{"items":[{"id":"CVE-2026-99270","published":"2026-11-03T12:32:09.364Z","updated":"2026-11-03T19:14:43.225Z","title":"tcp: Fix potential UAF in reqsk_timer_handler().","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99269","published":"2026-11-03T11:48:18.333Z","updated":"2026-11-03T19:14:42.052Z","title":"sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99268","published":"2026-11-03T11:48:17.911Z","updated":"2026-11-03T19:13:19.667Z","title":"io_uring: wake ring pollers for local task_work","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99267","published":"2026-11-03T11:48:17.478Z","updated":"2026-11-03T19:13:19.155Z","title":"io_uring/napi: make stale entries time out after 60s","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99266","published":"2026-11-03T11:48:17.035Z","updated":"2026-11-03T19:13:18.705Z","title":"io_uring/zcrx: fix buffer offsets in areas above 4GB","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99265","published":"2026-11-03T11:48:16.602Z","updated":"2026-11-03T19:13:18.221Z","title":"io_uring/openclose: keep the lock in io_pipe_fixed()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99264","published":"2026-11-03T11:48:16.173Z","updated":"2026-11-03T19:14:41.067Z","title":"io_uring/net: don't retry recv on uncommitted buffers","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99263","published":"2026-11-03T11:48:15.743Z","updated":"2026-11-03T19:13:17.237Z","title":"io_uring/poll: avoid retry wakeup loss when dropping ownership","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99262","published":"2026-11-03T11:48:15.294Z","updated":"2026-11-03T19:13:16.211Z","title":"io_uring/timeout: don't lose a cancel as io-wq arms a timeout","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99261","published":"2026-11-03T11:25:15.605Z","updated":"2026-11-03T19:13:15.613Z","title":"drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99260","published":"2026-11-03T11:25:15.299Z","updated":"2026-11-03T19:13:15.077Z","title":"ntfs: fix resident conversion in ntfs_new_attr_flags","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99259","published":"2026-11-03T11:25:14.989Z","updated":"2026-11-03T11:40:47.014Z","title":"soc/tegra: pmc: Fix uninitialised clock rate","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99258","published":"2026-11-03T11:25:14.680Z","updated":"2026-11-03T11:40:46.409Z","title":"x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99257","published":"2026-11-03T11:25:14.374Z","updated":"2026-11-03T11:40:45.753Z","title":"gpio: shared: gracefully handle no-device lookup of shared GPIOs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99256","published":"2026-11-03T11:25:14.077Z","updated":"2026-11-03T11:40:45.109Z","title":"dm cache: fix issue with background work locking","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99255","published":"2026-11-03T11:20:13.169Z","updated":"2026-11-03T19:13:14.626Z","title":"io_uring/io-wq: don't hide a link from cancellations","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99254","published":"2026-11-03T11:20:12.802Z","updated":"2026-11-03T19:13:13.959Z","title":"io_uring: don't flood a cancelling task with task_work","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99253","published":"2026-11-03T11:20:12.490Z","updated":"2026-11-03T19:13:12.605Z","title":"io_uring/cancel: rearm local work wake up before sleep","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99252","published":"2026-11-03T11:20:12.192Z","updated":"2026-11-03T19:13:11.345Z","title":"io_uring/mpscq: disable preemption while pushing","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99251","published":"2026-11-03T11:18:27.412Z","updated":"2026-11-03T11:18:27.412Z","title":"Drivers: hv: Avoid infinite retry loop in init_vp_index()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99250","published":"2026-11-03T11:18:27.105Z","updated":"2026-11-03T11:18:27.105Z","title":"printk: Postpone kthread startup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99249","published":"2026-11-03T11:18:26.800Z","updated":"2026-11-03T11:18:26.800Z","title":"pid_namespace: make zap_pid_ns_processes() freezable","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99248","published":"2026-11-03T11:18:26.478Z","updated":"2026-11-03T11:18:26.478Z","title":"i2c: xiic: restore non-managed runtime PM to fix clk WARN flood","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99247","published":"2026-11-03T11:18:26.163Z","updated":"2026-11-03T11:18:26.163Z","title":"tracing: Do not initialize tracefs work if tracing is disabled","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99246","published":"2026-11-03T11:18:25.838Z","updated":"2026-11-03T19:14:37.365Z","title":"tipc: protect node reset trace dump with node lock","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99245","published":"2026-11-03T11:15:15.050Z","updated":"2026-11-03T19:13:10.812Z","title":"KEYS: Fix key_reject_and_link() race with keyring restriction","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99244","published":"2026-11-03T11:15:14.715Z","updated":"2026-11-03T19:13:09.510Z","title":"pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99243","published":"2026-11-03T11:14:30.233Z","updated":"2026-11-03T19:13:08.710Z","title":"io-wq: order the exit bit against worker creation task work","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-99242","published":"2026-11-02T16:06:44.590Z","updated":"2026-11-02T16:06:44.590Z","title":"ntfs: fix race between fallocate and mmap reads","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-99241","published":"2026-11-02T16:06:44.163Z","updated":"2026-11-02T16:06:44.163Z","title":"ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-99240","published":"2026-11-02T16:06:43.703Z","updated":"2026-11-03T19:13:07.661Z","title":"mm/damon/core: error damos_commit_quota_goal() for zero target_value","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-99239","published":"2026-11-02T16:06:43.262Z","updated":"2026-11-03T19:13:06.554Z","title":"Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-99238","published":"2026-11-02T16:06:42.810Z","updated":"2026-11-03T19:13:05.949Z","title":"tracing: Hold trace_types_lock when updating modules in persistent instances","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-99237","published":"2026-11-02T16:06:42.386Z","updated":"2026-11-03T19:13:04.997Z","title":"tracing: Hold trace_types_lock when resetting last boot data from readers","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-99236","published":"2026-11-02T16:06:41.950Z","updated":"2026-11-03T19:13:04.332Z","title":"tracing: Reject incomplete event filter expressions","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-99235","published":"2026-11-02T16:06:41.510Z","updated":"2026-11-03T19:13:03.627Z","title":"tracing: Save the event file instead of the compatible histogram","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-99234","published":"2026-11-02T16:06:41.083Z","updated":"2026-11-03T19:13:02.797Z","title":"tracing: Unregister field variable histograms when the command fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-99233","published":"2026-11-02T16:06:40.643Z","updated":"2026-11-03T19:13:02.404Z","title":"tracing/histograms: Verify event_call identity when updating synth_event refcount","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-99232","published":"2026-11-02T16:06:39.212Z","updated":"2026-11-03T19:13:01.998Z","title":"tracing/syscalls: Use copy_from_user for the faultable syscall buffer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-99231","published":"2026-11-02T16:06:38.553Z","updated":"2026-11-03T19:13:01.604Z","title":"io_uring/waitid: own the request before clearing ->head","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2026-99230","published":"2026-11-02T16:06:37.984Z","updated":"2026-11-03T19:13:01.012Z","title":"io_uring/cmd: don't leave list poison in ->hash_node","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-99229","published":"2026-11-02T16:06:37.423Z","updated":"2026-11-03T19:13:00.548Z","title":"io_uring/wait: don't spin on a stuck overflow list","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-99228","published":"2026-11-02T16:06:36.680Z","updated":"2026-11-03T19:12:59.931Z","title":"io_uring/io-wq: don't lose the signal that ends work","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-99227","published":"2026-11-02T16:06:36.101Z","updated":"2026-11-03T19:12:59.440Z","title":"io_uring/waitid: prevent cancel reference wrap","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-99226","published":"2026-11-02T16:06:35.362Z","updated":"2026-11-03T19:12:58.803Z","title":"keys: Avoid the owner account dereference in named keyring lookup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-99225","published":"2026-11-02T16:06:34.759Z","updated":"2026-11-03T19:12:58.334Z","title":"keys: Check the authorization payload in process keyring searches","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-99224","published":"2026-11-02T16:06:34.014Z","updated":"2026-11-03T19:12:57.782Z","title":"keys: Protect the type name while describing a key","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-99223","published":"2026-11-02T16:06:33.408Z","updated":"2026-11-03T19:12:57.119Z","title":"keys: make keyring indexes independent of kernel addresses","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-99222","published":"2026-11-02T16:06:32.844Z","updated":"2026-11-03T19:12:56.503Z","title":"keys: Protect the read method check against type removal","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-99221","published":"2026-11-02T16:06:32.409Z","updated":"2026-11-03T19:12:55.574Z","title":"keys/trusted_keys: return immediately after TPM unseal failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-99220","published":"2026-11-02T16:06:31.966Z","updated":"2026-11-03T19:12:54.971Z","title":"asymmetric_keys: reject trust keys without IDs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2026-99219","published":"2026-11-02T16:06:31.529Z","updated":"2026-11-03T19:12:54.203Z","title":"ftrace: Initialize modname and offset in print_rec()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-99218","published":"2026-11-02T16:06:31.088Z","updated":"2026-11-03T19:12:53.426Z","title":"coredump: hold RCU while releasing parked threads","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-99216","published":"2026-10-28T10:36:09.383Z","updated":"2026-10-31T12:45:15.499Z","title":"Drivers: hv: Don't reset VMBus connection state on error/exit paths","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2026-99215","published":"2026-10-28T10:36:08.618Z","updated":"2026-10-28T10:36:08.618Z","title":"power: supply: core: prevent unregistering a power supply while a callback runs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-99214","published":"2026-10-28T10:36:07.867Z","updated":"2026-10-30T12:43:00.909Z","title":"drm/vc4: hdmi: Move packet RAM enable to PM runtime","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-99213","published":"2026-10-28T10:36:06.441Z","updated":"2026-10-31T12:45:10.380Z","title":"vsock: treat TCP_CLOSING as once-established","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-99212","published":"2026-10-28T10:36:05.612Z","updated":"2026-10-31T12:45:05.538Z","title":"net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2026-99211","published":"2026-10-28T10:36:04.864Z","updated":"2026-10-30T12:42:57.701Z","title":"netlink: reset skb headers before unicast and multicast filtering","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-99210","published":"2026-10-28T10:36:04.110Z","updated":"2026-10-28T10:36:04.110Z","title":"accel/rocket: clear rdev on device init failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-99209","published":"2026-10-28T10:36:03.274Z","updated":"2026-10-28T10:36:03.274Z","title":"drm/xe: skip eviction of a BO with no resource","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-99208","published":"2026-10-28T10:36:01.473Z","updated":"2026-10-28T10:36:01.473Z","title":"drm/xe/oa: Zero OA buffer at allocation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-99207","published":"2026-10-28T10:36:00.728Z","updated":"2026-10-28T10:36:00.728Z","title":"scsi: target: Disable interrupts while holding delayed_cmd_lock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-99206","published":"2026-10-28T10:35:59.851Z","updated":"2026-10-30T12:42:55.447Z","title":"scsi: target: iscsi: Fix race in discovery auth updates","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-99205","published":"2026-10-28T10:35:59.093Z","updated":"2026-10-28T10:35:59.093Z","title":"sched/core: Call wakeup_preempt() for queued tasks during class change","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-99204","published":"2026-10-28T10:35:58.336Z","updated":"2026-10-30T12:42:54.359Z","title":"ocfs2/dlm: Protect the recovery list during debugfs reads","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-99203","published":"2026-10-28T10:35:57.589Z","updated":"2026-10-31T12:45:00.735Z","title":"pipe: preserve existing fasync readers on writer setup failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-99202","published":"2026-10-28T10:35:56.827Z","updated":"2026-10-30T12:42:52.198Z","title":"scsi: libsas: Fix SMP IO deadlock during HA resume","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-99201","published":"2026-10-28T10:35:56.069Z","updated":"2026-10-30T12:42:51.128Z","title":"netlink: avoid hashing the network namespace pointer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-99200","published":"2026-10-28T10:35:55.323Z","updated":"2026-10-28T10:35:55.323Z","title":"net: hisilicon: hisi_femac: Move setting of netops to fix crash","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-99199","published":"2026-10-28T10:35:54.538Z","updated":"2026-10-28T10:35:54.538Z","title":"net: hisilicon: hip04_eth: Move setting of netops to fix crash","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-99198","published":"2026-10-28T10:35:53.740Z","updated":"2026-10-28T10:35:53.740Z","title":"net: ethernet: actions: Move setting of netops to fix crash","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99197","published":"2026-10-28T10:35:52.987Z","updated":"2026-10-28T10:35:52.987Z","title":"net: mv643xx: move setting of netops to fix crash","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-99196","published":"2026-10-28T10:35:52.223Z","updated":"2026-10-28T10:35:52.223Z","title":"net: au1000: move setting of netops to fix crash","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99195","published":"2026-10-28T10:35:51.485Z","updated":"2026-10-28T10:35:51.485Z","title":"net: ethoc: move setting of netops to fix crash","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-99194","published":"2026-10-28T10:35:50.670Z","updated":"2026-10-28T10:35:50.670Z","title":"net: ethernet: aeroflex: move setting of netops to fix crash","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-99193","published":"2026-10-28T10:35:49.441Z","updated":"2026-10-28T10:35:49.441Z","title":"net: ti: icssm-prueth: Move setting of netops to fix crash","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-99192","published":"2026-10-28T10:35:48.686Z","updated":"2026-10-30T12:42:50.060Z","title":"net: bcmgenet: unshare the skb before writing the control block","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-99191","published":"2026-10-28T10:35:47.854Z","updated":"2026-10-30T12:42:48.993Z","title":"calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-99190","published":"2026-10-28T10:35:47.107Z","updated":"2026-10-30T12:42:47.929Z","title":"gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99189","published":"2026-10-28T10:35:46.366Z","updated":"2026-10-28T10:35:46.366Z","title":"gpio: mxc: fix race between chained IRQ handler install and probe completion","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-99188","published":"2026-10-28T10:35:45.591Z","updated":"2026-10-28T10:35:45.591Z","title":"net: stmmac: dwmac1000: clear the RGMII status interrupt","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-99187","published":"2026-10-28T10:35:44.813Z","updated":"2026-10-30T12:42:46.871Z","title":"perf: Fix perf_pmu_migrate_context() leaving events behind","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-99186","published":"2026-10-28T10:35:44.049Z","updated":"2026-10-28T10:35:44.049Z","title":"x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-99185","published":"2026-10-28T10:35:43.282Z","updated":"2026-10-31T12:44:55.216Z","title":"firewire: core: fix race condition in split transaction handling","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-99184","published":"2026-10-28T10:35:42.469Z","updated":"2026-10-28T10:35:42.469Z","title":"accel/rocket: search every core slot when a core is removed","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-99183","published":"2026-10-28T10:35:36.754Z","updated":"2026-10-28T10:35:36.754Z","title":"accel/rocket: search every core slot when looking up a scheduler","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-99182","published":"2026-10-28T10:35:35.193Z","updated":"2026-10-30T12:42:45.813Z","title":"ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-99181","published":"2026-10-28T10:35:34.443Z","updated":"2026-10-30T12:42:44.732Z","title":"autofs: ignore notification errors from a replaced pipe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-99180","published":"2026-10-28T10:35:33.578Z","updated":"2026-10-31T12:44:50.381Z","title":"unicode: free the map after a grace period","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-99179","published":"2026-10-28T10:35:32.734Z","updated":"2026-10-30T12:42:42.438Z","title":"watch_queue: Fix note pool publication race in watch_queue_set_size()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-99178","published":"2026-10-28T10:35:31.961Z","updated":"2026-11-01T12:42:11.076Z","title":"x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-99177","published":"2026-10-28T10:35:31.315Z","updated":"2026-10-31T12:44:45.294Z","title":"KVM: SEV: Fix page dirtying in sev_gmem_post_populate()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-99176","published":"2026-10-28T10:35:30.615Z","updated":"2026-10-30T12:42:40.156Z","title":"KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-99175","published":"2026-10-28T10:35:29.760Z","updated":"2026-10-30T12:42:39.046Z","title":"fsnotify: prevent mark additions during connector teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99174","published":"2026-10-28T10:35:28.758Z","updated":"2026-10-30T12:42:37.969Z","title":"ext4: free the sbi after a grace period","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-99173","published":"2026-10-28T10:35:28.017Z","updated":"2026-10-31T12:44:40.199Z","title":"eventfs: Free the eventfs_inode after an rcu grace period too","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-99172","published":"2026-10-28T10:35:27.245Z","updated":"2026-10-28T10:35:27.245Z","title":"ipc: drop the mqueue mount with kern_unmount() on setup failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-99171","published":"2026-10-28T10:35:26.598Z","updated":"2026-10-30T12:42:35.809Z","title":"ntfs3: free the sbi after a grace period","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-99170","published":"2026-10-28T10:35:25.923Z","updated":"2026-10-31T12:44:35.158Z","title":"namespace: a mount that copy_tree() leaves out can't take over a lock","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-99169","published":"2026-10-28T10:35:20.170Z","updated":"2026-10-30T12:42:34.724Z","title":"futex: Fix mm reuse handling for FUT_OFF_MMSHARED","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-99168","published":"2026-10-28T10:35:19.539Z","updated":"2026-10-28T10:35:19.539Z","title":"mshv_vtl: Check per-CPU register page before mmap","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-99167","published":"2026-10-28T10:35:18.850Z","updated":"2026-10-31T12:44:30.175Z","title":"net/sched: fix use-after-free in __tcf_action_put()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-99166","published":"2026-10-28T10:35:18.050Z","updated":"2026-10-30T12:42:32.571Z","title":"net: rds: fix uninitialized trans dereference in CM event handler","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-99165","published":"2026-10-28T10:35:17.366Z","updated":"2026-10-30T12:42:30.300Z","title":"sctp: revalidate output stream after association connect wait","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-99164","published":"2026-10-28T10:35:16.694Z","updated":"2026-10-31T12:44:24.973Z","title":"spi: imx: fix slab corruption from undersized DMA bounce buffers","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-99163","published":"2026-10-28T10:35:15.577Z","updated":"2026-10-31T12:44:20.055Z","title":"tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-99162","published":"2026-10-28T10:35:14.755Z","updated":"2026-10-28T10:35:14.755Z","title":"gpio: shared: fix use-after-free bug when adding shared proxies","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-99161","published":"2026-10-28T10:35:13.970Z","updated":"2026-10-30T12:42:28.035Z","title":"i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-99160","published":"2026-10-28T10:35:13.341Z","updated":"2026-10-30T12:42:26.948Z","title":"ring-buffer: Do not show buffer_meta for CPUs without a buffer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-99159","published":"2026-10-28T10:35:12.520Z","updated":"2026-10-30T12:42:25.874Z","title":"ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-99158","published":"2026-10-28T10:35:11.848Z","updated":"2026-10-30T12:42:24.782Z","title":"ring-buffer: Fix false warning in ring_buffer_map_get_reader()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-99157","published":"2026-10-28T10:35:11.192Z","updated":"2026-10-30T12:42:23.683Z","title":"scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-99156","published":"2026-10-28T10:35:10.493Z","updated":"2026-10-31T12:44:14.895Z","title":"scsi: st: Fix use-after-free race between st_remove() and st_open()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-99155","published":"2026-10-28T10:35:09.733Z","updated":"2026-10-30T12:42:21.472Z","title":"scsi: xen/scsifront: Check for a NULL shadow entry on a backend response","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-99154","published":"2026-10-28T10:35:08.968Z","updated":"2026-10-31T12:44:09.854Z","title":"scsi: libiscsi: Reject a negative task index from parse_pdu_itt","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-99153","published":"2026-10-28T10:35:08.287Z","updated":"2026-10-31T12:44:04.972Z","title":"scsi: libiscsi: Validate the ITT reflected in a Reject PDU","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00552,"kevAdded":null},{"id":"CVE-2026-99152","published":"2026-10-28T10:35:07.622Z","updated":"2026-10-31T12:44:00.040Z","title":"scsi: libiscsi: Validate the task named by a management