its reason sits in the …
CVE-2026-99179Nonewatch_queue: Fix note pool publication race in watch_queue_set_size()
In the Linux kernel, the following vulnerability has been resolved: watch_queue: Fix note pool publication race in watch_queue_set_size() There is a race between watch_queue_set_size() and post_one_notification(). watch_queue_set_size(…
CVE-2026-99183Noneaccel/rocket: search every core slot when looking up a scheduler
In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when looking up a scheduler sched_to_core() walks rdev->cores[] up to rdev->num_cores, and rocket_remove() decrements num_cores fo…
CVE-2026-99180Noneunicode: free the map after a grace period
In the Linux kernel, the following vulnerability has been resolved: unicode: free the map after a grace period generic_ci_d_hash() and generic_ci_d_compare() read sb->s_encoding and dereference the unicode map while a pathwalk in rcu m…
CVE-2026-99181Noneautofs: ignore notification errors from a replaced pipe
In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced pipe autofs_notify_daemon() takes a reference to the current notification pipe under wq_mutex, then drops the mutex …
CVE-2026-99186Nonex86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()
In the Linux kernel, the following vulnerability has been resolved: x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx() Commit 45e1dccc0653 ("x86/insn: Simplify for_each_insn_prefix()") made for_each_insn_prefix() d…
CVE-2026-99184Noneaccel/rocket: search every core slot when a core is removed
In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when a core is removed rocket_remove() decrements rdev->num_cores for each core it removes, while find_core_for_dev() searches slo…
CVE-2026-99187Noneperf: Fix perf_pmu_migrate_context() leaving events behind
In the Linux kernel, the following vulnerability has been resolved: perf: Fix perf_pmu_migrate_context() leaving events behind __perf_pmu_remove() walks the group leaders of a CPU and PMU with perf_event_groups_for_cpu_pmu(), removing …
CVE-2026-99185Nonefirewire: core: fix race condition in split transaction handling
In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition in split transaction handling For a split transaction, either fw_core_handle_response() or split_transaction_timeout_callback() may …
CVE-2026-99188Nonenet: stmmac: dwmac1000: clear the RGMII status interrupt
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac1000: clear the RGMII status interrupt Since commit 2e2c878a3141 ("net: stmmac: remove SGMII/RGMII/SMII interrupt handling") nothing on the RGMII pat…
CVE-2026-99191Nonecalipso: keep BIG TCP payload_len in calipso_skbuff_setattr()
In the Linux kernel, the following vulnerability has been resolved: calipso: keep BIG TCP payload_len in calipso_skbuff_setattr() calipso_skbuff_setattr() adjusts payload_len by the length of the option it inserts or resizes: payload…
CVE-2026-99189Nonegpio: mxc: fix race between chained IRQ handler install and probe completion
In the Linux kernel, the following vulnerability has been resolved: gpio: mxc: fix race between chained IRQ handler install and probe completion mxc_update_irq_chained_handler() is called before the IRQ domain, the generic IRQ chip, an…