Tagged “csaf”
CVEs tagged csaf, newest first.
7670 CVEsRSS
CVE-2026-98829Medium· 6.5kernel: wifi: mac80211: drop oversized fragments to avoid extra_len overflow (CVE-2026-98829)
A flaw was found in the mac80211 wireless networking subsystem of the Linux kernel. An adjacent attacker, such as a rogue Wi-Fi access point or nearby malicious device, can cause a Denial of Service (DoS) by transmitting a sequence of over…
CVE-2026-98833Medium· 5.5mtd: core: call _get_device() with the master MTD
In the Linux kernel, the following vulnerability has been resolved: mtd: core: call _get_device() with the master MTD __get_mtd_device() calls the master's _get_device() callback with mtd, which may be a partition. __put_mtd_device() p…
CVE-2026-98832Medium· 4.7kernel: blk-cgroup: save IRQ state in blkg_tryget_closest() (CVE-2026-98832)
A flaw was found in the Linux kernel's block control group (blk-cgroup) subsystem. When associating block I/O requests with control groups, the kernel prematurely re-enables interrupts while internal locks are still held. A local user can …
CVE-2026-98830Medium· 5.5wifi: wfx: validate MIB read length before copying to caller
In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfx_hif_read_mib() copies reply->length bytes from the firmware response into the caller-provided buffer w…
CVE-2026-98837Medium· 5.5ALSA: caiaq: unregister the input device when probe fails
In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: unregister the input device when probe fails setup_card() registers the input device, whose name and phys point into struct snd_usb_caiaqdev, and then goe…
CVE-2026-98835Medium· 5.5kernel: iio: accel: kionix-kx022a: Fix array boundary check (CVE-2026-98835)
A flaw was found in the Linux kernel's Kionix KX022A accelerometer driver. A local user could trigger a Denial of Service (DoS) or kernel memory disclosure due to an off-by-one array bounds validation check when converting device register …
CVE-2026-98834Medium· 4.1kernel: mtd: core: avoid double-free of OTP NVMEM device (CVE-2026-98834)
A flaw was found in the Linux kernel's Memory Technology Device (MTD) subsystem. An attacker capable of triggering device registration failures can cause a Denial of Service (DoS) via a kernel crash. During the setup of One-Time Programmab…
CVE-2026-98840Medium· 4.7vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
In the Linux kernel, the following vulnerability has been resolved: vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF The reload of 'vc' added by commit 8fb9ea65c9d1 ("vc_screen: reload load of struct vc_data poi…
CVE-2026-98838Medium· 4.4vt: skip screen update for DEC alignment test on backgroup consoles
In the Linux kernel, the following vulnerability has been resolved: vt: skip screen update for DEC alignment test on backgroup consoles [BUG] Recently, we encountered a KASAN warning as follows: BUG: KASAN: slab-out-of-bounds in fb_pa…
CVE-2026-98836Medium· 6.2ALSA: line6: reject oversized playback packets
In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: reject oversized playback packets Each playback URB is handed a slice of out.buffer that is exactly LINE6_ISO_PACKETS * max_packet_size_out bytes, sized f…
CVE-2026-98842Medium· 4.4kernel: module: fix lost error code from codetag_load_module() (CVE-2026-98842)
A flaw was found in the Linux kernel's module loading subsystem. When an error occurs during module initialization, the kernel fails to propagate the error code and incorrectly reports a successful load after the module has already been cl…
CVE-2026-98839Medium· 6.1kernel: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() (CVE-2026-98839)
A flaw was found in the Linux kernel's virtual terminal selection subsystem. When pasting console selections, a race condition can occur if another process concurrently replaces the selection buffer with shorter content while the operation…
CVE-2026-98845Medium· 4.5kernel: tpm: Disable TPM on null key name mismatch (CVE-2026-98845)
A flaw was found in the Linux kernel's Trusted Platform Module (TPM) subsystem. This vulnerability allows an attacker to bypass TPM reset protections because the driver fails to disable the device when a null key integrity check fails. Con…
CVE-2026-98843Medium· 4.4kernel: netfs: zero gaps in read-gaps folio to avoid writing back stale data (CVE-2026-98843)
A flaw was found in the Linux kernel's Network Filesystem (netfs) subsystem. When reading data gaps around modified memory regions during streaming write operations, truncated or incomplete read responses from a remote server fail to clear…
CVE-2026-98841Medium· 4.1kernel: virt: vmgenid: set driver_data before registering notification handlers (CVE-2026-98841)
A flaw was found in the Linux kernel's Virtual Machine Generation ID (vmgenid) driver. The driver registers interrupt and notification handlers before fully initializing driver data during startup. If an interrupt or notification is receiv…