response","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00523,"kevAdded":null},{"id":"CVE-2026-99151","published":"2026-10-28T10:35:06.866Z","updated":"2026-10-28T10:35:06.866Z","title":"drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-99150","published":"2026-10-28T10:35:05.753Z","updated":"2026-10-30T12:42:17.152Z","title":"drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-99149","published":"2026-10-28T10:35:05.015Z","updated":"2026-10-28T10:35:05.015Z","title":"drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-99148","published":"2026-10-28T10:35:04.360Z","updated":"2026-10-31T12:43:54.856Z","title":"drm/amdgpu: keep the eviction fence until the last handle is closed","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-99147","published":"2026-10-28T10:35:03.580Z","updated":"2026-10-30T12:42:16.086Z","title":"drm/exec: don't immediately add prelocked obj to array of locked objs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-99146","published":"2026-10-28T10:35:02.847Z","updated":"2026-10-28T10:35:02.847Z","title":"drm/i915/dmc: Add sanity check for DMC load address","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-99145","published":"2026-10-28T10:35:02.038Z","updated":"2026-10-28T10:35:02.038Z","title":"drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-99144","published":"2026-10-28T10:35:00.602Z","updated":"2026-10-28T10:35:00.602Z","title":"sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-99143","published":"2026-10-28T10:34:54.527Z","updated":"2026-10-31T12:43:49.775Z","title":"tracing: Keep the predicate limit separate from program capacity","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-99142","published":"2026-10-28T10:34:53.839Z","updated":"2026-10-31T12:43:44.895Z","title":"tracing: Check operator stack capacity before pushing","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-99141","published":"2026-10-28T10:34:52.091Z","updated":"2026-10-28T10:34:52.091Z","title":"tracing: Fix crash in print_graph_function_event()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-99140","published":"2026-10-28T10:34:51.421Z","updated":"2026-10-30T12:42:12.896Z","title":"tracing: Fix hist trigger timestamps for buffered events","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-99139","published":"2026-10-28T10:34:50.674Z","updated":"2026-10-30T12:42:11.824Z","title":"tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-99138","published":"2026-10-28T10:34:49.993Z","updated":"2026-10-30T12:42:10.759Z","title":"tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99137","published":"2026-10-28T10:34:49.266Z","updated":"2026-10-28T10:34:49.266Z","title":"cifs: don't update i_size in cifs_do_truncate without a cached handle","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-99136","published":"2026-10-28T10:34:48.558Z","updated":"2026-10-31T12:43:39.281Z","title":"dm-crypt: fix a tiny race condition in crypt_dec_pending","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-99135","published":"2026-10-28T10:34:47.902Z","updated":"2026-10-30T12:42:08.647Z","title":"dm-integrity: fix infinite loop on discard with large tag size","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-99134","published":"2026-10-28T10:34:47.193Z","updated":"2026-10-30T12:42:07.557Z","title":"mac802154: fix data race and NULL deref on local->assoc_dev","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-99133","published":"2026-10-28T10:34:46.398Z","updated":"2026-10-30T12:42:06.467Z","title":"net/iucv: fix the recvmsg window update","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-99132","published":"2026-10-28T10:34:45.756Z","updated":"2026-10-30T12:42:05.352Z","title":"xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99131","published":"2026-10-28T10:34:45.102Z","updated":"2026-10-31T12:43:34.118Z","title":"xfs: fix capability check in xfs","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0045,"kevAdded":null},{"id":"CVE-2026-99130","published":"2026-10-28T10:34:43.514Z","updated":"2026-10-30T12:42:03.208Z","title":"io_uring/cancel: don't spin on local work the task can't run","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-99129","published":"2026-10-28T10:34:42.881Z","updated":"2026-10-28T10:34:42.881Z","title":"selinux: fix BPF token permission checks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-99128","published":"2026-10-28T10:34:42.229Z","updated":"2026-10-30T12:42:02.124Z","title":"sctp: validate chunk length in the inqueue parser","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-99127","published":"2026-10-28T10:34:41.448Z","updated":"2026-10-30T12:42:01.046Z","title":"page_pool: keep frag_offset aligned for odd-sized requests","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-99126","published":"2026-10-28T10:34:40.661Z","updated":"2026-10-30T12:41:59.971Z","title":"s390/ctcm: Prevent XID null dereference","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99125","published":"2026-10-28T10:34:40.025Z","updated":"2026-10-28T10:34:40.025Z","title":"s390/pai: Handle multiple PMU stop callback invocations","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-99124","published":"2026-10-28T10:34:39.370Z","updated":"2026-10-30T12:41:58.903Z","title":"s390/pci: Fix leak of uninitialized kernel data in SCLP report","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99123","published":"2026-10-28T10:34:38.600Z","updated":"2026-10-31T12:43:28.598Z","title":"vsock/virtio: validate packet source for connected sockets","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-99122","published":"2026-10-28T10:34:37.859Z","updated":"2026-10-31T12:43:23.512Z","title":"vsock/vmci: validate packet source for connected sockets","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-99121","published":"2026-10-28T10:34:37.082Z","updated":"2026-10-30T12:41:56.754Z","title":"ipv4: avoid divide by zero in fib_rebalance","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-99120","published":"2026-10-28T10:34:36.224Z","updated":"2026-10-28T10:34:36.224Z","title":"KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-99119","published":"2026-10-28T10:34:35.364Z","updated":"2026-10-28T10:34:35.364Z","title":"drm/amdgpu/userq: actually validate userq BOs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-99118","published":"2026-10-28T10:34:34.627Z","updated":"2026-10-30T12:41:55.667Z","title":"drm/i915/dmc: Harden DMC firmware payload parsing","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-99117","published":"2026-10-28T10:34:33.874Z","updated":"2026-10-31T12:43:18.238Z","title":"net: bridge: mcast: don't truncate the port group walk on teardown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-99116","published":"2026-10-28T10:34:33.109Z","updated":"2026-10-31T12:43:13.361Z","title":"net: psp: do not inherit the Rx association on clone","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-99115","published":"2026-10-28T10:34:32.347Z","updated":"2026-10-30T12:41:53.529Z","title":"ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-99114","published":"2026-10-28T10:34:31.576Z","updated":"2026-10-30T12:41:52.446Z","title":"ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-99113","published":"2026-10-28T10:34:30.767Z","updated":"2026-10-30T12:41:51.384Z","title":"ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-99112","published":"2026-10-28T10:34:29.881Z","updated":"2026-10-31T12:43:08.195Z","title":"net/sched: cls_flower: validate mask pointer after nla_next()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-99111","published":"2026-10-28T10:34:29.053Z","updated":"2026-10-28T10:34:29.053Z","title":"smb: client: fix data corruption with concurrent writes and O_TRUNC","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-99110","published":"2026-10-28T10:34:28.239Z","updated":"2026-10-31T12:43:03.377Z","title":"smb: client: fix heap overflow in cifs_do_set_acl()","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-99109","published":"2026-10-28T10:34:27.507Z","updated":"2026-10-31T12:42:58.137Z","title":"smb: client: reject SetEA requests that do not fit the request buffer","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-99108","published":"2026-10-28T10:34:26.772Z","updated":"2026-10-28T10:34:26.772Z","title":"ntfs: fix FITRIM range alignment","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-99107","published":"2026-10-28T10:34:26.017Z","updated":"2026-10-31T12:42:53.060Z","title":"ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-99106","published":"2026-10-28T10:34:25.279Z","updated":"2026-10-30T12:41:47.227Z","title":"drm/amdgpu: free the userptr ranges when a CS fails after parser_bos","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-99105","published":"2026-10-28T10:34:24.456Z","updated":"2026-10-30T12:41:46.163Z","title":"sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-99104","published":"2026-10-28T10:34:23.729Z","updated":"2026-10-28T10:34:23.729Z","title":"sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-99103","published":"2026-10-28T10:34:22.945Z","updated":"2026-10-30T12:41:45.076Z","title":"workqueue: Fix unbound pool lifetime for pending pwqs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-99102","published":"2026-10-28T10:34:17.224Z","updated":"2026-10-28T10:34:17.224Z","title":"ntfs: take invalidate_lock in ntfs_setattr_size()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-99101","published":"2026-10-28T10:34:16.583Z","updated":"2026-11-01T12:42:05.410Z","title":"ntfs: move attribute payload before shrinking its record","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-99100","published":"2026-10-28T03:55:38.898Z","updated":"2026-11-01T12:42:04.550Z","title":"wifi: p54: validate firmware record lengths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-99099","published":"2026-10-26T14:52:04.997Z","updated":"2026-10-31T12:42:48.094Z","title":"x86/CPU/AMD: Fix AMD TLBI Erratum #1718","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-99098","published":"2026-10-26T14:52:04.416Z","updated":"2026-10-26T14:52:04.416Z","title":"dm-integrity: fix buffer overflow in inline mode with large tag size","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-99097","published":"2026-10-26T14:52:03.824Z","updated":"2026-10-26T14:52:03.824Z","title":"tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-99096","published":"2026-10-26T14:52:03.236Z","updated":"2026-10-26T14:52:03.236Z","title":"io_uring/register: don't exempt disabled rings from task restrictions","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-99095","published":"2026-10-26T14:52:02.647Z","updated":"2026-10-30T12:41:42.869Z","title":"drm/vc4: drain the hangcheck timer and works on V3D unbind","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-99094","published":"2026-10-26T14:52:02.053Z","updated":"2026-10-31T12:42:42.980Z","title":"Bluetooth: btintel_pcie: fix TX descriptor bounds check","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2026-99093","published":"2026-10-26T14:52:01.450Z","updated":"2026-10-26T14:52:01.450Z","title":"mm: don't schedule deferred kernel page table freeing while booting","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-99092","published":"2026-10-26T14:52:00.860Z","updated":"2026-10-26T14:52:00.860Z","title":"riscv: patch: fix handling of bpf-jit execmem addresses","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-99091","published":"2026-10-26T14:52:00.262Z","updated":"2026-10-30T12:41:41.779Z","title":"Bluetooth: MGMT: Fix status of pending commands flushed on power off","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-99090","published":"2026-10-26T14:51:59.654Z","updated":"2026-10-27T15:53:00.938Z","title":"drm/amdgpu: serialize vblank counter reads against GPU reset","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-99089","published":"2026-10-26T14:51:59.055Z","updated":"2026-10-30T12:41:40.718Z","title":"ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-99088","published":"2026-10-26T14:51:58.460Z","updated":"2026-10-30T12:41:39.655Z","title":"net: openvswitch: validate transport header presence in set_ipv6_addr","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-99087","published":"2026-10-23T12:45:05.714Z","updated":"2026-10-23T12:45:05.714Z","title":"dm-integrity: fix NULL pointer dereference when the 'R' flag is used","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-99086","published":"2026-10-23T12:45:04.496Z","updated":"2026-10-23T12:45:04.496Z","title":"dm-integrity: validate the superblock on resume","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-99085","published":"2026-10-23T12:45:03.465Z","updated":"2026-10-23T12:45:03.465Z","title":"sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-99084","published":"2026-10-23T12:45:02.631Z","updated":"2026-10-23T12:45:02.631Z","title":"readdir: take no inode lock on an immutable directory","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-99083","published":"2026-10-23T12:45:01.735Z","updated":"2026-10-30T12:41:38.581Z","title":"ksmbd: fix heap out-of-bounds write in krb5_authenticate()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2026-99082","published":"2026-10-23T12:45:00.798Z","updated":"2026-10-30T12:41:37.510Z","title":"KVM: x86: Use active memslots for the per-vCPU MMIO cache","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-99081","published":"2026-10-23T12:23:28.347Z","updated":"2026-10-30T12:41:36.421Z","title":"bnxt_en: fix DMA mapping length for padded small packets","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00518,"kevAdded":null},{"id":"CVE-2026-99080","published":"2026-10-23T12:23:27.393Z","updated":"2026-10-30T12:41:35.342Z","title":"fs: Free any excess xarray nodes in clear_inode()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-99079","published":"2026-10-23T12:23:26.458Z","updated":"2026-10-24T14:10:21.247Z","title":"net/mlx5e: Prevent stale XSK buffer release on refill retry","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2026-99078","published":"2026-10-23T12:23:25.542Z","updated":"2026-10-24T14:10:20.145Z","title":"net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2026-99077","published":"2026-10-23T12:23:22.773Z","updated":"2026-10-30T12:41:34.248Z","title":"ipv4: udp: Create exceptions before socket matching","severity":"HIGH","score":7.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00431,"kevAdded":null},{"id":"CVE-2026-99076","published":"2026-10-23T12:23:19.727Z","updated":"2026-10-23T12:23:19.727Z","title":"ipv6: udp: Create exceptions before socket matching","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-99075","published":"2026-10-23T12:23:18.830Z","updated":"2026-10-23T12:23:18.830Z","title":"rust_binder: reschedule node refcount update on thread exit","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-99074","published":"2026-10-23T12:23:17.866Z","updated":"2026-10-30T12:41:33.126Z","title":"ipv4: stop PMTU walk when nexthop group shrinks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-99073","published":"2026-10-23T12:23:16.935Z","updated":"2026-10-23T12:23:16.935Z","title":"ipv4: stop exception dump when nexthop group shrinks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-99072","published":"2026-10-23T12:23:15.735Z","updated":"2026-10-30T12:41:31.995Z","title":"ipv4: stop route notification sizing when nexthop group shrinks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-99071","published":"2026-10-23T12:23:14.297Z","updated":"2026-10-30T12:41:30.940Z","title":"ipv4: do not warn on route notification size race","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-99070","published":"2026-10-23T12:23:13.342Z","updated":"2026-10-30T12:41:29.857Z","title":"ipv6: do not warn on route notification size race","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-99069","published":"2026-10-23T12:23:12.396Z","updated":"2026-10-23T12:23:12.396Z","title":"Input: ati_remote2 - fix type confusion in device attribute handlers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-99068","published":"2026-10-23T12:23:11.461Z","updated":"2026-10-23T12:23:11.461Z","title":"ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-99067","published":"2026-10-23T12:23:10.430Z","updated":"2026-10-30T12:41:28.799Z","title":"btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99066","published":"2026-10-23T12:23:09.516Z","updated":"2026-10-23T12:23:09.516Z","title":"can: dev: init_can_skb(): restore skb header initialization","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-99065","published":"2026-10-23T12:23:08.458Z","updated":"2026-10-23T12:23:08.458Z","title":"cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-99064","published":"2026-10-23T12:23:05.854Z","updated":"2026-10-24T14:10:17.979Z","title":"cipso: adjust cached option offsets when removing CIPSO","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00516,"kevAdded":null},{"id":"CVE-2026-99063","published":"2026-10-23T12:23:04.655Z","updated":"2026-10-30T12:41:27.735Z","title":"dm ioctl: don't let data_start run past the buffer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99062","published":"2026-10-23T12:23:03.360Z","updated":"2026-10-23T12:23:03.360Z","title":"vsock/virtio: account only unread bytes in read_skb()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-99061","published":"2026-10-23T12:22:59.770Z","updated":"2026-10-30T12:41:26.663Z","title":"wifi: brcmfmac: fix P2P device removal race in brcmf_detach()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99060","published":"2026-10-23T12:22:49.164Z","updated":"2026-10-23T12:22:49.164Z","title":"wifi: mt76: mt7603: initialize global station WCID","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-99059","published":"2026-10-23T12:22:47.559Z","updated":"2026-10-30T12:41:25.597Z","title":"wireguard: noise: reject response consumption after intermediate initiation","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00506,"kevAdded":null},{"id":"CVE-2026-99058","published":"2026-10-23T12:22:45.920Z","updated":"2026-10-30T12:41:24.511Z","title":"workqueue: Fix NULL current_pwq deref in chained work check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-99057","published":"2026-10-23T12:22:44.683Z","updated":"2026-10-30T12:41:23.425Z","title":"xen/netfront: don't leak the skb when xennet_fill_frags() fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-99056","published":"2026-10-23T12:22:42.234Z","updated":"2026-10-30T12:41:22.353Z","title":"strparser: make sure __strp_recv isn't running before tearing down the parser","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-99055","published":"2026-10-23T12:22:39.451Z","updated":"2026-10-23T12:22:39.451Z","title":"tcp: reject net_iov in zerocopy receive mapping hints","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-99054","published":"2026-10-23T12:22:36.886Z","updated":"2026-10-30T12:41:21.256Z","title":"tipc: destroy topsrv workqueues before closing connections","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-99053","published":"2026-10-23T12:22:35.462Z","updated":"2026-10-30T12:41:20.179Z","title":"tipc: hold a reference to nodes found by link name","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-99052","published":"2026-10-23T12:22:34.168Z","updated":"2026-10-30T12:41:19.103Z","title":"selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99051","published":"2026-10-23T12:22:30.370Z","updated":"2026-10-24T14:10:12.469Z","title":"fsverity: RCU-delay the freeing of struct fsverity_info","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2026-99050","published":"2026-10-23T12:22:29.204Z","updated":"2026-10-24T14:10:11.370Z","title":"gpio: mpsse: fix race when arming the IRQ poll worker","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-99049","published":"2026-10-23T12:22:26.409Z","updated":"2026-10-30T12:41:18.034Z","title":"gpio: xilinx: fix runtime PM leak on request error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-99048","published":"2026-10-23T12:22:13.825Z","updated":"2026-10-23T12:22:13.825Z","title":"gve: fix napi_disable deadlock when attempting to disable XSK pools","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-99047","published":"2026-10-23T12:22:12.104Z","updated":"2026-10-23T12:22:12.104Z","title":"gve: fix XSK buffer leak when rings are stopped","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-99046","published":"2026-10-23T12:22:10.460Z","updated":"2026-10-24T14:10:10.249Z","title":"gve: fix XSK buffer leak on error descriptor","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00527,"kevAdded":null},{"id":"CVE-2026-99045","published":"2026-10-23T12:22:09.352Z","updated":"2026-10-30T12:41:16.971Z","title":"ibmveth: h_free logical LAN on open-fail after register","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-99044","published":"2026-10-23T12:22:08.328Z","updated":"2026-10-23T12:22:08.328Z","title":"ice: fix use-after-free in dynamic port cleanup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-99043","published":"2026-10-23T12:22:07.372Z","updated":"2026-10-30T12:41:15.899Z","title":"ice: fix metadata_dst refcount handling on representor teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-99042","published":"2026-10-23T12:22:01.804Z","updated":"2026-10-24T14:10:09.161Z","title":"io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-99041","published":"2026-10-23T12:22:00.403Z","updated":"2026-10-30T12:41:14.790Z","title":"ip6_gre: remove obsolete ERSPAN PMTU update","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-99040","published":"2026-10-23T12:21:59.288Z","updated":"2026-10-30T12:41:13.694Z","title":"KEYS: Fix add_key() race with keyring restriction","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-99039","published":"2026-10-23T12:21:57.421Z","updated":"2026-10-30T12:41:12.630Z","title":"memstick: core: wait for request completion before freeing card","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99038","published":"2026-10-23T12:21:56.333Z","updated":"2026-10-30T12:41:11.555Z","title":"memstick: rtsx_usb_ms: complete requests after eject instead of dropping them","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99037","published":"2026-10-23T12:21:54.317Z","updated":"2026-10-30T12:41:10.478Z","title":"dm-crypt: reject the lmk IV mode with AEAD ciphers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99036","published":"2026-10-23T12:21:49.410Z","updated":"2026-10-30T12:41:09.415Z","title":"dm: fix reading free memory in do_resume","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-99035","published":"2026-10-23T12:21:44.522Z","updated":"2026-10-30T12:41:08.346Z","title":"mmc: mtk-sd: Cancel request timeout work on remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99034","published":"2026-10-23T12:21:41.941Z","updated":"2026-10-30T12:41:07.264Z","title":"mmc: sdhci-sprd: disable runtime PM on remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99033","published":"2026-10-23T12:21:37.662Z","updated":"2026-10-30T12:41:06.206Z","title":"net/packet: guard the ll header push in packet_rcv_spkt()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-99032","published":"2026-10-23T12:21:36.202Z","updated":"2026-10-30T12:41:05.122Z","title":"net/smc: protect clcsock lifetime in smc_getname","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-99031","published":"2026-10-23T12:21:31.535Z","updated":"2026-10-30T12:41:04.054Z","title":"net: bridge: avoid recursive multicast port