Tagged “cve.org”
CVEs tagged cve.org, newest first.
50027 CVEsRSS
CVE-2026-98838Medium· 4.4vt: skip screen update for DEC alignment test on backgroup consoles
In the Linux kernel, the following vulnerability has been resolved: vt: skip screen update for DEC alignment test on backgroup consoles [BUG] Recently, we encountered a KASAN warning as follows: BUG: KASAN: slab-out-of-bounds in fb_pa…
CVE-2026-98836Medium· 6.2ALSA: line6: reject oversized playback packets
In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: reject oversized playback packets Each playback URB is handed a slice of out.buffer that is exactly LINE6_ISO_PACKETS * max_packet_size_out bytes, sized f…
CVE-2026-98842Medium· 4.4kernel: module: fix lost error code from codetag_load_module() (CVE-2026-98842)
A flaw was found in the Linux kernel's module loading subsystem. When an error occurs during module initialization, the kernel fails to propagate the error code and incorrectly reports a successful load after the module has already been cl…
CVE-2026-98839Medium· 6.1kernel: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() (CVE-2026-98839)
A flaw was found in the Linux kernel's virtual terminal selection subsystem. When pasting console selections, a race condition can occur if another process concurrently replaces the selection buffer with shorter content while the operation…
CVE-2026-98845Medium· 4.5kernel: tpm: Disable TPM on null key name mismatch (CVE-2026-98845)
A flaw was found in the Linux kernel's Trusted Platform Module (TPM) subsystem. This vulnerability allows an attacker to bypass TPM reset protections because the driver fails to disable the device when a null key integrity check fails. Con…
CVE-2026-98843Medium· 4.4kernel: netfs: zero gaps in read-gaps folio to avoid writing back stale data (CVE-2026-98843)
A flaw was found in the Linux kernel's Network Filesystem (netfs) subsystem. When reading data gaps around modified memory regions during streaming write operations, truncated or incomplete read responses from a remote server fail to clear…
CVE-2026-98841Medium· 4.1kernel: virt: vmgenid: set driver_data before registering notification handlers (CVE-2026-98841)
A flaw was found in the Linux kernel's Virtual Machine Generation ID (vmgenid) driver. The driver registers interrupt and notification handlers before fully initializing driver data during startup. If an interrupt or notification is receiv…
CVE-2026-98849Medium· 4.7kernel: pfcp: fix socket lifetime on netdevice registration failure (CVE-2026-98849)
A flaw was found in the Linux kernel's Packet Forwarding Control Protocol (PFCP) driver. When creating a PFCP network interface, a failure during device registration triggers error handling that attempts to release an internal network sock…
CVE-2026-98846Medium· 5.5sctp: check RCV_SHUTDOWN after the sendmsg connect wait
In the Linux kernel, the following vulnerability has been resolved: sctp: check RCV_SHUTDOWN after the sendmsg connect wait sctp_wait_for_connect() drops the socket lock while it sleeps. An out-of-the-blue ABORT can then be processed f…
CVE-2026-98844Low· 3.3kernel: netfs: clear post-EOF pagecache when extending a file via write (CVE-2026-98844)
A flaw was found in the Linux kernel's network filesystem (netfs) subsystem. When a file is extended through write operations after previous writes were performed via memory mapping, the system fails to clear stale cache data located beyon…
CVE-2026-98850Medium· 5.5net/packet: prevent TX_RING byte count overflow
In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TX_RING byte count overflow tpacket_snd() drains every SEND_REQUEST frame in a TX ring and adds each valid packet length to the signed int len_sum.…
CVE-2026-98848Medium· 4.1kernel: rtc: ac100: Assign .num before accessing .hws (CVE-2026-98848)
A flaw was found in the Linux kernel's AC100 Real-Time Clock (RTC) driver. During device probing, the driver accesses an internal array before initializing its element counter. On systems compiled with runtime bounds checking enabled, this…
CVE-2026-98847Medium· 4.1rtc: spear: initialize IRQ state before requesting alarm IRQ
In the Linux kernel, the following vulnerability has been resolved: rtc: spear: initialize IRQ state before requesting alarm IRQ devm_request_irq() enables the interrupt before it returns, so the handler may run while probe is still in…
CVE-2026-98852Medium· 5.9kernel: net: extend IPv6 exthdr detection of tunneled packets (CVE-2026-98852)
A flaw was found in the Linux kernel's networking subsystem. An attacker could exploit this vulnerability by sending specially crafted encapsulated IPv6 network traffic, leading to a Denial of Service (DoS). This issue stems from improper …
CVE-2026-98851Low· 3.3netfilter: nft_flow_offload: drop flowtable reference on init error path
