Tagged “cve.org”
CVEs tagged cve.org, newest first.
50031 CVEsRSS
CVE-2026-98517Medium· 5.5⚖ disputedkernel: drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (CVE-2026-98517)
A flaw was found in the Linux kernel's Nouveau graphics driver. When handling buffer objects in system memory, the driver improperly accesses memory past the allocated resource boundary. A local attacker could exploit this flaw to cause a …
CVE-2026-98516Nonedrm/nouveau: Fix bridge reference leak in nv1a_ram_new()
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix bridge reference leak in nv1a_ram_new() pci_get_domain_bus_and_slot() takes a reference to the PCI device, which is never released once the memory siz…
CVE-2026-98515Medium· 4.7⚖ disputedkernel: drm/nouveau: fix double-free in nvif_vmm_dtor (CVE-2026-98515)
A flaw was found in the Linux kernel's Nouveau graphics driver. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by crashing the system or potentially escalate privileges. During device initialization failures,…
CVE-2026-98520Medium· 4.7⚖ disputedkernel: drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping (CVE-2026-98520)
A flaw was found in the Linux kernel's AMD GPU driver (amdkfd). In multi-container environments, terminating an initial container session that accessed the GPU interface leaves behind an invalid internal memory reference. When a subsequent…
CVE-2026-98519Nonedrm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() amdgpu_debugfs_test_ib_show() resumes the device with pm_runtime_get_sync() before taking the reset do…
CVE-2026-98518Medium· 5.5kernel: drm/nouveau/dmem: pin VRAM for the whole registered range (CVE-2026-98518)
A flaw was found in the Linux kernel's Nouveau graphics driver. This vulnerability allows a local user to cause a denial of service (DoS) or system instability through an out-of-bounds memory access in video random-access memory (VRAM). Th…
CVE-2026-98523Nonedrm/client: fix restore of partially initialized client
In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drm_atomic.c:2031 a…
CVE-2026-98522Nonedrm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()
In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() Map failure from pvr_mmu_map_sgl() interface was not returned correctly to pvr_mmu_map() inter…
CVE-2026-98521Nonedrm/i915: fix incorrect RCU teardown order
In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix incorrect RCU teardown order i915_gem_busy_ioctl uses dma_resv_for_each_fence_unlocked() to iterate over the fences in an GEM object without holding a re…
CVE-2026-98529Nonegpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
In the Linux kernel, the following vulnerability has been resolved: gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() Switching a persistent GPIO line from input to output acquires a runtime PM reference on the parent …
CVE-2026-98525Nonemctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()
In the Linux kernel, the following vulnerability has been resolved: mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag() When a socket transmits a packet with MCTP_TAG_PREALLOC set, mctp_lookup_prealloc_tag() iterates ove…
CVE-2026-98524High· 7.8kernel: rds: ib: Clear the sg list when mapping an MR fails (CVE-2026-98524)
A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) subsystem. When memory region mapping fails during InfiniBand operations, the kernel can retain a stale reference to memory buffers that have already been released. A l…
CVE-2026-98528Nonegpio: cdev: fix kernel stack leak to user-space in error path
In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: fix kernel stack leak to user-space in error path If we fail to acquire the GPIO chip guard in gpio_desc_to_lineinfo(), we return immediately before zeroin…
CVE-2026-98527Nonegpio: zynq: fix runtime PM leak on request error path
In the Linux kernel, the following vulnerability has been resolved: gpio: zynq: fix runtime PM leak on request error path pm_runtime_get_sync() leaves the usage counter incremented even when it fails, and zynq_gpio_request() returns th…
CVE-2026-98526Nonellc: reserve device headroom for allocated frames
In the Linux kernel, the following vulnerability has been resolved: llc: reserve device headroom for allocated frames llc_alloc_frame() reserves link-layer headroom using the device type. This is insufficient for stacked Ethernet devic…