cleanup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99030","published":"2026-10-23T12:21:23.271Z","updated":"2026-10-24T14:10:06.982Z","title":"net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2026-99029","published":"2026-10-23T12:21:21.898Z","updated":"2026-10-23T12:21:21.898Z","title":"net: sparx5: free the matchall entry on destroy","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-99028","published":"2026-10-23T12:21:20.294Z","updated":"2026-10-23T12:21:20.294Z","title":"net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-99027","published":"2026-10-23T12:21:14.896Z","updated":"2026-10-30T12:41:02.988Z","title":"net: team: stop reusing skb after queue override","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-99026","published":"2026-10-23T12:21:13.509Z","updated":"2026-10-23T12:21:13.509Z","title":"net: team: free skb when broadcast has no txable port","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-99025","published":"2026-10-23T12:21:12.410Z","updated":"2026-10-30T12:41:01.936Z","title":"openvswitch: fix soft lockup in the netlink flow dump","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99024","published":"2026-10-23T12:21:08.551Z","updated":"2026-10-30T12:41:00.882Z","title":"optee: register TEE devices only once fully initialized","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99023","published":"2026-10-23T12:21:06.818Z","updated":"2026-10-23T12:21:06.818Z","title":"power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-99022","published":"2026-10-23T12:21:03.138Z","updated":"2026-10-30T12:40:59.813Z","title":"regulator: ltc3676: don't read the write-only HRST and CLIRQ registers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99021","published":"2026-10-23T12:21:00.951Z","updated":"2026-10-23T12:21:00.951Z","title":"regulator: of: fill in supply names in of_regulator_bulk_get_all()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-99020","published":"2026-10-23T12:20:57.162Z","updated":"2026-10-23T12:20:57.162Z","title":"regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-99019","published":"2026-10-23T12:20:55.832Z","updated":"2026-10-30T12:40:58.753Z","title":"scsi: ch: Do not keep references to data transfer element devices","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-99018","published":"2026-10-23T12:20:54.888Z","updated":"2026-10-24T14:10:05.883Z","title":"riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-99017","published":"2026-10-23T12:20:53.518Z","updated":"2026-10-24T14:10:04.808Z","title":"riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-99016","published":"2026-10-23T12:20:47.859Z","updated":"2026-10-24T14:10:03.722Z","title":"riscv: futex: untag the user pointer before the atomic access","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-99015","published":"2026-10-23T12:20:41.608Z","updated":"2026-10-30T12:40:57.696Z","title":"Bluetooth: hci_sock: Serialize dead-device detachment","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99014","published":"2026-10-23T12:20:39.617Z","updated":"2026-10-24T14:10:02.640Z","title":"Bluetooth: hci_sync: Fix command skb lifetime during scan setup","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-99013","published":"2026-10-23T12:20:38.612Z","updated":"2026-10-24T14:10:01.562Z","title":"Bluetooth: ISO: Reject concurrent BIS listener setup","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-99012","published":"2026-10-23T12:20:37.472Z","updated":"2026-10-30T12:40:56.601Z","title":"Bluetooth: ISO: Serialize concurrent connect calls","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-99011","published":"2026-10-23T12:20:36.460Z","updated":"2026-10-24T14:09:59.382Z","title":"Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-99010","published":"2026-10-23T12:20:35.485Z","updated":"2026-10-30T12:40:55.508Z","title":"Bluetooth: RFCOMM: free the skb when the DLC has no owner","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99009","published":"2026-10-23T12:20:34.301Z","updated":"2026-10-30T12:40:54.430Z","title":"Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99008","published":"2026-10-23T12:20:33.355Z","updated":"2026-10-30T12:40:53.373Z","title":"Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99007","published":"2026-10-23T12:20:32.381Z","updated":"2026-10-30T12:40:51.342Z","title":"drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-99006","published":"2026-10-23T12:20:31.415Z","updated":"2026-10-30T12:40:50.256Z","title":"drm/i915/gem: Prevent overstepping exec array boundary","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-99005","published":"2026-10-23T12:20:30.462Z","updated":"2026-10-30T12:40:49.182Z","title":"drm/i915/gt: Unmask interrupts only when ACTIVE is true","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-99004","published":"2026-10-23T12:20:29.122Z","updated":"2026-10-23T12:20:29.122Z","title":"drm/imagination: Size page table preallocation by device address","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-99003","published":"2026-10-23T12:20:24.476Z","updated":"2026-10-23T12:20:24.476Z","title":"drm/panthor: validate userspace queue count against initialized firmware slot count","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-99002","published":"2026-10-23T12:20:22.763Z","updated":"2026-10-30T12:40:48.116Z","title":"drm/vmwgfx: validate pitch coming from userspace","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-99001","published":"2026-10-23T12:20:21.753Z","updated":"2026-10-23T12:20:21.753Z","title":"drm/xe/i2c: cancel the client work on remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-99000","published":"2026-10-23T12:20:20.753Z","updated":"2026-10-23T12:20:20.753Z","title":"drm/xe: Fix shrinker accounting double-subtraction on nested external pins","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98999","published":"2026-10-23T12:20:19.451Z","updated":"2026-10-24T14:09:56.167Z","title":"drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-98998","published":"2026-10-23T12:20:18.352Z","updated":"2026-10-23T12:20:18.352Z","title":"drm/bridge: th1520-dw-hdmi: Fix remove() callback","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-98997","published":"2026-10-23T12:20:16.267Z","updated":"2026-10-23T12:20:16.267Z","title":"drm/amdgpu/userq: only accept doorbell BOs as queue doorbell","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98996","published":"2026-10-23T12:20:15.188Z","updated":"2026-10-23T12:20:15.188Z","title":"fs: don't silently unmount busy mounts","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-98995","published":"2026-10-23T12:20:14.155Z","updated":"2026-10-24T14:09:55.095Z","title":"namespace: reset the old parent's ->overmount in mnt_change_mountpoint()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-98994","published":"2026-10-23T12:20:13.244Z","updated":"2026-10-23T12:20:13.244Z","title":"statmount: read the parent of an unmounted mount under mount_lock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-98993","published":"2026-10-23T12:20:12.266Z","updated":"2026-10-30T12:40:47.019Z","title":"namespace: don't inherit MNT_UMOUNT in clone_mnt()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98992","published":"2026-10-23T12:20:11.256Z","updated":"2026-10-30T12:40:45.913Z","title":"namespace: don't copy an unmounted mount tree","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98991","published":"2026-10-23T12:20:10.289Z","updated":"2026-10-24T14:09:52.901Z","title":"namespace: queue a mount only once for mount notifications","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-98990","published":"2026-10-23T12:20:09.349Z","updated":"2026-10-30T12:40:44.542Z","title":"namespace: check a submount for references right before unmounting it","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-98989","published":"2026-10-23T12:20:08.366Z","updated":"2026-10-23T12:20:08.366Z","title":"namespace: check a recursive bind mount for mount namespace loops","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-98988","published":"2026-10-23T12:20:07.483Z","updated":"2026-10-24T14:09:51.817Z","title":"namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-98987","published":"2026-10-23T12:20:06.180Z","updated":"2026-10-23T12:20:06.180Z","title":"namespace: look at the topmost mount for a mount namespace file","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98986","published":"2026-10-23T12:20:04.966Z","updated":"2026-10-23T12:20:04.966Z","title":"namespace: remove the fsnotify marks of a mount namespace in process context","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-98985","published":"2026-10-23T12:20:03.622Z","updated":"2026-10-30T12:40:43.386Z","title":"namespace: check the mounts before reading their parents in pivot_root()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98984","published":"2026-10-23T12:20:02.285Z","updated":"2026-10-30T12:40:42.302Z","title":"dcache: don't put a mountpoint on a dentry that's being removed","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98983","published":"2026-10-23T12:20:00.918Z","updated":"2026-10-23T12:20:00.918Z","title":"unshare: don't drop active namespace references that were never taken","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-98982","published":"2026-10-23T12:19:59.784Z","updated":"2026-10-24T14:09:50.745Z","title":"namespace: don't let a pseudo dentry become the root of a mount","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-98981","published":"2026-10-23T12:19:58.507Z","updated":"2026-10-30T12:40:41.226Z","title":"namespace: unhash a dentry before detaching the mounts on it","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-98980","published":"2026-10-23T12:19:53.838Z","updated":"2026-10-24T14:09:48.534Z","title":"namei: don't reveal overmounted entries in refwalk","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-98979","published":"2026-10-23T12:19:52.523Z","updated":"2026-10-30T12:40:40.137Z","title":"namespace: refuse an automount below a mount that is in no namespace","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98978","published":"2026-10-23T12:19:51.428Z","updated":"2026-10-24T14:09:47.444Z","title":"namespace: never expire a locked mount","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-98977","published":"2026-10-23T12:19:50.475Z","updated":"2026-10-30T12:40:39.052Z","title":"namespace: handle mount locking for automounts correctly","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-98976","published":"2026-10-23T12:19:49.363Z","updated":"2026-10-24T14:09:46.343Z","title":"namespace: keep the lock on a mount that a propagated copy is moved beneath","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2026-98975","published":"2026-10-23T12:19:48.379Z","updated":"2026-10-24T14:09:45.210Z","title":"xfs: stop exchanging reflink flags when exchanging mappings","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-98974","published":"2026-10-23T12:19:47.424Z","updated":"2026-10-24T14:09:44.115Z","title":"xfs: fix exchange-range-to-eof file size exchange","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-98973","published":"2026-10-23T12:19:46.458Z","updated":"2026-10-23T12:19:46.458Z","title":"drm/bridge: Fix unlocked list_del in drm_bridge_add()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-98972","published":"2026-10-23T12:19:45.458Z","updated":"2026-10-23T12:19:45.458Z","title":"cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-98971","published":"2026-10-23T12:19:44.536Z","updated":"2026-10-30T12:40:37.940Z","title":"gpio: exar: initialize the ID before registering its cleanup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98970","published":"2026-10-23T12:19:43.586Z","updated":"2026-10-30T12:40:36.828Z","title":"drm/vc4: Free the BO cache size list on teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98969","published":"2026-10-23T12:19:42.012Z","updated":"2026-10-30T12:40:35.763Z","title":"net/sched: em_text: reject unterminated algo before autoload","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98968","published":"2026-10-23T12:19:39.236Z","updated":"2026-10-30T12:40:34.695Z","title":"amt: send the relay's General Query directly from the receive path","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00532,"kevAdded":null},{"id":"CVE-2026-98967","published":"2026-10-23T12:19:37.625Z","updated":"2026-10-30T12:40:33.620Z","title":"cxgb4/ch_ktls: disable softirqs around tid_list erases","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-98966","published":"2026-10-23T12:19:36.024Z","updated":"2026-10-23T12:19:36.024Z","title":"bonding: fix the program leak when XDP is replaced","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-98965","published":"2026-10-23T12:19:34.754Z","updated":"2026-10-24T14:09:41.904Z","title":"ice: Restore Ordered MMIO Writes for Tx Doorbells","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00527,"kevAdded":null},{"id":"CVE-2026-98964","published":"2026-10-23T12:19:32.374Z","updated":"2026-10-30T12:40:32.519Z","title":"nvmet: use the local P2P device on metadata allocation failure","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00612,"kevAdded":null},{"id":"CVE-2026-98963","published":"2026-10-23T12:19:31.392Z","updated":"2026-10-23T12:19:31.392Z","title":"btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-98962","published":"2026-10-23T12:19:30.482Z","updated":"2026-10-23T12:19:30.482Z","title":"btrfs: free iov when btrfs_uring_read_extent() fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-98961","published":"2026-10-23T12:19:29.616Z","updated":"2026-10-23T12:19:29.616Z","title":"btrfs: unlock inode and extent in caller when io_uring read extent fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98960","published":"2026-10-23T12:19:28.651Z","updated":"2026-10-23T12:19:28.651Z","title":"btrfs: don't stash io_uring encoded data across -EAGAIN","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-98959","published":"2026-10-23T12:19:27.679Z","updated":"2026-10-24T14:09:39.735Z","title":"btrfs: fix xattr replace when multiple xattrs are packed in the same item","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00607,"kevAdded":null},{"id":"CVE-2026-98958","published":"2026-10-23T12:19:26.256Z","updated":"2026-10-23T12:19:26.256Z","title":"wifi: mt76: account non-AQL frames per peer rather than per link","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-98957","published":"2026-10-23T12:19:22.400Z","updated":"2026-10-23T12:19:22.400Z","title":"wifi: mt76: mt7915: disable rx napi when removing device","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98956","published":"2026-10-23T12:19:20.208Z","updated":"2026-10-30T12:40:31.416Z","title":"ASoC: adau1372: allow sleepy powerdown GPIOs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98955","published":"2026-10-23T12:19:15.287Z","updated":"2026-10-30T12:40:30.324Z","title":"flow_dissector: avoid u16 truncation of skb->len when computing thoff","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98954","published":"2026-10-23T12:19:13.873Z","updated":"2026-10-23T12:19:13.873Z","title":"net: always dissect GSO packets in __virtio_net_hdr_to_skb()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98953","published":"2026-10-23T12:19:13.015Z","updated":"2026-10-23T12:19:13.015Z","title":"devlink: fix devlink_rel reference leak when notify work is pending","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98952","published":"2026-10-23T12:19:12.127Z","updated":"2026-10-24T14:09:37.815Z","title":"pfcp: make sure the SEID is linear before reading it","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00377,"kevAdded":null},{"id":"CVE-2026-98951","published":"2026-10-23T12:19:10.747Z","updated":"2026-10-23T12:19:10.747Z","title":"riscv: ptrace: Zero-initialize regset buffers before copyin","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-98950","published":"2026-10-23T12:19:09.890Z","updated":"2026-10-30T12:40:29.247Z","title":"flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-98949","published":"2026-10-23T12:19:08.946Z","updated":"2026-10-23T12:19:08.946Z","title":"drm/imagination: Fix reference and vm_bo handling in remap()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98948","published":"2026-10-23T12:19:08.043Z","updated":"2026-10-23T12:19:08.043Z","title":"mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98947","published":"2026-10-23T12:19:06.146Z","updated":"2026-10-23T12:19:06.146Z","title":"vsock: Fix memory leak in vmci_transport_recv_dgram_cb()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98946","published":"2026-10-23T12:19:05.190Z","updated":"2026-10-23T12:19:05.190Z","title":"drm/vc4: Disable the V3D interrupt across runtime suspend","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-98945","published":"2026-10-23T12:19:04.191Z","updated":"2026-10-26T06:56:55.094Z","title":"HID: steam: Rearrange teardown sequence","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-98944","published":"2026-10-23T12:19:02.560Z","updated":"2026-10-30T12:40:28.138Z","title":"HID: steam: Refactor registration","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98942","published":"2026-10-23T12:12:14.180Z","updated":"2026-10-26T06:56:52.637Z","title":"sched_ext: Build the cid tables privately and publish them with RCU","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-98941","published":"2026-10-23T12:12:12.296Z","updated":"2026-10-24T14:09:34.434Z","title":"ext4: don't enable large folios on encrypted inodes","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-98940","published":"2026-10-23T12:12:08.487Z","updated":"2026-10-30T12:40:27.052Z","title":"ASoC: qcom: lpass-cpu: use DAI table index for playback constraints","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98939","published":"2026-10-23T12:12:06.180Z","updated":"2026-10-23T12:12:06.180Z","title":"x86/mm: Drop unnecessary PMD page copy when freeing","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98938","published":"2026-10-23T12:11:59.043Z","updated":"2026-10-23T12:11:59.043Z","title":"rust: irq: pass RegistrationInner as cookie to request_irq","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-98937","published":"2026-10-23T12:11:53.327Z","updated":"2026-10-26T06:56:51.396Z","title":"perf/core: Check kernel access when kernel callchains are requested","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98936","published":"2026-10-23T12:11:48.632Z","updated":"2026-10-30T12:40:25.994Z","title":"wifi: ath11k: reset ar->num_stations on hardware start","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98935","published":"2026-10-23T12:11:46.041Z","updated":"2026-10-30T12:40:24.910Z","title":"rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-98934","published":"2026-10-23T12:11:43.459Z","updated":"2026-10-30T12:40:23.809Z","title":"ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98933","published":"2026-10-23T12:11:39.531Z","updated":"2026-10-30T12:40:22.693Z","title":"usb: hub: use shorter 120ms post resume hold for SS root hubs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98932","published":"2026-10-23T12:11:35.940Z","updated":"2026-10-24T14:09:33.367Z","title":"EDAC/altera: Fix use-after-free in error paths","severity":"HIGH","score":7.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98931","published":"2026-10-23T12:11:34.935Z","updated":"2026-10-30T12:40:20.679Z","title":"mtd: spinand: fix NULL pointer dereference with no ECC engine","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98930","published":"2026-10-23T12:08:17.513Z","updated":"2026-10-23T12:08:17.513Z","title":"KVM: s390: Fix IRQ injection with SIGP Stop and Store Status","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-98929","published":"2026-10-23T12:08:11.551Z","updated":"2026-10-23T12:08:11.551Z","title":"macsec: initialize SecY before registering the netdevice","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-98928","published":"2026-10-23T12:08:09.412Z","updated":"2026-10-23T12:08:09.412Z","title":"KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98927","published":"2026-10-23T12:06:01.528Z","updated":"2026-10-24T14:09:32.255Z","title":"KVM: arm64: nv: Fix life cycle of the nested_mmus array","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-98926","published":"2026-10-23T12:05:54.511Z","updated":"2026-10-26T06:56:50.146Z","title":"drm/amd/display: Remove sink usage from DPMS","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-98925","published":"2026-10-23T12:05:53.207Z","updated":"2026-10-23T12:05:53.207Z","title":"bpf, sockmap: Fix self-redirect copied_seq double-counting","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-98924","published":"2026-10-23T12:03:50.230Z","updated":"2026-10-23T12:05:50.501Z","title":"fs: avoid repeated scans in evict_inodes()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-98923","published":"2026-10-23T12:03:28.027Z","updated":"2026-10-23T12:05:45.179Z","title":"arm64: io: Reject non-user protection in ioremap_prot()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98922","published":"2026-10-23T12:03:02.790Z","updated":"2026-10-23T12:05:38.754Z","title":"net: emac: move setting of netops to fix crash","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-98921","published":"2026-10-23T12:02:38.969Z","updated":"2026-10-23T12:05:33.583Z","title":"ovl: fix UAF in ovl_do_mkdir() debug print","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-98920","published":"2026-10-23T12:02:06.560Z","updated":"2026-10-23T12:05:25.919Z","title":"netfs: Fix missing alloc tagging of direct mempool allocations","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98919","published":"2026-10-23T12:01:55.092Z","updated":"2026-10-23T12:05:08.723Z","title":"drm/xe: harden adjust_idledly() against divide-by-zero and overflow","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-98918","published":"2026-10-23T12:01:50.803Z","updated":"2026-10-23T12:05:05.149Z","title":"mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-98917","published":"2026-10-23T12:01:46.420Z","updated":"2026-10-26T06:56:48.902Z","title":"parisc: Increase kernel stack size to 32kb","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-98916","published":"2026-10-23T11:55:20.958Z","updated":"2026-10-26T06:56:47.686Z","title":"wifi: nl80211: check link is beaconing for color change","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-98915","published":"2026-10-23T11:55:16.281Z","updated":"2026-10-26T06:56:46.442Z","title":"media: video-i2c: use vb2_video_unregister_device on driver removal","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-98914","published":"2026-10-23T11:55:10.630Z","updated":"2026-10-26T06:56:45.185Z","title":"drm/amdgpu: cap ATOM command table nesting depth","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-98913","published":"2026-10-23T11:55:08.297Z","updated":"2026-10-26T06:56:43.960Z","title":"net: thunderx: fix PTP device ref leak in nicvf_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-98912","published":"2026-10-23T11:55:04.908Z","updated":"2026-10-26T06:56:42.752Z","title":"ALSA: seq: oss: Reject reads that cannot fit the next event","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-98911","published":"2026-10-23T11:54:57.029Z","updated":"2026-10-26T06:56:41.537Z","title":"dpaa2-switch: fix the error path in