Tagged “cve.org”
CVEs tagged cve.org, newest first.
50032 CVEsRSS
CVE-2026-98599Medium· 6.7kernel: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() (CVE-2026-98599)
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier. A local attacker can exploit this flaw to cause kernel memory corruption and potentially achieve privilege escalation or a denial of service (system crash). This…
CVE-2026-98612Medium· 6.8kernel: net: usb: catc: bound the RX packet length in catc_rx_done() (CVE-2026-98612)
A flaw was found in the Linux kernel's CATC USB Ethernet driver. The driver fails to properly validate packet length boundaries when processing incoming multi-packet network transfers. An attacker could exploit this flaw by providing craft…
CVE-2026-98609Nonedrm/virtio: fix object leak when drm_gem_handle_create() fails
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak when drm_gem_handle_create() fails virtio_gpu_gem_create() owns the reference taken by virtio_gpu_object_create(). On the drm_gem_handle_cr…
CVE-2026-98606Nonedrm/virtio: release the GEM object on virtio_gpu_vram_create() errors
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: release the GEM object on virtio_gpu_vram_create() errors virtio_gpu_vram_create() frees the object with a bare kfree(vram) on both error paths after drm_g…
CVE-2026-98610Medium· 5.5kernel: net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget (CVE-2026-98610)
A flaw was found in the Linux kernel's Hierarchical Fair Service Curve (HFSC) network packet scheduler. A local user with network administration privileges, such as within a user namespace, can exploit this flaw to cause a Denial of Servic…
CVE-2026-98608Nonedrm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() virtio_gpu_resource_create_ioctl() calls drm_gem_object_release() on the drm_gem_handle_create() erro…
CVE-2026-98619Nonenet: ethtool: keep rtnl_lock for the ioctl self test
In the Linux kernel, the following vulnerability has been resolved: net: ethtool: keep rtnl_lock for the ioctl self test An offline self test that brings the interface down and back up with netif_close() / netif_open() requires rtnl_lo…
CVE-2026-98611Medium· 4.4kernel: bpf: Check params size before reading reserved fields (CVE-2026-98611)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. The bpf_crypto_ctx_create() function attempts to read reserved fields from a parameter structure prior to verifying that the supplied buffer is sufficiently lar…
CVE-2026-98607Nonedrm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() virtio_gpu_resource_create_blob_ioctl() calls drm_gem_object_release() on both the virtio_gpu_r…
CVE-2026-98617Medium· 4.1kernel: eth: fbnic: use the Rx queue napi pointer to find the napi vector (CVE-2026-98617)
A flaw was found in the Linux kernel's Meta Host Network Interface (fbnic) driver. The driver incorrectly associates receive queues with network processing vectors and fails to verify whether the datapath is active before allocating queue …
CVE-2026-98614High· 7.5kernel: sctp: avoid livelock while updating retransmit path (CVE-2026-98614)
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) subsystem. An attacker could exploit this vulnerability to cause a Denial of Service (DoS) by triggering an infinite loop during retransmission path selecti…
CVE-2026-98613Medium· 4.4kernel: bpf: Bound ownership depth through local kptrs and graph roots (CVE-2026-98613)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. A local user with permissions to load BPF programs can trigger a Denial of Service (DoS) by creating deeply nested or cyclical object references using local ker…
CVE-2026-98621Nonenet: gue: reject invalid REMCSUM offsets
In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gue_remcsum() passes them to skb_remcsum_proc…
CVE-2026-98616Medium· 4.1kernel: eth: fbnic: reset num_napi when the napi vectors are freed (CVE-2026-98616)
A flaw was found in the Linux kernel's fbnic driver. This flaw allows a local user to trigger a kernel crash, resulting in a Denial of Service (DoS). During power management suspend or failed resume operations, the driver frees interrupt v…
CVE-2026-98615Medium· 4.4kernel: eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox (CVE-2026-98615)
A flaw was found in the Linux kernel's fbnic network driver. A local user with administrative privileges could trigger a Denial of Service (DoS) by initiating a reset or teardown of the firmware mailbox. Because the driver fails to properl…
CVE-2026-98625Nonenetfilter: flowtable: publish HW_DEAD after worker is done
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish HW_DEAD after worker is done flow_offload_work_del() sets NF_FLOW_HW_DEAD before the work handler clears NF_FLOW_HW_PENDING. Once a flow …
CVE-2026-98618Noneeth: fbnic: Handle maximum standalone channels
In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Handle maximum standalone channels Standalone channels use one NAPI vector for each Tx and Rx queue. fbnic's allocation path excludes FBNIC_MAX_TXQS from t…
CVE-2026-98626Nonebpf: Restrict CO-RE poisoning to relocatable instructions
In the Linux kernel, the following vulnerability has been resolved: bpf: Restrict CO-RE poisoning to relocatable instructions CO-RE relocation records can name any instruction offset. When a relocation cannot be resolved, bpf_core_patc…
CVE-2026-98622Nonenet/sched: act_ct: don't WARN on benign flow_offload_alloc() failure
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure flow_offload_alloc() returns NULL when the conntrack entry is dying (e.g. raced with a conntrack f…
CVE-2026-98620Nonenet: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure If register_netdev() fails for one of the MTK_MAX_DEVS devices in mtk_probe(), the error pa…
CVE-2026-98627Nonebpf: Preserve packet pointer class displacement in regsafe()
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve packet pointer class displacement in regsafe() regsafe() maps packet pointer IDs between states and checks that each current register range is a subset o…
CVE-2026-98624Nonenetfilter: nfnetlink_queue: hold nfnl mutex in event notifier
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: hold nfnl mutex in event notifier We must serialize the release notifier and the config netlink function. A concurrent thread can issue clo…
CVE-2026-98623Nonedrm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update If list_for_each_entry() exits without hitting a break then "pstate" is not a valid pstate po…
CVE-2026-98629Nonenet/sched: cls_u32: fix manual hash table handle IDR aliasing
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: fix manual hash table handle IDR aliasing A u32 hash table created with an explicit handle ('tc filter add ... handle 801: u32 divisor N') keys its…
CVE-2026-98628Nonebpf: Make post-verification instruction rewrites killable
In the Linux kernel, the following vulnerability has been resolved: bpf: Make post-verification instruction rewrites killable After do_check() returns, the verifier runs several instruction rewrite passes. Some of them patch or remove …
CVE-2026-98635Nonescsi: block: Fix zones_cond out-of-bounds write on zone report
In the Linux kernel, the following vulnerability has been resolved: scsi: block: Fix zones_cond out-of-bounds write on zone report blk_revalidate_disk_zones() sizes the zones_cond array from the disk capacity and zone size, but the ind…
CVE-2026-98632NoneBluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel In send_cancel(), pending mesh_tx objects are removed from the hdev->mesh_pending list and freed via …
CVE-2026-98631Nonexsk: Use a 32-bit compare in xsk_map_gen_lookup
In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xsk_map_gen_lookup xsk_map_gen_lookup() loads a u32 key and compares it with max_entries using BPF_JMP_IMM. BPF immediates are sign-extend…
CVE-2026-98634Nonescsi: sd_zbc: Reject disks with too many zones
In the Linux kernel, the following vulnerability has been resolved: scsi: sd_zbc: Reject disks with too many zones sd_zbc_read_zones() computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nr_zon…
CVE-2026-98633NoneBluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump() When CONFIG_DEV_COREDUMP=n, hci_devcd_append() returns -EOPNOTSUPP without freeing its skb argument. This l…