Tagged “vex”
CVEs tagged vex, newest first.
7401 CVEsRSS
CVE-2026-98478Medium· 4.7kernel: scsi: ufs: core: Keep internal commands dispatchable during error handling (CVE-2026-98478)
A flaw was found in the Linux kernel's Universal Flash Storage (UFS) driver. During device error recovery, the driver pauses all command queues, which inadvertently prevents internal recovery commands from being dispatched. This condition …
CVE-2026-98470Medium· 4.7kernel: KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode (CVE-2026-98470)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for ARM64. This vulnerability allows a local attacker to cause a Denial of Service (DoS). When running in protected mode, the kernel issues an internal war…
CVE-2026-98481Medium· 6.2kernel: nfc: port100: reject frames whose declared length exceeds the received data (CVE-2026-98481)
A flaw was found in the Linux kernel's Near Field Communication (NFC) Port-100 driver. An attacker connecting a malicious USB device can provide a response frame whose declared length exceeds the actual received data size. This flaw causes…
CVE-2026-98475Medium· 5.1kernel: s390/cmf: Fix virtual vs physical address confusion (CVE-2026-98475)
A flaw was found in the Linux kernel's s390 Channel Measurement Facility (CMF). This vulnerability can allow a local user to cause memory corruption or a Denial of Service (DoS) due to confusion between virtual and physical memory addresse…
CVE-2026-98473Low· 1.9kernel: s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config (CVE-2026-98473)
A flaw was found in the Linux kernel's s390 Virtual Function I/O Adjunct Processor (VFIO-AP) device driver. A local user with administrative privileges can trigger this issue by removing an AP queue from the host configuration while it rem…
CVE-2026-98483Medium· 5.5kernel: nfc: fix use-after-free in nfc_get_local_general_bytes (CVE-2026-98483)
A flaw was found in the Linux kernel's Near Field Communication (NFC) subsystem. A reference counting error in the nfc_get_local_general_bytes() function causes memory to be freed prematurely while callers still access the returned pointer…
CVE-2026-98482Medium· 6.5kernel: nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (CVE-2026-98482)
A flaw was found in the Linux kernel's Near Field Communication (NFC) subsystem. The Logical Link Control Protocol (LLCP) implementation does not verify the length of incoming network packets before reading sequence information. An attacke…
CVE-2026-98479Medium· 6.5kernel: scsi: libiscsi_tcp: Check the data direction of a Data-In PDU (CVE-2026-98479)
A flaw was found in the Linux kernel's iSCSI TCP subsystem. A malicious or compromised iSCSI storage server can cause memory corruption and data integrity loss on a connected client by sending an unexpected Data-In Protocol Data Unit (PDU)…
CVE-2026-98477Medium· 5.5perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()
In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() perf_pmu_sched_task() returns early when cpuctx->task_ctx is set, and cpc->task_epc is only non-NULL while a ta…
CVE-2026-98490Critical· 9.8⚖ disputednet: openvswitch: conntrack: fix helper UAF due to extensions realloc
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: …
CVE-2026-98485Medium· 5.9kernel: netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read (CVE-2026-98485)
A flaw was found in the Linux kernel's netfilter subsystem. This flaw allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted IPv6 packets to an affected system. The issue occurs when an IPv6 routing header…
CVE-2026-98491Medium· 5.9kernel: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry (CVE-2026-98491)
A flaw was found in the Linux kernel's Open vSwitch subsystem. When cloned network packet buffers share an unconfirmed connection tracking entry, committing the entry with conflicting extensions can trigger a use-after-free memory issue du…
CVE-2026-98484Low· 3.4netfilter: nf_tables: skip expired catchall elements on insert and delete
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: skip expired catchall elements on insert and delete nft_setelem_catchall_insert() looks up duplicates with nft_set_elem_active() only, while nft_…
CVE-2026-98487Medium· 5.5⚖ disputedkernel: net: bridge: mdb: restart port group walk after deletion (CVE-2026-98487)
A flaw was found in the Linux kernel's network bridge subsystem. When deleting multicast database (MDB) port groups, the kernel can maintain a stale reference to memory that has already been freed during recursive group removal, resulting …
CVE-2026-98499Medium· 6.8kernel: HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (CVE-2026-98499)
A flaw was found in the Linux kernel's Wacom Human Interface Device (HID) driver. When processing a device report descriptor with mismatched usage and count configurations, the driver can calculate an invalid memory offset and perform an o…
CVE-2026-98497Medium· 5.6kernel: net/mlx5e: fix swapped IPv6 IPsec policy masks (CVE-2026-98497)
