394400CVEs tracked
4643Last 7 days
16081Last 30 days
1756CISA KEV
Published CVEs
CRITICALHIGHMEDIUMLOWUnscored
15667 CVEs in this period · counted 2026-10-25 15:15 UTC, refreshed hourly
Recently published CVEs
4643 results| CVE | CVSS | Attack conditions / Impact | EPSS | Summary | Published |
|---|---|---|---|---|---|
| CVE-2026-99007 | — | Not scored | 0.2% | drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN __drm_fb_helper_initial_config_and_unlock() calls drm_cli… |
2026-10-23 |
| CVE-2026-99006 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | drm/i915/gem: Prevent overstepping exec array boundary In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for eb_relocate_parse_slow() to call kvfree() on entries out… |
2026-10-23 |
| CVE-2026-99005 | — | Not scored | 0.2% | drm/i915/gt: Unmask interrupts only when ACTIVE is true In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race window between intel_rps_boost() reading a stale ACT… |
2026-10-23 |
| CVE-2026-99004 | — | Not scored | 0.2% | drm/imagination: Size page table preallocation by device address In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 ("drm/imagination: Fix page count for page ta… |
2026-10-23 |
| CVE-2026-99003 | — | Not scored | 0.2% | drm/panthor: validate userspace queue count against initialized firmware slot count In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthor_drv.c:panthor_ioctl_group_create(),… |
2026-10-23 |
| CVE-2026-99002 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | drm/vmwgfx: validate pitch coming from userspace In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from … |
2026-10-23 |
| CVE-2026-99001 | — | Not scored | 0.2% | drm/xe/i2c: cancel the client work on remove In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xe_i2c_notifier() stores the DesignWare adapter in i2c->adapter and schedules i2c->wo… |
2026-10-23 |
| CVE-2026-99000 | — | Not scored | 0.2% | drm/xe: Fix shrinker accounting double-subtraction on nested external pins In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins xe_bo_pin_external() and xe_bo_unpin_external() support… |
2026-10-23 |
| CVE-2026-98999 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin xe_bo_pin_external() and xe_bo_unpin_external() maintain … |
2026-10-23 |
| CVE-2026-98998 | — | Not scored | 0.2% | drm/bridge: th1520-dw-hdmi: Fix remove() callback In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove() callback This driver stores struct th1520_hdmi * in platform drvdata, but th1520_dw_hdmi_… |
2026-10-23 |
| CVE-2026-98997 | — | Not scored | 0.2% | drm/amdgpu/userq: only accept doorbell BOs as queue doorbell In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpu_userq_get_doorbell_index() pins any BO passed as doorbell_hand… |
2026-10-23 |
| CVE-2026-98996 | — | Not scored | 0.2% | fs: don't silently unmount busy mounts In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagate_mount_busy() helper exists to decide whether a synchronous can suceed. It doe… |
2026-10-23 |
| CVE-2026-98995 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | namespace: reset the old parent's ->overmount in mnt_change_mountpoint() In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's ->overmount in mnt_change_mountpoint() __umount_mnt() resets ->overmount of the parent when it u… |
2026-10-23 |
| CVE-2026-98994 | — | Not scored | 0.2% | statmount: read the parent of an unmounted mount under mount_lock In the Linux kernel, the following vulnerability has been resolved: statmount: read the parent of an unmounted mount under mount_lock statmount_mnt_basic() reads the ids of the parent through m->mnt… |
2026-10-23 |
| CVE-2026-98993 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | namespace: don't inherit MNT_UMOUNT in clone_mnt() In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNT_UMOUNT in clone_mnt() MNT_UMOUNT gets raised on a mount that umount_tree() or umount_one() has taken … |
2026-10-23 |
| CVE-2026-98992 | — | Not scored | 0.2% | namespace: don't copy an unmounted mount tree In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree may_copy_tree() accepts a mount whose root is an nsfs or pidfs file before it checks… |
2026-10-23 |
| CVE-2026-98991 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | namespace: queue a mount only once for mount notifications In the Linux kernel, the following vulnerability has been resolved: namespace: queue a mount only once for mount notifications mnt_notify_add() puts a mount on notify_list. It doesn't check whether … |
2026-10-23 |
| CVE-2026-98990 | — | Not scored | 0.2% | namespace: check a submount for references right before unmounting it In the Linux kernel, the following vulnerability has been resolved: namespace: check a submount for references right before unmounting it shrink_submounts() and mark_mounts_for_expiry() first collec… |
