Tagged “cve.org”
CVEs tagged cve.org, newest first.
50031 CVEsRSS
CVE-2026-98486Nonenet: ena: fix MMIO read buffer leak on probe failure
In the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer leak on probe failure ena_device_init() initializes the MMIO read mechanism with ena_com_mmio_reg_read_request_init(), which allocates a…
CVE-2026-98485Medium· 5.9kernel: netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read (CVE-2026-98485)
A flaw was found in the Linux kernel's netfilter subsystem. This flaw allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted IPv6 packets to an affected system. The issue occurs when an IPv6 routing header…
CVE-2026-98491Medium· 5.9kernel: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry (CVE-2026-98491)
A flaw was found in the Linux kernel's Open vSwitch subsystem. When cloned network packet buffers share an unconfirmed connection tracking entry, committing the entry with conflicting extensions can trigger a use-after-free memory issue du…
CVE-2026-98488Nonenet: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
In the Linux kernel, the following vulnerability has been resolved: net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read Same issue as atl1c (see the first commit in this series, "net: atl1c: fix soft lockup on out-of-rang…
CVE-2026-98484Low· 3.4netfilter: nf_tables: skip expired catchall elements on insert and delete
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: skip expired catchall elements on insert and delete nft_setelem_catchall_insert() looks up duplicates with nft_set_elem_active() only, while nft_…
CVE-2026-98494Nonenet: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
In the Linux kernel, the following vulnerability has been resolved: net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read Same issue as atl1c (see the first commit in this series, "net: atl1c: fix soft lockup on out-of-…
CVE-2026-98493Nonenet: ipconfig: bound DHCP option construction
In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction ic_dhcp_init_options() appends the hostname (option 12), vendor-class (option 60) and client-ID (option 61) options into …
CVE-2026-98487Medium· 5.5⚖ disputedkernel: net: bridge: mdb: restart port group walk after deletion (CVE-2026-98487)
A flaw was found in the Linux kernel's network bridge subsystem. When deleting multicast database (MDB) port groups, the kernel can maintain a stale reference to memory that has already been freed during recursive group removal, resulting …
CVE-2026-98499Medium· 6.8PoCkernel: HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (CVE-2026-98499)
A flaw was found in the Linux kernel's Wacom Human Interface Device (HID) driver. When processing a device report descriptor with mismatched usage and count configurations, the driver can calculate an invalid memory offset and perform an o…
CVE-2026-98496Nonenet: airoha: npu: cancel wdt_work after releasing the WDT IRQ
In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdt_work after releasing the WDT IRQ airoha_npu_remove() calls cancel_work_sync() on each core's wdt_work, but the watchdog IRQ that queues it…
CVE-2026-98489Nonenet: atl1c: fix soft lockup on out-of-range tpd_cons read
In the Linux kernel, the following vulnerability has been resolved: net: atl1c: fix soft lockup on out-of-range tpd_cons read The hardware can report an out-of-range tpd_cons (seen as 0xffff) while the PCIe link/MAC is resetting. An ou…
CVE-2026-98505Nonemm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()
In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() damon_hugetlb_mkold() reads the page table entry into a local variable, unsets the accessed bi…
CVE-2026-98500NoneHID: hid-oxp: use cancel_delayed_work_sync() in remove
In the Linux kernel, the following vulnerability has been resolved: HID: hid-oxp: use cancel_delayed_work_sync() in remove oxp_hid_remove() uses cancel_delayed_work() for all three delayed work items. cancel_delayed_work() only dequeu…
CVE-2026-98495Nonenet: arp: terminate device name before lookup
In the Linux kernel, the following vulnerability has been resolved: net: arp: terminate device name before lookup The ARP ioctl copies a user-provided struct arpreq into a stack object. Its arp_dev field may contain IFNAMSIZ bytes with…
CVE-2026-98492Nonenet: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths
