Tagged “cve.org”
CVEs tagged cve.org, newest first.
50027 CVEsRSS
CVE-2026-98862Medium· 4.1audit: fix exe mark UAF in kill_rules()
In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in kill_rules() kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit tree is pruned. It drops entry->rule.exe before removing…
CVE-2026-111990High· 7.3PoCkishan0725 Hospital Management System Appointment Cancellation admin-panel.php mysqli_query sql injection
A weakness has been identified in kishan0725 Hospital Management System up to 777fda46b77a820977a5ba616283dbfbc40bf7e1. This affects the function mysqli_query of the file admin-panel.php of the component Appointment Cancellation Handler.…
CVE-2026-98438Nonemptcp: options: fix uninit-value in mptcp_write_data_fin
In the Linux kernel, the following vulnerability has been resolved: mptcp: options: fix uninit-value in mptcp_write_data_fin When sending a DATA_FIN without data, and because the DATA_FIN occupies 1 octet of the connection-level sequen…
CVE-2026-98435Medium· 4.4kernel: EDAC/altera: Use parent device for devres in altr_portb_setup() (CVE-2026-98435)
A flaw was found in the Linux kernel's Altera EDAC (Error Detection and Correction) driver. Device-managed interrupt requests and resource groups in the altr_portb_setup() function were improperly associated with a temporary per-port devic…
CVE-2026-98434Medium· 5.5kernel: sysctl: Check range in proc_dointvec_ms_jiffies_minmax (CVE-2026-98434)
A flaw was found in the Linux kernel. Due to a missing range validation check in the sysctl subsystem, configured minimum and maximum limits were not enforced during specific millisecond-to-jiffies conversions. A local user with permission…
CVE-2026-98433Low· 2.5kernel: KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure (CVE-2026-98433)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for PowerPC architectures. When handling secure virtual machines, a failure during secure memory paging fails to release allocated device memory and intern…
CVE-2026-98441Medium· 4.7⚖ disputedkernel: net/sched: act_ct: avoid modifying shared unconfirmed ct entry (CVE-2026-98441)
A flaw was found in the Linux kernel's traffic control conntrack action module (act_ct). An attacker capable of sending network traffic through affected packet filters could trigger a Denial of Service (DoS) or kernel memory corruption. Th…
CVE-2026-98437Nonemedia: qcom: iris: fix runtime PM reference leaks
In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: fix runtime PM reference leaks Use pm_runtime_resume_and_get() in iris_enable_power_domains() to avoid leaking a runtime PM usage count on failure. …
CVE-2026-98436High· 7.8accel/amdxdna: Disable device buffer exporting
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Disable device buffer exporting Device buffers are never intended to be exported. Disable exporting support explicitly.
CVE-2026-98439Nonesmb/server: cancel async requests when closing connection
In the Linux kernel, the following vulnerability has been resolved: smb/server: cancel async requests when closing connection An async request may still be waiting when a connection is closed. This can stop the connection from closing.…
CVE-2026-111991Medium· 6.3PoCWongKinYiu yolov9 ONNX Metadata common.py DetectMultiBackend.__init__ code injection
A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBackend.__init__ of the file models/common.py of the component ONNX Metadata Handler. The manipulation of the argumen…
CVE-2026-98446Nonexfs: don't let hidden_space go negative in xfs_metafile_resv_init
In the Linux kernel, the following vulnerability has been resolved: xfs: don't let hidden_space go negative in xfs_metafile_resv_init LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes be…
CVE-2026-98444Nonexfs: drop dquot flush lock when we can't find a buffer to flush
In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when we can't find a buffer to flush LOLLM noticed that xfs_qm_flush_one fails to drop the dquot flush lock if it can't grab the buffer asso…
CVE-2026-98442High· 7.5kernel: net/sched: act_ct: fix helper UAF due to extensions realloc (CVE-2026-98442)
A flaw was found in the Linux kernel's traffic control connection tracking action (act_ct). An attacker capable of sending network traffic handled by the affected system can cause a Denial of Service (DoS) or kernel memory corruption throu…
CVE-2026-98440Medium· 5.6kernel: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction (CVE-2026-98440)
A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem on ARM64 architectures. In nested virtualization configurations, shadow memory management structures are prematurely freed during shadow page flushes while…
CVE-2026-98448Nonexfs: release orphanage dir inode if chown fails
In the Linux kernel, the following vulnerability has been resolved: xfs: release orphanage dir inode if chown fails LOLLM points out that we leak the igrab'd reference to the orphanage directory inode if chowning it fails. Fix that.