2026-10-23 |
| CVE-2026-98989 | — | Not scored | 0.2% | namespace: check a recursive bind mount for mount namespace loops In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops do_loopback() refuses to bind mount the file of a mount namespac… |
2026-10-23 |
| CVE-2026-98988 | 8.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
Scope change
C:HI:HA:H
|
0.2% | namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE open_tree(OPEN_TREE_NAMESPACE) creates a new mount namespace from a … |
2026-10-23 |
| CVE-2026-98987 | — | Not scored | 0.2% | namespace: look at the topmost mount for a mount namespace file In the Linux kernel, the following vulnerability has been resolved: namespace: look at the topmost mount for a mount namespace file attach_recursive_mnt() preallocates a mountpoint for the root of t… |
2026-10-23 |
| CVE-2026-98986 | — | Not scored | 0.2% | namespace: remove the fsnotify marks of a mount namespace in process context In the Linux kernel, the following vulnerability has been resolved: namespace: remove the fsnotify marks of a mount namespace in process context mnt_ns_release() drops the last passive reference of … |
2026-10-23 |
| CVE-2026-98985 | — | Not scored | 0.2% | namespace: check the mounts before reading their parents in pivot_root() In the Linux kernel, the following vulnerability has been resolved: namespace: check the mounts before reading their parents in pivot_root() path_pivot_root() reads the parents of new_root and of th… |
2026-10-23 |
| CVE-2026-98984 | — | Not scored | 0.2% | dcache: don't put a mountpoint on a dentry that's being removed In the Linux kernel, the following vulnerability has been resolved: dcache: don't put a mountpoint on a dentry that's being removed rmdir(), unlink() and rename() call dont_mount() on the victim and… |
2026-10-23 |
| CVE-2026-98983 | — | Not scored | 0.2% | unshare: don't drop active namespace references that were never taken In the Linux kernel, the following vulnerability has been resolved: unshare: don't drop active namespace references that were never taken Active references on the namespaces of an nsproxy are taken … |
2026-10-23 |
| CVE-2026-98982 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | namespace: don't let a pseudo dentry become the root of a mount In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount d_alloc_pseudo() hands out dentries for pipes, sockets and other f… |
2026-10-23 |
| CVE-2026-98981 | 8.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
Scope change
C:HI:HA:H
|
0.2% | namespace: unhash a dentry before detaching the mounts on it In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink(), rmdir() and rename() remove the entry from the filesystem, … |
2026-10-23 |
| CVE-2026-98980 | 8.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
Scope change
C:HI:HA:H
|
0.2% | namei: don't reveal overmounted entries in refwalk In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted. step_into() step_into… |
2026-10-23 |
| CVE-2026-98979 | — | Not scored | 0.2% | namespace: refuse an automount below a mount that is in no namespace In the Linux kernel, the following vulnerability has been resolved: namespace: refuse an automount below a mount that is in no namespace It's possible to add autmounts even when the parent mount isn… |
2026-10-23 |
| CVE-2026-98978 | 8.4
CNA (via NVD) v3.1 |
LocalLoginNo interaction
Scope change
C:HI:HA:N
|
0.2% | namespace: never expire a locked mount In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being rev… |
2026-10-23 |
| CVE-2026-98977 | — | Not scored | 0.2% | namespace: handle mount locking for automounts correctly In the Linux kernel, the following vulnerability has been resolved: namespace: handle mount locking for automounts correctly If mounts are propagated across user namespaces, attach_recursive_mnt() l… |
2026-10-23 |
| CVE-2026-98976 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interactionConditions
Scope change
C:HI:HA:H
|
0.2% | namespace: keep the lock on a mount that a propagated copy is moved beneath In the Linux kernel, the following vulnerability has been resolved: namespace: keep the lock on a mount that a propagated copy is moved beneath attach_recursive_mnt() transfers MNT_LOCKED from the t… |
2026-10-23 |
| CVE-2026-98975 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | xfs: stop exchanging reflink flags when exchanging mappings In the Linux kernel, the following vulnerability has been resolved: xfs: stop exchanging reflink flags when exchanging mappings When an exchange covers both files from offset 0 to i_disk_size, xmi_c… |
2026-10-23 |
| CVE-2026-98974 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | xfs: fix exchange-range-to-eof file size exchange In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range-to-eof file size exchange Norbert Szetei posted a patch containing an incomplete description of a bug in X… |
