Tagged “csaf”
CVEs tagged csaf, newest first.
7670 CVEsRSS
CVE-2026-98797Medium· 5.5kernel: net: cap skb->queue_mapping when the tx queue is picked (CVE-2026-98797)
A flaw was found in the Linux kernel. A local user with network administration privileges in a network namespace can cause a Denial of Service (DoS) by triggering an out-of-bounds memory read. When redirecting packets between network inter…
CVE-2026-98802Low· 3.7kernel: seg6: ensure packet data is writable before modifying SRH and IPv6 DA (CVE-2026-98802)
A flaw was found in the Linux kernel. When processing IPv6 segment routing (seg6) headers, the kernel modifies routing and destination address fields without first ensuring that the network packet buffer is writable. If the packet buffer i…
CVE-2026-98800Medium· 4.7kernel: kernel: Denial of Service via use-after-free in BPF trampoline (CVE-2026-98800)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. When a BPF program attached to a trampoline is detached, the kernel may release the program's memory prematurely before preempted tasks have safely completed ex…
CVE-2026-98804Medium· 4.7kernel: net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk() (CVE-2026-98804)
A flaw was found in the Linux kernel's networking subsystem. When page pool statistics are enabled, a race condition in the bulk recycling mechanism can allow a memory pool to be freed before statistical updates finish processing. An attac…
CVE-2026-98803Medium· 6.5kernel: net: stmmac: fix rx Scatter-Gather support (CVE-2026-98803)
A flaw was found in the Linux kernel's stmmac ethernet driver. When receiving network frames larger than the primary buffer size, the Direct Memory Access (DMA) engine attempts to write excess data into a secondary receive buffer that is n…
CVE-2026-98801Medium· 5.5kernel: kernel: Denial of Service via improper socket memory reservation handling (CVE-2026-98801)
A flaw was found in the Linux kernel. A local user can cause a Denial of Service (DoS) or kernel memory corruption by manipulating socket memory reservation settings. Due to a lack of upper-bound validation and missing locking mechanisms w…
CVE-2026-98807Medium· 4.4kernel: net/mlx5: Fix slab-out-of-bounds when handling team device events (CVE-2026-98807)
A flaw was found in the Linux kernel's Mellanox ConnectX (mlx5) network driver. It allows a privileged local user to cause a Denial of Service (DoS) via an out-of-bounds memory read. When processing Link Aggregation (LAG) events, the drive…
CVE-2026-98806Medium· 4.4kernel: octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled (CVE-2026-98806)
A flaw was found in the Linux kernel's octeontx2-pf network driver. When Data Center Bridging (DCB) is enabled, the driver assumes traffic queue mapping structures are always initialized, which is not the case for System Data Path (SDP) vi…
CVE-2026-98805High· 7.4tipc: prevent GCM nonce reuse on peer key changes
In the Linux kernel, the following vulnerability has been resolved: tipc: prevent GCM nonce reuse on peer key changes TIPC can encrypt traffic between nodes using a different transmit key for each node. In this mode, the AES-GCM nonce …
CVE-2026-98810Medium· 6.1kernel: wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() (CVE-2026-98810)
A flaw was found in the Linux kernel's mac80211 wireless subsystem. A local attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory by transmitting specially crafted network packets. This issue occurs because …
CVE-2026-98808Medium· 6.7kernel: net: systemport: Fix buffer overflow in bcm_sysport_get_stats() (CVE-2026-98808)
A flaw was found in the Linux kernel's Broadcom SYSTEMPORT driver. This vulnerability can lead to a Denial of Service (DoS) or memory corruption when a local user queries network device statistics on systems with SYSTEMPORT Lite hardware. …
CVE-2026-98812Medium· 5.5net/mctp: publish the mctp_dev only after it is initialised
In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctp_dev only after it is initialised mctp_add_dev() links the new mctp_dev into dev->mctp_ptr before mdev->dev is assigned, so a reader that pic…
CVE-2026-98811Low· 3.3net/sched: cls_api: reclaim an empty proto on the error path
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change() on th…
CVE-2026-98809Medium· 4.4Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister hci_unregister_dev() disables cmd_work and cmd_timer, then calls hci_cmd_sync_clear(), whose cancel_wor…
CVE-2026-98814Medium· 4.4kernel: nvme: fix command effects log lifetime for multipath heads (CVE-2026-98814)
A flaw was found in the Linux kernel's Non-Volatile Memory Express (NVMe) driver. A local attacker can cause a denial of service (DoS) or potentially escalate privileges by exploiting a use-after-free flaw. This issue occurs when an input/…
