Tagged “cve.org”
CVEs tagged cve.org, newest first.
47225 CVEsRSS
CVE-2026-99116High· 7.8net: psp: do not inherit the Rx association on clone
In the Linux kernel, the following vulnerability has been resolved: net: psp: do not inherit the Rx association on clone sk->psp_assoc sits past sk_dontcopy_end, so sock_copy() copies it into every socket accepted from a listener witho…
CVE-2026-99118Nonedrm/i915/dmc: Harden DMC firmware payload parsing
In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Harden DMC firmware payload parsing Validate the conversion of the DMC firmware size from dwords to bytes using check_mul_overflow() before calculating t…
CVE-2026-99117High· 7.8net: bridge: mcast: don't truncate the port group walk on teardown
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: don't truncate the port group walk on teardown __br_multicast_disable_port_ctx() and br_multicast_del_port() walk port->mglist with hlist_for_each_…
CVE-2026-99121Noneipv4: avoid divide by zero in fib_rebalance
In the Linux kernel, the following vulnerability has been resolved: ipv4: avoid divide by zero in fib_rebalance fib_rebalance() computes the total eligible nexthop weight in one pass and programs upper bounds in a second pass. A concur…
CVE-2026-99120NoneKVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes When running Hyper-V from Windows 11, KVM is seeing the SS bit set in nested page fault error codes pro…
CVE-2026-99119Nonedrm/amdgpu/userq: actually validate userq BOs
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: actually validate userq BOs This was supposed to loop over the individual evicted list, as the kernel and always_valid evicted lists were already han…
CVE-2026-99123High· 7.1vsock/virtio: validate packet source for connected sockets
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: validate packet source for connected sockets virtio_transport_recv_pkt() looks up sockets first by the full source and destination tuple, then by destina…
CVE-2026-99125Nones390/pai: Handle multiple PMU stop callback invocations
In the Linux kernel, the following vulnerability has been resolved: s390/pai: Handle multiple PMU stop callback invocations Handle the following scenario: The kernel protects itself against a very high sampling load and throttles the s…
CVE-2026-99122High· 7.3vsock/vmci: validate packet source for connected sockets
In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: validate packet source for connected sockets vmci_transport_recv_stream_cb() looks up sockets first by the full source and destination tuple, then by desti…
CVE-2026-99128Nonesctp: validate chunk length in the inqueue parser
In the Linux kernel, the following vulnerability has been resolved: sctp: validate chunk length in the inqueue parser SCTP chunks always include a four-byte generic header, but sctp_inq_pop() currently accepts shorter declared lengths.…
CVE-2026-99126Nones390/ctcm: Prevent XID null dereference
In the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Prevent XID null dereference The mpc_validate_xid() function sets grp->saved_xid2->xid2_flag2 to 0x40 to signal XID validation error. If peer XID is NULL or…
CVE-2026-99129Noneselinux: fix BPF token permission checks
In the Linux kernel, the following vulnerability has been resolved: selinux: fix BPF token permission checks Avoid multiple lookups of the bpffs creator SID using the token's file descriptor when the same information can be found via t…
CVE-2026-99127Nonepage_pool: keep frag_offset aligned for odd-sized requests
In the Linux kernel, the following vulnerability has been resolved: page_pool: keep frag_offset aligned for odd-sized requests page_pool_alloc_frag_netmem() rounds the requested fragment size with size = ALIGN(size, dma_get_cache_ali…
CVE-2026-99124Nones390/pci: Fix leak of uninitialized kernel data in SCLP report
In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix leak of uninitialized kernel data in SCLP report While report_error_write() checks that the provided buffer is at least as large as the header struct, bu…
CVE-2026-99130Noneio_uring/cancel: don't spin on local work the task can't run
In the Linux kernel, the following vulnerability has been resolved: io_uring/cancel: don't spin on local work the task can't run io_uring_cancel_generic() refuses to sleep while any ring on the exiting task's tctx has local work pendin…
CVE-2026-99132Nonexfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf
In the Linux kernel, the following vulnerability has been resolved: xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf xfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous xfs_trans_commit(), wh…
CVE-2026-99131High· 8.2xfs: fix capability check in xfs
In the Linux kernel, the following vulnerability has been resolved: xfs: fix capability check in xfs An user reported a bug where he managed to evade group's quota by changing a file's gid to a different group id the same user belonged…
CVE-2026-99134Nonemac802154: fix data race and NULL deref on local->assoc_dev
In the Linux kernel, the following vulnerability has been resolved: mac802154: fix data race and NULL deref on local->assoc_dev local->assoc_dev is shared between the association path and the association-response worker without common …
CVE-2026-99140Nonetracing: Fix hist trigger timestamps for buffered events
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix hist trigger timestamps for buffered events Syzkaller triggered a WARN_ON_ONCE(!nest) warning: WARNING: kernel/trace/ring_buffer.c:821 at ring_buffer_e…
CVE-2026-99135Nonedm-integrity: fix infinite loop on discard with large tag size
In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix infinite loop on discard with large tag size When integrity_metadata handles a discard, it fills a buffer with DISCARD_FILLER and writes it over the …
CVE-2026-99137Nonecifs: don't update i_size in cifs_do_truncate without a cached handle
In the Linux kernel, the following vulnerability has been resolved: cifs: don't update i_size in cifs_do_truncate without a cached handle If find_writable_file() returns null, cifs_file_flush will return 0 without issuing set_file_size…
CVE-2026-99136High· 7.0dm-crypt: fix a tiny race condition in crypt_dec_pending
In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in crypt_dec_pending crypt_dec_pending reads io->error before calling atomic_dec_and_test. Another context, for example crypt_endio…
CVE-2026-99138Nonetcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)
In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO) do_tcp_getsockopt() reads icsk->icsk_ca_ops and dereferences the get_info function pointer without rcu_read_l…
CVE-2026-99133Nonenet/iucv: fix the recvmsg window update
In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix the recvmsg window update iucv_sock_recvmsg() sends the HiperSockets-only AF_IUCV_FLAG_WIN without testing the transport, so on a classic z/VM socket iuc…
CVE-2026-99139Nonetcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)
In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION) do_tcp_getsockopt() reads icsk->icsk_ca_ops->name without holding rcu_read_lock(). Since commit 0baf26b0fc…
CVE-2026-99142High· 7.1tracing: Check operator stack capacity before pushing
In the Linux kernel, the following vulnerability has been resolved: tracing: Check operator stack capacity before pushing predicate_parse() uses the first operator stack entry before processing any opening parentheses. A push then incr…
CVE-2026-99141Nonetracing: Fix crash in print_graph_function_event()
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash in print_graph_function_event() tracing_set_tracer() assigns the flags of the newly selected tracer with: tr->current_trace_flags = t->flags ? : t…
CVE-2026-99148High· 7.0drm/amdgpu: keep the eviction fence until the last handle is closed
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpu_gem_object_close() detaches the user queue eviction fence from the BO before it checks bo_va…
CVE-2026-99143High· 7.8tracing: Keep the predicate limit separate from program capacity
In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the predicate limit separate from program capacity predicate_parse() adds two to nr_preds to reserve the terminal TRUE and FALSE entries. It also uses th…
CVE-2026-99145Nonedrm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change Pinned bos have their pages removed from the shrinker's shrinkable / purgeable counts on…