CVEs we hold for Linux

Records whose assigning authority named Linux as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-99999ipv4: validate checksum_start before completing checksumLinux

CVE-2026-98432ipv4: free inet_opt and ireq_opt after an RCU grace periodLinux

CVE-2026-98431RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependencyLinux

CVE-2026-98430RDMA/efa: Keep admin queues alive while IRQ is registeredLinux

CVE-2026-98429RDMA/efa: Keep EQ resources alive while IRQ is registeredLinux

CVE-2026-98428ALSA: usb: 6fire: Avoid embedded URBsLinux

CVE-2026-98427net/sched: codel: bound the dropping loop per dequeue callLinux

CVE-2026-98426wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error pathLinux

CVE-2026-98425wifi: mac80211: don't warn when an IBSS has no channel to scanLinux

CVE-2026-98424wifi: cfg80211: undo netns switch if renaming the wiphy failsLinux

CVE-2026-98423wifi: mac80211_hwsim: don't hand frames to mac80211 while stoppingLinux

CVE-2026-98422wifi: mac80211: reset the AP_VLAN tailroom counter on ifdownLinux

CVE-2026-98421wifi: mac80211: require a peer station for TDLS setup confirmLinux

CVE-2026-98420ksmbd: follow SMB2 session expiration semanticsLinux

CVE-2026-98419drop_monitor: fix out-of-bounds write in reset_per_cpu_data()Linux

CVE-2026-98418sched/core: Avoid false migration warning for proxy donorsLinux

CVE-2026-98417net: xfrm: reject unrepresentable espintcp transport headersLinux

CVE-2026-98416dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()Linux

CVE-2026-98415soc: samsung: exynos-pmu: fix use-after-free of interrupt generator nodeLinux

CVE-2026-98414memcg: avoid charging the root memcg from obj_cgroup_charge_pages()Linux

CVE-2026-98413selinux: always fill AVC decision in avc_has_perm_noaudit()Linux

CVE-2026-98412power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new()Linux

CVE-2026-98411power: sequencing: fix NULL-pointer dereference in pwrseq_device_register()Linux

CVE-2026-98410watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdogLinux

CVE-2026-98409watchdog: rtd119x: Avoid division by zeroLinux

CVE-2026-98408watchdog: rzv2h: Avoid division by zeroLinux

CVE-2026-98407wifi: rsi: fix heap OOB write on key removalLinux

CVE-2026-98406wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driverLinux

CVE-2026-98405smb: client: fix missing iov bounds check in parse_posix_sids()Linux

CVE-2026-98404drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()Linux

CVE-2026-98403s390/boot: Avoid IPL parameter append past command lineLinux

CVE-2026-98402net: icmp: avoid invalid transport header access in icmp_send tracepointLinux

CVE-2026-98401net: iptunnel: fix stale transport header during tunnel decapsulationLinux

CVE-2026-98400s390/ipl: Fix NULL deref in kdump without re-IPL parm blockLinux

CVE-2026-98399s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm blockLinux

CVE-2026-98398locking/lockdep: Invalidate stale class_cache entries for zapped classesLinux

CVE-2026-98397platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardownLinux

CVE-2026-98396powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()Linux

CVE-2026-98395powerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exitLinux

CVE-2026-98394af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.Linux

CVE-2026-98393net: ipv4: Fix UDP length overflow with PMTU discover and big MTULinux

CVE-2026-98392Bluetooth: btintel_pcie: fix tx_handle bounds off-by-oneLinux

CVE-2026-98391drm/xe: Guard page-fault worker with runtime PM checkLinux

CVE-2026-98390x86/amd_node: Avoid divide by zero on virtualized systemsLinux

CVE-2026-98389drm/amdgpu: skip gfx switch_power_profile during GPU resetLinux

CVE-2026-98388exec: do_close_on_exec() before taking exec_update_lockLinux

CVE-2026-98387s390/crypto: Fix skcipher_walk return code handling in aes_s390Linux