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_flow_offload: drop flowtable reference on init error path nft_flow_offload_init() bumps the flowtable use count with nft_use_inc() before calling nf_ct_…
CVE-2026-98856Medium· 4.4kprobes: Skip disarmed probes when checking optkprobe overlap
In the Linux kernel, the following vulnerability has been resolved: kprobes: Skip disarmed probes when checking optkprobe overlap On x86, an optkprobe at A replaces five bytes with a jump. If a disabled probe B is at A+2, get_optimized…
CVE-2026-98855Medium· 4.4of/overlay: put property on deadprops only after changeset add succeeds
In the Linux kernel, the following vulnerability has been resolved: of/overlay: put property on deadprops only after changeset add succeeds add_changeset_property() links a new property of a not-yet-live target node into the node's dea…
CVE-2026-98853High· 7.5net: gso: limit recursive IP-in-IP segmentation
In the Linux kernel, the following vulnerability has been resolved: net: gso: limit recursive IP-in-IP segmentation IP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment() for each nested IP header. encap_level tracks header…
CVE-2026-98858Medium· 5.5kernel: io_uring: fix task_work add use-after-free with SQPOLL (CVE-2026-98858)
A flaw was found in the Linux kernel's io_uring subsystem. When submission queue polling (SQPOLL) is enabled, a race condition can cause the polling thread to free the ring context while another operation is still accessing it. A local use…
CVE-2026-98857High· 7.5ipvs: bound LBLCR and LBLC cache growth
In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for every previously unseen destination address. The table max_size…
CVE-2026-98854Medium· 4.1of/overlay: only treat a positive changeset id as registered
In the Linux kernel, the following vulnerability has been resolved: of/overlay: only treat a positive changeset id as registered of_overlay_fdt_apply() stores the idr_alloc() return value in ovcs->id before checking it. On failure the …
CVE-2026-98865Medium· 4.4kernel: sched_ext: Don't run ops.dequeue() with a DSQ lock held (CVE-2026-98865)
A flaw was found in the Linux kernel's sched_ext subsystem. A local attacker could cause a Denial of Service (DoS) by triggering a deadlock condition when running an extensible scheduler program that accesses a dispatch queue while a lock …
CVE-2026-98859Medium· 5.3HID: multitouch: stop the release timer from being rearmed on remove
In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: stop the release timer from being rearmed on remove mt_remove() quiesces the sticky-finger timer before stopping the hardware: timer_delete_sync(…
CVE-2026-98864Medium· 4.7kernel: sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task (CVE-2026-98864)
A flaw was found in the Linux kernel's extensible scheduler (sched_ext) subsystem. A race condition occurs when a task is re-enqueued before a prior dispatch operation has completed, allowing internal scheduling states to be improperly ove…
CVE-2026-98861Medium· 4.7kernel: kernel: Denial of Service via fprobe use-after-free (CVE-2026-98861)
A flaw was found in the Linux kernel's function probe (fprobe) tracing mechanism. When handlers execute during inactive Read-Copy Update (RCU, a kernel synchronization mechanism) states, unregistration routines fail to wait for active hand…
CVE-2026-98860Low· 1.9kernel: HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request (CVE-2026-98860)
A flaw was found in the Linux kernel's Human Interface Device (HID) subsystem. This flaw can lead to information disclosure when hardware communication errors occur. Due to an improper integer comparison in the Berkeley Packet Filter (BPF)…
CVE-2026-98866Medium· 4.7kernel: sched/cache: Introduce task_struct->sched_cache_grp to fix UAF (CVE-2026-98866)
A flaw was found in the Linux kernel. A use-after-free vulnerability, where memory is accessed after being released, occurs in the process scheduler cache component during task memory switches. A local user could exploit this flaw to cause…
CVE-2026-98863Medium· 5.6KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails Re-pend GET_NESTED_STATE_PAGES before exiting to userspace if getting the nested pages fails in th…
CVE-2026-98868Medium· 4.4kernel: dm-pcache: reject a kset that overruns its segment (CVE-2026-98868)
A flaw was found in the Linux kernel's dm-pcache driver. A local attacker capable of presenting a crafted storage device with forged metadata can cause cache operations to exceed segment boundaries. This flaw triggers a kernel assertion fa…
CVE-2026-98867Medium· 4.4kernel: dm-pcache: bound the logical key offset from persistent memory (CVE-2026-98867)
A flaw was found in the Linux kernel's Device Mapper persistent cache (dm-pcache) module. A local attacker capable of mounting or attaching a crafted persistent cache device can exploit missing boundary checks on logical key offsets. This …