Tagged “vex”
CVEs tagged vex, newest first.
7401 CVEsRSS
CVE-2026-89556Medium· 5.5module: validate string table section types
In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elf_validity_cache_sechdrs, section sizes and offsets are validated, unless the section type is SHT_NULL or SHT_NOBITS. …
CVE-2026-81004High· 8.4⚖ disputedipmi:msghandler: Cancel work cleanly on an error
In the Linux kernel, the following vulnerability has been resolved: ipmi:msghandler: Cancel work cleanly on an error If an error occurs during startup of an IPMI interface, it may have scheduled work to run. The work needs to be cance…
CVE-2026-80998High· 7.5⚖ disputednet: bnxt: ring the doorbell when SW USO exits early
In the Linux kernel, the following vulnerability has been resolved: net: bnxt: ring the doorbell when SW USO exits early When a burst of packets is handed down to the driver, the driver defers the doorbell to the end by setting txr->ki…
CVE-2026-80997High· 7.5⚖ disputednet: ipa: fix stalled modem TX queue after runtime resume
In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix stalled modem TX queue after runtime resume ipa_start_xmit() unconditionally stops the TX queue before calling pm_runtime_get(), relying on the wake sche…
CVE-2026-80995High· 7.8⚖ disputednet: mctp: hold a reference to the route device in mctp_route_lookup()
In the Linux kernel, the following vulnerability has been resolved: net: mctp: hold a reference to the route device in mctp_route_lookup() mctp_route_lookup() uses rt->dev without holding a reference on it. mctp_route_lookup_single() r…
CVE-2026-80991High· 7.8⚖ disputednet: ravb: serialize PTP clock teardown
In the Linux kernel, the following vulnerability has been resolved: net: ravb: serialize PTP clock teardown ravb_ptp_interrupt() can race with ravb_ptp_stop() and pass the clock to ptp_clock_event() while ptp_clock_unregister() is free…
CVE-2026-80986Critical· 9.8⚖ disputednet/smc: bound the peer rkey counts in SMC-Rv2 LLC messages
In the Linux kernel, the following vulnerability has been resolved: net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages On a link whose device has max_recv_sge == 1 there is no shared v2 receive buffer, and smc_llc_save_add_lin…
CVE-2026-80985High· 8.2net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry
In the Linux kernel, the following vulnerability has been resolved: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() read the part of a v2 message that does no…
CVE-2026-80981Critical· 9.8⚖ disputednet/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() smc_llc_srv_add_link() keeps add_llc pointing into the queue entry: add_llc = &qentry->msg.a…
CVE-2026-80980Critical· 9.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and out_of_sync sharing a byte The three connection state flags are single-bit bitfields, so they occupy one byte of struct smc_connection …
In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and out_of_sync sharing a byte The three connection state flags are single-bit bitfields, so they occupy one byte of struct smc_connection …
CVE-2026-80975High· 7.8⚖ disputedmfd: qnap-mcu: keep the reply buffer alive past a command timeout
In the Linux kernel, the following vulnerability has been resolved: mfd: qnap-mcu: keep the reply buffer alive past a command timeout qnap_mcu_exec() publishes an on-stack buffer to the receive path: unsigned char rx[QNAP_MCU_RX_BUFF…
CVE-2026-80962High· 7.8⚖ disputeddm-pcache: validate geometry fields from on-disk cache_info
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate geometry fields from on-disk cache_info cache_segs_init() iterates cache_info->n_segs times indexing cache->segments[], which is sized to the cache…
CVE-2026-80961High· 7.8⚖ disputeddm-pcache: validate kset key_num and intra-segment bounds
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate kset key_num and intra-segment bounds Two more fields decoded from the cache device go unbounded. The kset key_num drives cache_kset_crc() and the …
CVE-2026-80959High· 7.8⚖ disputeddm-pcache: bound the persisted tail-position offset
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the persisted tail-position offset cache_pos_decode() takes the persisted key_tail and dirty_tail seg_off from the cache device and addresses within t…
CVE-2026-80958High· 7.1dm-pcache: clamp the tail kset read to the segment data region
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cache_replay(), the writeback worker and the GC worker bounds its length by PCACHE…