CVE-2026-98386scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slotLinux

CVE-2026-98385sched/cache: Decouple sched_cache_group from mm to fix UAFLinux

CVE-2026-98384bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()Linux

CVE-2026-98383bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCALLinux

CVE-2026-98382bpf: Reject dev-bound-only programs on other devicesLinux

CVE-2026-98381veth: manage XDP program pointers during channel resizeLinux

CVE-2026-98380net/sched: reject IDR error pointers when deleting actionsLinux

CVE-2026-98379netfilter: ip6t_rpfilter: reject routes without inet6_devLinux

CVE-2026-98378bpf: Skip unsettled links in link iteratorLinux

CVE-2026-98377vlan: require the MAC header to be present in __vlan_insert_inner_tag()Linux

CVE-2026-98376bpf: Use array_map_meta_equal for percpu array inner map replacementLinux

CVE-2026-98375xen/netfront: drop RX packets with a short Ethernet headerLinux

CVE-2026-98374tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()Linux

CVE-2026-98373mm/hugetlb: preserve mremap address delta when skipping page tablesLinux

CVE-2026-98372xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()Linux

CVE-2026-98371xfrm: iptfs: fix runt reassembly panic from short inner tot_lenLinux

CVE-2026-98370xfrm: fix compat ALLOCSPI request use-after-freeLinux

CVE-2026-98369xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()Linux

CVE-2026-98368esp: downgrade zerocopy managed frags before mutating skb fragsLinux

CVE-2026-98367RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_acceptLinux

CVE-2026-98366RDMA/rxe: validate access flags before swapping the MR's PDLinux

CVE-2026-98365RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB accessLinux

CVE-2026-98364xfrm: hold net_device reference under RCU in bundle creationLinux

CVE-2026-98363firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPSLinux

CVE-2026-98362clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rateLinux

CVE-2026-98361RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write pathsLinux

CVE-2026-98360RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeedsLinux

CVE-2026-98359RDMA/core: Reject unregistering netdevs in ib_get_eth_speedLinux

CVE-2026-98358IB/iser: reject a remote invalidation of an unregistered directionLinux

CVE-2026-98357IB/isert: wait for deferred control PDU completions before releasing the connectionLinux

CVE-2026-98356RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setupLinux

CVE-2026-98355RDMA/rtrs: guard against null kobj nameLinux

CVE-2026-98354RDMA/mad: Fix receive buffer leak when PKey enforcement failsLinux

CVE-2026-98353RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tablesLinux

CVE-2026-98352RDMA/rtrs-clt: Fix CQ pool leak when connect is interruptedLinux

CVE-2026-98351wifi: virt_wifi: free skb when disconnectedLinux

CVE-2026-98350wifi: brcmfmac: cyw: pass PMKID to firmware if presentLinux

CVE-2026-98349wifi: libipw: reject too-short beacon and probe responsesLinux

CVE-2026-98348wifi: libipw: reject too-short association responsesLinux

CVE-2026-98347IB/IPoIB: Avoid restoring OPER_UP after multicast flushLinux

CVE-2026-98346wifi: cfg80211: don't get the radio mask for netdev-less wdevsLinux

CVE-2026-98345wifi: cfg80211: check IP header size in cfg80211_classify8021d()Linux

CVE-2026-98344dmaengine: Fix device kref underflow in dma_chan_put()Linux

CVE-2026-98343dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()Linux

CVE-2026-98342dmaengine: wait for RCU readers before releasing dma_deviceLinux

CVE-2026-98341wifi: cfg80211: don't free driver-owned scan requestsLinux

CVE-2026-98340wifi: cfg80211: only group hidden BSSes with beacon entriesLinux

CVE-2026-98339wifi: cfg80211: don't filter by BSS type when removing stale entriesLinux

CVE-2026-98338wifi: cfg80211: ibss: ref BSS entry for joined eventLinux

CVE-2026-98337wifi: mac80211: don't start a ROC while scanningLinux

CVE-2026-98336wifi: mac80211: don't offload TC setup on AP_VLAN interfacesLinux

CVE-2026-98335wifi: mac80211: abort chanswitch when leaving a meshLinux

CVE-2026-98334wifi: mac80211: reset state when starting AP failsLinux

CVE-2026-98333wifi: mac80211: reset the LED state when ifup failsLinux

CVE-2026-98332wifi: mac80211: only operate on TDLS peers in the TDLS codeLinux

CVE-2026-98331wifi: mac80211: unlist vifs when their netdev is unregisteredLinux

CVE-2026-98330wifi: cfg80211: get the wiphy out of a dying network namespaceLinux

