415128CVEs tracked
4591Last 7 days
16054Last 30 days
1756CISA KEV
Recently published CVEs
4591 results| CVE | CVSS | Attack conditions / Impact | EPSS | Summary | Published |
|---|---|---|---|---|---|
| CVE-2026-99074 | — | Not scored | 0.2% | ipv4: stop PMTU walk when nexthop group shrinks In the Linux kernel, the following vulnerability has been resolved: ipv4: stop PMTU walk when nexthop group shrinks Commit 7d3f3b4367f3 ("net: ipv4: Cache pmtu for all packet paths if multipath enab… |
2026-10-23 |
| CVE-2026-99073 | — | Not scored | 0.2% | ipv4: stop exception dump when nexthop group shrinks In the Linux kernel, the following vulnerability has been resolved: ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de ("inet: switch inet_dump_fib() to RCU protection") allowe… |
2026-10-23 |
| CVE-2026-99072 | — | Not scored | 0.2% | ipv4: stop route notification sizing when nexthop group shrinks In the Linux kernel, the following vulnerability has been resolved: ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c ("net: ipv4: Emit notification when fib hardwa… |
2026-10-23 |
| CVE-2026-99071 | — | Not scored | 0.2% | ipv4: do not warn on route notification size race In the Linux kernel, the following vulnerability has been resolved: ipv4: do not warn on route notification size race Commit 680aea08e78c ("net: ipv4: Emit notification when fib hardware flags are c… |
2026-10-23 |
| CVE-2026-99070 | — | Not scored | 0.2% | ipv6: do not warn on route notification size race In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later fills it … |
2026-10-23 |
| CVE-2026-99069 | — | Not scored | 0.2% | Input: ati_remote2 - fix type confusion in device attribute handlers In the Linux kernel, the following vulnerability has been resolved: Input: ati_remote2 - fix type confusion in device attribute handlers Previously, the channel_mask and mode_mask attributes were re… |
2026-10-23 |
| CVE-2026-99068 | — | Not scored | 0.2% | ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d ("ALSA: ctxfi: Simplify dao_clear_{left,right}… |
2026-10-23 |
| CVE-2026-99067 | — | Not scored | 0.2% | btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() When paths_from_inode() fails, scrub_print_warning_inod… |
2026-10-23 |
| CVE-2026-99066 | — | Not scored | 0.2% | can: dev: init_can_skb(): restore skb header initialization In the Linux kernel, the following vulnerability has been resolved: can: dev: init_can_skb(): restore skb header initialization Commit 9f10374bb024 ("can: remove private CAN skb headroom infrastruct… |
2026-10-23 |
| CVE-2026-99065 | — | Not scored | 0.2% | cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus() In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus() With commit 2125c0034c5d ("cgroup/cpuset: Make cpuset hotplug pr… |
2026-10-23 |
| CVE-2026-99064 | 8.1
CNA (via NVD) v3.1 |
NetworkNo authNo interactionConditions
C:HI:HA:H
|
0.2% | cipso: adjust cached option offsets when removing CIPSO In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust cach… |
2026-10-23 |
| CVE-2026-99063 | — | Not scored | 0.2% | dm ioctl: don't let data_start run past the buffer In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let data_start run past the buffer struct dm_ioctl has seven bytes of trailing padding, so the smallest buffer use… |
2026-10-23 |
| CVE-2026-99062 | — | Not scored | 0.2% | vsock/virtio: account only unread bytes in read_skb() In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in read_skb() After a partial stream receive, rx_bytes tracks the unread suffix while buf_… |
2026-10-23 |
| CVE-2026-99061 | — | Not scored | 0.2% | wifi: brcmfmac: fix P2P device removal race in brcmf_detach() In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmf_detach() When the driver is removed while the user space process that created… |
2026-10-23 |
| CVE-2026-99060 | — | Not scored | 0.2% | wifi: mt76: mt7603: initialize global station WCID In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for frames that have neither a… |
2026-10-23 |
| CVE-2026-99059 | 7.7
CNA (via NVD) v3.1 |
NetworkNo authNo interactionConditions
C:HI:HA:L
|
0.2% | wireguard: noise: reject response consumption after intermediate initiation In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing the identical response me… |
2026-10-23 |
| CVE-2026-99058 | — | Not scored | 0.2% | workqueue: Fix NULL current_pwq deref in chained work check In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL current_pwq deref in chained work check current_wq_worker() only tells us that %current is a kworker. It does … |
2026-10-23 |
