Tagged “cve.org”
CVEs tagged cve.org, newest first.
47225 CVEsRSS
CVE-2026-99176NoneKVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry Reset the vCPU's MMU pointer back to the root MMU if loading L2 state fails in the "n…
CVE-2026-99174Noneext4: free the sbi after a grace period
In the Linux kernel, the following vulnerability has been resolved: ext4: free the sbi after a grace period ext4_get_link() follows a symlink that keeps its target in a data block in rcu pathwalk mode with ext4_getblk(EXT4_GET_BLOCKS_C…
CVE-2026-99182NoneASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When ch_count is smaller than blob->alh_cfg.device_count (e.g. a mono capture stream, such…
CVE-2026-99178Nonex86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context
In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context An async #PF "page not present" event arrives through the #PF vector, and its reason sits in the …
CVE-2026-99179Nonewatch_queue: Fix note pool publication race in watch_queue_set_size()
In the Linux kernel, the following vulnerability has been resolved: watch_queue: Fix note pool publication race in watch_queue_set_size() There is a race between watch_queue_set_size() and post_one_notification(). watch_queue_set_size(…
CVE-2026-99183Noneaccel/rocket: search every core slot when looking up a scheduler
In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when looking up a scheduler sched_to_core() walks rdev->cores[] up to rdev->num_cores, and rocket_remove() decrements num_cores fo…
CVE-2026-99180High· 7.8unicode: free the map after a grace period
In the Linux kernel, the following vulnerability has been resolved: unicode: free the map after a grace period generic_ci_d_hash() and generic_ci_d_compare() read sb->s_encoding and dereference the unicode map while a pathwalk in rcu m…
CVE-2026-99181Noneautofs: ignore notification errors from a replaced pipe
In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced pipe autofs_notify_daemon() takes a reference to the current notification pipe under wq_mutex, then drops the mutex …
CVE-2026-99186Nonex86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()
In the Linux kernel, the following vulnerability has been resolved: x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx() Commit 45e1dccc0653 ("x86/insn: Simplify for_each_insn_prefix()") made for_each_insn_prefix() d…
CVE-2026-99184Noneaccel/rocket: search every core slot when a core is removed
In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when a core is removed rocket_remove() decrements rdev->num_cores for each core it removes, while find_core_for_dev() searches slo…
CVE-2026-99187Noneperf: Fix perf_pmu_migrate_context() leaving events behind
In the Linux kernel, the following vulnerability has been resolved: perf: Fix perf_pmu_migrate_context() leaving events behind __perf_pmu_remove() walks the group leaders of a CPU and PMU with perf_event_groups_for_cpu_pmu(), removing …
CVE-2026-99185High· 8.8firewire: core: fix race condition in split transaction handling
In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition in split transaction handling For a split transaction, either fw_core_handle_response() or split_transaction_timeout_callback() may …
CVE-2026-99188Nonenet: stmmac: dwmac1000: clear the RGMII status interrupt
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac1000: clear the RGMII status interrupt Since commit 2e2c878a3141 ("net: stmmac: remove SGMII/RGMII/SMII interrupt handling") nothing on the RGMII pat…
CVE-2026-99191Nonecalipso: keep BIG TCP payload_len in calipso_skbuff_setattr()
In the Linux kernel, the following vulnerability has been resolved: calipso: keep BIG TCP payload_len in calipso_skbuff_setattr() calipso_skbuff_setattr() adjusts payload_len by the length of the option it inserts or resizes: payload…
CVE-2026-99189Nonegpio: mxc: fix race between chained IRQ handler install and probe completion
In the Linux kernel, the following vulnerability has been resolved: gpio: mxc: fix race between chained IRQ handler install and probe completion mxc_update_irq_chained_handler() is called before the IRQ domain, the generic IRQ chip, an…
CVE-2026-99190Nonegpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths
In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths A drive-by review by Sashiko reports that, after a failed call to gpiochip_set_multiple(), g…
CVE-2026-99193Nonenet: ti: icssm-prueth: Move setting of netops to fix crash
In the Linux kernel, the following vulnerability has been resolved: net: ti: icssm-prueth: Move setting of netops to fix crash icssm_prueth_netdev_init() calls of_phy_get_and_connect() before ndev->netdev_ops is assigned. phy_attach_di…
CVE-2026-99192Nonenet: bcmgenet: unshare the skb before writing the control block
In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: unshare the skb before writing the control block bcmgenet stores first_cb, last_cb and bytes_sent in the skb control block and reads them back on comple…
CVE-2026-99194Nonenet: ethernet: aeroflex: move setting of netops to fix crash
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: aeroflex: move setting of netops to fix crash greth_of_probe() calls greth_mdio_init(), which connects the PHY, before dev->netdev_ops is assigned. phy_…
CVE-2026-99195Nonenet: ethoc: move setting of netops to fix crash
In the Linux kernel, the following vulnerability has been resolved: net: ethoc: move setting of netops to fix crash ethoc_probe() calls ethoc_mdio_probe(), which connects the PHY, before netdev->netdev_ops is assigned. phy_attach_direc…
CVE-2026-99198Nonenet: ethernet: actions: Move setting of netops to fix crash
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: actions: Move setting of netops to fix crash owl_emac_probe() calls owl_emac_phy_init(), which connects the PHY, before netdev->netdev_ops is assigned. …
CVE-2026-99197Nonenet: mv643xx: move setting of netops to fix crash
In the Linux kernel, the following vulnerability has been resolved: net: mv643xx: move setting of netops to fix crash mv643xx_eth_probe() connects the PHY before dev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy…
CVE-2026-99200Nonenet: hisilicon: hisi_femac: Move setting of netops to fix crash
In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hisi_femac: Move setting of netops to fix crash hisi_femac_drv_probe() connects the PHY before dev->netdev_ops is assigned. phy_attach_direct() -> phy_…
CVE-2026-99196Nonenet: au1000: move setting of netops to fix crash
In the Linux kernel, the following vulnerability has been resolved: net: au1000: move setting of netops to fix crash au1000_probe() calls au1000_mii_probe(), which connects the PHY, before dev->netdev_ops is assigned. phy_attach_direct…
CVE-2026-99201Nonenetlink: avoid hashing the network namespace pointer
In the Linux kernel, the following vulnerability has been resolved: netlink: avoid hashing the network namespace pointer The netlink rhashtable key includes a raw struct net pointer and a user-controlled port ID. Both /proc/net/netlink…
CVE-2026-99199Nonenet: hisilicon: hip04_eth: Move setting of netops to fix crash
In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hip04_eth: Move setting of netops to fix crash hip04_mac_probe() calls of_phy_connect() before ndev->netdev_ops is assigned. phy_attach_direct() -> phy…
CVE-2026-99203High· 7.8pipe: preserve existing fasync readers on writer setup failure
In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure F_SETFL and FIOASYNC decide whether to invoke ->fasync() before pipe_fasync() takes pipe->mutex. Two ena…
CVE-2026-99202Nonescsi: libsas: Fix SMP IO deadlock during HA resume
In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix SMP IO deadlock during HA resume smp_execute_task_sg() calls pm_runtime_get_sync() on the host before issuing an SMP command. When that command is it…
CVE-2026-99206Nonescsi: target: iscsi: Fix race in discovery auth updates
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix race in discovery auth updates Separate configfs opens can concurrently update the discovery AuthMethod parameter. Both callers may free the s…
CVE-2026-99207Nonescsi: target: Disable interrupts while holding delayed_cmd_lock
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Disable interrupts while holding delayed_cmd_lock target_do_delayed_work() takes dev->delayed_cmd_lock with a plain spin_lock(). It runs from system_perc…