Tagged “cve.org”
CVEs tagged cve.org, newest first.
50042 CVEsRSS
CVE-2026-98627Nonebpf: Preserve packet pointer class displacement in regsafe()
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve packet pointer class displacement in regsafe() regsafe() maps packet pointer IDs between states and checks that each current register range is a subset o…
CVE-2026-98624Nonenetfilter: nfnetlink_queue: hold nfnl mutex in event notifier
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: hold nfnl mutex in event notifier We must serialize the release notifier and the config netlink function. A concurrent thread can issue clo…
CVE-2026-98623Nonedrm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update If list_for_each_entry() exits without hitting a break then "pstate" is not a valid pstate po…
CVE-2026-98629Nonenet/sched: cls_u32: fix manual hash table handle IDR aliasing
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: fix manual hash table handle IDR aliasing A u32 hash table created with an explicit handle ('tc filter add ... handle 801: u32 divisor N') keys its…
CVE-2026-98628Nonebpf: Make post-verification instruction rewrites killable
In the Linux kernel, the following vulnerability has been resolved: bpf: Make post-verification instruction rewrites killable After do_check() returns, the verifier runs several instruction rewrite passes. Some of them patch or remove …
CVE-2026-98635Nonescsi: block: Fix zones_cond out-of-bounds write on zone report
In the Linux kernel, the following vulnerability has been resolved: scsi: block: Fix zones_cond out-of-bounds write on zone report blk_revalidate_disk_zones() sizes the zones_cond array from the disk capacity and zone size, but the ind…
CVE-2026-98632NoneBluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel In send_cancel(), pending mesh_tx objects are removed from the hdev->mesh_pending list and freed via …
CVE-2026-98631Nonexsk: Use a 32-bit compare in xsk_map_gen_lookup
In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xsk_map_gen_lookup xsk_map_gen_lookup() loads a u32 key and compares it with max_entries using BPF_JMP_IMM. BPF immediates are sign-extend…
CVE-2026-98634Nonescsi: sd_zbc: Reject disks with too many zones
In the Linux kernel, the following vulnerability has been resolved: scsi: sd_zbc: Reject disks with too many zones sd_zbc_read_zones() computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nr_zon…
CVE-2026-98633NoneBluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump() When CONFIG_DEV_COREDUMP=n, hci_devcd_append() returns -EOPNOTSUPP without freeing its skb argument. This l…
CVE-2026-98640NoneHID: amd_sfh: Validate PCI BAR size before mapping
In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: Validate PCI BAR size before mapping The amd_sfh driver maps PCI BAR 2 using pcim_iomap_regions() and subsequently accesses MMIO registers at offsets up …
CVE-2026-98638NoneKVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() pkvm_vcpu_init_sve() clamps only the upper bound of the host-provided sve_max_vl, so an invalid vect…
CVE-2026-98630Noneeth: fbnic: Fix payload page pool error cleanup
In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Fix payload page pool error cleanup The payload page pool pointer contains an error pointer when its allocation fails. The cleanup path passes that error p…
CVE-2026-98643Nonebpf: Fix out-of-bounds read of rtt_min in sock_ops
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rtt_min in sock_ops A sockops prog reading skops->rtt_min never checks the sk type: on the tcp_conn_request() path sock_ops->sk is a req…
CVE-2026-98639Medium· 5.8kernel: kernel: Incorrect TLB flushing in RISC-V KVM via improper nested acceleration update order (CVE-2026-98639)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for the RISC-V architecture. During nested virtualization acceleration, control flags are written before the target page parameters are properly committed …
CVE-2026-98637NoneKVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure pkvm_vcpu_init_sve() clears KVM_ARM_VCPU_SVE in kvm->arch.vcpu_features when it fails, but vcpu_has_s…
CVE-2026-98641Nonebpf, arm64: set up the frame pointer for the exception callback
In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: set up the frame pointer for the exception callback A program acting as exception boundary saves all callee-saved registers, so build_prologue() takes the …
CVE-2026-98636Nonesquashfs: Add dictionary size range check to prevent shift-out-of-bounds
In the Linux kernel, the following vulnerability has been resolved: squashfs: Add dictionary size range check to prevent shift-out-of-bounds When an abnormal SquashFS image (COMP_OPTS flag is 1 but dictionary size is 0) is mounted, and…
CVE-2026-98647Nonebpf: Fix divide-by-zero in btf_struct_walk()
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix divide-by-zero in btf_struct_walk() When an access goes past the struct and the last member is a flexible array, btf_struct_walk() folds the offset back into …
CVE-2026-98644Nonebpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()
In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() __htab_map_lookup_and_delete_batch() has no rescheduling point. The batch count bounds how many entries …
CVE-2026-98642Medium· 4.7kernel: kernel: Denial of Service via race condition in BPF memory allocator (CVE-2026-98642)
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) memory allocator. A race condition occurs when bulk memory allocation and memory cleanup run concurrently without adequate synchronization. A local attacker could exploit …
CVE-2026-98649NoneKVM: s390: Fix race in _destroy_pages_crste()
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix race in _destroy_pages_crste() Use READ_ONCE() in _destroy_pages_crste() to read the crste, avoid dereferencing the pointer multiple times.
CVE-2026-98648Nones390/uv: Prevent potential out-of-bounds read
In the Linux kernel, the following vulnerability has been resolved: s390/uv: Prevent potential out-of-bounds read When the system has more than 85 secrets, the uv_secret_list struct array only holds up to 85 items per page, resulting i…
CVE-2026-98645NoneHID: winwing: fix use-after-free in force feedback teardown
In the Linux kernel, the following vulnerability has been resolved: HID: winwing: fix use-after-free in force feedback teardown winwing_init_ff() passes the driver's private data, allocated with devm_kzalloc() in winwing_probe(), as th…
CVE-2026-98651NoneKVM: s390: Properly handle NULL pointer in dat_cond_set_storage_key()
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Properly handle NULL pointer in dat_cond_set_storage_key() Some callers pass NULL as oldkey. Calling page_cond_set_storage_key() will cause that NULL pointe…
CVE-2026-98650Medium· 4.7kernel: kernel: Denial of Service via race condition in s390 KVM storage key handling (CVE-2026-98650)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for the s390 architecture. A race condition occurs when storage key management functions process large memory pages that are simultaneously split by anothe…
CVE-2026-98653NoneKVM: s390: Fix _gaccess_shadow_fault()
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix _gaccess_shadow_fault() In some circumstances, it is possible that the page of nested guest memory that is being shadowed is not present at all in the p…
CVE-2026-98652NoneKVM: s390: Add missing srcu in kvm_s390_set_irq_state()
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Add missing srcu in kvm_s390_set_irq_state() Like kvm_s390_inject_vcpu(), kvm_s390_set_irq_state() also needs the kvm->srcu or the slots lock when performin…
CVE-2026-98646Nonetcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context
In the Linux kernel, the following vulnerability has been resolved: tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context bpf_sock_destroy() runs from the tcp iterator, under rcu_read_lock(). If the sock is a listener th…
CVE-2026-98654Nonedrm/amd/display: Atomize IRQ register read/modify/write ops
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Atomize IRQ register read/modify/write ops [Why] The OTG_GLOBAL_SYNC_STATUS register controls various HW IRQ sources for the output timing generator …