In the Linux kernel, the following vulnerability has been resolved: net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths Fix 3 leaks in macb_alloc() error paths: - Tx buffer allocated but crossing a 4G boundary: Tx leak…
CVE-2026-98514Nonedrm/nouveau: Fix gem reference leak in validate_init()
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validate_init() On the ttm_bo_reserve() failure and "vma not found" error paths, the loop breaks without adding the looked-up ob…
CVE-2026-98498Nonenet/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() When the reverse entry is found but its counter is already being released, refcount_inc_not_z…
CVE-2026-98497Medium· 5.6kernel: net/mlx5e: fix swapped IPv6 IPsec policy masks (CVE-2026-98497)
A flaw was found in the Linux kernel's mlx5 network driver. When configuring IPv6 IPsec (Internet Protocol Security) rules with differing source and destination prefix lengths, the driver inadvertently swaps the source and destination addr…
CVE-2026-98508Nonedrm/virtio: fix NULL pointer dereference on fence allocation failure
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference on fence allocation failure virtio_gpu_fence_alloc() can fail due to memory pressure and return NULL, but its caller like virt…
CVE-2026-98502NoneHID: alps: unregister DualPoint Stick input device on remove
In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on remove alps_input_configured() allocates a second input device ("DualPoint Stick") with input_allocate_device() a…
CVE-2026-98501Medium· 5.1⚖ disputedkernel: HID: alps: fix use-after-free on input2 registration failure (CVE-2026-98501)
A flaw was found in the Linux kernel's Alps Human Interface Device (HID) driver. If registration of an input device fails during configuration, the driver frees the device memory while communication channels are already active, leaving a d…
CVE-2026-98506Nonemm/hugetlb: do not dissolve gigantic pages without runtime support
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not dissolve gigantic pages without runtime support dissolve_free_hugetlb_folio() doesn't check hstate_is_gigantic_no_runtime(h) though remove_hugetlb_f…
CVE-2026-98504NonePCI: of_property: Omit bus properties without a subordinate bus
In the Linux kernel, the following vulnerability has been resolved: PCI: of_property: Omit bus properties without a subordinate bus A bridge (a device with a Type 1 header) may not have a secondary bus allocated (pdev->subordinate), e.…
CVE-2026-98503Nonepacket: use ubuf_info completion for TX_RING packets
In the Linux kernel, the following vulnerability has been resolved: packet: use ubuf_info completion for TX_RING packets tpacket_snd sends skbs with frags pointing into its ring slots. Slots are released when skb->destructor is called.…
CVE-2026-98512Medium· 5.5kernel: drm/nouveau: RCU-free the scheduler-containing nouveau_sched (CVE-2026-98512)
A flaw was found in the Linux kernel's Nouveau graphics driver. When destroying a GPU scheduler object, the driver frees memory prematurely while user-space synchronization objects still hold references to it. A local, unprivileged user co…
CVE-2026-98509Nonedrm/virtio: fix memory leak of fence event on execbuffer failure
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix memory leak of fence event on execbuffer failure virtio_gpu_execbuffer_ioctl() reserves a DRM event with drm_event_reserve_init() when VIRTGPU_EXECBUF_…
CVE-2026-98507High· 7.8⚖ disputedmm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish
In the Linux kernel, the following vulnerability has been resolved: mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish On arm64 server, we find that a task trying to grab the anon_vma lock triggers hungtask. …
CVE-2026-98513Nonedrm/nouveau: Fix runtime PM leak in nouveau_connector_detect()
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() If nvif_outp_edid_get() fails, nouveau_connector_detect() returns early without dropping the runtime PM …
CVE-2026-98511Nonedrm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() nouveau_bo_pin_locked() checks whether an already pinned BO is in a memory domain compati…
CVE-2026-98510Medium· 4.7⚖ disputedkernel: drm/xe/vm: nuke PTs only after unlinking contested VMAs (CVE-2026-98510)
A flaw was found in the Linux kernel's Intel Xe graphics driver. When closing a GPU virtual memory space, page tables were destroyed before contested virtual memory areas were properly unlinked from shared buffer objects. A concurrent thre…