CVE-2026-98849Medium· 4.7kernel: pfcp: fix socket lifetime on netdevice registration failure (CVE-2026-98849)
A flaw was found in the Linux kernel's Packet Forwarding Control Protocol (PFCP) driver. When creating a PFCP network interface, a failure during device registration triggers error handling that attempts to release an internal network sock…
CVE-2026-98846Medium· 5.5sctp: check RCV_SHUTDOWN after the sendmsg connect wait
In the Linux kernel, the following vulnerability has been resolved: sctp: check RCV_SHUTDOWN after the sendmsg connect wait sctp_wait_for_connect() drops the socket lock while it sleeps. An out-of-the-blue ABORT can then be processed f…
CVE-2026-98844Low· 3.3kernel: netfs: clear post-EOF pagecache when extending a file via write (CVE-2026-98844)
A flaw was found in the Linux kernel's network filesystem (netfs) subsystem. When a file is extended through write operations after previous writes were performed via memory mapping, the system fails to clear stale cache data located beyon…
CVE-2026-98850Medium· 5.5net/packet: prevent TX_RING byte count overflow
In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TX_RING byte count overflow tpacket_snd() drains every SEND_REQUEST frame in a TX ring and adds each valid packet length to the signed int len_sum.…
CVE-2026-98848Medium· 4.1kernel: rtc: ac100: Assign .num before accessing .hws (CVE-2026-98848)
A flaw was found in the Linux kernel's AC100 Real-Time Clock (RTC) driver. During device probing, the driver accesses an internal array before initializing its element counter. On systems compiled with runtime bounds checking enabled, this…
CVE-2026-98847Medium· 4.1rtc: spear: initialize IRQ state before requesting alarm IRQ
In the Linux kernel, the following vulnerability has been resolved: rtc: spear: initialize IRQ state before requesting alarm IRQ devm_request_irq() enables the interrupt before it returns, so the handler may run while probe is still in…
CVE-2026-98852Medium· 5.9kernel: net: extend IPv6 exthdr detection of tunneled packets (CVE-2026-98852)
A flaw was found in the Linux kernel's networking subsystem. An attacker could exploit this vulnerability by sending specially crafted encapsulated IPv6 network traffic, leading to a Denial of Service (DoS). This issue stems from improper …
CVE-2026-98851Low· 3.3netfilter: nft_flow_offload: drop flowtable reference on init error path
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_flow_offload: drop flowtable reference on init error path nft_flow_offload_init() bumps the flowtable use count with nft_use_inc() before calling nf_ct_…
CVE-2026-98856Medium· 4.4kprobes: Skip disarmed probes when checking optkprobe overlap
In the Linux kernel, the following vulnerability has been resolved: kprobes: Skip disarmed probes when checking optkprobe overlap On x86, an optkprobe at A replaces five bytes with a jump. If a disabled probe B is at A+2, get_optimized…
CVE-2026-98855Medium· 4.4of/overlay: put property on deadprops only after changeset add succeeds
In the Linux kernel, the following vulnerability has been resolved: of/overlay: put property on deadprops only after changeset add succeeds add_changeset_property() links a new property of a not-yet-live target node into the node's dea…
CVE-2026-98853High· 7.5net: gso: limit recursive IP-in-IP segmentation
In the Linux kernel, the following vulnerability has been resolved: net: gso: limit recursive IP-in-IP segmentation IP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment() for each nested IP header. encap_level tracks header…
CVE-2026-98858Medium· 5.5kernel: io_uring: fix task_work add use-after-free with SQPOLL (CVE-2026-98858)
A flaw was found in the Linux kernel's io_uring subsystem. When submission queue polling (SQPOLL) is enabled, a race condition can cause the polling thread to free the ring context while another operation is still accessing it. A local use…
CVE-2026-98857High· 7.5ipvs: bound LBLCR and LBLC cache growth
In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for every previously unseen destination address. The table max_size…
CVE-2026-98854Medium· 4.1of/overlay: only treat a positive changeset id as registered
In the Linux kernel, the following vulnerability has been resolved: of/overlay: only treat a positive changeset id as registered of_overlay_fdt_apply() stores the idr_alloc() return value in ovcs->id before checking it. On failure the …
CVE-2026-98865Medium· 4.4kernel: sched_ext: Don't run ops.dequeue() with a DSQ lock held (CVE-2026-98865)
A flaw was found in the Linux kernel's sched_ext subsystem. A local attacker could cause a Denial of Service (DoS) by triggering a deadlock condition when running an extensible scheduler program that accesses a dispatch queue while a lock …