CVE-2026-98329wifi: mac80211: don't allow injecting frames wider than the chanctxLinux

CVE-2026-98328wifi: mac80211: add HE 6 GHz capability in the scan elems lenLinux

CVE-2026-98327wifi: mac80211: mesh: reset the CSA state when leavingLinux

CVE-2026-98326wifi: mac80211: mesh: release the channel if start failsLinux

CVE-2026-98325wifi: mac80211: set up the TX info early to fix failure pathsLinux

CVE-2026-98324dmaengine: pxa: fix double counting of the hw descriptorsLinux

CVE-2026-98323RDMA/siw: Bound fragmented header copies by the remaining lengthLinux

CVE-2026-98322netfilter: nft_nat: fully initialise new_addr in netmap setupLinux

CVE-2026-98321netfilter: nf_nat: unregister and release hooks on errorLinux

CVE-2026-98320netfilter: flowtable: hold reference on ct until flow is releasedLinux

CVE-2026-98319drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptrLinux

CVE-2026-98318smb: client: validate absolute native symlink targets before NT fixupsLinux

CVE-2026-98317neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.Linux

CVE-2026-98316ALSA: bcd2000: Fix race between rawmidi and disconnectLinux

CVE-2026-98315ntfs: protect runlist updates with the runlist lockLinux

CVE-2026-98314ALSA: pcm: set timer->private_data before registering the PCM timerLinux

CVE-2026-98313drm/msm/dp: skip PUSH_IDLE when the link was never enabledLinux

CVE-2026-98312ALSA: 6fire: fix OOB write from device-reported iso lengthLinux

CVE-2026-98311wifi: virt_wifi: don't transfer operstate before registerLinux

CVE-2026-98310drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memoryLinux

CVE-2026-98309drm/vc4: Use managed KMS polling to fix UAF on unbindLinux

CVE-2026-98308ALSA: hda: trace PCM open only after assigning a streamLinux

CVE-2026-98307wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()Linux

CVE-2026-98306seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulationLinux

CVE-2026-98305net: dsa: mxl862xx: disable the stats poll on teardownLinux

CVE-2026-98304net: bcmgenet: restore the hardware filters on openLinux

CVE-2026-98303ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookupLinux

CVE-2026-98302net: fddi: skfp: fix NULL deref when setting the MAC address while downLinux

CVE-2026-98301net: bridge: mst: move switchdev call outside rcuLinux

CVE-2026-98300tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().Linux

CVE-2026-98299tcp: do not let tcp_rmem be set below 4096Linux

CVE-2026-98298dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()Linux

CVE-2026-98297Bluetooth: hci_core: Fix queuing tx_work after workqueue is drainedLinux

CVE-2026-98296Bluetooth: btintel_pcie: validate TX skb length in send_syncLinux

CVE-2026-98295Bluetooth: coredump: Quiesce dump work on unregisterLinux

CVE-2026-98294Bluetooth: hci_qca: Do not write to the serial port after it is closedLinux

CVE-2026-98293Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()Linux

CVE-2026-98292Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct accessLinux

CVE-2026-98291Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submitLinux

CVE-2026-98290Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanupLinux

CVE-2026-98289af_unix: Unify scc_index when finalising SCC in __unix_walk_scc().Linux

CVE-2026-98288net: stmmac: fix TSO header length truncationLinux

CVE-2026-98287pppoatm: ensure a writable skb header and linear dataLinux

CVE-2026-98286drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardownLinux

CVE-2026-98285net: bridge: vlan: fix bugs caused by switchdev deletion errorsLinux

CVE-2026-98284netlink: do not free nlk->groups while lockless readers can use itLinux

