415043CVEs tracked
4582Last 7 days
16055Last 30 days
1756CISA KEV
Published CVEs
CRITICALHIGHMEDIUMLOWUnscored
15594 CVEs in this period · counted 2026-10-25 13:21 UTC, refreshed hourly
Recently published CVEs
4582 results| CVE | CVSS | Attack conditions / Impact | EPSS | Summary | Published |
|---|---|---|---|---|---|
| CVE-2026-99034 | — | Not scored | 0.2% | mmc: sdhci-sprd: disable runtime PM on remove In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhci_sprd_probe() enables runtime PM, while sdhci_sprd_remove() does not perform th… |
2026-10-23 |
| CVE-2026-99033 | — | Not scored | 0.2% | net/packet: guard the ll header push in packet_rcv_spkt() In the Linux kernel, the following vulnerability has been resolved: net/packet: guard the ll header push in packet_rcv_spkt() packet_rcv_spkt() restores the link layer header with skb_push(skb, sk… |
2026-10-23 |
| CVE-2026-99032 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | net/smc: protect clcsock lifetime in smc_getname In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smc_getname smc_getname() dereferences smc->clcsock without holding clcsock_release_lock. Lin… |
2026-10-23 |
| CVE-2026-99031 | — | Not scored | 0.2% | net: bridge: avoid recursive multicast port cleanup In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup br_multicast_sg_del_exclude_ports() removes automatically added STAR_EXCL port… |
2026-10-23 |
| CVE-2026-99030 | 7.5
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:HI:NA:N
|
0.2% | net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() When skb_copy_and_csum_bits() reaches unreadable frags it returns… |
2026-10-23 |
| CVE-2026-99029 | — | Not scored | 0.2% | net: sparx5: free the matchall entry on destroy In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5_tc_matchall_replace() allocates a struct sparx5_mall_entry for every offloa… |
2026-10-23 |
| CVE-2026-99028 | — | Not scored | 0.2% | net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the dmaengine path the driver pre-submits RX buffers and h… |
2026-10-23 |
| CVE-2026-99027 | — | Not scored | 0.2% | net: team: stop reusing skb after queue override In the Linux kernel, the following vulnerability has been resolved: net: team: stop reusing skb after queue override A nonzero dev_queue_xmit() result does not return ownership of the skb. When an o… |
2026-10-23 |
| CVE-2026-99026 | — | Not scored | 0.2% | net: team: free skb when broadcast has no txable port In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bc_transmit() sends the original skb through the last txable port. When no p… |
2026-10-23 |
| CVE-2026-99025 | — | Not scored | 0.2% | openvswitch: fix soft lockup in the netlink flow dump In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix soft lockup in the netlink flow dump A production compute node carrying a few thousand datapath flows hit a soft … |
2026-10-23 |
| CVE-2026-99024 | — | Not scored | 0.2% | optee: register TEE devices only once fully initialized In the Linux kernel, the following vulnerability has been resolved: optee: register TEE devices only once fully initialized optee_probe() called tee_device_register() on both the client and the supp… |
2026-10-23 |
| CVE-2026-99023 | — | Not scored | 0.2% | power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all() In the Linux kernel, the following vulnerability has been resolved: power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all() of_regulator_bulk_get_all() allocates the consumers… |
2026-10-23 |
| CVE-2026-99022 | — | Not scored | 0.2% | regulator: ltc3676: don't read the write-only HRST and CLIRQ registers In the Linux kernel, the following vulnerability has been resolved: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST (0x1e) and CLIRQ (0x1f) are write-only command strobes… |
2026-10-23 |
| CVE-2026-99021 | — | Not scored | 0.2% | regulator: of: fill in supply names in of_regulator_bulk_get_all() In the Linux kernel, the following vulnerability has been resolved: regulator: of: fill in supply names in of_regulator_bulk_get_all() of_regulator_bulk_get_all() returns an array it allocated itsel… |
2026-10-23 |
| CVE-2026-99020 | — | Not scored | 0.2% | regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 In the Linux kernel, the following vulnerability has been resolved: regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 The TPS65224 BUCK2, BUCK3 and BUCK4 descriptors pass 4 as n… |
2026-10-23 |