| CVE-2026-99057 | — | Not scored | 0.2% | xen/netfront: don't leak the skb when xennet_fill_frags() fails In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennet_fill_frags() fails When a response chain has more slots than fit in the skb's frags, … |
2026-10-23 |
| CVE-2026-99056 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | strparser: make sure __strp_recv isn't running before tearing down the parser In the Linux kernel, the following vulnerability has been resolved: strparser: make sure __strp_recv isn't running before tearing down the parser The comment above strp_done() claims that if strp is… |
2026-10-23 |
| CVE-2026-99055 | — | Not scored | 0.2% | tcp: reject net_iov in zerocopy receive mapping hints In the Linux kernel, the following vulnerability has been resolved: tcp: reject net_iov in zerocopy receive mapping hints After copying a readable prefix, receive_fallback_to_copy() asks tcp_zerocop… |
2026-10-23 |
| CVE-2026-99054 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | tipc: destroy topsrv workqueues before closing connections In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipc_topsrv_stop() closed subscriber connections while the topology ser… |
2026-10-23 |
| CVE-2026-99053 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | tipc: hold a reference to nodes found by link name In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipc_node_find_by_name() returns a node after dropping its RCU read lock withou… |
2026-10-23 |
| CVE-2026-99052 | — | Not scored | 0.2% | selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts In the Linux kernel, the following vulnerability has been resolved: selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts When an NFSv4 filesystem exported with security_label is… |
2026-10-23 |
| CVE-2026-99051 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | fsverity: RCU-delay the freeing of struct fsverity_info In the Linux kernel, the following vulnerability has been resolved: fsverity: RCU-delay the freeing of struct fsverity_info __fsverity_get_info() calls rhashtable_lookup_fast(), which just uses rcu_… |
2026-10-23 |
| CVE-2026-99050 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | gpio: mpsse: fix race when arming the IRQ poll worker In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpio_mpsse_irq_enable() arms the poll worker before publishing it: schedule_… |
2026-10-23 |
| CVE-2026-99049 | — | Not scored | 0.2% | gpio: xilinx: fix runtime PM leak on request error path In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: fix runtime PM leak on request error path pm_runtime_get_sync() leaves the usage counter incremented even when it fa… |
2026-10-23 |
| CVE-2026-99048 | — | Not scored | 0.2% | gve: fix napi_disable deadlock when attempting to disable XSK pools In the Linux kernel, the following vulnerability has been resolved: gve: fix napi_disable deadlock when attempting to disable XSK pools When disabling XSK pools, GVE calls the unlocked versions of n… |
2026-10-23 |
| CVE-2026-99047 | — | Not scored | 0.2% | gve: fix XSK buffer leak when rings are stopped In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak when rings are stopped GVE does not free XSK buffers when resetting ring state as a part of stopping queu… |
2026-10-23 |
| CVE-2026-99046 | 7.5
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:NI:NA:H
|
0.2% | gve: fix XSK buffer leak on error descriptor In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the buf_state and its atta… |
2026-10-23 |
| CVE-2026-99045 | — | Not scored | 0.2% | ibmveth: h_free logical LAN on open-fail after register In the Linux kernel, the following vulnerability has been resolved: ibmveth: h_free logical LAN on open-fail after register ibmveth_open() registers the logical LAN, then allocates the RX buffer poo… |
2026-10-23 |
| CVE-2026-99044 | — | Not scored | 0.2% | ice: fix use-after-free in dynamic port cleanup In the Linux kernel, the following vulnerability has been resolved: ice: fix use-after-free in dynamic port cleanup ice_dealloc_dynamic_port() uses dyn_port->vsi->idx to erase the dynamic port from … |
2026-10-23 |
| CVE-2026-99043 | — | Not scored | 0.2% | ice: fix metadata_dst refcount handling on representor teardown In the Linux kernel, the following vulnerability has been resolved: ice: fix metadata_dst refcount handling on representor teardown ice_eswitch_release_repr() uses metadata_dst_free() to release the… |
2026-10-23 |
| CVE-2026-99042 | 8.4
CNA (via NVD) v3.1 |
LocalLoginNo interaction
Scope change
C:HI:HA:N
|
0.2% | io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 In the Linux kernel, the following vulnerability has been resolved: io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 io_connect_bpf_populate() fills connect.port and connect.v6_… |
