Tagged “cve.org”
CVEs tagged cve.org, newest first.
50006 CVEsRSS
CVE-2026-98676Noneiio: adc: ade9000: fix NULL pointer dereference in clkout registration
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: fix NULL pointer dereference in clkout registration ade9000_setup_clkout() passes NULL as the register address when registering a divider clock. Dur…
CVE-2026-98683Nonesmb: client: flush dirty data before zeroing a range
In the Linux kernel, the following vulnerability has been resolved: smb: client: flush dirty data before zeroing a range smb3_zero_range() emulates FALLOC_FL_ZERO_RANGE by invalidating the page cache over the target range with truncate…
CVE-2026-98682Nonesmb: client: drain and invalidate before server-side copy/clone
In the Linux kernel, the following vulnerability has been resolved: smb: client: drain and invalidate before server-side copy/clone cifs_file_copychunk_range() and the clone (FICLONE) path of cifs_remap_file_range() do not serialise th…
CVE-2026-98681Nonesmb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races
In the Linux kernel, the following vulnerability has been resolved: smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races The invalidHandle, swapfile, oplock_break_cancelled, offload, and status_file_deleted fields a…
CVE-2026-98680Noneiio: accel: kionix-kx022a: Prevent memory leak and fix state
In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Prevent memory leak and fix state The driver allocates memory for samples at buffer enable path. If regmap operation fails in the kx022a_fif…
CVE-2026-98692Nonethunderbolt: Make the DP tunnel activation callback mandatory
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Make the DP tunnel activation callback mandatory tb_tunnel_alloc_dp() takes an optional callback which is run from dprx_work once the DPRX capabilities re…
CVE-2026-98685Nonesmb: client: discard post-EOF pagecache when extending a file via clone range
In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via clone range cifs_remap_file_range() discarded the pagecache only for the folios overlapping the desti…
CVE-2026-98684Nonesmb: client: flush and commit data before querying allocated ranges
In the Linux kernel, the following vulnerability has been resolved: smb: client: flush and commit data before querying allocated ranges The mode 0 / FALLOC_FL_KEEP_SIZE fallocate emulation for small interior ranges in smb3_simple_fallo…
CVE-2026-98689Nonethunderbolt: Don't access a DP tunnel after its DPRX read was canceled
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Don't access a DP tunnel after its DPRX read was canceled tb_dp_dprx_work() checks ->dprx_canceled before it takes tb->lock so it misses a tb_dp_dprx_stop…
CVE-2026-98688Nonethunderbolt: Fix NULL dereference in tb_remove_work()
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL dereference in tb_remove_work() There is a slight race between tb_remove_work() and tb_domain_remove() which leads to dereferencing a NULL tb->ro…
CVE-2026-98687Nonethunderbolt: Reject oversized XDomain properties responses
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject oversized XDomain properties responses tb_xdp_properties_request() allocates room for 45 data dwords in its 252-byte response buffer. The XDomain …
CVE-2026-98686Nonesmb: client: discard post-EOF pagecache when extending a file via zero range
In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via zero range smb3_zero_range() removed the pagecache only for the range being zeroed, so when it extend…
CVE-2026-98694Nonethunderbolt: Fix KASAN reported use-after-free when request is canceled
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported use-after-free when request is canceled Alan reported that when doing stress testing sometimes KASAN notices use-after-free during cont…
CVE-2026-98691Nonethunderbolt: Tear down inactive DP tunnels when the domain is stopped
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Tear down inactive DP tunnels when the domain is stopped tb_stop() only tears down DMA tunnels so a DP tunnel that is still waiting for dprx_work to compl…
CVE-2026-98690Nonethunderbolt: Fix domain reference leak when DPRX read is canceled
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix domain reference leak when DPRX read is canceled tb_tunnel_one_dp() takes a domain reference which is only dropped once tb_dp_tunnel_active() has run …
CVE-2026-98698Nonewifi: mac80211: handle empty FILS association request payload
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: handle empty FILS association request payload fils_encrypt_assoc_req() accepts a (Re)Association Request frame whose last element is the FILS Session e…
CVE-2026-98696Medium· 4.1USB: serial: fix driver deregistration order
In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix driver deregistration order USB serial driver modules register one driver for the USB bus and one or more drivers for the ports on the USB serial bus.…
CVE-2026-98695NoneUSB: serial: fix ioctl hangup race
In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix ioctl hangup race The tty ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Seriali…
CVE-2026-98693Nonethunderbolt: Hold a router reference for each allocated HopID
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Hold a router reference for each allocated HopID tb_stop() drops the reference to all DP tunnels but does not deactivate them, thus nothing cancels a dprx…
CVE-2026-98700Nonewifi: mac80211: set info->band for 802.3 encap offload frames
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set info->band for 802.3 encap offload frames Unlike the 802.11 TX paths, ieee80211_8023_xmit() does not set info->band from the channel context on non…
CVE-2026-98699Nonewifi: mac80211: fix mesh fast xmit path deletion UAF
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF mesh_fast_tx_cache() stores raw mesh_path pointers. Path deletion flushes the cache and then frees the path with k…
CVE-2026-98697NoneUSB: serial: fix dynamic id driver deregistration race
In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix dynamic id driver deregistration race Only free the dynamic ids after having deregistered the driver and removed the "new_id" attribute to avoid leaki…
CVE-2026-98703Nonewifi: mac80211: minstrel_ht: validate fixed rate index
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrel_ht: validate fixed rate index The fixed_rate_idx debugfs file is a plain u32 attribute, so any value can be written to it. minstrel_ht_update…
CVE-2026-98702Medium· 6.5kernel: kernel: Denial of Service via invalid channel switch frame in mac80211 (CVE-2026-98702)
A flaw was found in the Linux kernel's mac80211 wireless subsystem. A nearby wireless attacker can cause a Denial of Service (DoS) by sending a crafted Channel Switch Announcement (CSA) frame with an unsupported bandwidth configuration. Be…
CVE-2026-98701Nonewifi: mac80211: release mesh path quota on failed additions
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: release mesh path quota on failed additions Repeated failed or duplicate mesh path additions can exhaust MESH_MAX_MPATHS while the path table holds few…
CVE-2026-98706Nonewifi: mac80211: drain PS delivery work during station teardown
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drain PS delivery work during station teardown Removing an AP or mesh station can notify the driver and wake TXQs after the station has already been re…
CVE-2026-98705Nonewifi: mac80211: account proxy paths against the mesh path limit
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: account proxy paths against the mesh path limit Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed…
CVE-2026-98704Nonewifi: mac80211: keep fallback association elements alive
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep fallback association elements alive Associating to a non-transmitted MBSSID profile reads freed memory while determining the operating channel and…
CVE-2026-98710Nonewifi: iwlegacy: 3945: free EEPROM data on remove
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPROM data on remove il3945_pci_probe() calls il_eeprom_init(), which allocates memory for the EEPROM data. The probe failure paths release…
CVE-2026-98708Medium· 4.7wifi: mac80211: keep paired old chanctx alive
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old chanctx alive An in-place replacement keeps reciprocal replace_ctx pointers between the old WILL_BE_REPLACED chanctx and the new REPLAC…