Tagged “csaf”
CVEs tagged csaf, newest first.
7670 CVEsRSS
CVE-2026-98859Medium· 5.3HID: multitouch: stop the release timer from being rearmed on remove
In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: stop the release timer from being rearmed on remove mt_remove() quiesces the sticky-finger timer before stopping the hardware: timer_delete_sync(…
CVE-2026-98864Medium· 4.7kernel: sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task (CVE-2026-98864)
A flaw was found in the Linux kernel's extensible scheduler (sched_ext) subsystem. A race condition occurs when a task is re-enqueued before a prior dispatch operation has completed, allowing internal scheduling states to be improperly ove…
CVE-2026-98861Medium· 4.7kernel: kernel: Denial of Service via fprobe use-after-free (CVE-2026-98861)
A flaw was found in the Linux kernel's function probe (fprobe) tracing mechanism. When handlers execute during inactive Read-Copy Update (RCU, a kernel synchronization mechanism) states, unregistration routines fail to wait for active hand…
CVE-2026-98860Low· 1.9kernel: HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request (CVE-2026-98860)
A flaw was found in the Linux kernel's Human Interface Device (HID) subsystem. This flaw can lead to information disclosure when hardware communication errors occur. Due to an improper integer comparison in the Berkeley Packet Filter (BPF)…
CVE-2026-98866Medium· 4.7kernel: sched/cache: Introduce task_struct->sched_cache_grp to fix UAF (CVE-2026-98866)
A flaw was found in the Linux kernel. A use-after-free vulnerability, where memory is accessed after being released, occurs in the process scheduler cache component during task memory switches. A local user could exploit this flaw to cause…
CVE-2026-98863Medium· 5.6kernel: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (CVE-2026-98863)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem. When running nested virtual machines, the hypervisor fails to properly re-queue a memory page request if retrieving state pages for a nested guest fails d…
CVE-2026-98868Medium· 4.4kernel: dm-pcache: reject a kset that overruns its segment (CVE-2026-98868)
A flaw was found in the Linux kernel's dm-pcache driver. A local attacker capable of presenting a crafted storage device with forged metadata can cause cache operations to exceed segment boundaries. This flaw triggers a kernel assertion fa…
CVE-2026-98867Medium· 4.4kernel: dm-pcache: bound the logical key offset from persistent memory (CVE-2026-98867)
A flaw was found in the Linux kernel's Device Mapper persistent cache (dm-pcache) module. A local attacker capable of mounting or attaching a crafted persistent cache device can exploit missing boundary checks on logical key offsets. This …
CVE-2026-98862Medium· 4.1audit: fix exe mark UAF in kill_rules()
In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in kill_rules() kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit tree is pruned. It drops entry->rule.exe before removing…
CVE-2026-98435Medium· 4.4kernel: EDAC/altera: Use parent device for devres in altr_portb_setup() (CVE-2026-98435)
A flaw was found in the Linux kernel's Altera EDAC (Error Detection and Correction) driver. Device-managed interrupt requests and resource groups in the altr_portb_setup() function were improperly associated with a temporary per-port devic…
CVE-2026-98434Medium· 5.5kernel: sysctl: Check range in proc_dointvec_ms_jiffies_minmax (CVE-2026-98434)
A flaw was found in the Linux kernel. Due to a missing range validation check in the sysctl subsystem, configured minimum and maximum limits were not enforced during specific millisecond-to-jiffies conversions. A local user with permission…
CVE-2026-98433Low· 2.5kernel: KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure (CVE-2026-98433)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for PowerPC architectures. When handling secure virtual machines, a failure during secure memory paging fails to release allocated device memory and intern…
CVE-2026-98441Medium· 4.7⚖ disputedkernel: net/sched: act_ct: avoid modifying shared unconfirmed ct entry (CVE-2026-98441)
A flaw was found in the Linux kernel's traffic control conntrack action module (act_ct). An attacker capable of sending network traffic through affected packet filters could trigger a Denial of Service (DoS) or kernel memory corruption. Th…
CVE-2026-98442High· 7.5kernel: net/sched: act_ct: fix helper UAF due to extensions realloc (CVE-2026-98442)
A flaw was found in the Linux kernel's traffic control connection tracking action (act_ct). An attacker capable of sending network traffic handled by the affected system can cause a Denial of Service (DoS) or kernel memory corruption throu…
CVE-2026-98440Medium· 5.6kernel: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction (CVE-2026-98440)