CVE-2026-98447Nonexfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots
In the Linux kernel, the following vulnerability has been resolved: xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots LOLLM noticed that the inode btree root formatting methods copy too many bytes -- there's onl…
CVE-2026-98443High· 7.8⚖ disputedxfs: fix cursor and pointer handling when recovering iunlink buckets
In the Linux kernel, the following vulnerability has been resolved: xfs: fix cursor and pointer handling when recovering iunlink buckets LOLLM pointed out a bug in xlog_recover_iunlink_bucket: 1. We don't null out prev_ip after releas…
CVE-2026-98451High· 8.8⚖ disputedsmb: client: use finish_no_open() for non-regular inodes
In the Linux kernel, the following vulnerability has been resolved: smb: client: use finish_no_open() for non-regular inodes An O_CREAT open can find an existing symlink or another non-regular inode. cifs_atomic_open() calls finish_ope…
CVE-2026-98450Nonesmb: client: close completed creates on compound wait errors
In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait errors compound_send_recv() waits for responses in order. If a later wait is interrupted, or if a later MID fails…
CVE-2026-98445Nonexfs: don't let memory failures leak blocks and kill repairs
In the Linux kernel, the following vulnerability has been resolved: xfs: don't let memory failures leak blocks and kill repairs LOLLM complains that a memory allocation failure in xrep_newbt_add_blocks results in online repair leaking …
CVE-2026-98457NoneBluetooth: L2CAP: validate frame length before control and FCS access
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2cap_data_rcv() unpacks either a two-byte or four-byte control field without first ensuring that…
CVE-2026-98455NoneBluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO The RFCOMM_CONNINFO getsockopt handler accepts a socket that is not connected as long as def…
CVE-2026-98454High· 8.1smb: client: fix create context out-of-bounds reads
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2_parse_contexts() validates the complete create-context area but does not limit each record to its Next field b…
CVE-2026-98449Nonesmb: client: delete compound mids on send failure before unlock
In the Linux kernel, the following vulnerability has been resolved: smb: client: delete compound mids on send failure before unlock When sending a compound request fails, smb_send_rqst() kicks off a reconnect. compound_send_recv() stil…
CVE-2026-98456High· 7.0⚖ disputedBluetooth: mgmt: fix race in read_unconf_index_list()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in read_unconf_index_list() read_unconf_index_list() counts unconfigured controllers before allocating its response, then checks the device f…
CVE-2026-98453Nonesmb: client: close handle after create-context parsing failure
In the Linux kernel, the following vulnerability has been resolved: smb: client: close handle after create-context parsing failure SMB2_open() accounts a successful CREATE response as a remote open before parsing its create contexts. …
CVE-2026-98452Nonesmb: client: clean up failed cached directory opens
In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens open_cached_dir() sends CREATE and QUERY_INFO as a compound request. If the CREATE succeeds but a later command ret…
CVE-2026-98462Medium· 4.7kernel: Bluetooth: hci_conn: fix CIS hold ownership on reuse (CVE-2026-98462)
A flaw was found in the Linux kernel's Bluetooth subsystem. Improper reference count management during the reuse and binding of Connected Isochronous Stream (CIS) connections can result in an unbalanced connection hold count. A local attac…
CVE-2026-98460NoneBluetooth: hci_sock: reject out-of-range OCF values
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: reject out-of-range OCF values The raw HCI socket security filter has 128 OCF bits per supported OGF, but masks the 10-bit OCF with 127 before loo…