Tagged “cve.org”
CVEs tagged cve.org, newest first.
50031 CVEsRSS
CVE-2026-98456High· 7.0⚖ disputedBluetooth: mgmt: fix race in read_unconf_index_list()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in read_unconf_index_list() read_unconf_index_list() counts unconfigured controllers before allocating its response, then checks the device f…
CVE-2026-98453Nonesmb: client: close handle after create-context parsing failure
In the Linux kernel, the following vulnerability has been resolved: smb: client: close handle after create-context parsing failure SMB2_open() accounts a successful CREATE response as a remote open before parsing its create contexts. …
CVE-2026-98452Nonesmb: client: clean up failed cached directory opens
In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens open_cached_dir() sends CREATE and QUERY_INFO as a compound request. If the CREATE succeeds but a later command ret…
CVE-2026-98462Medium· 4.7kernel: Bluetooth: hci_conn: fix CIS hold ownership on reuse (CVE-2026-98462)
A flaw was found in the Linux kernel's Bluetooth subsystem. Improper reference count management during the reuse and binding of Connected Isochronous Stream (CIS) connections can result in an unbalanced connection hold count. A local attac…
CVE-2026-98460NoneBluetooth: hci_sock: reject out-of-range OCF values
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: reject out-of-range OCF values The raw HCI socket security filter has 128 OCF bits per supported OGF, but masks the 10-bit OCF with 127 before loo…
CVE-2026-98458NoneBluetooth: ISO: release unused CIS holds after channel attach
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hci_bind_cis() and hci_connect_cis() return one hci_conn hold for the ISO layer. A new channel associati…
CVE-2026-98466High· 8.2KVM: arm64: Transfer the hyp stack pages out of the host stage-2
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 fix_host_ownership() walks only the linear-map alias of each memblock region, and the per-CPU hyp stac…
CVE-2026-98461NoneBluetooth: hci_sock: validate event length before filtering
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: validate event length before filtering is_filtered_packet() reads the event code from skb->data[0] without first checking that the skb is nonempty…
CVE-2026-98459NoneBluetooth: ISO: balance the parent hold in hci_bind_bis()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hci_bind_bis() hci_conn_link() takes a lifetime reference to its parent with hci_conn_get(), but only takes an operational h…
CVE-2026-98467NoneKVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race Commit 7270cc9157f4 ("KVM: arm64: nv: Handle VNCR_EL2 invalidation from MMU notifiers") introduced…
CVE-2026-98465Medium· 5.3kernel: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration (CVE-2026-98465)
A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem for the RISC-V architecture. Due to missing synchronization between interrupt controller device operations and virtual CPU (vCPU) execution, a local user w…
CVE-2026-98464Medium· 5.6⚖ disputedkernel: RISC-V: KVM: Synchronize hrtimer callback during teardown (CVE-2026-98464)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) implementation for the RISC-V architecture. This vulnerability can lead to a Denial of Service (DoS) or host system crash due to a use-after-free memory issue during…
CVE-2026-98463Nonesched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags schedule_deferred_locked() skips scheduling a deferred action while SCX_RQ_IN_WAKEUP is set and relies o…
CVE-2026-98472Low· 3.3kernel: KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV (CVE-2026-98472)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) AMD SEV (Secure Encrypted Virtualization) implementation. This flaw allows a local user with permissions to manage virtual machines to cause a denial of service (DoS…
CVE-2026-98471Medium· 5.3kernel: KVM: SEV: Do cache maintenance on the source VM during intra-host migration (CVE-2026-98471)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for AMD SEV (Secure Encrypted Virtualization). During intra-host migration of an encrypted virtual machine, the source virtual machine's CPU caches are not…
CVE-2026-98469Medium· 5.5kernel: KVM: arm64: Fix AArch32 DBGBXVR<n> handling (CVE-2026-98469)
A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem for ARM64 architectures. Improper handling of specific debug register accesses in 32-bit ARM (AArch32) mode causes the hypervisor to encounter an internal …