CVE-2026-98813Medium· 4.4kernel: bpf: Hold map BTF for the memory allocator destructor record (CVE-2026-98813)
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. During the teardown of certain BPF hash maps, the memory allocator destructor failed to retain a reference to the map's BPF Type Format (BTF) metadata, allowing…
CVE-2026-98818Medium· 4.7kernel: mm/slab: do not wake up kswapd in __kfree_rcu_sheaf() (CVE-2026-98818)
A flaw was found in the Linux kernel. When freeing memory through the slab allocator, the system may attempt to wake the kernel swap daemon while an internal scheduler lock is already held. This unsafe sequence can trigger a circular locki…
CVE-2026-98816Medium· 4.1kernel: bpf: Fix overflow of jump offset in constant blinding (CVE-2026-98816)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. An integer overflow occurs in the constant blinding mechanism when calculating backward jump offsets during BPF program hardening. A local attacker capable of l…
CVE-2026-98815Medium· 4.1nvme: fix cdev lifetime
In the Linux kernel, the following vulnerability has been resolved: nvme: fix cdev lifetime Sashiko bot reported a potential problem for the cdev lifetime in [0] - the code there is heavily based on the NVMe code. Currently the NS hea…
CVE-2026-98820Medium· 5.5kernel: blk-mq: set RQF_USE_SCHED when the operation is known (CVE-2026-98820)
A flaw was found in the Linux kernel's block multi-queue (blk-mq) subsystem. When cached input/output (I/O) requests originally allocated for passthrough commands are reused for standard read or write operations, scheduler flags are not pr…
CVE-2026-98822Medium· 4.3kernel: wifi: mac80211: prevent AP VLAN tx from other interfaces (CVE-2026-98822)
A flaw was found in the Linux kernel's mac80211 wireless subsystem. This flaw can lead to information disclosure across network boundaries when transmitting frames across Access Point (AP) virtual local area networks (VLANs). Due to improp…
CVE-2026-98821Medium· 4.7kernel: block: reject polled dio with user integrity metadata (CVE-2026-98821)
A flaw was found in the Linux kernel's block layer. A local user could exploit this vulnerability to cause a denial of service (DoS) by initiating polled direct I/O operations combined with user integrity metadata. Because the kernel impro…
CVE-2026-98819Medium· 4.4Bluetooth: btintel: validate DDC record lengths
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byt…
CVE-2026-98825Medium· 4.1rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()
In the Linux kernel, the following vulnerability has been resolved: rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() devm_clk_get(&pdev->dev, "rtcref")'s return value was passed straight into clk_get_rate() without chec…
CVE-2026-98824Medium· 5.3kernel: wifi: mac80211: validate TX status rate metadata (CVE-2026-98824)
A flaw was found in the Linux kernel's mac80211 wireless subsystem. When processing transmission (TX) status reports, the subsystem fails to properly validate rate metadata before using it to index internal rate tables. Malformed metadata …
CVE-2026-98823Medium· 5.3wifi: cfg80211: preserve hidden-group beacon IE ownership
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: preserve hidden-group beacon IE ownership A hidden-group probe-response entry borrows its beacon IEs from the group's beacon entry. cfg80211_update_ass…
CVE-2026-98828Medium· 6.2kernel: wifi: ath9k: reject short WMI command responses (CVE-2026-98828)
A flaw was found in the Linux kernel's ath9k wireless driver. When handling Wireless Module Interface (WMI) command responses, the driver copies data into a response buffer without verifying that the received message is sufficiently long. …
CVE-2026-98827Medium· 5.3kernel: wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE (CVE-2026-98827)
A flaw was found in the Linux kernel's ath9k_htc wireless network driver. An attacker transmitting large network packets can trigger a Denial of Service (DoS) or system crash through memory corruption. This issue occurs because the driver …
CVE-2026-98826Medium· 4.7kernel: kernel: Denial of service via use-after-free in the AC100 RTC driver (CVE-2026-98826)
A flaw was found in the Linux kernel's AC100 Real-Time Clock (RTC) driver. If device initialization fails during driver probing, unmanaged clock provider references remain registered in global system lists while their underlying memory is …
CVE-2026-98831Low· 2.3of/overlay: don't leak fragment references when changeset init fails
In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails init_overlay_changeset() stores the number of initialized fragments in ovcs->count only on full su…