| CVE-2026-99019 | — | Not scored | 0.2% | scsi: ch: Do not keep references to data transfer element devices In the Linux kernel, the following vulnerability has been resolved: scsi: ch: Do not keep references to data transfer element devices ch_readconfig() looks up the scsi_device of every data transfer … |
2026-10-23 |
| CVE-2026-99018 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIG_SHADOW_CALL_STACK, handle_exception() reloads the … |
2026-10-23 |
| CVE-2026-99017 | 7.0
CNA (via NVD) v3.1 |
LocalLoginNo interactionConditions
C:HI:HA:H
|
0.2% | riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE In the Linux kernel, the following vulnerability has been resolved: riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE errata_probe_ghostwrite() only marks the CPU as vulnerable when… |
2026-10-23 |
| CVE-2026-99016 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | riscv: futex: untag the user pointer before the atomic access In the Linux kernel, the following vulnerability has been resolved: riscv: futex: untag the user pointer before the atomic access access_ok() checks untagged_addr(uaddr), but arch_futex_atomic_op_in… |
2026-10-23 |
| CVE-2026-99015 | — | Not scored | 0.2% | Bluetooth: hci_sock: Serialize dead-device detachment In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Serialize dead-device detachment Rebinding an HCI socket after its controller is unregistered can race monito… |
2026-10-23 |
| CVE-2026-99014 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | Bluetooth: hci_sync: Fix command skb lifetime during scan setup In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix command skb lifetime during scan setup During PA sync scan setup, hci_le_set_ext_scan_param_sync() gets t… |
2026-10-23 |
| CVE-2026-99013 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | Bluetooth: ISO: Reject concurrent BIS listener setup In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup iso_sock_listen() drops the socket lock before calling iso_listen_bis() to pr… |
2026-10-23 |
| CVE-2026-99012 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | Bluetooth: ISO: Serialize concurrent connect calls In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Serialize concurrent connect calls iso_sock_connect() checks the socket state before taking the socket lock and dr… |
2026-10-23 |
| CVE-2026-99011 | 7.1
CNA (via NVD) v3.1 |
AdjacentNo authUser actionConditions
C:HI:HA:H
|
0.2% | Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata() In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata() sco_recv_scodata() upgrades the weak hcon->sco_data back-po… |
2026-10-23 |
| CVE-2026-99010 | — | Not scored | 0.2% | Bluetooth: RFCOMM: free the skb when the DLC has no owner In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcomm_recv_data() hands the skb to d->data_ready() and returns 0 withou… |
2026-10-23 |
| CVE-2026-99009 | — | Not scored | 0.2% | Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex An RFCOMM connect() issued while a BR/EDR link is being authent… |
2026-10-23 |
| CVE-2026-99008 | — | Not scored | 0.2% | Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown syzbot hit a NULL pointer dereference in rfcomm_dev_shutdow… |
2026-10-23 |
| CVE-2026-99007 | — | Not scored | 0.2% | drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN __drm_fb_helper_initial_config_and_unlock() calls drm_cli… |
2026-10-23 |
| CVE-2026-99006 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | drm/i915/gem: Prevent overstepping exec array boundary In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for eb_relocate_parse_slow() to call kvfree() on entries out… |
2026-10-23 |
| CVE-2026-99005 | — | Not scored | 0.2% | drm/i915/gt: Unmask interrupts only when ACTIVE is true In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race window between intel_rps_boost() reading a stale ACT… |
2026-10-23 |
| CVE-2026-99004 | — | Not scored | 0.2% | drm/imagination: Size page table preallocation by device address In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 ("drm/imagination: Fix page count for page ta… |
2026-10-23 |
| CVE-2026-99003 | — | Not scored | 0.2% | drm/panthor: validate userspace queue count against initialized firmware slot count In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthor_drv.c:panthor_ioctl_group_create(),… |
2026-10-23 |
| CVE-2026-99002 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | drm/vmwgfx: validate pitch coming from userspace In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from … |
2026-10-23 |
| CVE-2026-99001 | — | Not scored | 0.2% | drm/xe/i2c: cancel the client work on remove In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xe_i2c_notifier() stores the DesignWare adapter in i2c->adapter and schedules i2c->wo… |