2026-10-23 |
| CVE-2026-99041 | — | Not scored | 0.2% | ip6_gre: remove obsolete ERSPAN PMTU update In the Linux kernel, the following vulnerability has been resolved: ip6_gre: remove obsolete ERSPAN PMTU update A tc tunnel_key action can attach a METADATA_IP_TUNNEL dst to an skb, and mirred can r… |
2026-10-23 |
| CVE-2026-99040 | — | Not scored | 0.2% | KEYS: Fix add_key() race with keyring restriction In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix add_key() race with keyring restriction __key_create_or_update() snapshots keyring->restrict_link before taking the dest… |
2026-10-23 |
| CVE-2026-99039 | — | Not scored | 0.2% | memstick: core: wait for request completion before freeing card In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstick_alloc_card() and memstick_set_rw_addr(), wait_for_comp… |
2026-10-23 |
| CVE-2026-99038 | — | Not scored | 0.2% | memstick: rtsx_usb_ms: complete requests after eject instead of dropping them In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: complete requests after eject instead of dropping them memstick_check() can pass its host->removing check j… |
2026-10-23 |
| CVE-2026-99037 | — | Not scored | 0.2% | dm-crypt: reject the lmk IV mode with AEAD ciphers In the Linux kernel, the following vulnerability has been resolved: dm-crypt: reject the lmk IV mode with AEAD ciphers A "capi:" table line that pairs an AEAD cipher with the lmk IV mode, for exampl… |
2026-10-23 |
| CVE-2026-99036 | — | Not scored | 0.2% | dm: fix reading free memory in do_resume In the Linux kernel, the following vulnerability has been resolved: dm: fix reading free memory in do_resume When do_resume calls dm_table_get_mode(new_map), the call is done without holding any loc… |
2026-10-23 |
| CVE-2026-99035 | — | Not scored | 0.2% | mmc: mtk-sd: Cancel request timeout work on remove In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues req_timeout while a request is active. msdc_request_done() us… |
2026-10-23 |
| CVE-2026-99034 | — | Not scored | 0.2% | mmc: sdhci-sprd: disable runtime PM on remove In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhci_sprd_probe() enables runtime PM, while sdhci_sprd_remove() does not perform th… |
2026-10-23 |
| CVE-2026-99033 | — | Not scored | 0.2% | net/packet: guard the ll header push in packet_rcv_spkt() In the Linux kernel, the following vulnerability has been resolved: net/packet: guard the ll header push in packet_rcv_spkt() packet_rcv_spkt() restores the link layer header with skb_push(skb, sk… |
2026-10-23 |
| CVE-2026-99032 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | net/smc: protect clcsock lifetime in smc_getname In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smc_getname smc_getname() dereferences smc->clcsock without holding clcsock_release_lock. Lin… |
2026-10-23 |
| CVE-2026-99031 | — | Not scored | 0.2% | net: bridge: avoid recursive multicast port cleanup In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup br_multicast_sg_del_exclude_ports() removes automatically added STAR_EXCL port… |
2026-10-23 |
| CVE-2026-99030 | 7.5
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:HI:NA:N
|
0.2% | net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() When skb_copy_and_csum_bits() reaches unreadable frags it returns… |
2026-10-23 |
| CVE-2026-99029 | — | Not scored | 0.2% | net: sparx5: free the matchall entry on destroy In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5_tc_matchall_replace() allocates a struct sparx5_mall_entry for every offloa… |
2026-10-23 |
| CVE-2026-99028 | — | Not scored | 0.2% | net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the dmaengine path the driver pre-submits RX buffers and h… |
2026-10-23 |
| CVE-2026-99027 | — | Not scored | 0.2% | net: team: stop reusing skb after queue override In the Linux kernel, the following vulnerability has been resolved: net: team: stop reusing skb after queue override A nonzero dev_queue_xmit() result does not return ownership of the skb. When an o… |
2026-10-23 |
| CVE-2026-99026 | — | Not scored | 0.2% | net: team: free skb when broadcast has no txable port In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bc_transmit() sends the original skb through the last txable port. When no p… |
2026-10-23 |
| CVE-2026-99025 | — | Not scored | 0.2% | openvswitch: fix soft lockup in the netlink flow dump In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix soft lockup in the netlink flow dump A production compute node carrying a few thousand datapath flows hit a soft … |
2026-10-23 |