Tagged “cve.org”
CVEs tagged cve.org, newest first.
50026 CVEsRSS
CVE-2026-98810Medium· 6.1kernel: wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() (CVE-2026-98810)
A flaw was found in the Linux kernel's mac80211 wireless subsystem. A local attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory by transmitting specially crafted network packets. This issue occurs because …
CVE-2026-98808Medium· 6.7kernel: net: systemport: Fix buffer overflow in bcm_sysport_get_stats() (CVE-2026-98808)
A flaw was found in the Linux kernel's Broadcom SYSTEMPORT driver. This vulnerability can lead to a Denial of Service (DoS) or memory corruption when a local user queries network device statistics on systems with SYSTEMPORT Lite hardware. …
CVE-2026-98812Medium· 5.5net/mctp: publish the mctp_dev only after it is initialised
In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctp_dev only after it is initialised mctp_add_dev() links the new mctp_dev into dev->mctp_ptr before mdev->dev is assigned, so a reader that pic…
CVE-2026-98811Low· 3.3net/sched: cls_api: reclaim an empty proto on the error path
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change() on th…
CVE-2026-98809Medium· 4.4Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister hci_unregister_dev() disables cmd_work and cmd_timer, then calls hci_cmd_sync_clear(), whose cancel_wor…
CVE-2026-98814Medium· 4.4kernel: nvme: fix command effects log lifetime for multipath heads (CVE-2026-98814)
A flaw was found in the Linux kernel's Non-Volatile Memory Express (NVMe) driver. A local attacker can cause a denial of service (DoS) or potentially escalate privileges by exploiting a use-after-free flaw. This issue occurs when an input/…
CVE-2026-98813Medium· 4.4kernel: bpf: Hold map BTF for the memory allocator destructor record (CVE-2026-98813)
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. During the teardown of certain BPF hash maps, the memory allocator destructor failed to retain a reference to the map's BPF Type Format (BTF) metadata, allowing…
CVE-2026-98818Medium· 4.7kernel: mm/slab: do not wake up kswapd in __kfree_rcu_sheaf() (CVE-2026-98818)
A flaw was found in the Linux kernel. When freeing memory through the slab allocator, the system may attempt to wake the kernel swap daemon while an internal scheduler lock is already held. This unsafe sequence can trigger a circular locki…
CVE-2026-98816Medium· 4.1kernel: bpf: Fix overflow of jump offset in constant blinding (CVE-2026-98816)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. An integer overflow occurs in the constant blinding mechanism when calculating backward jump offsets during BPF program hardening. A local attacker capable of l…
CVE-2026-98815Medium· 4.1nvme: fix cdev lifetime
In the Linux kernel, the following vulnerability has been resolved: nvme: fix cdev lifetime Sashiko bot reported a potential problem for the cdev lifetime in [0] - the code there is heavily based on the NVMe code. Currently the NS hea…
CVE-2026-98820Medium· 5.5kernel: blk-mq: set RQF_USE_SCHED when the operation is known (CVE-2026-98820)
A flaw was found in the Linux kernel's block multi-queue (blk-mq) subsystem. When cached input/output (I/O) requests originally allocated for passthrough commands are reused for standard read or write operations, scheduler flags are not pr…
CVE-2026-98817NoneASoC: SDCA: Add better pm_runtime error handling in func probe
In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add better pm_runtime error handling in func probe Add a common error path in probe that balances the runtime PM reference.