2026-10-23 |
| CVE-2026-99000 | — | Not scored | 0.2% | drm/xe: Fix shrinker accounting double-subtraction on nested external pins In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins xe_bo_pin_external() and xe_bo_unpin_external() support… |
2026-10-23 |
| CVE-2026-98999 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin xe_bo_pin_external() and xe_bo_unpin_external() maintain … |
2026-10-23 |
| CVE-2026-98998 | — | Not scored | 0.2% | drm/bridge: th1520-dw-hdmi: Fix remove() callback In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove() callback This driver stores struct th1520_hdmi * in platform drvdata, but th1520_dw_hdmi_… |
2026-10-23 |
| CVE-2026-98997 | — | Not scored | 0.2% | drm/amdgpu/userq: only accept doorbell BOs as queue doorbell In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpu_userq_get_doorbell_index() pins any BO passed as doorbell_hand… |
2026-10-23 |
| CVE-2026-98996 | — | Not scored | 0.2% | fs: don't silently unmount busy mounts In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagate_mount_busy() helper exists to decide whether a synchronous can suceed. It doe… |
2026-10-23 |
| CVE-2026-98995 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | namespace: reset the old parent's ->overmount in mnt_change_mountpoint() In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's ->overmount in mnt_change_mountpoint() __umount_mnt() resets ->overmount of the parent when it u… |
2026-10-23 |
| CVE-2026-98994 | — | Not scored | 0.2% | statmount: read the parent of an unmounted mount under mount_lock In the Linux kernel, the following vulnerability has been resolved: statmount: read the parent of an unmounted mount under mount_lock statmount_mnt_basic() reads the ids of the parent through m->mnt… |
2026-10-23 |
| CVE-2026-98993 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | namespace: don't inherit MNT_UMOUNT in clone_mnt() In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNT_UMOUNT in clone_mnt() MNT_UMOUNT gets raised on a mount that umount_tree() or umount_one() has taken … |
2026-10-23 |
| CVE-2026-98992 | — | Not scored | 0.2% | namespace: don't copy an unmounted mount tree In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree may_copy_tree() accepts a mount whose root is an nsfs or pidfs file before it checks… |
2026-10-23 |
| CVE-2026-98991 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | namespace: queue a mount only once for mount notifications In the Linux kernel, the following vulnerability has been resolved: namespace: queue a mount only once for mount notifications mnt_notify_add() puts a mount on notify_list. It doesn't check whether … |
2026-10-23 |
| CVE-2026-98990 | — | Not scored | 0.2% | namespace: check a submount for references right before unmounting it In the Linux kernel, the following vulnerability has been resolved: namespace: check a submount for references right before unmounting it shrink_submounts() and mark_mounts_for_expiry() first collec… |
2026-10-23 |
| CVE-2026-98989 | — | Not scored | 0.2% | namespace: check a recursive bind mount for mount namespace loops In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops do_loopback() refuses to bind mount the file of a mount namespac… |
2026-10-23 |
| CVE-2026-98988 | 8.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
Scope change
C:HI:HA:H
|
0.2% | namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE open_tree(OPEN_TREE_NAMESPACE) creates a new mount namespace from a … |
2026-10-23 |
| CVE-2026-98987 | — | Not scored | 0.2% | namespace: look at the topmost mount for a mount namespace file In the Linux kernel, the following vulnerability has been resolved: namespace: look at the topmost mount for a mount namespace file attach_recursive_mnt() preallocates a mountpoint for the root of t… |
2026-10-23 |
| CVE-2026-98986 | — | Not scored | 0.2% | namespace: remove the fsnotify marks of a mount namespace in process context In the Linux kernel, the following vulnerability has been resolved: namespace: remove the fsnotify marks of a mount namespace in process context mnt_ns_release() drops the last passive reference of … |
2026-10-23 |
| CVE-2026-98985 | — | Not scored | 0.2% | namespace: check the mounts before reading their parents in pivot_root() In the Linux kernel, the following vulnerability has been resolved: namespace: check the mounts before reading their parents in pivot_root() path_pivot_root() reads the parents of new_root and of th… |
2026-10-23 |