CVE-2026-80955High· 7.8⚖ disputeddm-pcache: fix use-after-free and invalid seg operations in kset_replay()
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: fix use-after-free and invalid seg operations in kset_replay() In kset_replay, when key->seg_gen is stale (key->seg_gen < key->cache_pos.cache_seg->gen), ca…
CVE-2026-80954High· 7.8⚖ disputedi3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode()
In the Linux kernel, the following vulnerability has been resolved: i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode() i3c_device_get_supported_xfer_mode() uses dev->desc to obtain the master controller.…
CVE-2026-80953High· 8.4⚖ disputedi3c: master: adi: initialize the lock before enabling interrupts
In the Linux kernel, the following vulnerability has been resolved: i3c: master: adi: initialize the lock before enabling interrupts adi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR before the controller's IBI s…
CVE-2026-80950High· 7.8⚖ disputedi3c: renesas: Check that the transfer is valid before accessing it
In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Check that the transfer is valid before accessing it The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesas_i3c…
CVE-2026-80947High· 7.8⚖ disputedwifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop rtl8xxxu arms rx_urb_wq from the RX completion path: rtl8xxxu_rx_complete() hands the URB to rtl8xxxu_queue_r…
CVE-2026-80945Critical· 9.1⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: crypto: iaa - unmap dst before software fallback on decompress On a hardware analytics error, decompress retries through the software fallback, which writes req->dst w…
In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - unmap dst before software fallback on decompress On a hardware analytics error, decompress retries through the software fallback, which writes req->dst w…
CVE-2026-80943High· 7.6⚖ disputedwifi: rtlwifi: rtl8192du: check QoS TID before indexing tids
In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids rtl92du_tx_fill_desc() uses ieee80211_get_tid() to read the QoS TID from the 802.11 header and then uses i…
CVE-2026-80937High· 8.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915_mcu_get_eeprom() copies a fixed EFUSE block into the driver's dev->mt76.eeprom.data bu…
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915_mcu_get_eeprom() copies a fixed EFUSE block into the driver's dev->mt76.eeprom.data bu…
CVE-2026-80936High· 7.8⚖ disputedwifi: mt76: mt7925: cancel mlo_pm_work on stop
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel mlo_pm_work on stop mt7925 queues mlo_pm_work with a 5 second delay during multi-link power-save setup and never cancels it on the stop path…
CVE-2026-80929High· 7.8sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
In the Linux kernel, the following vulnerability has been resolved: sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] cad_pid is global, and kill_cad_pid() is only used in the root namespace. However, due to pid…
CVE-2026-89534High· 8.8In the Linux kernel, the following vulnerability has been resolved: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails When svc_rdma_listen_handler() handles RDMA_CM_EVENT_ADDR_CHANGE, it creates a replacement listener cm_id an…
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails When svc_rdma_listen_handler() handles RDMA_CM_EVENT_ADDR_CHANGE, it creates a replacement listener cm_id an…
CVE-2026-89528High· 7.5svcrdma: Reject Read lists that exceed the page budget
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Read lists that exceed the page budget Individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending mult…
CVE-2026-89526Critical· 9.8svcrdma: Validate Read chunk positions before reconstruction
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed …
CVE-2026-89523High· 7.8wifi: mt76: mt7925: cancel pending mlo_pm_work
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel pending mlo_pm_work If the device is reset, suspended or unregistered within that window, the pending work can still run and access vif/bss …
CVE-2026-89522High· 7.8⚖ disputedmedia: staging/ipu7: fix async notifier UAF on probe error path
In the Linux kernel, the following vulnerability has been resolved: media: staging/ipu7: fix async notifier UAF on probe error path isys_register_devices() registers the V4L2 async notifier via isys_notifier_init(). If a subsequent pro…