CVE-2026-98283KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()Linux

CVE-2026-98282powerpc/iommu: Fix the overflow validation in iommu_tce_check_iobaLinux

CVE-2026-98281futex: Also allocate private hash on vfork()Linux

CVE-2026-98280drm/xe/i2c: Disable IRQ on unbindLinux

CVE-2026-98279btrfs: handle lack of space when cleaning up verity itemsLinux

CVE-2026-98278net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop checkLinux

CVE-2026-98277eth: fbnic: ring the doorbell if a burst ends in a dropLinux

CVE-2026-98276net: lock the socket in sock_gettstamp()Linux

CVE-2026-98275net: ethernet: cortina: Ack RX overrun interrupt correctlyLinux

CVE-2026-98274net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()Linux

CVE-2026-98273x86/kprobes: Fix crash when probing CS CALL instructionsLinux

CVE-2026-98272net: mvpp2: prevent buffer overflow in page_pool allocationLinux

CVE-2026-98271net: skbuff: do not leave stale header offsets after pskb_carve()Linux

CVE-2026-98270drm/amdgpu: check ras and obj before dereferenceLinux

CVE-2026-98269btrfs: abort transaction on failure to update inode for hole punching and reflinkingLinux

CVE-2026-98268perf: Fix null pointer access in is_include_guest_event()Linux

CVE-2026-982679p: Fix v9fs_issue_write() to update i_size and remote_i_sizeLinux

CVE-2026-98266ALSA: core: Fix potential UAF after asynchronous card releaseLinux

CVE-2026-98265ALSA: usb-audio: Clamp implicit feedback packet count to URB capacityLinux

CVE-2026-98264ALSA: virtio: reset device before deleting virtqueuesLinux

CVE-2026-98263ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->typeLinux

CVE-2026-98262ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLYLinux

CVE-2026-98261cifs: Fix server use-after-free in cifs_chan_skip_or_disable()Linux

CVE-2026-98260exec: Cleanup POSIX timers right after de_thread()Linux

CVE-2026-98259fs/dax: check zero or empty entry before converting xarray entryLinux

CVE-2026-98258posix-cpu-timers: Prevent freeing a timer which is queued on the expiry listLinux

CVE-2026-98257rds: ib: use rds_conn_drop() on protocol version mismatchLinux

CVE-2026-98256signal: Prevent exec() raceLinux

CVE-2026-98255tcp: exclude old ACKs from tcp fast pathLinux

CVE-2026-98254swiotlb: use the adjusted address for the highmem page lookupLinux

CVE-2026-98253RDMA/ucma: Serialize join and leave on copy_to_user failureLinux

CVE-2026-98252RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()Linux

CVE-2026-98251openvswitch: avoid reallocating confirmed conntrack labelsLinux

CVE-2026-98250nfsd: fix handling of NFSEXP_PNFS in the netlink codepathLinux

CVE-2026-98249arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvcLinux

CVE-2026-98248arm64: percpu: Fix LSE operations on {8,16}-bit typesLinux

CVE-2026-98247Bluetooth: hci_codec: validate vendor codec count lengthLinux

CVE-2026-98246Bluetooth: hci_sync: Serialize local codec list cleanupLinux

CVE-2026-98245btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()Linux

CVE-2026-98244btrfs: clear free space tree creation state on rebuild failureLinux

CVE-2026-98243dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3Linux

CVE-2026-98242dma-buf: Fix silent overflow for phys vec to sgtLinux

CVE-2026-98241ipv6: xfrm: use full sockets in local error pathsLinux

CVE-2026-98240net: ip_tunnel: initialize `options_len` before referencing optionsLinux

CVE-2026-98239net: lan743x: fix RX checksum use-after-freeLinux

CVE-2026-98238net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()Linux

CVE-2026-98237net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chainLinux

CVE-2026-98236net: wwan: mhi_wwan_mbim: check skb_copy_bits() return valueLinux

CVE-2026-98235net/sched: act_api: release tail references on DELACTION failureLinux

CVE-2026-98234net/sched: hhf: cap hh_flows_limit at change timeLinux

200 records, read from the index as it stood on 18 Oct 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.