A flaw was found in the Linux kernel's mlx5 network driver. When configuring IPv6 IPsec (Internet Protocol Security) rules with differing source and destination prefix lengths, the driver inadvertently swaps the source and destination addr…
CVE-2026-98501Medium· 5.1⚖ disputedkernel: HID: alps: fix use-after-free on input2 registration failure (CVE-2026-98501)
A flaw was found in the Linux kernel's Alps Human Interface Device (HID) driver. If registration of an input device fails during configuration, the driver frees the device memory while communication channels are already active, leaving a d…
CVE-2026-98512Medium· 5.5kernel: drm/nouveau: RCU-free the scheduler-containing nouveau_sched (CVE-2026-98512)
A flaw was found in the Linux kernel's Nouveau graphics driver. When destroying a GPU scheduler object, the driver frees memory prematurely while user-space synchronization objects still hold references to it. A local, unprivileged user co…
CVE-2026-98507High· 7.8⚖ disputedmm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish
In the Linux kernel, the following vulnerability has been resolved: mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish On arm64 server, we find that a task trying to grab the anon_vma lock triggers hungtask. …
CVE-2026-98510Medium· 4.7⚖ disputedkernel: drm/xe/vm: nuke PTs only after unlinking contested VMAs (CVE-2026-98510)
A flaw was found in the Linux kernel's Intel Xe graphics driver. When closing a GPU virtual memory space, page tables were destroyed before contested virtual memory areas were properly unlinked from shared buffer objects. A concurrent thre…
CVE-2026-98517Medium· 5.5⚖ disputedkernel: drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (CVE-2026-98517)
A flaw was found in the Linux kernel's Nouveau graphics driver. When handling buffer objects in system memory, the driver improperly accesses memory past the allocated resource boundary. A local attacker could exploit this flaw to cause a …
CVE-2026-98515Medium· 4.7⚖ disputedkernel: drm/nouveau: fix double-free in nvif_vmm_dtor (CVE-2026-98515)
A flaw was found in the Linux kernel's Nouveau graphics driver. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by crashing the system or potentially escalate privileges. During device initialization failures,…
CVE-2026-98520Medium· 4.7⚖ disputedkernel: drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping (CVE-2026-98520)
A flaw was found in the Linux kernel's AMD GPU driver (amdkfd). In multi-container environments, terminating an initial container session that accessed the GPU interface leaves behind an invalid internal memory reference. When a subsequent…
CVE-2026-98518Medium· 5.5kernel: drm/nouveau/dmem: pin VRAM for the whole registered range (CVE-2026-98518)
A flaw was found in the Linux kernel's Nouveau graphics driver. This vulnerability allows a local user to cause a denial of service (DoS) or system instability through an out-of-bounds memory access in video random-access memory (VRAM). Th…
CVE-2026-98524High· 7.8kernel: rds: ib: Clear the sg list when mapping an MR fails (CVE-2026-98524)
A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) subsystem. When memory region mapping fails during InfiniBand operations, the kernel can retain a stale reference to memory buffers that have already been released. A l…
CVE-2026-98532High· 7.5kernel: ipv6: do not let ipv6_find_hdr() return an offset past the packet end (CVE-2026-98532)
A flaw was found in the Linux kernel. A remote attacker could cause a Denial of Service (DoS) or memory corruption by sending specially crafted IPv6 network packets. The IPv6 extension header parsing mechanism fails to verify that the decl…
CVE-2026-98542Low· 2.3kernel: cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict (CVE-2026-98542)
A flaw was found in the Linux kernel's cpuset subsystem, which can lead to a denial of service (DoS) or compromised resource isolation. A local user with permissions to configure control groups (cgroups) can trigger this flaw by creating a…
CVE-2026-98545Medium· 6.2kernel: ata: libata-scsi: bound the ATA passthru sense descriptor writes (CVE-2026-98545)
A flaw was found in the Linux kernel's libata SCSI subsystem. When processing ATA pass-through commands to an ATAPI storage device, the kernel fails to properly validate the length byte returned in the device's sense response buffer. A mal…
CVE-2026-98547Medium· 5.5kernel: af_packet: fix integer overflow in prb_calc_retire_blk_tmo() (CVE-2026-98547)
A flaw was found in the Linux kernel's af_packet network socket implementation. An integer overflow occurs during timeout calculations when configuring packet receive rings with large block sizes. A local user with raw network privileges c…
CVE-2026-98546Medium· 4.7kernel: arm64/boot: Disable trapping of PMZR_EL0 writes to EL2 (CVE-2026-98546)
A flaw was found in the Linux kernel's ARM64 architecture support. When user-space access to performance monitoring counters is enabled, write traps for a write-only performance register are improperly configured during hypervisor initiali…