CVE-2026-98822Medium· 4.3kernel: wifi: mac80211: prevent AP VLAN tx from other interfaces (CVE-2026-98822)
A flaw was found in the Linux kernel's mac80211 wireless subsystem. This flaw can lead to information disclosure across network boundaries when transmitting frames across Access Point (AP) virtual local area networks (VLANs). Due to improp…
CVE-2026-98821Medium· 4.7kernel: block: reject polled dio with user integrity metadata (CVE-2026-98821)
A flaw was found in the Linux kernel's block layer. A local user could exploit this vulnerability to cause a denial of service (DoS) by initiating polled direct I/O operations combined with user integrity metadata. Because the kernel impro…
CVE-2026-98819Medium· 4.4Bluetooth: btintel: validate DDC record lengths
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byt…
CVE-2026-98825Medium· 4.1rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()
In the Linux kernel, the following vulnerability has been resolved: rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() devm_clk_get(&pdev->dev, "rtcref")'s return value was passed straight into clk_get_rate() without chec…
CVE-2026-98824Medium· 5.3kernel: wifi: mac80211: validate TX status rate metadata (CVE-2026-98824)
A flaw was found in the Linux kernel's mac80211 wireless subsystem. When processing transmission (TX) status reports, the subsystem fails to properly validate rate metadata before using it to index internal rate tables. Malformed metadata …
CVE-2026-98823Medium· 5.3wifi: cfg80211: preserve hidden-group beacon IE ownership
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: preserve hidden-group beacon IE ownership A hidden-group probe-response entry borrows its beacon IEs from the group's beacon entry. cfg80211_update_ass…
CVE-2026-98828Medium· 6.2kernel: wifi: ath9k: reject short WMI command responses (CVE-2026-98828)
A flaw was found in the Linux kernel's ath9k wireless driver. When handling Wireless Module Interface (WMI) command responses, the driver copies data into a response buffer without verifying that the received message is sufficiently long. …
CVE-2026-98827Medium· 5.3kernel: wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE (CVE-2026-98827)
A flaw was found in the Linux kernel's ath9k_htc wireless network driver. An attacker transmitting large network packets can trigger a Denial of Service (DoS) or system crash through memory corruption. This issue occurs because the driver …
CVE-2026-98826Medium· 4.7kernel: kernel: Denial of service via use-after-free in the AC100 RTC driver (CVE-2026-98826)
A flaw was found in the Linux kernel's AC100 Real-Time Clock (RTC) driver. If device initialization fails during driver probing, unmanaged clock provider references remain registered in global system lists while their underlying memory is …
CVE-2026-98831Low· 2.3of/overlay: don't leak fragment references when changeset init fails
In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails init_overlay_changeset() stores the number of initialized fragments in ovcs->count only on full su…
CVE-2026-98829Medium· 6.5kernel: wifi: mac80211: drop oversized fragments to avoid extra_len overflow (CVE-2026-98829)
A flaw was found in the mac80211 wireless networking subsystem of the Linux kernel. An adjacent attacker, such as a rogue Wi-Fi access point or nearby malicious device, can cause a Denial of Service (DoS) by transmitting a sequence of over…
CVE-2026-98833Medium· 5.5mtd: core: call _get_device() with the master MTD
In the Linux kernel, the following vulnerability has been resolved: mtd: core: call _get_device() with the master MTD __get_mtd_device() calls the master's _get_device() callback with mtd, which may be a partition. __put_mtd_device() p…
CVE-2026-98832Medium· 4.7kernel: blk-cgroup: save IRQ state in blkg_tryget_closest() (CVE-2026-98832)
A flaw was found in the Linux kernel's block control group (blk-cgroup) subsystem. When associating block I/O requests with control groups, the kernel prematurely re-enables interrupts while internal locks are still held. A local user can …
CVE-2026-98830Medium· 5.5wifi: wfx: validate MIB read length before copying to caller
In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfx_hif_read_mib() copies reply->length bytes from the firmware response into the caller-provided buffer w…
CVE-2026-98837Medium· 5.5ALSA: caiaq: unregister the input device when probe fails
In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: unregister the input device when probe fails setup_card() registers the input device, whose name and phys point into struct snd_usb_caiaqdev, and then goe…
CVE-2026-98835Medium· 5.5kernel: iio: accel: kionix-kx022a: Fix array boundary check (CVE-2026-98835)
A flaw was found in the Linux kernel's Kionix KX022A accelerometer driver. A local user could trigger a Denial of Service (DoS) or kernel memory disclosure due to an off-by-one array bounds validation check when converting device register …
CVE-2026-98834Medium· 4.1kernel: mtd: core: avoid double-free of OTP NVMEM device (CVE-2026-98834)
A flaw was found in the Linux kernel's Memory Technology Device (MTD) subsystem. An attacker capable of triggering device registration failures can cause a Denial of Service (DoS) via a kernel crash. During the setup of One-Time Programmab…
CVE-2026-98840Medium· 4.7vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
In the Linux kernel, the following vulnerability has been resolved: vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF The reload of 'vc' added by commit 8fb9ea65c9d1 ("vc_screen: reload load of struct vc_data poi…