dpaa2_switch_rx()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00318,"kevAdded":null},{"id":"CVE-2026-98910","published":"2026-10-23T11:54:50.520Z","updated":"2026-10-26T06:56:40.297Z","title":"drm/amdkfd: Unwind debug trap enable on copy_to_user failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-98909","published":"2026-10-23T11:54:47.326Z","updated":"2026-10-26T06:56:39.086Z","title":"net: cpsw_new: unregister devlink on port registration failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-98908","published":"2026-10-23T11:54:46.243Z","updated":"2026-10-26T06:56:37.786Z","title":"net: microchip: sparx5: clean up PSFP resources on flower setup failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-98907","published":"2026-10-23T11:54:44.224Z","updated":"2026-10-26T06:56:36.536Z","title":"btrfs: protect sb_write_pointer() with invalidate lock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-98906","published":"2026-10-23T11:54:42.697Z","updated":"2026-10-26T06:56:35.317Z","title":"net: lan966x: restore RX state on reload failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98905","published":"2026-10-23T11:54:40.083Z","updated":"2026-10-26T06:56:34.069Z","title":"drm/amdkfd: Properly acquire queue buffers in CRIU restore","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98904","published":"2026-10-23T11:54:16.943Z","updated":"2026-10-26T06:56:32.858Z","title":"mailbox: imx: Use devm_pm_runtime_enable()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98903","published":"2026-10-23T11:54:15.010Z","updated":"2026-10-26T06:56:31.630Z","title":"mailbox: imx: Add a channel shutdown field","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-98902","published":"2026-10-23T11:54:12.635Z","updated":"2026-10-26T06:56:30.416Z","title":"md/raid5: let stripe batch bm_seq comparison wrap-safe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-98901","published":"2026-10-23T11:54:11.554Z","updated":"2026-10-26T06:56:29.179Z","title":"ksmbd: fix lease break and ack state handling","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-98900","published":"2026-10-23T11:54:10.566Z","updated":"2026-10-26T06:56:27.943Z","title":"xen/gntalloc: validate grant count before allocation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-98899","published":"2026-10-23T11:54:09.249Z","updated":"2026-10-26T06:56:26.708Z","title":"netfilter: ipset: mark the rcu locked areas properly","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-98898","published":"2026-10-23T11:54:07.890Z","updated":"2026-10-26T06:56:25.439Z","title":"drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-98897","published":"2026-10-23T11:54:05.872Z","updated":"2026-10-26T06:56:24.210Z","title":"ksmbd: don't hold ci->m_lock while waiting for a lease break ack","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2026-98896","published":"2026-10-23T11:37:58.225Z","updated":"2026-10-26T06:56:22.985Z","title":"thunderbolt: Keep the domain reference while processing hotplug","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-98895","published":"2026-10-23T11:37:56.618Z","updated":"2026-10-26T06:56:21.757Z","title":"net/mlx5: HWS, Handle destroying table that has a miss table","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-98894","published":"2026-10-23T11:37:55.539Z","updated":"2026-10-26T06:56:20.527Z","title":"drm/amd/ras: reset CPER ring on corrupt entry size","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2026-98893","published":"2026-10-23T11:37:54.017Z","updated":"2026-10-26T06:56:19.302Z","title":"firmware: arm_scmi: Validate SENSOR_UPDATE payload size","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2026-98892","published":"2026-10-23T11:37:52.692Z","updated":"2026-10-26T06:56:18.073Z","title":"firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-98891","published":"2026-10-23T11:37:51.588Z","updated":"2026-10-26T06:56:16.835Z","title":"wifi: mac80211: validate deauth frame length before reason access","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-98890","published":"2026-10-23T11:37:50.495Z","updated":"2026-10-26T06:56:15.594Z","title":"wifi: libertas: reject short monitor TX frames","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-98889","published":"2026-10-23T11:37:49.469Z","updated":"2026-10-26T06:56:14.362Z","title":"wifi: iwlwifi: mvm: fix sched scan IE sizing","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-98888","published":"2026-10-23T11:37:46.984Z","updated":"2026-10-26T06:56:13.106Z","title":"arm64: kprobes: Allow reentering kprobes while single-stepping","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-98887","published":"2026-10-23T11:37:44.605Z","updated":"2026-10-26T06:56:11.864Z","title":"wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-98886","published":"2026-10-23T11:37:43.338Z","updated":"2026-10-26T06:56:10.643Z","title":"drm/gma500: return errors from Oaktrail HDMI I2C reads","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-98885","published":"2026-10-23T11:37:41.736Z","updated":"2026-10-26T06:56:09.404Z","title":"ima: return error early if file xattr cannot be changed","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-98884","published":"2026-10-23T11:37:39.893Z","updated":"2026-10-26T06:56:08.177Z","title":"mmc: core: Add validation for host-provided max_segs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-98883","published":"2026-10-23T11:37:38.372Z","updated":"2026-10-26T06:56:06.942Z","title":"serial: 8250_port: recognize UPIO_AU","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-98882","published":"2026-10-23T11:37:34.601Z","updated":"2026-10-26T06:56:05.724Z","title":"media: chips-media: wave5: Add range checks for dec_output_info","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-98881","published":"2026-10-23T11:37:32.327Z","updated":"2026-10-26T06:56:04.487Z","title":"net: bridge: remove stale rcu_barrier() in br_multicast_dev_del()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-98880","published":"2026-10-23T11:37:31.247Z","updated":"2026-10-26T06:56:03.260Z","title":"ntfs3: handle set_blocksize failures","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-98879","published":"2026-10-23T11:37:28.048Z","updated":"2026-10-26T06:56:02.033Z","title":"isofs: handle set_blocksize failures","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-98878","published":"2026-10-23T11:37:25.121Z","updated":"2026-10-26T06:56:00.811Z","title":"irqchip/gic-v5: Immediately exec priority drop following activate","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2026-98877","published":"2026-10-23T11:37:23.678Z","updated":"2026-10-26T06:55:59.697Z","title":"irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-98876","published":"2026-10-23T11:37:21.776Z","updated":"2026-10-26T06:55:58.587Z","title":"host1x: bus: Fix missing ops null check in error teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-98875","published":"2026-10-23T11:37:19.955Z","updated":"2026-10-26T06:55:57.445Z","title":"drm/nouveau/gsp: add SEC2 to GA100 chip table","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-98874","published":"2026-10-23T11:37:18.847Z","updated":"2026-10-26T06:55:56.228Z","title":"wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2026-98873","published":"2026-10-23T11:37:14.109Z","updated":"2026-10-26T06:55:54.978Z","title":"netfilter: nf_conntrack_expect: zero at allocation time","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-98872","published":"2026-10-23T11:37:11.214Z","updated":"2026-10-26T06:55:53.758Z","title":"freevxfs: don't BUG() on unknown typed-extent type","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-98871","published":"2026-10-23T11:37:09.369Z","updated":"2026-10-23T11:37:09.369Z","title":"crypto: ccp - Fix possible deadlock in SEV init failure path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98870","published":"2026-10-23T11:37:07.113Z","updated":"2026-10-24T14:09:26.805Z","title":"ksmbd: remove stale channels from all sessions on teardown","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00544,"kevAdded":null},{"id":"CVE-2023-7356","published":"2026-10-21T14:59:38.724Z","updated":"2026-10-26T06:55:41.493Z","title":"Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2026-98869","published":"2026-10-21T14:55:10.364Z","updated":"2026-10-24T14:09:25.680Z","title":"bpf: Infer zext_dst based on static register liveness analysis","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-98868","published":"2026-10-18T15:51:30.658Z","updated":"2026-10-19T09:27:02.926Z","title":"dm-pcache: reject a kset that overruns its segment","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-98867","published":"2026-10-18T15:51:29.499Z","updated":"2026-10-19T09:27:01.563Z","title":"dm-pcache: bound the logical key offset from persistent memory","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98866","published":"2026-10-18T15:51:27.883Z","updated":"2026-10-19T09:27:00.570Z","title":"sched/cache: Introduce task_struct->sched_cache_grp to fix UAF","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-98865","published":"2026-10-18T15:51:26.449Z","updated":"2026-10-19T09:26:59.604Z","title":"sched_ext: Don't run ops.dequeue() with a DSQ lock held","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-98864","published":"2026-10-18T15:51:25.532Z","updated":"2026-10-19T09:26:58.668Z","title":"sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-98863","published":"2026-10-18T15:51:24.446Z","updated":"2026-10-19T09:26:57.709Z","title":"KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-98862","published":"2026-10-18T15:51:23.224Z","updated":"2026-10-30T12:40:19.578Z","title":"audit: fix exe mark UAF in kill_rules()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-98861","published":"2026-10-18T15:51:22.271Z","updated":"2026-10-19T09:26:55.805Z","title":"fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-98860","published":"2026-10-18T15:51:21.403Z","updated":"2026-10-19T09:26:54.770Z","title":"HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-98859","published":"2026-10-18T15:51:20.456Z","updated":"2026-10-21T12:57:37.465Z","title":"HID: multitouch: stop the release timer from being rearmed on remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-98858","published":"2026-10-18T15:51:19.578Z","updated":"2026-10-19T09:26:52.852Z","title":"io_uring: fix task_work add use-after-free with SQPOLL","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-98857","published":"2026-10-18T15:51:17.262Z","updated":"2026-10-30T12:40:18.489Z","title":"ipvs: bound LBLCR and LBLC cache growth","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-98856","published":"2026-10-18T15:51:12.359Z","updated":"2026-10-30T12:40:17.396Z","title":"kprobes: Skip disarmed probes when checking optkprobe overlap","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98855","published":"2026-10-18T15:51:09.970Z","updated":"2026-10-30T12:40:16.306Z","title":"of/overlay: put property on deadprops only after changeset add succeeds","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-98854","published":"2026-10-18T15:51:06.167Z","updated":"2026-10-30T12:40:15.237Z","title":"of/overlay: only treat a positive changeset id as registered","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-98853","published":"2026-10-18T15:51:02.683Z","updated":"2026-10-30T12:40:14.136Z","title":"net: gso: limit recursive IP-in-IP segmentation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98852","published":"2026-10-18T15:50:55.946Z","updated":"2026-10-21T12:57:32.027Z","title":"net: extend IPv6 exthdr detection of tunneled packets","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-98851","published":"2026-10-18T15:50:50.910Z","updated":"2026-10-30T12:40:13.069Z","title":"netfilter: nft_flow_offload: drop flowtable reference on init error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-98850","published":"2026-10-18T15:50:50.062Z","updated":"2026-10-30T12:40:11.960Z","title":"net/packet: prevent TX_RING byte count overflow","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-98849","published":"2026-10-18T15:50:48.743Z","updated":"2026-10-19T09:26:41.559Z","title":"pfcp: fix socket lifetime on netdevice registration failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98848","published":"2026-10-18T15:50:47.105Z","updated":"2026-10-21T12:57:28.688Z","title":"rtc: ac100: Assign .num before accessing .hws","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-98847","published":"2026-10-18T15:50:40.825Z","updated":"2026-10-30T12:40:10.886Z","title":"rtc: spear: initialize IRQ state before requesting alarm IRQ","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-98846","published":"2026-10-18T15:50:34.714Z","updated":"2026-10-30T12:40:09.817Z","title":"sctp: check RCV_SHUTDOWN after the sendmsg connect wait","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-98845","published":"2026-10-18T15:50:27.596Z","updated":"2026-10-19T09:26:37.375Z","title":"tpm: Disable TPM on null key name mismatch","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-98844","published":"2026-10-18T15:50:25.256Z","updated":"2026-10-19T09:26:36.394Z","title":"netfs: clear post-EOF pagecache when extending a file via write","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-98843","published":"2026-10-18T15:50:23.578Z","updated":"2026-10-19T09:26:35.419Z","title":"netfs: zero gaps in read-gaps folio to avoid writing back stale data","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98842","published":"2026-10-18T15:50:19.217Z","updated":"2026-10-19T09:26:34.441Z","title":"module: fix lost error code from codetag_load_module()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98841","published":"2026-10-18T15:50:15.224Z","updated":"2026-10-19T09:26:33.492Z","title":"virt: vmgenid: set driver_data before registering notification handlers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98840","published":"2026-10-18T15:50:14.029Z","updated":"2026-10-30T12:40:08.759Z","title":"vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98839","published":"2026-10-18T15:50:11.869Z","updated":"2026-10-19T09:26:31.558Z","title":"vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98838","published":"2026-10-18T15:50:07.004Z","updated":"2026-10-30T12:40:07.684Z","title":"vt: skip screen update for DEC alignment test on backgroup consoles","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98837","published":"2026-10-18T15:50:05.338Z","updated":"2026-10-30T12:40:06.606Z","title":"ALSA: caiaq: unregister the input device when probe fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-98836","published":"2026-10-18T15:49:51.823Z","updated":"2026-10-30T12:40:05.522Z","title":"ALSA: line6: reject oversized playback packets","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98835","published":"2026-10-18T15:49:48.676Z","updated":"2026-10-21T12:57:20.938Z","title":"iio: accel: kionix-kx022a: Fix array boundary check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98834","published":"2026-10-18T15:49:46.003Z","updated":"2026-10-19T09:26:26.676Z","title":"mtd: core: avoid double-free of OTP NVMEM device","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98833","published":"2026-10-18T15:49:42.181Z","updated":"2026-10-30T12:40:04.468Z","title":"mtd: core: call _get_device() with the master MTD","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98832","published":"2026-10-18T15:49:36.925Z","updated":"2026-10-19T09:26:24.782Z","title":"blk-cgroup: save IRQ state in blkg_tryget_closest()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98831","published":"2026-10-18T15:49:32.909Z","updated":"2026-10-30T12:40:03.420Z","title":"of/overlay: don't leak fragment references when changeset init fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98830","published":"2026-10-18T15:49:31.843Z","updated":"2026-10-30T12:40:02.347Z","title":"wifi: wfx: validate MIB read length before copying to caller","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-98829","published":"2026-10-18T15:49:29.426Z","updated":"2026-10-19T09:26:21.901Z","title":"wifi: mac80211: drop oversized fragments to avoid extra_len overflow","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98828","published":"2026-10-18T15:49:22.580Z","updated":"2026-10-19T09:26:20.947Z","title":"wifi: ath9k: reject short WMI command responses","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98827","published":"2026-10-18T15:49:20.872Z","updated":"2026-10-19T09:26:19.987Z","title":"wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98826","published":"2026-10-18T15:49:19.709Z","updated":"2026-10-19T09:26:19.030Z","title":"rtc: ac100: Fix clock provider use-after-free on probe failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98825","published":"2026-10-18T15:49:17.605Z","updated":"2026-10-30T12:40:01.280Z","title":"rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-98824","published":"2026-10-18T15:49:16.650Z","updated":"2026-10-19T09:26:17.090Z","title":"wifi: mac80211: validate TX status rate metadata","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-98823","published":"2026-10-18T15:49:15.473Z","updated":"2026-10-30T12:40:00.224Z","title":"wifi: cfg80211: preserve hidden-group beacon IE ownership","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-98822","published":"2026-10-18T15:49:14.593Z","updated":"2026-10-21T12:57:13.743Z","title":"wifi: mac80211: prevent AP VLAN tx from other interfaces","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-98821","published":"2026-10-18T15:49:13.154Z","updated":"2026-10-19T09:26:14.186Z","title":"block: reject polled dio with user integrity metadata","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98820","published":"2026-10-18T15:49:12.251Z","updated":"2026-10-19T09:26:13.210Z","title":"blk-mq: set RQF_USE_SCHED when the operation is known","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98819","published":"2026-10-18T15:49:11.226Z","updated":"2026-10-30T12:39:59.162Z","title":"Bluetooth: btintel: validate DDC record lengths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-98818","published":"2026-10-18T15:49:10.258Z","updated":"2026-10-19T09:26:11.267Z","title":"mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-98817","published":"2026-10-18T15:49:07.163Z","updated":"2026-10-19T09:26:10.318Z","title":"ASoC: SDCA: Add better pm_runtime error handling in func probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-98816","published":"2026-10-18T15:49:05.616Z","updated":"2026-10-19T09:26:09.337Z","title":"bpf: Fix overflow of jump offset in constant blinding","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-98815","published":"2026-10-18T15:49:03.248Z","updated":"2026-10-26T06:55:52.556Z","title":"nvme: fix cdev lifetime","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98814","published":"2026-10-18T15:49:01.538Z","updated":"2026-10-19T09:26:07.427Z","title":"nvme: fix command effects log lifetime for multipath heads","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-98813","published":"2026-10-18T15:48:59.745Z","updated":"2026-10-19T09:26:06.490Z","title":"bpf: Hold map BTF for the memory allocator destructor record","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98812","published":"2026-10-18T15:48:58.470Z","updated":"2026-10-30T12:39:58.094Z","title":"net/mctp: publish the mctp_dev only after it is initialised","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-98811","published":"2026-10-18T15:48:57.588Z","updated":"2026-10-30T12:39:57.018Z","title":"net/sched: cls_api: reclaim an empty proto on the error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98810","published":"2026-10-18T15:48:56.733Z","updated":"2026-10-19T09:26:03.626Z","title":"wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-98809","published":"2026-10-18T15:48:55.913Z","updated":"2026-10-30T12:39:55.898Z","title":"Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98808","published":"2026-10-18T15:48:55.053Z","updated":"2026-10-21T12:57:08.174Z","title":"net: systemport: Fix buffer overflow in bcm_sysport_get_stats()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2026-98807","published":"2026-10-18T15:48:53.992Z","updated":"2026-10-19T09:26:00.670Z","title":"net/mlx5: Fix slab-out-of-bounds when handling team device events","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-98806","published":"2026-10-18T15:48:52.707Z","updated":"2026-10-19T09:25:59.674Z","title":"octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-98805","published":"2026-10-18T15:48:51.902Z","updated":"2026-10-30T12:39:54.828Z","title":"tipc: prevent GCM nonce reuse on peer key changes","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-98804","published":"2026-10-18T15:48:51.062Z","updated":"2026-10-19T09:25:57.688Z","title":"net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98803","published":"2026-10-18T15:48:50.108Z","updated":"2026-10-19T09:25:56.634Z","title":"net: stmmac: fix rx Scatter-Gather support","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98802","published":"2026-10-18T15:48:49.192Z","updated":"2026-10-19T09:25:55.677Z","title":"seg6: ensure packet data is writable before modifying SRH and IPv6 DA","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98801","published":"2026-10-18T15:48:47.171Z","updated":"2026-10-19T09:25:54.691Z","title":"net: restrict SO_RESERVE_MEM to TCP sockets and cap max value","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98800","published":"2026-10-18T15:48:46.223Z","updated":"2026-10-19T09:25:53.724Z","title":"bpf: Wait for an RCU tasks grace period before freeing trampoline progs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98799","published":"2026-10-18T15:48:44.434Z","updated":"2026-10-19T09:25:51.855Z","title":"bpf: Skip detached progs in trampoline images that are still in use","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98798","published":"2026-10-18T15:48:43.367Z","updated":"2026-10-30T12:39:53.751Z","title":"net: bcmgenet: fix NULL dereference in set_coalesce before first open","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98797","published":"2026-10-18T15:48:41.613Z","updated":"2026-10-19T09:25:49.920Z","title":"net: cap skb->queue_mapping when the tx queue is picked","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-98796","published":"2026-10-18T15:48:40.684Z","updated":"2026-10-21T12:57:04.919Z","title":"net: ethernet: mtk_eth_soc: allocate dummy netdev sooner","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98795","published":"2026-10-18T15:48:39.633Z","updated":"2026-10-19T09:25:48.008Z","title":"net: sparx5: skip ptp deinit if init was skipped","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98794","published":"2026-10-18T15:48:37.924Z","updated":"2026-10-30T12:39:52.699Z","title":"ipvs: filter some flags received in the backup server","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-98793","published":"2026-10-18T15:48:33.555Z","updated":"2026-10-30T12:39:51.633Z","title":"netfilter: bpf: reject invalid NAT manipulation types","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98792","published":"2026-10-18T15:48:31.098Z","updated":"2026-10-21T12:57:01.669Z","title":"netfilter: flowtable: generalize pending status bit","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98791","published":"2026-10-18T15:48:30.080Z","updated":"2026-10-19T09:25:44.148Z","title":"net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98790","published":"2026-10-18T15:48:27.412Z","updated":"2026-10-30T12:39:50.548Z","title":"perf: Fix race between perf_event_exit_task() and perf_pending_task()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98789","published":"2026-10-18T15:48:25.665Z","updated":"2026-10-19T09:25:42.177Z","title":"bpf: Fix objects stuck in free_by_rcu_ttrace","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98788","published":"2026-10-18T15:48:24.833Z","updated":"2026-10-19T09:25:41.209Z","title":"futex: Fix private hash use-after-free on resize","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98787","published":"2026-10-18T15:48:23.947Z","updated":"2026-10-19T09:25:40.244Z","title":"bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98786","published":"2026-10-18T15:48:22.989Z","updated":"2026-10-19T09:25:39.296Z","title":"drm/amd/display: guard dc_sink dereferences in MST mode validation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98785","published":"2026-10-18T15:48:22.111Z","updated":"2026-10-30T12:39:49.489Z","title":"drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-98784","published":"2026-10-18T15:48:21.282Z","updated":"2026-10-30T12:39:48.411Z","title":"drm/amdgpu/gfx6: fix firmware leak on teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98783","published":"2026-10-18T15:48:20.377Z","updated":"2026-10-21T12:56:57.231Z","title":"drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98782","published":"2026-10-18T15:48:19.567Z","updated":"2026-10-21T12:56:56.157Z","title":"drm/mediatek: Fix ovl adaptor platform device leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98781","published":"2026-10-18T15:48:18.590Z","updated":"2026-10-21T12:56:55.059Z","title":"drm/mediatek: Fix pdev reference leak in mtk_drm_bind()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98780","published":"2026-10-18T15:48:17.804Z","updated":"2026-10-30T12:39:47.351Z","title":"drm/amdgpu: fix IP instance memory leak on kobject add failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-98779","published":"2026-10-18T15:48:16.729Z","updated":"2026-10-30T12:39:46.267Z","title":"drm/amdgpu: fix ACP MFD device leak on init failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98778","published":"2026-10-18T15:48:15.254Z","updated":"2026-10-30T12:39:45.207Z","title":"binder: fix is_failure flag for superseded transaction cleanup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98777","published":"2026-10-18T15:48:13.993Z","updated":"2026-10-30T12:39:44.001Z","title":"binder: fix leaked fd fixups on TF_UPDATE_TXN supersede","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98776","published":"2026-10-18T15:48:12.661Z","updated":"2026-10-19T09:25:29.605Z","title":"binderfs: fix UAF write in binder_add_device","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98775","published":"2026-10-18T15:48:11.317Z","updated":"2026-10-30T12:39:42.932Z","title":"nitro_enclaves: fix use-after-free on SLOT_ALLOC failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98774","published":"2026-10-18T15:48:09.884Z","updated":"2026-10-19T09:25:27.235Z","title":"rust_binder: cancel deferred work items in thread exit","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98773","published":"2026-10-18T15:48:09.093Z","updated":"2026-10-30T12:39:41.890Z","title":"USB: cdc-acm: skip URB restart in port_shutdown if disconnected","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98772","published":"2026-10-18T15:48:08.184Z","updated":"2026-10-30T12:39:40.826Z","title":"USB: serial: fix port tear down use-after-free","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98771","published":"2026-10-18T15:48:07.367Z","updated":"2026-10-30T12:39:39.761Z","title":"usb: storage: sierra_ms: reject short SWoC info transfers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98770","published":"2026-10-18T15:48:06.586Z","updated":"2026-10-21T12:56:45.210Z","title":"usb: gadget: midi2: Fix the jack descriptor array sizes","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98769","published":"2026-10-18T15:48:04.800Z","updated":"2026-10-30T12:39:38.690Z","title":"usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98768","published":"2026-10-18T15:48:03.089Z","updated":"2026-10-30T12:39:37.620Z","title":"usb: typec: anx7411 - stop the IRQ before destroying the workqueue","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98767","published":"2026-10-18T15:48:02.089Z","updated":"2026-10-30T12:39:36.527Z","title":"usb: dwc3: gadget: fix IRQ storm on invalid event buffer count","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98766","published":"2026-10-18T15:47:59.061Z","updated":"2026-10-30T12:39:35.461Z","title":"usb: gadget: aspeed-vhub: cancel wake work on device removal","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98765","published":"2026-10-18T15:47:57.358Z","updated":"2026-10-30T12:39:34.382Z","title":"USB: gadget: dummy-hcd: Fix wait for outstanding request completions","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98764","published":"2026-10-18T15:47:56.225Z","updated":"2026-10-30T12:39:33.311Z","title":"usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98763","published":"2026-10-18T15:47:54.526Z","updated":"2026-10-30T12:39:32.238Z","title":"usb: core: clear both ep_in and ep_out for non-ep0 control endpoints","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98762","published":"2026-10-18T15:47:53.656Z","updated":"2026-10-30T12:39:31.169Z","title":"USB: dwc2: shut down wakeup timer before freeing HCD state","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98761","published":"2026-10-18T15:47:51.757Z","updated":"2026-10-30T12:39:30.112Z","title":"usb: typec: tcpm: recover after failure to start the frs ams","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98760","published":"2026-10-18T15:47:50.759Z","updated":"2026-10-30T12:39:29.050Z","title":"usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98759","published":"2026-10-18T15:47:47.988Z","updated":"2026-10-19T09:25:12.754Z","title":"usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98758","published":"2026-10-18T15:47:46.209Z","updated":"2026-10-19T09:25:11.783Z","title":"usb: typec: ucsi: glink: fix use-after-free of ucsi on remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98757","published":"2026-10-18T15:47:44.486Z","updated":"2026-10-30T12:39:27.986Z","title":"usb: cdns3: fix use-after-free in cdns3_gadget_exit()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98756","published":"2026-10-18T15:47:42.085Z","updated":"2026-10-30T12:39:26.925Z","title":"usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98755","published":"2026-10-18T15:47:41.106Z","updated":"2026-10-30T12:39:25.859Z","title":"tty: vcc: zero-initialize control packet in vcc_send_ctl()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98754","published":"2026-10-18T15:47:40.255Z","updated":"2026-10-30T12:39:24.788Z","title":"tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98753","published":"2026-10-18T15:47:37.700Z","updated":"2026-10-30T12:39:23.712Z","title":"tty: tty_port: restore TTY_IO_ERROR on activation failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98752","published":"2026-10-18T15:47:36.877Z","updated":"2026-10-30T12:39:22.635Z","title":"tty: port: fix tty_port_tty_vhangup() race","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98751","published":"2026-10-18T15:47:36.026Z","updated":"2026-10-30T12:39:21.567Z","title":"tty: abort break signalling on hangup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98750","published":"2026-10-18T15:47:35.167Z","updated":"2026-10-30T12:39:20.512Z","title":"tty: fix saved termios reset race","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98749","published":"2026-10-18T15:47:34.347Z","updated":"2026-10-30T12:39:19.454Z","title":"tty: serial: max3100: shut down timer before freeing port","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-98748","published":"2026-10-18T15:47:33.446Z","updated":"2026-10-30T12:39:18.369Z","title":"serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98747","published":"2026-10-18T15:47:32.607Z","updated":"2026-10-19T09:24:59.721Z","title":"serial: core: fix NULL pointer dereference in serial_core_unregister_port()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98746","published":"2026-10-18T15:47:31.780Z","updated":"2026-10-21T12:56:22.318Z","title":"serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98745","published":"2026-10-18T15:47:30.967Z","updated":"2026-10-30T12:39:17.288Z","title":"arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98744","published":"2026-10-18T15:47:29.706Z","updated":"2026-10-21T12:56:20.042Z","title":"ASoC: codecs: max98363: fix uninitialized stream_config->type","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98743","published":"2026-10-18T15:47:28.831Z","updated":"2026-10-21T12:56:18.942Z","title":"ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98742","published":"2026-10-18T15:47:27.137Z","updated":"2026-10-30T12:39:16.216Z","title":"ALSA: seq: Serialize compat port-info ioctls","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98741","published":"2026-10-18T15:47:26.283Z","updated":"2026-10-30T12:39:15.151Z","title":"ALSA: ua101: reject mismatched capture/playback packet sizes","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98740","published":"2026-10-18T15:47:24.602Z","updated":"2026-10-19T09:24:50.943Z","title":"EDAC/altera: Drop __init from ECC setup paths for re-probe safety","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-98739","published":"2026-10-18T15:47:23.653Z","updated":"2026-10-30T12:39:14.099Z","title":"Bluetooth: RFCOMM: Fix initial port reference race","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98738","published":"2026-10-18T15:47:21.503Z","updated":"2026-10-21T12:56:14.531Z","title":"Bluetooth: Serialize SMP remote OOB data access","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98737","published":"2026-10-18T15:47:14.936Z","updated":"2026-10-21T12:56:13.421Z","title":"Bluetooth: hci_sync: Fix inquiry cache use-after-free","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98736","published":"2026-10-18T15:47:14.076Z","updated":"2026-10-30T12:39:13.042Z","title":"Bluetooth: hci_conn: Lock parent access during enhanced SCO setup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98735","published":"2026-10-18T15:47:13.062Z","updated":"2026-10-30T12:39:11.976Z","title":"Bluetooth: hci_core: Serialize ACL scheduling with channel deletion","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98734","published":"2026-10-18T15:47:12.203Z","updated":"2026-10-21T12:56:10.088Z","title":"Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98733","published":"2026-10-18T15:47:11.210Z","updated":"2026-10-30T12:39:09.881Z","title":"Bluetooth: hci_core: Serialize fragmented ISO packet queueing","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98732","published":"2026-10-18T15:47:10.364Z","updated":"2026-10-30T12:39:08.820Z","title":"Bluetooth: btintel: fix buffer over-read in btintel_hw_error()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98731","published":"2026-10-18T15:47:08.399Z","updated":"2026-10-19T09:24:41.766Z","title":"Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-98730","published":"2026-10-18T15:47:07.600Z","updated":"2026-10-19T09:24:40.788Z","title":"Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98729","published":"2026-10-18T15:47:06.633Z","updated":"2026-10-19T09:24:39.819Z","title":"x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98728","published":"2026-10-18T15:47:05.722Z","updated":"2026-10-19T09:24:38.853Z","title":"tpm: fix off-by-four bounds check in tpm2_get_random()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98727","published":"2026-10-18T15:47:04.645Z","updated":"2026-10-19T09:24:37.897Z","title":"nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98726","published":"2026-10-18T15:47:03.665Z","updated":"2026-10-30T12:39:07.738Z","title":"nvme-multipath: fix underflow in ANA log bounds checks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-98725","published":"2026-10-18T15:47:02.735Z","updated":"2026-10-30T12:39:06.682Z","title":"nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-98724","published":"2026-10-18T15:47:01.614Z","updated":"2026-10-19T09:24:34.979Z","title":"nvmet: pci-epf: reject too-short SGL segments","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98723","published":"2026-10-18T15:46:59.444Z","updated":"2026-10-19T09:24:33.989Z","title":"nvmet: copy the hostid into the ctrl before creating PR pc_refs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98722","published":"2026-10-18T15:46:58.093Z","updated":"2026-10-30T12:39:05.611Z","title":"mtd: block2mtd: Fix divide error when erase_size is zero","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98721","published":"2026-10-18T15:46:56.857Z","updated":"2026-10-30T12:39:04.545Z","title":"mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-98720","published":"2026-10-18T15:46:55.863Z","updated":"2026-10-19T09:24:31.090Z","title":"KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98719","published":"2026-10-18T15:46:54.631Z","updated":"2026-10-19T09:24:30.132Z","title":"KVM: SEV: Nullify \"have run CPUs\" mask pointer when freeing it","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98718","published":"2026-10-18T15:46:53.611Z","updated":"2026-10-19T09:24:29.156Z","title":"KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98717","published":"2026-10-18T15:46:51.862Z","updated":"2026-10-21T12:56:02.536Z","title":"KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98716","published":"2026-10-18T15:46:49.960Z","updated":"2026-10-30T12:39:03.485Z","title":"KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98715","published":"2026-10-18T15:46:47.988Z","updated":"2026-10-19T09:24:26.247Z","title":"KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-98714","published":"2026-10-18T15:46:47.176Z","updated":"2026-10-26T06:55:47.638Z","title":"KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98713","published":"2026-10-18T15:46:45.902Z","updated":"2026-10-19T09:24:24.367Z","title":"KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98712","published":"2026-10-18T15:46:44.857Z","updated":"2026-10-19T09:24:23.386Z","title":"KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98711","published":"2026-10-18T15:46:44.001Z","updated":"2026-10-30T12:39:02.373Z","title":"wifi: cw1200: fix TX padding OOB read leaking heap data to device","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98710","published":"2026-10-18T15:46:40.790Z","updated":"2026-10-30T12:39:01.294Z","title":"wifi: iwlegacy: 3945: free EEPROM data on remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98709","published":"2026-10-18T15:46:39.290Z","updated":"2026-10-30T12:39:00.231Z","title":"wifi: mac80211: count only matching reservations in reserved switch","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98708","published":"2026-10-18T15:46:38.475Z","updated":"2026-10-30T12:38:59.169Z","title":"wifi: mac80211: keep paired old chanctx alive","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98707","published":"2026-10-18T15:46:37.587Z","updated":"2026-10-30T12:38:58.097Z","title":"wifi: mac80211: shut down RX BA session timer on teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98706","published":"2026-10-18T15:46:36.328Z","updated":"2026-10-30T12:38:57.040Z","title":"wifi: mac80211: drain PS delivery work during station teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98705","published":"2026-10-18T15:46:35.520Z","updated":"2026-10-30T12:38:55.966Z","title":"wifi: mac80211: account proxy paths against the mesh path limit","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-98704","published":"2026-10-18T15:46:34.493Z","updated":"2026-10-30T12:38:54.905Z","title":"wifi: mac80211: keep fallback association elements alive","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98703","published":"2026-10-18T15:46:33.395Z","updated":"2026-10-30T12:38:53.843Z","title":"wifi: mac80211: minstrel_ht: validate fixed rate index","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-98702","published":"2026-10-18T15:46:32.122Z","updated":"2026-10-19T09:24:11.728Z","title":"wifi: mac80211: reject invalid 320 MHz CSA bandwidth","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98701","published":"2026-10-18T15:46:31.257Z","updated":"2026-10-30T12:38:52.791Z","title":"wifi: mac80211: release mesh path quota on failed additions","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98700","published":"2026-10-18T15:46:30.043Z","updated":"2026-10-30T12:38:51.724Z","title":"wifi: mac80211: set info->band for 802.3 encap offload frames","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98699","published":"2026-10-18T15:46:29.245Z","updated":"2026-10-21T12:55:49.005Z","title":"wifi: mac80211: fix mesh fast xmit path deletion UAF","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98698","published":"2026-10-18T15:46:23.363Z","updated":"2026-10-30T12:38:50.641Z","title":"wifi: mac80211: handle empty FILS association request payload","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98697","published":"2026-10-18T15:46:22.503Z","updated":"2026-10-30T12:38:49.567Z","title":"USB: serial: fix dynamic id driver deregistration race","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98696","published":"2026-10-18T15:46:20.399Z","updated":"2026-10-30T12:38:48.486Z","title":"USB: serial: fix driver deregistration order","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98695","published":"2026-10-18T15:46:19.498Z","updated":"2026-10-30T12:38:47.405Z","title":"USB: serial: fix ioctl hangup race","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-98694","published":"2026-10-18T15:46:18.654Z","updated":"2026-10-30T12:38:46.335Z","title":"thunderbolt: Fix KASAN reported use-after-free when request is canceled","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98693","published":"2026-10-18T15:46:17.742Z","updated":"2026-10-19T09:24:03.100Z","title":"thunderbolt: Hold a router reference for each allocated HopID","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98692","published":"2026-10-18T15:46:16.794Z","updated":"2026-10-19T09:24:02.145Z","title":"thunderbolt: Make the DP tunnel activation callback mandatory","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98691","published":"2026-10-18T15:46:15.299Z","updated":"2026-10-19T09:24:01.186Z","title":"thunderbolt: Tear down inactive DP tunnels when the domain is stopped","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98690","published":"2026-10-18T15:46:13.825Z","updated":"2026-10-19T09:24:00.240Z","title":"thunderbolt: Fix domain reference leak when DPRX read is canceled","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98689","published":"2026-10-18T15:46:04.217Z","updated":"2026-10-19T09:23:59.268Z","title":"thunderbolt: Don't access a DP tunnel after its DPRX read was canceled","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98688","published":"2026-10-18T15:46:02.231Z","updated":"2026-10-19T09:23:58.312Z","title":"thunderbolt: Fix NULL dereference in tb_remove_work()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98687","published":"2026-10-18T15:45:58.719Z","updated":"2026-10-30T12:38:45.242Z","title":"thunderbolt: Reject oversized XDomain properties responses","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98686","published":"2026-10-18T15:45:55.193Z","updated":"2026-10-30T12:38:44.094Z","title":"smb: client: discard post-EOF pagecache when extending a file via zero range","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98685","published":"2026-10-18T15:45:53.821Z","updated":"2026-10-19T09:23:55.472Z","title":"smb: client: discard post-EOF pagecache when extending a file via clone range","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-98684","published":"2026-10-18T15:45:52.828Z","updated":"2026-10-19T09:23:54.479Z","title":"smb: client: flush and commit data before querying allocated ranges","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98683","published":"2026-10-18T15:45:50.014Z","updated":"2026-10-19T09:23:53.516Z","title":"smb: client: flush dirty data before zeroing a range","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98682","published":"2026-10-18T15:45:47.375Z","updated":"2026-10-19T09:23:52.548Z","title":"smb: client: drain and invalidate before server-side copy/clone","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98681","published":"2026-10-18T15:45:45.654Z","updated":"2026-10-30T12:38:43.025Z","title":"smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98680","published":"2026-10-18T15:45:39.927Z","updated":"2026-10-19T09:23:49.667Z","title":"iio: accel: kionix-kx022a: Prevent memory leak and fix state","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98679","published":"2026-10-18T15:45:38.283Z","updated":"2026-10-30T12:38:41.965Z","title":"iio: accel: kxcjk-1013: reject duplicate event disable","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98678","published":"2026-10-18T15:45:35.605Z","updated":"2026-10-19T09:23:47.783Z","title":"iio: adc: ad4030: fix invalid oversampling_ratio validation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98677","published":"2026-10-18T15:45:33.871Z","updated":"2026-10-30T12:38:40.900Z","title":"iio: adc: ad_sigma_delta: fix use-after-free on unbind","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-98676","published":"2026-10-18T15:45:31.286Z","updated":"2026-10-19T09:23:45.848Z","title":"iio: adc: ade9000: fix NULL pointer dereference in clkout registration","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98675","published":"2026-10-18T15:45:29.569Z","updated":"2026-10-19T09:23:44.902Z","title":"iio: adc: ade9000: handle Phase C dip events in IRQ1 handler","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98674","published":"2026-10-18T15:45:28.739Z","updated":"2026-10-19T09:23:43.939Z","title":"iio: adc: adi-axi-adc: Initialize state mutex","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98673","published":"2026-10-18T15:45:27.705Z","updated":"2026-10-19T09:23:42.843Z","title":"iio: adc: pac1934: check ACPI label duplication","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98672","published":"2026-10-18T15:45:25.169Z","updated":"2026-10-30T12:38:39.835Z","title":"iio: adc: stm32-adc: fix possible division by zero in processed channel","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98671","published":"2026-10-18T15:45:17.500Z","updated":"2026-10-30T12:38:38.781Z","title":"iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98670","published":"2026-10-18T15:45:14.810Z","updated":"2026-10-30T12:38:37.715Z","title":"iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98669","published":"2026-10-18T15:45:05.836Z","updated":"2026-10-30T12:38:36.653Z","title":"iio: buffer: serialize buffer teardown with mode claims","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98668","published":"2026-10-18T15:44:55.291Z","updated":"2026-10-30T12:38:35.592Z","title":"iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98667","published":"2026-10-18T15:44:51.640Z","updated":"2026-10-19T09:23:35.252Z","title":"iio: frequency: adf4377: Fully