2026-10-23 |
| CVE-2026-98973 | — | Not scored | 0.2% | drm/bridge: Fix unlocked list_del in drm_bridge_add() In the Linux kernel, the following vulnerability has been resolved: drm/bridge: Fix unlocked list_del in drm_bridge_add() When re-adding a bridge that was previously removed, drm_bridge_add() drops … |
2026-10-23 |
| CVE-2026-98972 | — | Not scored | 0.2% | cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode() In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode() After seeing the patch [1] to guard is_in_v2_mode() with RC… |
2026-10-23 |
| CVE-2026-98971 | — | Not scored | 0.2% | gpio: exar: initialize the ID before registering its cleanup In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devm_add_action_or_reset() invokes the cleanup action immediately whe… |
2026-10-23 |
| CVE-2026-98970 | — | Not scored | 0.2% | drm/vc4: Free the BO cache size list on teardown In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4_bo_cache_destroy() purges the cached BOs but never frees the size list, leaki… |
2026-10-23 |
| CVE-2026-98969 | — | Not scored | 0.2% | net/sched: em_text: reject unterminated algo before autoload In the Linux kernel, the following vulnerability has been resolved: net/sched: em_text: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a ("net/sched: fix potential… |
2026-10-23 |
| CVE-2026-98968 | 8.1
CNA (via NVD) v3.1 |
NetworkNo authNo interactionConditions
C:HI:HA:H
|
0.2% | amt: send the relay's General Query directly from the receive path In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references t… |
2026-10-23 |
| CVE-2026-98967 | — | Not scored | 0.2% | cxgb4/ch_ktls: disable softirqs around tid_list erases In the Linux kernel, the following vulnerability has been resolved: cxgb4/ch_ktls: disable softirqs around tid_list erases chcr_ktls_cpl_act_open_rpl() inserts into tid_list from the receive path us… |
2026-10-23 |
| CVE-2026-98966 | — | Not scored | 0.2% | bonding: fix the program leak when XDP is replaced In the Linux kernel, the following vulnerability has been resolved: bonding: fix the program leak when XDP is replaced We need to release the reference on the old BPF prog, whether we are going to n… |
2026-10-23 |
| CVE-2026-98965 | 7.5
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:NI:NA:H
|
0.2% | ice: Restore Ordered MMIO Writes for Tx Doorbells In the Linux kernel, the following vulnerability has been resolved: ice: Restore Ordered MMIO Writes for Tx Doorbells The DQL accounting state which tracks the number of bytes queued for the NIC to … |
2026-10-23 |
| CVE-2026-98964 | 7.5
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:NI:NA:H
|
0.2% | nvmet: use the local P2P device on metadata allocation failure In the Linux kernel, the following vulnerability has been resolved: nvmet: use the local P2P device on metadata allocation failure nvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after the d… |
2026-10-23 |
| CVE-2026-98963 | — | Not scored | 0.2% | btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio In the Linux kernel, the following vulnerability has been resolved: btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio If all bios finish before btrfs_encoded_read_regular_fill_pa… |
2026-10-23 |
| CVE-2026-98962 | — | Not scored | 0.2% | btrfs: free iov when btrfs_uring_read_extent() fails In the Linux kernel, the following vulnerability has been resolved: btrfs: free iov when btrfs_uring_read_extent() fails After btrfs_uring_read_extent(), the caller always jumped to out_acct. That s… |
2026-10-23 |
| CVE-2026-98961 | — | Not scored | 0.2% | btrfs: unlock inode and extent in caller when io_uring read extent fails In the Linux kernel, the following vulnerability has been resolved: btrfs: unlock inode and extent in caller when io_uring read extent fails btrfs_uring_read_extent() runs only after btrfs_encoded_r… |
2026-10-23 |
| CVE-2026-98960 | — | Not scored | 0.2% | btrfs: don't stash io_uring encoded data across -EAGAIN In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash io_uring encoded data across -EAGAIN Returning -EAGAIN while leaving btrfs_uring_encoded_data in the cmd PDU le… |
2026-10-23 |
| CVE-2026-98959 | 9.8
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:HI:HA:H
|
0.2% | btrfs: fix xattr replace when multiple xattrs are packed in the same item In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xattrs are packed in the same item If we have a btrfs_dir_item item that packs multiple xat… |
2026-10-23 |
| CVE-2026-98958 | — | Not scored | 0.2% | wifi: mt76: account non-AQL frames per peer rather than per link In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: account non-AQL frames per peer rather than per link The driver increments wcid->non_aql_packets when a frame goes to … |
2026-10-23 |