Tagged “cve.org”
CVEs tagged cve.org, newest first.
50026 CVEsRSS
CVE-2026-98717NoneKVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i…
CVE-2026-98716NoneKVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted Use the MSR permission bitmap of the active VMCB instead of assuming that KVM is always …
CVE-2026-98722Nonemtd: block2mtd: Fix divide error when erase_size is zero
In the Linux kernel, the following vulnerability has been resolved: mtd: block2mtd: Fix divide error when erase_size is zero The erase size is parsed from the "block2mtd" module parameter and can be set to zero. add_device() then evalu…
CVE-2026-98721Nonemtd: rawnand: cadence: Initialize IRQ state before requesting IRQ
In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ The Cadence NAND interrupt handler uses both the IRQ lock and completion object. Registering the IRQ …
CVE-2026-98718NoneKVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state Explicitly flush caches after intra-host migration before clearing "SEV active" on the sour…
CVE-2026-98725Nonenvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() nvmet_auth_challenge() receives its output buffer as a void pointer. sizeof(*d) therefore evaluates to on…
CVE-2026-98724Nonenvmet: pci-epf: reject too-short SGL segments
In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: reject too-short SGL segments The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nr_descs zero, so nvmet…
CVE-2026-98723Nonenvmet: copy the hostid into the ctrl before creating PR pc_refs
In the Linux kernel, the following vulnerability has been resolved: nvmet: copy the hostid into the ctrl before creating PR pc_refs Commit 6202783184bf ("nvmet: Improve nvmet_alloc_ctrl() interface and implementation") added a second u…
CVE-2026-98728Low· 2.5kernel: tpm: fix off-by-four bounds check in tpm2_get_random() (CVE-2026-98728)
A flaw was found in the Linux kernel's Trusted Platform Module (TPM) driver. This flaw can lead to information disclosure when the kernel requests random data. Due to an incorrect bounds check when processing session-tagged responses, a tr…
CVE-2026-98727Medium· 4.1kernel: nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known (CVE-2026-98727)
A flaw was found in the Linux kernel's NVMe (Non-Volatile Memory Express) multipath subsystem. The multipath driver inappropriately marks a storage device as supporting zoned storage before confirming its zone configuration. When a device …
CVE-2026-98726Medium· 4.4nvme-multipath: fix underflow in ANA log bounds checks
In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix underflow in ANA log bounds checks The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and…
CVE-2026-98732Low· 3.4Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: fix buffer over-read in btintel_hw_error() The "Exception info %s" print uses skb->data + 1, but the 12-byte payload is not guaranteed to be NUL-te…
CVE-2026-98730Medium· 6.7kernel: Bluetooth: btintel_pcie: reject oversized TX packets in send_frame() (CVE-2026-98730)
A flaw was found in the Linux kernel's Intel Bluetooth PCIe driver. A local user with access to the Bluetooth Host Controller Interface (HCI) user channel can inject an oversized transmission packet. Because the driver fails to validate pa…
CVE-2026-98729Medium· 5.5kernel: x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h (CVE-2026-98729)
A flaw was found in the Linux kernel. On systems utilizing specific AMD processors, improper virtual address alignment for huge page memory mappings can allow a local user to cause a Denial of Service (DoS). When unmapping these misaligned…
CVE-2026-98734NoneBluetooth: hci_core: Serialize SCO and ISO scheduling with teardown
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown hci_low_sent() selects a connection under RCU but drops the read lock before calculating its quota …
CVE-2026-98733High· 7.0Bluetooth: hci_core: Serialize fragmented ISO packet queueing
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Serialize fragmented ISO packet queueing The fragmented path in hci_queue_iso() calls __skb_queue_tail() without holding conn->data_q.lock. The so…
CVE-2026-98731Medium· 6.5kernel: Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame() (CVE-2026-98731)
A flaw was found in the Linux kernel's Intel Bluetooth PCIe driver. An integer overflow vulnerability exists in the packet reception function when calculating the total length of incoming Bluetooth frames. An adjacent attacker within Bluet…
CVE-2026-98739Medium· 4.4Bluetooth: RFCOMM: Fix initial port reference race
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix initial port reference race For RFCOMM_RELEASE_ONHUP devices, rfcomm_tty_install() and __rfcomm_release_dev() both use RFCOMM_TTY_OWNED to decid…
CVE-2026-98736Medium· 4.7Bluetooth: hci_conn: Lock parent access during enhanced SCO setup
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Lock parent access during enhanced SCO setup Bluetooth: hci_conn: Lock parent access during enhanced SCO setup hci_enhanced_setup_sync() runs on …
CVE-2026-98735Medium· 4.7Bluetooth: hci_core: Serialize ACL scheduling with channel deletion
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Serialize ACL scheduling with channel deletion hci_chan_sent() selects a channel under RCU but drops the read lock before accessing chan->conn and…
CVE-2026-98740Medium· 4.1kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety (CVE-2026-98740)
A flaw was found in the Linux kernel's Altera Error Detection and Correction (EDAC) driver. Certain setup functions were incorrectly designated as temporary initialization routines that are released from memory after startup. When device r…
CVE-2026-98738Medium· 5.1Bluetooth: Serialize SMP remote OOB data access
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Serialize SMP remote OOB data access build_pairing_cmd() looks up remote OOB data and copies its contents without holding hdev->lock, which serializes the l…
CVE-2026-98737Medium· 4.7Bluetooth: hci_sync: Fix inquiry cache use-after-free
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix inquiry cache use-after-free The sync command worker holds hdev->req_lock, but inquiry-cache updates and flushes use hdev->lock. Both hci_acl_…
CVE-2026-98743Medium· 5.5kernel: ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type (CVE-2026-98743)
A flaw was found in the Linux kernel's rt1017 SDCA audio codec driver. The driver fails to initialize stream configuration data before passing it to the sound subsystem, leaving configuration fields populated with uninitialized memory. A l…
CVE-2026-98742Medium· 4.7ALSA: seq: Serialize compat port-info ioctls
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize compat port-info ioctls The native sequencer ioctl path serializes handler calls with client->ioctl_mutex, but the translated port-info compat pat…
CVE-2026-98741High· 7.8ALSA: ua101: reject mismatched capture/playback packet sizes
In the Linux kernel, the following vulnerability has been resolved: ALSA: ua101: reject mismatched capture/playback packet sizes detect_usb_format() cross-checks bSubframeSize, bBitResolution and tSamFreq between the capture and playba…
CVE-2026-98747Medium· 4.4kernel: serial: core: fix NULL pointer dereference in serial_core_unregister_port() (CVE-2026-98747)
A flaw was found in the Linux kernel's serial core subsystem. This flaw allows a local user with administrative access to cause a Denial of Service (DoS) by crashing the system. The issue occurs during the unregistration of a serial port t…
CVE-2026-98746Low· 2.3kernel: serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() (CVE-2026-98746)
A flaw was found in the Linux kernel's ma35d1 serial driver. This flaw allows a local user to cause a Denial of Service (DoS) through resource exhaustion. The driver fails to release clock references during probe error handling or when the…
CVE-2026-98745Medium· 5.5arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems
In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems When system_supports_sme() is true but system_supports_sve() is false, restoring a specifica…
CVE-2026-98744Medium· 5.5kernel: ASoC: codecs: max98363: fix uninitialized stream_config->type (CVE-2026-98744)
A flaw was found in the Linux kernel's MAX98363 audio codec driver. A local user could trigger this vulnerability during audio stream configuration because internal stream parameters are left uninitialized in memory. This issue allows unin…