CVE-2026-98533Noneipe: protect the dm-verity root hash with RCU
In the Linux kernel, the following vulnerability has been resolved: ipe: protect the dm-verity root hash with RCU ipe_bdev_setintegrity() frees the old root hash when dm-verity publishes a new one on ->preresume, while policy evaluatio…
CVE-2026-98531Noneipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST In seg6_genl_policy, SEG6_ATTR_DST is defined with .type = NLA_BINARY and .len = sizeof(struct in6_addr). Fo…
CVE-2026-98530Nonekprobes: Fix permanent hang when flushing the kprobe optimizer
In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix permanent hang when flushing the kprobe optimizer Writing 0 to /proc/sys/debug/kprobes-optimization while a kprobe is jump-optimized never returns. The wr…
CVE-2026-98537Noneworkqueue: Fix NULL current_pwq deref in flush dependency check
In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL current_pwq deref in flush dependency check check_flush_dependency() uses current_wq_worker() to determine whether the caller is a workqueue worker…
CVE-2026-98534Noneipe: fix use-after-free when auditing a newly loaded policy
In the Linux kernel, the following vulnerability has been resolved: ipe: fix use-after-free when auditing a newly loaded policy new_policy() audits the policy after ipe_new_policyfs_node() publishes it and drops the new directory's ino…
CVE-2026-98532High· 7.5kernel: ipv6: do not let ipv6_find_hdr() return an offset past the packet end (CVE-2026-98532)
A flaw was found in the Linux kernel. A remote attacker could cause a Denial of Service (DoS) or memory corruption by sending specially crafted IPv6 network packets. The IPv6 extension header parsing mechanism fails to verify that the decl…
CVE-2026-98539Nonefs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga ntfs_create_inode() creates a new inode via ntfs_new_inode(…
CVE-2026-98536Nonewriteback: report a Tasks-RCU quiescent state per cgwb drain pass
In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanup_offline_cgwbs_workfn() drains a dying cgwb by calling cleanup_offline_cgwb() until it returns…
CVE-2026-98535Nonefsl/fman: Fix clk reference leak in read_dts_node()
In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in read_dts_node() of_clk_get() returns a clock with its reference count incremented, but read_dts_node() only uses it to read the rat…
CVE-2026-98538Nonewriteback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes
In the Linux kernel, the following vulnerability has been resolved: writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes cleanup_offline_cgwb() prepares at most WB_MAX_INODES_PER_ISW inodes per call and is called …
CVE-2026-98542Low· 2.3kernel: cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict (CVE-2026-98542)
A flaw was found in the Linux kernel's cpuset subsystem, which can lead to a denial of service (DoS) or compromised resource isolation. A local user with permissions to configure control groups (cgroups) can trigger this flaw by creating a…
CVE-2026-98540Nonefprobe: Terminate the fgraph_data list when the reservation is not filled
In the Linux kernel, the following vulnerability has been resolved: fprobe: Terminate the fgraph_data list when the reservation is not filled fprobe_fgraph_entry() reserves shadow stack space for every fprobe with an exit handler, but …
CVE-2026-98545Medium· 6.2kernel: ata: libata-scsi: bound the ATA passthru sense descriptor writes (CVE-2026-98545)
A flaw was found in the Linux kernel's libata SCSI subsystem. When processing ATA pass-through commands to an ATAPI storage device, the kernel fails to properly validate the length byte returned in the device's sense response buffer. A mal…
CVE-2026-98544Nonebna: prevent IOC timer rearm during teardown
In the Linux kernel, the following vulnerability has been resolved: bna: prevent IOC timer rearm during teardown bna: prevent IOC timer rearm during teardown bnad_pci_remove() and the probe disable_ioceth path call timer_delete_sync()…
CVE-2026-98541Nonefou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT Commit 7a9bc9e3f423 ("fou: Don't allow 0 for FOU_ATTR_IPPROTO.") added NLA_POLICY_MIN(NLA_U8, 1) to fou_nl_pol…