CVE-2026-98476Medium· 4.7kernel: s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str() (CVE-2026-98476)
A flaw was found in the Linux kernel's s390 channel I/O (CIO) subsystem. When querying device utility strings, the kernel fails to verify that an associated channel path remains valid after its removal from the registry. A local user could…
CVE-2026-98474Medium· 4.1kernel: s390/pci: Fix missing device lock in zpci_report_status() (CVE-2026-98474)
A flaw was found in the Linux kernel's s390 PCI subsystem. This flaw can lead to a Denial of Service (DoS) due to a missing device lock during PCI (Peripheral Component Interconnect) error recovery. When error recovery status is reported w…
CVE-2026-98468Low· 2.5kernel: KVM: arm64: Fix spurious warning for benign stage 2 teardown race (CVE-2026-98468)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for ARM64. This flaw may allow a local user to cause a Denial of Service (DoS) or kernel instability. A race condition occurs when virtual machine stage 2 …
CVE-2026-98480Low· 1.9kernel: nfc: trf7970a: power down on startup RX gain failure (CVE-2026-98480)
A flaw was found in the Linux kernel's Near Field Communication (NFC) TRF7970A driver. This vulnerability can lead to a denial of service (DoS) or improper hardware state due to unreleased power resources. If a communication error occurs w…
CVE-2026-98478Medium· 4.7kernel: scsi: ufs: core: Keep internal commands dispatchable during error handling (CVE-2026-98478)
A flaw was found in the Linux kernel's Universal Flash Storage (UFS) driver. During device error recovery, the driver pauses all command queues, which inadvertently prevents internal recovery commands from being dispatched. This condition …
CVE-2026-98470Medium· 4.7kernel: KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode (CVE-2026-98470)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for ARM64. This vulnerability allows a local attacker to cause a Denial of Service (DoS). When running in protected mode, the kernel issues an internal war…
CVE-2026-98481Medium· 6.2kernel: nfc: port100: reject frames whose declared length exceeds the received data (CVE-2026-98481)
A flaw was found in the Linux kernel's Near Field Communication (NFC) Port-100 driver. An attacker connecting a malicious USB device can provide a response frame whose declared length exceeds the actual received data size. This flaw causes…
CVE-2026-98475Medium· 5.1kernel: s390/cmf: Fix virtual vs physical address confusion (CVE-2026-98475)
A flaw was found in the Linux kernel's s390 Channel Measurement Facility (CMF). This vulnerability can allow a local user to cause memory corruption or a Denial of Service (DoS) due to confusion between virtual and physical memory addresse…
CVE-2026-98473Low· 1.9kernel: s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config (CVE-2026-98473)
A flaw was found in the Linux kernel's s390 Virtual Function I/O Adjunct Processor (VFIO-AP) device driver. A local user with administrative privileges can trigger this issue by removing an AP queue from the host configuration while it rem…
CVE-2026-98483Medium· 5.5kernel: nfc: fix use-after-free in nfc_get_local_general_bytes (CVE-2026-98483)
A flaw was found in the Linux kernel's Near Field Communication (NFC) subsystem. A reference counting error in the nfc_get_local_general_bytes() function causes memory to be freed prematurely while callers still access the returned pointer…
CVE-2026-98482Medium· 6.5kernel: nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (CVE-2026-98482)
A flaw was found in the Linux kernel's Near Field Communication (NFC) subsystem. The Logical Link Control Protocol (LLCP) implementation does not verify the length of incoming network packets before reading sequence information. An attacke…
CVE-2026-98479Medium· 6.5kernel: scsi: libiscsi_tcp: Check the data direction of a Data-In PDU (CVE-2026-98479)
A flaw was found in the Linux kernel's iSCSI TCP subsystem. A malicious or compromised iSCSI storage server can cause memory corruption and data integrity loss on a connected client by sending an unexpected Data-In Protocol Data Unit (PDU)…
CVE-2026-98477Medium· 5.5perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()
In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() perf_pmu_sched_task() returns early when cpuctx->task_ctx is set, and cpc->task_epc is only non-NULL while a ta…
CVE-2026-98490Critical· 9.8⚖ disputednet: openvswitch: conntrack: fix helper UAF due to extensions realloc
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: …