A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem on ARM64 architectures. In nested virtualization configurations, shadow memory management structures are prematurely freed during shadow page flushes while…
CVE-2026-98443High· 7.8⚖ disputedxfs: fix cursor and pointer handling when recovering iunlink buckets
In the Linux kernel, the following vulnerability has been resolved: xfs: fix cursor and pointer handling when recovering iunlink buckets LOLLM pointed out a bug in xlog_recover_iunlink_bucket: 1. We don't null out prev_ip after releas…
CVE-2026-98451High· 8.8⚖ disputedsmb: client: use finish_no_open() for non-regular inodes
In the Linux kernel, the following vulnerability has been resolved: smb: client: use finish_no_open() for non-regular inodes An O_CREAT open can find an existing symlink or another non-regular inode. cifs_atomic_open() calls finish_ope…
CVE-2026-98454High· 8.1smb: client: fix create context out-of-bounds reads
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2_parse_contexts() validates the complete create-context area but does not limit each record to its Next field b…
CVE-2026-98456High· 7.0⚖ disputedBluetooth: mgmt: fix race in read_unconf_index_list()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in read_unconf_index_list() read_unconf_index_list() counts unconfigured controllers before allocating its response, then checks the device f…
CVE-2026-98462Medium· 4.7kernel: Bluetooth: hci_conn: fix CIS hold ownership on reuse (CVE-2026-98462)
A flaw was found in the Linux kernel's Bluetooth subsystem. Improper reference count management during the reuse and binding of Connected Isochronous Stream (CIS) connections can result in an unbalanced connection hold count. A local attac…
CVE-2026-98466High· 8.2kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem on ARM64 platforms. During system initialization in protected virtualization modes, the hypervisor fails to revoke host stage-2 access permissions for per-…
CVE-2026-98465Medium· 5.3kernel: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration (CVE-2026-98465)
A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem for the RISC-V architecture. Due to missing synchronization between interrupt controller device operations and virtual CPU (vCPU) execution, a local user w…
CVE-2026-98464Medium· 5.6⚖ disputedkernel: RISC-V: KVM: Synchronize hrtimer callback during teardown (CVE-2026-98464)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) implementation for the RISC-V architecture. This vulnerability can lead to a Denial of Service (DoS) or host system crash due to a use-after-free memory issue during…
CVE-2026-98472Low· 3.3kernel: KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV (CVE-2026-98472)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) AMD SEV (Secure Encrypted Virtualization) implementation. This flaw allows a local user with permissions to manage virtual machines to cause a denial of service (DoS…
CVE-2026-98471Medium· 5.3kernel: KVM: SEV: Do cache maintenance on the source VM during intra-host migration (CVE-2026-98471)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for AMD SEV (Secure Encrypted Virtualization). During intra-host migration of an encrypted virtual machine, the source virtual machine's CPU caches are not…
CVE-2026-98469Medium· 5.5kernel: KVM: arm64: Fix AArch32 DBGBXVR<n> handling (CVE-2026-98469)
A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem for ARM64 architectures. Improper handling of specific debug register accesses in 32-bit ARM (AArch32) mode causes the hypervisor to encounter an internal …
CVE-2026-98476Medium· 4.7kernel: s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str() (CVE-2026-98476)
A flaw was found in the Linux kernel's s390 channel I/O (CIO) subsystem. When querying device utility strings, the kernel fails to verify that an associated channel path remains valid after its removal from the registry. A local user could…
CVE-2026-98474Medium· 4.1kernel: s390/pci: Fix missing device lock in zpci_report_status() (CVE-2026-98474)
A flaw was found in the Linux kernel's s390 PCI subsystem. This flaw can lead to a Denial of Service (DoS) due to a missing device lock during PCI (Peripheral Component Interconnect) error recovery. When error recovery status is reported w…
CVE-2026-98468Low· 2.5kernel: KVM: arm64: Fix spurious warning for benign stage 2 teardown race (CVE-2026-98468)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for ARM64. This flaw may allow a local user to cause a Denial of Service (DoS) or kernel instability. A race condition occurs when virtual machine stage 2 …
CVE-2026-98480Low· 1.9kernel: nfc: trf7970a: power down on startup RX gain failure (CVE-2026-98480)
A flaw was found in the Linux kernel's Near Field Communication (NFC) TRF7970A driver. This vulnerability can lead to a denial of service (DoS) or improper hardware state due to unreleased power resources. If a communication error occurs w…