initialize clk_init_data and clk_parent_data","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98666","published":"2026-10-18T15:44:43.803Z","updated":"2026-10-30T12:38:34.520Z","title":"iio: gyro: adis16136: fix unprotected debugfs reads","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98665","published":"2026-10-18T15:44:35.323Z","updated":"2026-10-21T12:55:30.413Z","title":"iio: health: max30102: fix NULL dereference in interrupt handler","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98664","published":"2026-10-18T15:44:32.940Z","updated":"2026-10-30T12:38:33.465Z","title":"iio: imu: adis16400: fix unprotected debugfs reads","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-98663","published":"2026-10-18T15:44:31.100Z","updated":"2026-10-30T12:38:32.405Z","title":"iio: imu: adis16480: fix unprotected debugfs reads","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98662","published":"2026-10-18T15:44:24.421Z","updated":"2026-10-30T12:38:31.341Z","title":"iio: light: gp2ap020a00f: drain irq_work after free_irq","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98661","published":"2026-10-18T15:44:21.543Z","updated":"2026-10-19T09:23:29.422Z","title":"iio: light: rohm-bu27034: Fix infinite delay on error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98660","published":"2026-10-18T15:44:19.707Z","updated":"2026-10-30T12:38:30.274Z","title":"iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-98659","published":"2026-10-18T15:44:17.572Z","updated":"2026-10-19T09:23:27.492Z","title":"iio: pressure: rohm-bm1390: Return error when read fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98658","published":"2026-10-18T15:44:12.196Z","updated":"2026-10-19T09:23:26.505Z","title":"iio: proximity: aw96103: validate firmware data length","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98657","published":"2026-10-18T15:44:09.808Z","updated":"2026-10-30T12:38:29.218Z","title":"iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98656","published":"2026-10-18T15:44:07.883Z","updated":"2026-10-30T12:38:28.155Z","title":"iio: trigger: cancel reenable_work before freeing trigger","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98655","published":"2026-10-18T15:44:05.722Z","updated":"2026-10-30T12:38:27.085Z","title":"perf: Require kernel access for text poke events","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-98653","published":"2026-10-18T15:20:24.848Z","updated":"2026-10-19T09:23:22.624Z","title":"KVM: s390: Fix _gaccess_shadow_fault()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98652","published":"2026-10-18T15:20:23.975Z","updated":"2026-10-19T09:23:21.668Z","title":"KVM: s390: Add missing srcu in kvm_s390_set_irq_state()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98651","published":"2026-10-18T15:20:22.978Z","updated":"2026-10-19T09:23:20.711Z","title":"KVM: s390: Properly handle NULL pointer in dat_cond_set_storage_key()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98650","published":"2026-10-18T15:20:22.173Z","updated":"2026-10-19T09:23:19.769Z","title":"KVM: s390: Fix potential races in dat skey functions","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98649","published":"2026-10-18T15:20:21.346Z","updated":"2026-10-19T09:23:18.799Z","title":"KVM: s390: Fix race in _destroy_pages_crste()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-98648","published":"2026-10-18T15:20:20.496Z","updated":"2026-10-19T09:23:17.853Z","title":"s390/uv: Prevent potential out-of-bounds read","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98647","published":"2026-10-18T15:20:18.360Z","updated":"2026-10-19T09:23:16.870Z","title":"bpf: Fix divide-by-zero in btf_struct_walk()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98646","published":"2026-10-18T15:20:17.490Z","updated":"2026-10-19T09:23:15.900Z","title":"tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98645","published":"2026-10-18T15:20:16.676Z","updated":"2026-10-19T09:23:14.926Z","title":"HID: winwing: fix use-after-free in force feedback teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-98644","published":"2026-10-18T15:20:15.380Z","updated":"2026-10-19T09:23:13.963Z","title":"bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98643","published":"2026-10-18T15:20:14.561Z","updated":"2026-10-19T09:23:12.946Z","title":"bpf: Fix out-of-bounds read of rtt_min in sock_ops","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-98642","published":"2026-10-18T15:20:13.740Z","updated":"2026-10-19T09:23:11.995Z","title":"bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98641","published":"2026-10-18T15:20:12.730Z","updated":"2026-10-19T09:23:10.965Z","title":"bpf, arm64: set up the frame pointer for the exception callback","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98640","published":"2026-10-18T15:20:11.777Z","updated":"2026-10-19T09:23:09.980Z","title":"HID: amd_sfh: Validate PCI BAR size before mapping","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98639","published":"2026-10-18T15:20:10.591Z","updated":"2026-10-19T09:23:09.004Z","title":"KVM: riscv: Fix NACL hfence entry update order","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98638","published":"2026-10-18T15:20:09.380Z","updated":"2026-10-19T09:23:08.052Z","title":"KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98637","published":"2026-10-18T15:20:08.157Z","updated":"2026-10-19T09:23:07.105Z","title":"KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98636","published":"2026-10-18T15:20:07.184Z","updated":"2026-10-19T09:23:06.005Z","title":"squashfs: Add dictionary size range check to prevent shift-out-of-bounds","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98635","published":"2026-10-18T15:20:05.961Z","updated":"2026-10-19T09:23:04.703Z","title":"scsi: block: Fix zones_cond out-of-bounds write on zone report","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98634","published":"2026-10-18T15:20:03.198Z","updated":"2026-10-19T09:23:03.375Z","title":"scsi: sd_zbc: Reject disks with too many zones","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98633","published":"2026-10-18T15:19:58.365Z","updated":"2026-10-19T09:23:02.041Z","title":"Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98632","published":"2026-10-18T15:19:56.287Z","updated":"2026-10-19T09:23:00.460Z","title":"Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98631","published":"2026-10-18T15:19:53.529Z","updated":"2026-10-19T09:22:59.147Z","title":"xsk: Use a 32-bit compare in xsk_map_gen_lookup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-98630","published":"2026-10-18T15:19:51.484Z","updated":"2026-10-19T09:22:58.173Z","title":"eth: fbnic: Fix payload page pool error cleanup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98629","published":"2026-10-18T15:19:50.589Z","updated":"2026-10-19T09:22:57.219Z","title":"net/sched: cls_u32: fix manual hash table handle IDR aliasing","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98628","published":"2026-10-18T15:19:49.746Z","updated":"2026-10-19T09:22:56.237Z","title":"bpf: Make post-verification instruction rewrites killable","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-98627","published":"2026-10-18T15:19:48.952Z","updated":"2026-10-19T09:22:55.260Z","title":"bpf: Preserve packet pointer class displacement in regsafe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-98626","published":"2026-10-18T15:19:47.832Z","updated":"2026-10-19T09:22:54.307Z","title":"bpf: Restrict CO-RE poisoning to relocatable instructions","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-98625","published":"2026-10-18T15:19:46.372Z","updated":"2026-10-19T09:22:53.321Z","title":"netfilter: flowtable: publish HW_DEAD after worker is done","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-98624","published":"2026-10-18T15:19:45.566Z","updated":"2026-10-19T09:22:52.337Z","title":"netfilter: nfnetlink_queue: hold nfnl mutex in event notifier","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98623","published":"2026-10-18T15:19:44.744Z","updated":"2026-10-19T09:22:51.359Z","title":"drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98622","published":"2026-10-18T15:19:42.514Z","updated":"2026-10-19T09:22:50.359Z","title":"net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98621","published":"2026-10-18T15:19:41.211Z","updated":"2026-10-19T09:22:49.371Z","title":"net: gue: reject invalid REMCSUM offsets","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98620","published":"2026-10-18T15:19:40.320Z","updated":"2026-10-19T09:22:48.289Z","title":"net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98619","published":"2026-10-18T15:19:39.448Z","updated":"2026-10-19T09:22:47.182Z","title":"net: ethtool: keep rtnl_lock for the ioctl self test","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98618","published":"2026-10-18T15:19:38.631Z","updated":"2026-10-19T09:22:46.174Z","title":"eth: fbnic: Handle maximum standalone channels","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98617","published":"2026-10-18T15:19:37.060Z","updated":"2026-10-19T09:22:45.221Z","title":"eth: fbnic: use the Rx queue napi pointer to find the napi vector","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-98616","published":"2026-10-18T15:19:36.165Z","updated":"2026-10-19T09:22:44.159Z","title":"eth: fbnic: reset num_napi when the napi vectors are freed","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98615","published":"2026-10-18T15:19:35.307Z","updated":"2026-10-19T09:22:43.182Z","title":"eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98614","published":"2026-10-18T15:19:34.494Z","updated":"2026-10-19T09:22:42.185Z","title":"sctp: avoid livelock while updating retransmit path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98613","published":"2026-10-18T15:19:33.624Z","updated":"2026-10-19T09:22:41.226Z","title":"bpf: Bound ownership depth through local kptrs and graph roots","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98612","published":"2026-10-18T15:19:32.790Z","updated":"2026-10-19T09:22:40.233Z","title":"net: usb: catc: bound the RX packet length in catc_rx_done()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-98611","published":"2026-10-18T15:19:26.922Z","updated":"2026-10-19T09:22:38.197Z","title":"bpf: Check params size before reading reserved fields","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98610","published":"2026-10-18T15:19:25.128Z","updated":"2026-10-19T09:22:37.236Z","title":"net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98609","published":"2026-10-18T15:19:24.250Z","updated":"2026-10-19T09:22:36.271Z","title":"drm/virtio: fix object leak when drm_gem_handle_create() fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98608","published":"2026-10-18T15:19:23.052Z","updated":"2026-10-19T09:22:35.287Z","title":"drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98607","published":"2026-10-18T15:19:21.585Z","updated":"2026-10-19T09:22:34.330Z","title":"drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98606","published":"2026-10-18T15:19:20.639Z","updated":"2026-10-19T09:22:33.369Z","title":"drm/virtio: release the GEM object on virtio_gpu_vram_create() errors","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-98605","published":"2026-10-18T15:19:18.294Z","updated":"2026-10-19T09:22:32.426Z","title":"drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98604","published":"2026-10-18T15:19:17.227Z","updated":"2026-10-19T09:22:31.480Z","title":"ovpn: replace bind when learning local endpoint","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98603","published":"2026-10-18T15:19:16.215Z","updated":"2026-10-19T09:22:30.537Z","title":"ovpn: replace bind when clearing stale local source","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98602","published":"2026-10-18T15:19:14.606Z","updated":"2026-10-19T09:22:29.455Z","title":"Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98601","published":"2026-10-18T15:19:13.760Z","updated":"2026-10-19T09:22:28.028Z","title":"Bluetooth: btintel_pcie: validate device-supplied DMA indices","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98600","published":"2026-10-18T15:19:12.864Z","updated":"2026-10-19T09:22:26.711Z","title":"Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98599","published":"2026-10-18T15:19:11.941Z","updated":"2026-10-19T09:22:25.359Z","title":"bpf: Reject non-negative offsets in stack_slot_obj_get_spi()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-98598","published":"2026-10-18T15:19:11.126Z","updated":"2026-10-19T09:22:24.055Z","title":"ipv6: Prevent rt6_insert_exception() for dying fib6_info.","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98597","published":"2026-10-18T15:19:10.088Z","updated":"2026-10-19T09:22:22.716Z","title":"net: usb: sr9700: include receive overhead in the length check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98596","published":"2026-10-18T15:19:09.189Z","updated":"2026-10-19T09:22:21.750Z","title":"ipv6: Fix dst leak for uncached routes.","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98595","published":"2026-10-18T15:19:07.840Z","updated":"2026-10-19T09:22:20.774Z","title":"udp: remove a disconnected socket from the 4-tuple hash table","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98594","published":"2026-10-18T15:19:06.696Z","updated":"2026-10-19T09:22:19.792Z","title":"tg3: clean up PHYLIB resources on probe failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98593","published":"2026-10-18T15:19:05.272Z","updated":"2026-10-19T09:22:18.775Z","title":"s390/debug: Fix NULL pointer dereference in debug_info_copy()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98592","published":"2026-10-18T15:19:04.373Z","updated":"2026-10-19T09:22:17.811Z","title":"net: spacemit: clear TX descriptor on fragment mapping failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98591","published":"2026-10-18T15:19:03.567Z","updated":"2026-10-19T09:22:16.758Z","title":"bpf: Fix bounds check for skb-backed dynptrs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-98590","published":"2026-10-18T15:19:02.747Z","updated":"2026-10-19T09:22:15.786Z","title":"bpf: Fix bpf_sock context code generation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98589","published":"2026-10-18T15:19:01.769Z","updated":"2026-10-19T09:22:14.803Z","title":"bpf: Reject pkt arguments in mutating subprogs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-98588","published":"2026-10-18T15:19:00.934Z","updated":"2026-10-19T09:22:13.833Z","title":"bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-98587","published":"2026-10-18T15:19:00.077Z","updated":"2026-10-19T09:22:12.874Z","title":"firewire: cdev: fix back-transition for iso_resource_auto client resource","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-98586","published":"2026-10-18T15:18:59.046Z","updated":"2026-10-19T09:22:11.899Z","title":"sctp: hold asoc or transport before mod_timer() in timer handlers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98585","published":"2026-10-18T15:18:58.018Z","updated":"2026-10-19T09:22:10.939Z","title":"eth: fbnic: Avoid rounding zero ring sizes","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98584","published":"2026-10-18T15:18:57.204Z","updated":"2026-10-19T09:22:09.980Z","title":"net/sched: fix potential stack infoleak in em_text_dump()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98583","published":"2026-10-18T15:18:56.360Z","updated":"2026-10-19T09:22:09.019Z","title":"nfc: nfcmrvl: validate helper command length before pull","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98582","published":"2026-10-18T15:18:55.545Z","updated":"2026-10-19T09:22:08.022Z","title":"nfc: st21nfca: validate received frame size","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98581","published":"2026-10-18T15:18:54.696Z","updated":"2026-10-19T09:22:07.016Z","title":"nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98580","published":"2026-10-18T15:18:53.819Z","updated":"2026-10-19T09:22:05.887Z","title":"nfc: llcp: Fix race condition in accept_queue lifecycle","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98579","published":"2026-10-18T15:18:52.611Z","updated":"2026-10-19T09:22:04.617Z","title":"nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98578","published":"2026-10-18T15:18:51.807Z","updated":"2026-10-19T09:22:03.614Z","title":"nfc: st21nfca: validate ISO15693 inventory length","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98577","published":"2026-10-18T15:18:47.635Z","updated":"2026-10-19T09:22:02.632Z","title":"nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98576","published":"2026-10-18T15:18:41.629Z","updated":"2026-10-19T09:22:01.670Z","title":"nfc: llcp: fix slab-out-of-bounds reads when logging service names","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98575","published":"2026-10-18T15:18:40.577Z","updated":"2026-10-19T09:22:00.641Z","title":"nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98574","published":"2026-10-18T15:18:39.767Z","updated":"2026-10-19T09:21:59.645Z","title":"net: bcmgenet: stop Tx NAPI before disabling the queues","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98573","published":"2026-10-18T15:18:38.914Z","updated":"2026-10-19T09:21:58.681Z","title":"net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98572","published":"2026-10-18T15:18:38.105Z","updated":"2026-10-19T09:21:57.711Z","title":"bpf: Fix immediate JMP JEQ/JNE on MIPS32","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-98571","published":"2026-10-18T15:18:37.195Z","updated":"2026-10-19T09:21:56.739Z","title":"net: stmmac: clear stale buf->page after recycling on skb build failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98570","published":"2026-10-18T15:18:36.308Z","updated":"2026-10-19T09:21:55.765Z","title":"net: ipv6: keep room for the mac header in dst_dev_overhead()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-98569","published":"2026-10-18T15:18:35.413Z","updated":"2026-10-19T09:21:54.816Z","title":"ip_gre: Reject enabling collect metadata through changelink","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98568","published":"2026-10-18T15:18:34.562Z","updated":"2026-10-30T12:38:26.027Z","title":"vxlan: use one headroom snapshot for neighbour replies","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-98567","published":"2026-10-18T15:18:33.721Z","updated":"2026-10-19T09:21:52.909Z","title":"net: xps: reject an out of range traffic class","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98566","published":"2026-10-18T15:18:32.679Z","updated":"2026-10-19T09:21:51.721Z","title":"drm/imagination: clamp freelist reconstruction requests","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98565","published":"2026-10-18T15:18:31.836Z","updated":"2026-10-19T09:21:50.349Z","title":"net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98564","published":"2026-10-18T15:18:31.044Z","updated":"2026-10-19T09:21:49.010Z","title":"net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98563","published":"2026-10-18T15:18:30.158Z","updated":"2026-10-19T09:21:47.748Z","title":"net: phylink: record the PHY only once bringup cannot fail","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98562","published":"2026-10-18T15:18:29.310Z","updated":"2026-10-19T09:21:46.397Z","title":"net: libwx: fix races in Tx timestamp handling","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-98561","published":"2026-10-18T15:18:28.011Z","updated":"2026-10-19T09:21:45.378Z","title":"nfp: hold IPsec RX state under the XArray lock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98560","published":"2026-10-18T15:18:27.162Z","updated":"2026-10-19T09:21:44.401Z","title":"net/rds: size a connection's path set by the transport it ends up with","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-98559","published":"2026-10-18T15:18:26.349Z","updated":"2026-10-19T09:21:43.436Z","title":"net/smc: fix UAF on lgr list traversal in smcr_port_err()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-98558","published":"2026-10-18T15:18:25.282Z","updated":"2026-10-19T09:21:42.443Z","title":"net: flush skb_defer_nodes in dev_cpu_dead()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-98557","published":"2026-10-18T15:18:24.415Z","updated":"2026-10-19T09:21:41.472Z","title":"gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98556","published":"2026-10-18T15:18:23.536Z","updated":"2026-10-19T09:21:40.064Z","title":"gve: DQO: reject TSO packets with an out of range MSS","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98555","published":"2026-10-18T15:18:22.631Z","updated":"2026-10-24T14:09:24.593Z","title":"llc: fix skb UAF and leaks on llc_mac_hdr_init() failure","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0031,"kevAdded":null},{"id":"CVE-2026-98554","published":"2026-10-18T15:18:21.751Z","updated":"2026-10-19T09:21:37.221Z","title":"vlan: ensure sufficient headroom in vlan_dev_hard_header()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98553","published":"2026-10-18T15:18:20.728Z","updated":"2026-10-19T09:21:36.247Z","title":"autofs: fix sbi->pipe file reference leak in autofs_kill_sb()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98552","published":"2026-10-18T15:18:19.810Z","updated":"2026-10-19T09:21:35.261Z","title":"perf/core: Fix a refcount leak in attach_perf_ctx_data()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98551","published":"2026-10-18T15:18:19.008Z","updated":"2026-10-19T09:21:34.288Z","title":"perf/core: Fill branch entries with a single assignment","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-98550","published":"2026-10-18T15:18:18.173Z","updated":"2026-10-24T14:09:23.470Z","title":"tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00677,"kevAdded":null},{"id":"CVE-2026-98549","published":"2026-10-18T15:18:17.361Z","updated":"2026-10-30T12:38:24.928Z","title":"tcp: prevent collapsing skbs across boundary in rtx queue","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00559,"kevAdded":null},{"id":"CVE-2026-98548","published":"2026-10-18T15:18:16.510Z","updated":"2026-10-24T14:09:21.243Z","title":"sctp: discard the rest of the packet on a stale-cookie error","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00694,"kevAdded":null},{"id":"CVE-2026-98547","published":"2026-10-18T15:18:15.669Z","updated":"2026-10-19T09:21:30.417Z","title":"af_packet: fix integer overflow in prb_calc_retire_blk_tmo()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98546","published":"2026-10-18T15:18:14.808Z","updated":"2026-10-19T09:21:29.442Z","title":"arm64/boot: Disable trapping of PMZR_EL0 writes to EL2","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98545","published":"2026-10-18T15:18:13.949Z","updated":"2026-10-19T09:21:28.453Z","title":"ata: libata-scsi: bound the ATA passthru sense descriptor writes","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98544","published":"2026-10-18T15:18:12.964Z","updated":"2026-10-30T12:38:23.865Z","title":"bna: prevent IOC timer rearm during teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98543","published":"2026-10-18T15:18:10.823Z","updated":"2026-10-24T14:09:20.159Z","title":"bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-98542","published":"2026-10-18T15:18:10.035Z","updated":"2026-10-19T09:21:25.599Z","title":"cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98541","published":"2026-10-18T15:18:09.190Z","updated":"2026-10-19T09:21:24.620Z","title":"fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98540","published":"2026-10-18T15:18:08.352Z","updated":"2026-10-19T09:21:23.633Z","title":"fprobe: Terminate the fgraph_data list when the reservation is not filled","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-98539","published":"2026-10-18T15:18:06.921Z","updated":"2026-10-19T09:21:22.671Z","title":"fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's \"WARNING in do_new_mount\" saga","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-98538","published":"2026-10-18T15:18:05.901Z","updated":"2026-10-19T09:21:21.678Z","title":"writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-98537","published":"2026-10-18T15:18:05.028Z","updated":"2026-10-19T09:21:20.715Z","title":"workqueue: Fix NULL current_pwq deref in flush dependency check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-98536","published":"2026-10-18T15:18:04.013Z","updated":"2026-10-19T09:21:19.730Z","title":"writeback: report a Tasks-RCU quiescent state per cgwb drain pass","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-98535","published":"2026-10-18T15:17:58.081Z","updated":"2026-10-19T09:21:18.753Z","title":"fsl/fman: Fix clk reference leak in read_dts_node()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-98534","published":"2026-10-18T15:17:57.236Z","updated":"2026-10-19T09:21:17.763Z","title":"ipe: fix use-after-free when auditing a newly loaded policy","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-98533","published":"2026-10-18T15:17:51.339Z","updated":"2026-10-19T09:21:16.820Z","title":"ipe: protect the dm-verity root hash with RCU","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-98532","published":"2026-10-18T15:17:50.490Z","updated":"2026-10-24T14:09:19.064Z","title":"ipv6: do not let ipv6_find_hdr() return an offset past the packet end","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00613,"kevAdded":null},{"id":"CVE-2026-98531","published":"2026-10-18T15:17:49.632Z","updated":"2026-10-19T09:21:14.351Z","title":"ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-98530","published":"2026-10-18T15:17:48.670Z","updated":"2026-10-19T09:21:13.045Z","title":"kprobes: Fix permanent hang when flushing the kprobe optimizer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98529","published":"2026-10-18T15:17:47.577Z","updated":"2026-10-19T09:21:11.695Z","title":"gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-98528","published":"2026-10-18T15:17:46.695Z","updated":"2026-10-19T09:21:10.272Z","title":"gpio: cdev: fix kernel stack leak to user-space in error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-98527","published":"2026-10-18T15:17:45.684Z","updated":"2026-10-19T09:21:08.961Z","title":"gpio: zynq: fix runtime PM leak on request error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-98526","published":"2026-10-18T15:17:44.018Z","updated":"2026-10-19T09:21:07.983Z","title":"llc: reserve device headroom for allocated frames","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-98525","published":"2026-10-18T15:17:43.216Z","updated":"2026-10-19T09:21:07.010Z","title":"mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-98524","published":"2026-10-18T15:17:41.420Z","updated":"2026-10-24T14:09:17.970Z","title":"rds: ib: Clear the sg list when mapping an MR fails","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-98523","published":"2026-10-18T15:17:40.598Z","updated":"2026-10-19T09:21:05.087Z","title":"drm/client: fix restore of partially initialized client","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-98522","published":"2026-10-18T15:17:39.774Z","updated":"2026-10-19T09:21:04.111Z","title":"drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-98521","published":"2026-10-18T15:17:38.938Z","updated":"2026-10-19T09:21:03.153Z","title":"drm/i915: fix incorrect RCU teardown order","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-98520","published":"2026-10-18T15:17:38.113Z","updated":"2026-10-24T14:09:16.913Z","title":"drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98519","published":"2026-10-18T15:17:37.306Z","updated":"2026-10-30T12:38:22.800Z","title":"drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98518","published":"2026-10-18T15:17:36.371Z","updated":"2026-10-24T14:09:15.821Z","title":"drm/nouveau/dmem: pin VRAM for the whole registered range","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-98517","published":"2026-10-18T15:17:35.521Z","updated":"2026-10-24T14:09:14.724Z","title":"drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-98516","published":"2026-10-18T15:17:34.436Z","updated":"2026-10-19T09:20:57.329Z","title":"drm/nouveau: Fix bridge reference leak in nv1a_ram_new()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98515","published":"2026-10-18T15:17:31.953Z","updated":"2026-10-24T14:09:13.699Z","title":"drm/nouveau: fix double-free in nvif_vmm_dtor","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-98514","published":"2026-10-18T15:17:30.612Z","updated":"2026-10-19T09:20:54.190Z","title":"drm/nouveau: Fix gem reference leak in validate_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98513","published":"2026-10-18T15:17:29.308Z","updated":"2026-10-19T09:20:53.197Z","title":"drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98512","published":"2026-10-18T15:17:27.102Z","updated":"2026-10-24T14:09:12.662Z","title":"drm/nouveau: RCU-free the scheduler-containing nouveau_sched","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-98511","published":"2026-10-18T15:17:25.033Z","updated":"2026-10-30T12:38:21.735Z","title":"drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98510","published":"2026-10-18T15:17:20.805Z","updated":"2026-10-24T14:09:11.598Z","title":"drm/xe/vm: nuke PTs only after unlinking contested VMAs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98509","published":"2026-10-18T15:17:19.352Z","updated":"2026-10-19T09:20:48.207Z","title":"drm/virtio: fix memory leak of fence event on execbuffer failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98508","published":"2026-10-18T15:17:15.082Z","updated":"2026-10-19T09:20:47.221Z","title":"drm/virtio: fix NULL pointer dereference on fence allocation failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98507","published":"2026-10-18T15:17:13.767Z","updated":"2026-10-30T12:38:20.652Z","title":"mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-98506","published":"2026-10-18T15:17:12.898Z","updated":"2026-10-19T09:20:45.266Z","title":"mm/hugetlb: do not dissolve gigantic pages without runtime support","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98505","published":"2026-10-18T15:17:06.200Z","updated":"2026-10-21T12:55:16.703Z","title":"mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98504","published":"2026-10-18T15:17:05.274Z","updated":"2026-10-19T09:20:43.250Z","title":"PCI: of_property: Omit bus properties without a subordinate bus","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98503","published":"2026-10-18T15:17:03.904Z","updated":"2026-10-19T09:20:42.115Z","title":"packet: use ubuf_info completion for TX_RING packets","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98502","published":"2026-10-18T15:16:51.221Z","updated":"2026-10-30T12:38:19.578Z","title":"HID: alps: unregister DualPoint Stick input device on remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-98501","published":"2026-10-18T15:16:46.205Z","updated":"2026-10-24T14:09:09.356Z","title":"HID: alps: fix use-after-free on input2 registration failure","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2026-98500","published":"2026-10-18T15:16:33.969Z","updated":"2026-10-19T09:20:39.271Z","title":"HID: hid-oxp: use cancel_delayed_work_sync() in remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-98499","published":"2026-10-18T15:16:31.629Z","updated":"2026-10-24T14:09:08.254Z","title":"HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0039,"kevAdded":null},{"id":"CVE-2026-98498","published":"2026-10-18T15:16:30.116Z","updated":"2026-10-19T09:20:36.589Z","title":"net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98497","published":"2026-10-18T15:16:28.852Z","updated":"2026-10-24T14:09:07.181Z","title":"net/mlx5e: fix swapped IPv6 IPsec policy masks","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00459,"kevAdded":null},{"id":"CVE-2026-98496","published":"2026-10-18T15:16:27.545Z","updated":"2026-10-19T09:20:33.996Z","title":"net: airoha: npu: cancel wdt_work after releasing the WDT IRQ","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98495","published":"2026-10-18T15:16:24.810Z","updated":"2026-10-19T09:20:32.370Z","title":"net: arp: terminate device name before lookup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98494","published":"2026-10-18T15:16:23.155Z","updated":"2026-10-19T09:20:31.295Z","title":"net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98493","published":"2026-10-18T15:16:22.301Z","updated":"2026-10-30T12:38:18.516Z","title":"net: ipconfig: bound DHCP option construction","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-98492","published":"2026-10-18T15:16:21.208Z","updated":"2026-10-19T09:20:29.361Z","title":"net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98491","published":"2026-10-18T15:16:20.069Z","updated":"2026-10-24T14:09:06.117Z","title":"net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-98490","published":"2026-10-18T15:16:19.215Z","updated":"2026-10-30T12:38:17.458Z","title":"net: openvswitch: conntrack: fix helper UAF due to extensions realloc","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00695,"kevAdded":null},{"id":"CVE-2026-98489","published":"2026-10-18T15:16:16.084Z","updated":"2026-10-19T09:20:26.482Z","title":"net: atl1c: fix soft lockup on out-of-range tpd_cons read","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98488","published":"2026-10-18T15:16:14.168Z","updated":"2026-10-19T09:20:25.516Z","title":"net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98487","published":"2026-10-18T15:16:04.746Z","updated":"2026-10-24T14:09:03.998Z","title":"net: bridge: mdb: restart port group walk after deletion","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-98486","published":"2026-10-18T15:16:03.002Z","updated":"2026-10-30T12:38:16.404Z","title":"net: ena: fix MMIO read buffer leak on probe failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-98485","published":"2026-10-18T15:16:00.435Z","updated":"2026-10-24T14:09:02.897Z","title":"netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98484","published":"2026-10-18T15:15:58.118Z","updated":"2026-10-30T12:38:15.332Z","title":"netfilter: nf_tables: skip expired catchall elements on insert and delete","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98483","published":"2026-10-18T15:15:57.275Z","updated":"2026-10-19T09:20:20.665Z","title":"nfc: fix use-after-free in nfc_get_local_general_bytes","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98482","published":"2026-10-18T15:15:56.227Z","updated":"2026-10-19T09:20:19.712Z","title":"nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-98481","published":"2026-10-18T15:15:55.360Z","updated":"2026-10-19T09:20:18.735Z","title":"nfc: port100: reject frames whose declared length exceeds the received data","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98480","published":"2026-10-18T15:15:54.528Z","updated":"2026-10-19T09:20:17.774Z","title":"nfc: trf7970a: power down on startup RX gain failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98479","published":"2026-10-18T15:15:53.663Z","updated":"2026-10-24T14:09:01.805Z","title":"scsi: libiscsi_tcp: Check the data direction of a Data-In PDU","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00392,"kevAdded":null},{"id":"CVE-2026-98478","published":"2026-10-18T15:15:52.338Z","updated":"2026-10-19T09:20:15.817Z","title":"scsi: ufs: core: Keep internal commands dispatchable during error handling","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98477","published":"2026-10-18T15:15:51.475Z","updated":"2026-10-21T12:55:10.170Z","title":"perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98476","published":"2026-10-18T15:15:45.100Z","updated":"2026-10-19T09:20:13.920Z","title":"s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98475","published":"2026-10-18T15:15:44.206Z","updated":"2026-10-19T09:20:12.941Z","title":"s390/cmf: Fix virtual vs physical address confusion","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98474","published":"2026-10-18T15:15:36.667Z","updated":"2026-10-19T09:20:12.011Z","title":"s390/pci: Fix missing device lock in zpci_report_status()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98473","published":"2026-10-18T15:15:35.479Z","updated":"2026-10-19T09:20:11.069Z","title":"s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98472","published":"2026-10-18T15:15:24.654Z","updated":"2026-10-19T09:20:10.096Z","title":"KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98471","published":"2026-10-18T15:15:23.690Z","updated":"2026-10-24T14:09:00.765Z","title":"KVM: SEV: Do cache maintenance on the source VM during intra-host migration","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2026-98470","published":"2026-10-18T15:15:22.878Z","updated":"2026-10-19T09:20:08.206Z","title":"KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98469","published":"2026-10-18T15:15:22.065Z","updated":"2026-10-24T14:08:59.643Z","title":"KVM: arm64: Fix AArch32 DBGBXVR<n> handling","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-98468","published":"2026-10-18T15:15:20.882Z","updated":"2026-10-19T09:20:06.341Z","title":"KVM: arm64: Fix spurious warning for benign stage 2 teardown race","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98467","published":"2026-10-18T15:15:19.294Z","updated":"2026-10-19T09:20:05.363Z","title":"KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98466","published":"2026-10-18T15:15:18.414Z","updated":"2026-10-24T14:08:58.562Z","title":"KVM: arm64: Transfer the hyp stack pages out of the host stage-2","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-98465","published":"2026-10-18T15:15:17.498Z","updated":"2026-10-24T14:08:57.467Z","title":"RISC-V: KVM: Serialize IMSIC attributes with vCPU migration","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-98464","published":"2026-10-18T15:15:16.624Z","updated":"2026-10-24T14:08:56.354Z","title":"RISC-V: KVM: Synchronize hrtimer callback during teardown","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-98463","published":"2026-10-18T15:15:15.775Z","updated":"2026-10-19T09:20:01.130Z","title":"sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98462","published":"2026-10-18T15:15:11.696Z","updated":"2026-10-19T09:19:59.841Z","title":"Bluetooth: hci_conn: fix CIS hold ownership on reuse","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98461","published":"2026-10-18T15:15:10.726Z","updated":"2026-10-19T09:19:58.505Z","title":"Bluetooth: hci_sock: validate event length before filtering","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98460","published":"2026-10-18T15:15:09.787Z","updated":"2026-10-19T09:19:57.273Z","title":"Bluetooth: hci_sock: reject out-of-range OCF values","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98459","published":"2026-10-18T15:15:08.537Z","updated":"2026-10-19T09:19:55.996Z","title":"Bluetooth: ISO: balance the parent hold in hci_bind_bis()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98458","published":"2026-10-18T15:15:07.572Z","updated":"2026-10-19T09:19:54.818Z","title":"Bluetooth: ISO: release unused CIS holds after channel attach","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-98457","published":"2026-10-18T15:15:06.718Z","updated":"2026-10-19T09:19:53.885Z","title":"Bluetooth: L2CAP: validate frame length before control and FCS access","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-98456","published":"2026-10-18T15:15:05.909Z","updated":"2026-10-30T12:38:14.270Z","title":"Bluetooth: mgmt: fix race in read_unconf_index_list()","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-98455","published":"2026-10-18T15:15:04.988Z","updated":"2026-10-19T09:19:50.740Z","title":"Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98454","published":"2026-10-18T15:15:04.139Z","updated":"2026-10-30T12:38:13.210Z","title":"smb: client: fix create context out-of-bounds reads","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00387,"kevAdded":null},{"id":"CVE-2026-98453","published":"2026-10-18T15:15:03.262Z","updated":"2026-10-30T12:38:12.139Z","title":"smb: client: close handle after create-context parsing failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98452","published":"2026-10-18T15:15:02.436Z","updated":"2026-10-19T09:19:47.547Z","title":"smb: client: clean up failed cached directory opens","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-98451","published":"2026-10-18T15:15:01.473Z","updated":"2026-10-30T12:38:11.067Z","title":"smb: client: use finish_no_open() for non-regular inodes","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2026-98450","published":"2026-10-18T15:15:00.649Z","updated":"2026-10-30T12:38:10.005Z","title":"smb: client: close completed creates on compound wait errors","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98449","published":"2026-10-18T15:14:59.772Z","updated":"2026-10-19T09:19:44.655Z","title":"smb: client: delete compound mids on send failure before unlock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-98448","published":"2026-10-18T15:14:58.880Z","updated":"2026-10-19T09:19:43.713Z","title":"xfs: release orphanage dir inode if chown fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-98447","published":"2026-10-18T15:14:57.561Z","updated":"2026-10-19T09:19:42.728Z","title":"xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98446","published":"2026-10-18T15:14:56.724Z","updated":"2026-10-19T09:19:41.777Z","title":"xfs: don't let hidden_space go negative in xfs_metafile_resv_init","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98445","published":"2026-10-18T15:14:55.754Z","updated":"2026-10-19T09:19:40.826Z","title":"xfs: don't let memory failures leak blocks and kill repairs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98444","published":"2026-10-18T15:14:54.559Z","updated":"2026-10-19T09:19:39.866Z","title":"xfs: drop dquot flush lock when we can't find a buffer to flush","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98443","published":"2026-10-18T15:14:53.597Z","updated":"2026-10-30T12:38:08.950Z","title":"xfs: fix cursor and pointer handling when recovering iunlink buckets","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-98442","published":"2026-10-18T15:14:52.614Z","updated":"2026-10-24T14:08:50.801Z","title":"net/sched: act_ct: fix helper UAF due to extensions realloc","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-98441","published":"2026-10-18T15:14:51.664Z","updated":"2026-10-24T14:08:49.686Z","title":"net/sched: act_ct: avoid modifying shared unconfirmed ct entry","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-98440","published":"2026-10-18T15:14:50.740Z","updated":"2026-10-24T14:08:48.611Z","title":"KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-98439","published":"2026-10-18T14:45:28.290Z","updated":"2026-10-26T06:55:46.410Z","title":"smb/server: cancel async requests when closing connection","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-98438","published":"2026-10-18T14:45:27.288Z","updated":"2026-10-19T09:19:34.132Z","title":"mptcp: options: fix uninit-value in mptcp_write_data_fin","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-98437","published":"2026-10-18T14:45:26.337Z","updated":"2026-10-19T09:19:33.190Z","title":"media: qcom: iris: fix runtime PM reference leaks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98436","published":"2026-10-18T14:45:25.364Z","updated":"2026-10-26T06:55:45.188Z","title":"accel/amdxdna: Disable device buffer exporting","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-98435","published":"2026-10-18T14:45:24.453Z","updated":"2026-10-19T09:19:31.284Z","title":"EDAC/altera: Use parent device for devres in altr_portb_setup()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-98434","published":"2026-10-18T14:38:19.729Z","updated":"2026-10-19T09:19:30.349Z","title":"sysctl: Check range in  proc_dointvec_ms_jiffies_minmax","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-98433","published":"2026-10-18T14:38:18.296Z","updated":"2026-10-19T09:19:29.371Z","title":"KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-99999","published":"2026-10-15T12:19:22.784Z","updated":"2026-10-24T14:17:15.740Z","title":"ipv4: validate checksum_start before completing checksum","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00788,"kevAdded":null},{"id":"CVE-2026-98432","published":"2026-10-15T12:08:22.205Z","updated":"2026-11-03T06:08:32.425Z","title":"ipv4: free inet_opt and ireq_opt after an RCU grace period","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0076,"kevAdded":null},{"id":"CVE-2026-98431","published":"2026-10-14T13:27:56.162Z","updated":"2026-10-19T09:19:26.316Z","title":"RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98430","published":"2026-10-14T13:27:55.566Z","updated":"2026-10-19T09:19:25.294Z","title":"RDMA/efa: Keep admin queues alive while IRQ is registered","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-98429","published":"2026-10-14T13:27:54.960Z","updated":"2026-10-19T09:19:24.137Z","title":"RDMA/efa: Keep EQ resources alive while IRQ is registered","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-98428","published":"2026-10-14T13:27:54.364Z","updated":"2026-10-26T06:55:43.958Z","title":"ALSA: usb: 6fire: Avoid embedded URBs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-98427","published":"2026-10-14T13:27:53.770Z","updated":"2026-10-19T09:19:21.452Z","title":"net/sched: codel: bound the dropping loop per dequeue call","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98426","published":"2026-10-14T13:27:53.177Z","updated":"2026-10-19T09:19:20.215Z","title":"wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-98425","published":"2026-10-14T13:27:52.569Z","updated":"2026-10-19T09:19:19.012Z","title":"wifi: mac80211: don't warn when an IBSS has no channel to scan","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-98424","published":"2026-10-14T13:27:51.975Z","updated":"2026-10-19T09:19:17.805Z","title":"wifi: cfg80211: undo netns switch if renaming the wiphy fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-98423","published":"2026-10-14T13:27:51.391Z","updated":"2026-10-19T09:19:16.854Z","title":"wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-98422","published":"2026-10-14T13:27:50.789Z","updated":"2026-10-19T09:19:15.873Z","title":"wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-98421","published":"2026-10-14T13:27:50.200Z","updated":"2026-10-19T09:19:14.905Z","title":"wifi: mac80211: require a peer station for TDLS setup confirm","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-98420","published":"2026-10-14T13:27:49.599Z","updated":"2026-10-19T09:19:13.954Z","title":"ksmbd: follow SMB2 session expiration semantics","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-98419","published":"2026-10-14T13:27:49.005Z","updated":"2026-10-24T14:08:45.212Z","title":"drop_monitor: fix out-of-bounds write in reset_per_cpu_data()","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-98418","published":"2026-10-14T13:27:48.406Z","updated":"2026-10-19T09:19:11.970Z","title":"sched/core: Avoid false migration warning for proxy donors","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-98417","published":"2026-10-14T13:27:47.816Z","updated":"2026-10-19T09:19:11.040Z","title":"net: xfrm: reject unrepresentable espintcp transport headers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-98416","published":"2026-10-14T13:27:47.215Z","updated":"2026-10-19T09:19:10.061Z","title":"dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-98415","published":"2026-10-14T13:27:46.596Z","updated":"2026-10-19T09:19:09.114Z","title":"soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-98414","published":"2026-10-14T13:27:46.003Z","updated":"2026-10-19T09:19:08.193Z","title":"memcg: avoid charging the root memcg from obj_cgroup_charge_pages()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-98413","published":"2026-10-14T13:27:45.404Z","updated":"2026-10-19T09:19:07.242Z","title":"selinux: always fill AVC decision in avc_has_perm_noaudit()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-98412","published":"2026-10-14T13:27:44.772Z","updated":"2026-10-19T09:19:06.280Z","title":"power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-98411","published":"2026-10-14T13:27:44.175Z","updated":"2026-10-19T09:19:05.338Z","title":"power: sequencing: fix NULL-pointer dereference in pwrseq_device_register()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-98410","published":"2026-10-14T13:27:43.581Z","updated":"2026-10-19T09:19:04.415Z","title":"watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-98409","published":"2026-10-14T13:27:42.984Z","updated":"2026-10-30T12:38:07.889Z","title":"watchdog: rtd119x: Avoid division by zero","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98408","published":"2026-10-14T13:27:42.390Z","updated":"2026-10-19T09:19:01.406Z","title":"watchdog: rzv2h: Avoid division by zero","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98407","published":"2026-10-14T13:27:41.799Z","updated":"2026-10-19T09:19:00.454Z","title":"wifi: rsi: fix heap OOB write on key removal","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98406","published":"2026-10-14T13:27:41.192Z","updated":"2026-10-19T09:18:59.519Z","title":"wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98405","published":"2026-10-14T13:27:40.589Z","updated":"2026-10-24T14:08:44.159Z","title":"smb: client: fix missing iov bounds check in parse_posix_sids()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00478,"kevAdded":null},{"id":"CVE-2026-98404","published":"2026-10-14T13:26:03.510Z","updated":"2026-10-19T09:18:57.630Z","title":"drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98403","published":"2026-10-14T13:26:02.916Z","updated":"2026-10-19T09:18:56.682Z","title":"s390/boot: Avoid IPL parameter append past command line","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98402","published":"2026-10-14T13:26:02.321Z","updated":"2026-10-19T09:18:55.710Z","title":"net: icmp: avoid invalid transport header access in icmp_send tracepoint","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-98401","published":"2026-10-14T13:26:01.712Z","updated":"2026-10-24T14:08:43.092Z","title":"net: iptunnel: fix stale transport header during tunnel decapsulation","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00595,"kevAdded":null},{"id":"CVE-2026-98400","published":"2026-10-14T13:26:00.872Z","updated":"2026-10-19T09:18:53.762Z","title":"s390/ipl: Fix NULL deref in kdump without re-IPL parm block","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98399","published":"2026-10-14T13:26:00.278Z","updated":"2026-10-19T09:18:52.784Z","title":"s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98398","published":"2026-10-14T13:25:59.676Z","updated":"2026-10-19T09:18:51.739Z","title":"locking/lockdep: Invalidate stale class_cache entries for zapped classes","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98397","published":"2026-10-14T13:25:59.081Z","updated":"2026-10-19T09:18:50.767Z","title":"platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-98396","published":"2026-10-14T13:25:58.490Z","updated":"2026-10-19T09:18:49.794Z","title":"powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98395","published":"2026-10-14T13:25:57.887Z","updated":"2026-10-19T09:18:48.849Z","title":"powerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exit","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-98394","published":"2026-10-14T13:25:57.287Z","updated":"2026-10-19T09:18:47.827Z","title":"af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98393","published":"2026-10-14T13:25:56.697Z","updated":"2026-10-19T09:18:46.601Z","title":"net: ipv4: Fix UDP length overflow with PMTU discover and big MTU","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2026-98392","published":"2026-10-14T13:25:56.096Z","updated":"2026-10-19T09:18:45.317Z","title":"Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98391","published":"2026-10-14T13:25:55.498Z","updated":"2026-10-19T09:18:42.391Z","title":"drm/xe: Guard page-fault worker with runtime PM check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-98390","published":"2026-10-14T13:25:54.905Z","updated":"2026-10-19T09:18:41.175Z","title":"x86/amd_node: Avoid divide by zero on virtualized systems","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2026-98389","published":"2026-10-14T13:25:52.789Z","updated":"2026-10-26T06:55:42.742Z","title":"drm/amdgpu: skip gfx switch_power_profile during GPU reset","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98388","published":"2026-10-14T13:25:52.117Z","updated":"2026-10-19T09:18:39.224Z","title":"exec: do_close_on_exec() before taking exec_update_lock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98387","published":"2026-10-14T13:25:51.513Z","updated":"2026-10-19T09:18:38.225Z","title":"s390/crypto: Fix skcipher_walk return code handling in aes_s390","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98386","published":"2026-10-14T13:25:50.908Z","updated":"2026-10-30T12:38:06.821Z","title":"scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98385","published":"2026-10-12T05:48:52.248Z","updated":"2026-10-24T14:08:42.034Z","title":"sched/cache: Decouple sched_cache_group from mm to fix UAF","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98384","published":"2026-10-09T07:34:23.097Z","updated":"2026-10-19T09:18:35.149Z","title":"bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-98383","published":"2026-10-09T07:34:22.408Z","updated":"2026-10-24T14:08:40.964Z","title":"bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-98382","published":"2026-10-09T07:34:21.718Z","updated":"2026-10-24T14:08:39.904Z","title":"bpf: Reject dev-bound-only programs on other devices","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-98381","published":"2026-10-09T07:34:21.029Z","updated":"2026-10-24T14:08:38.193Z","title":"veth: manage XDP program pointers during channel resize","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-98380","published":"2026-10-09T07:34:20.218Z","updated":"2026-10-19T09:18:31.007Z","title":"net/sched: reject IDR error pointers when deleting actions","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98379","published":"2026-10-09T07:34:19.425Z","updated":"2026-10-19T09:18:30.044Z","title":"netfilter: ip6t_rpfilter: reject routes without inet6_dev","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-98378","published":"2026-10-09T07:34:18.626Z","updated":"2026-10-24T14:08:37.091Z","title":"bpf: Skip unsettled links in link iterator","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-98377","published":"2026-10-09T07:34:17.832Z","updated":"2026-10-30T12:38:05.752Z","title":"vlan: require the MAC header to be present in __vlan_insert_inner_tag()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-98376","published":"2026-10-09T07:34:17.043Z","updated":"2026-10-24T14:08:36.004Z","title":"bpf: Use array_map_meta_equal for percpu array inner map replacement","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2026-98375","published":"2026-10-09T07:10:45.930Z","updated":"2026-10-30T12:38:04.686Z","title":"xen/netfront: drop RX packets with a short Ethernet header","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98374","published":"2026-10-07T13:01:48.600Z","updated":"2026-10-24T14:08:34.914Z","title":"tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2026-98373","published":"2026-10-07T13:01:47.433Z","updated":"2026-10-30T12:38:03.639Z","title":"mm/hugetlb: preserve mremap address delta when skipping page tables","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-98372","published":"2026-10-06T08:46:56.529Z","updated":"2026-10-19T09:18:24.195Z","title":"xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98371","published":"2026-10-06T08:46:55.753Z","updated":"2026-10-19T09:18:23.197Z","title":"xfrm: iptfs: fix runt reassembly panic from short inner tot_len","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-98370","published":"2026-10-06T08:46:54.981Z","updated":"2026-10-19T09:18:22.245Z","title":"xfrm: fix compat ALLOCSPI request use-after-free","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-98369","published":"2026-10-06T08:46:54.188Z","updated":"2026-10-19T09:18:21.221Z","title":"xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-98368","published":"2026-10-06T08:46:53.292Z","updated":"2026-10-19T09:18:20.253Z","title":"esp: downgrade zerocopy managed frags before mutating skb frags","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-98367","published":"2026-10-06T08:46:52.452Z","updated":"2026-10-19T09:18:19.262Z","title":"RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-98366","published":"2026-10-06T08:46:51.638Z","updated":"2026-10-19T09:18:18.297Z","title":"RDMA/rxe: validate access flags before swapping the MR's PD","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2026-98365","published":"2026-10-06T08:46:50.834Z","updated":"2026-10-19T09:18:17.324Z","title":"RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00377,"kevAdded":null},{"id":"CVE-2026-98364","published":"2026-10-06T08:46:50.051Z","updated":"2026-10-19T09:18:16.366Z","title":"xfrm: hold net_device reference under RCU in bundle creation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-98363","published":"2026-10-06T08:46:49.235Z","updated":"2026-10-19T09:18:15.202Z","title":"firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-98362","published":"2026-10-06T08:46:48.426Z","updated":"2026-10-19T09:18:13.818Z","title":"clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-98361","published":"2026-10-06T08:46:47.600Z","updated":"2026-10-19T09:18:12.480Z","title":"RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-98360","published":"2026-10-06T08:46:46.743Z","updated":"2026-10-19T09:18:11.284Z","title":"RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-98359","published":"2026-10-06T08:46:45.938Z","updated":"2026-10-19T09:18:09.934Z","title":"RDMA/core: Reject unregistering netdevs in ib_get_eth_speed","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2026-98358","published":"2026-10-06T08:46:45.128Z","updated":"2026-10-19T09:18:08.867Z","title":"IB/iser: reject a remote invalidation of an unregistered direction","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-98357","published":"2026-10-06T08:46:44.216Z","updated":"2026-10-19T09:18:07.886Z","title":"IB/isert: wait for deferred control PDU completions before releasing the connection","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00354,"kevAdded":null},{"id":"CVE-2026-98356","published":"2026-10-06T08:46:43.380Z","updated":"2026-10-19T09:18:06.876Z","title":"RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98355","published":"2026-10-06T08:46:42.583Z","updated":"2026-10-19T09:18:05.923Z","title":"RDMA/rtrs: guard against null kobj name","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-98354","published":"2026-10-06T08:46:41.768Z","updated":"2026-10-19T09:18:04.973Z","title":"RDMA/mad: Fix receive buffer leak when PKey enforcement fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-98353","published":"2026-10-06T08:46:40.955Z","updated":"2026-10-30T12:38:02.585Z","title":"RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-98352","published":"2026-10-06T08:46:40.151Z","updated":"2026-10-19T09:18:03.073Z","title":"RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-98351","published":"2026-10-06T08:46:39.335Z","updated":"2026-10-19T09:18:02.098Z","title":"wifi: virt_wifi: free skb when disconnected","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-98350","published":"2026-10-06T08:46:38.525Z","updated":"2026-10-19T09:18:01.119Z","title":"wifi: brcmfmac: cyw: pass PMKID to firmware if present","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2026-98349","published":"2026-10-06T08:46:37.713Z","updated":"2026-10-19T09:18:00.168Z","title":"wifi: libipw: reject too-short beacon and probe responses","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2026-98348","published":"2026-10-06T08:46:36.927Z","updated":"2026-10-19T09:17:59.174Z","title":"wifi: libipw: reject too-short association responses","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2026-98347","published":"2026-10-06T08:46:36.136Z","updated":"2026-10-19T09:17:58.195Z","title":"IB/IPoIB: Avoid restoring OPER_UP after multicast flush","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98346","published":"2026-10-06T08:46:35.409Z","updated":"2026-10-19T09:17:57.199Z","title":"wifi: cfg80211: don't get the radio mask for netdev-less wdevs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98345","published":"2026-10-06T08:46:34.719Z","updated":"2026-10-19T09:17:56.221Z","title":"wifi: cfg80211: check IP header size in cfg80211_classify8021d()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98344","published":"2026-10-06T08:46:33.997Z","updated":"2026-10-19T09:17:55.263Z","title":"dmaengine: Fix device kref underflow in dma_chan_put()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98343","published":"2026-10-06T08:46:33.196Z","updated":"2026-10-19T09:17:54.287Z","title":"dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98342","published":"2026-10-06T08:46:32.366Z","updated":"2026-10-19T09:17:53.321Z","title":"dmaengine: wait for RCU readers before releasing dma_device","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98341","published":"2026-10-06T08:46:31.585Z","updated":"2026-10-19T09:17:52.370Z","title":"wifi: cfg80211: don't free driver-owned scan requests","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-98340","published":"2026-10-06T08:46:30.796Z","updated":"2026-10-19T09:17:51.387Z","title":"wifi: cfg80211: only group hidden BSSes with beacon entries","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98339","published":"2026-10-06T08:46:29.998Z","updated":"2026-10-19T09:17:50.299Z","title":"wifi: cfg80211: don't filter by BSS type when removing stale entries","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2026-98338","published":"2026-10-06T08:46:29.213Z","updated":"2026-10-19T09:17:49.327Z","title":"wifi: cfg80211: ibss: ref BSS entry for joined event","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-98337","published":"2026-10-06T08:46:28.420Z","updated":"2026-10-19T09:17:48.362Z","title":"wifi: mac80211: don't start a ROC while scanning","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-98336","published":"2026-10-06T08:46:27.634Z","updated":"2026-10-19T09:17:47.387Z","title":"wifi: mac80211: don't offload TC setup on AP_VLAN interfaces","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-98335","published":"2026-10-06T08:46:26.816Z","updated":"2026-10-19T09:17:46.461Z","title":"wifi: mac80211: abort chanswitch when leaving a mesh","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-98334","published":"2026-10-06T08:46:25.992Z","updated":"2026-10-19T09:17:45.494Z","title":"wifi: mac80211: reset state when starting AP fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-98333","published":"2026-10-06T08:46:25.118Z","updated":"2026-10-19T09:17:44.501Z","title":"wifi: mac80211: reset the LED state when ifup fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-98332","published":"2026-10-06T08:46:24.332Z","updated":"2026-10-19T09:17:43.556Z","title":"wifi: mac80211: only operate on TDLS peers in the TDLS code","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98331","published":"2026-10-06T08:46:23.481Z","updated":"2026-10-19T09:17:41.508Z","title":"wifi: mac80211: unlist vifs when their netdev is unregistered","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-98330","published":"2026-10-06T08:46:22.688Z","updated":"2026-10-19T09:17:40.543Z","title":"wifi: cfg80211: get the wiphy out of a dying network namespace","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-98329","published":"2026-10-06T08:46:21.887Z","updated":"2026-10-19T09:17:39.579Z","title":"wifi: mac80211: don't allow injecting frames wider than the chanctx","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98328","published":"2026-10-06T08:46:21.099Z","updated":"2026-10-19T09:17:38.625Z","title":"wifi: mac80211: add HE 6 GHz capability in the scan elems len","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-98327","published":"2026-10-06T08:46:20.317Z","updated":"2026-10-19T09:17:37.676Z","title":"wifi: mac80211: mesh: reset the CSA state when leaving","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-98326","published":"2026-10-06T08:46:19.534Z","updated":"2026-10-19T09:17:36.726Z","title":"wifi: mac80211: mesh: release the channel if start fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-98325","published":"2026-10-06T08:46:18.734Z","updated":"2026-10-19T09:17:35.760Z","title":"wifi: mac80211: set up the TX info early to fix failure paths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98324","published":"2026-10-06T08:46:17.919Z","updated":"2026-10-19T09:17:34.749Z","title":"dmaengine: pxa: fix double counting of the hw descriptors","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-98323","published":"2026-10-06T08:46:17.150Z","updated":"2026-10-19T09:17:33.779Z","title":"RDMA/siw: Bound fragmented header copies by the remaining length","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-98322","published":"2026-10-06T08:46:16.346Z","updated":"2026-10-19T09:17:32.745Z","title":"netfilter: nft_nat: fully initialise new_addr in netmap setup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-98321","published":"2026-10-06T08:46:15.546Z","updated":"2026-10-19T09:17:31.752Z","title":"netfilter: nf_nat: unregister and release hooks on error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98320","published":"2026-10-06T08:46:14.757Z","updated":"2026-10-19T09:17:30.784Z","title":"netfilter: flowtable: hold reference on ct until flow is released","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-98319","published":"2026-10-06T08:46:13.948Z","updated":"2026-10-19T09:17:29.834Z","title":"drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-98318","published":"2026-10-06T08:46:13.140Z","updated":"2026-10-19T09:17:28.900Z","title":"smb: client: validate absolute native symlink targets before NT fixups","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-98317","published":"2026-10-06T08:46:12.351Z","updated":"2026-10-19T09:17:27.952Z","title":"neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98316","published":"2026-10-06T08:46:11.528Z","updated":"2026-10-19T09:17:26.993Z","title":"ALSA: bcd2000: Fix race between rawmidi and disconnect","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98315","published":"2026-10-06T08:46:10.751Z","updated":"2026-10-19T09:17:25.955Z","title":"ntfs: protect runlist updates with the runlist lock","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-98314","published":"2026-10-06T08:46:09.965Z","updated":"2026-10-19T09:17:24.800Z","title":"ALSA: pcm: set timer->private_data before registering the PCM timer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-98313","published":"2026-10-06T08:46:09.174Z","updated":"2026-10-19T09:17:23.779Z","title":"drm/msm/dp: skip PUSH_IDLE when the link was never enabled","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98312","published":"2026-10-06T08:46:08.388Z","updated":"2026-10-19T09:17:22.807Z","title":"ALSA: 6fire: fix OOB write from device-reported iso length","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98311","published":"2026-10-06T08:46:07.562Z","updated":"2026-10-19T09:17:21.813Z","title":"wifi: virt_wifi: don't transfer operstate before register","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-98310","published":"2026-10-06T08:46:06.767Z","updated":"2026-10-19T09:17:20.846Z","title":"drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98309","published":"2026-10-06T08:46:05.957Z","updated":"2026-10-19T09:17:19.914Z","title":"drm/vc4: Use managed KMS polling to fix UAF on unbind","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-98308","published":"2026-10-06T08:46:05.128Z","updated":"2026-10-19T09:17:18.952Z","title":"ALSA: hda: trace PCM open only after assigning a stream","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98307","published":"2026-10-06T08:46:04.301Z","updated":"2026-10-19T09:17:17.992Z","title":"wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98306","published":"2026-10-06T08:46:03.001Z","updated":"2026-10-19T09:17:17.032Z","title":"seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-98305","published":"2026-10-06T08:46:02.190Z","updated":"2026-10-19T09:17:16.045Z","title":"net: dsa: mxl862xx: disable the stats poll on teardown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-98304","published":"2026-10-06T08:46:01.353Z","updated":"2026-10-19T09:17:15.103Z","title":"net: bcmgenet: restore the hardware filters on open","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98303","published":"2026-10-06T08:46:00.524Z","updated":"2026-10-19T09:17:14.136Z","title":"ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-98302","published":"2026-10-06T08:45:59.718Z","updated":"2026-10-19T09:17:13.166Z","title":"net: fddi: skfp: fix NULL deref when setting the MAC address while down","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98301","published":"2026-10-06T08:45:58.908Z","updated":"2026-10-19T09:17:12.171Z","title":"net: bridge: mst: move switchdev call outside rcu","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-98300","published":"2026-10-06T08:45:58.091Z","updated":"2026-10-19T09:17:11.164Z","title":"tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98299","published":"2026-10-06T08:45:57.226Z","updated":"2026-10-19T09:17:10.154Z","title":"tcp: do not let tcp_rmem be set below 4096","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98298","published":"2026-10-06T08:45:56.417Z","updated":"2026-10-19T09:17:09.166Z","title":"dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-98297","published":"2026-10-06T08:45:55.723Z","updated":"2026-10-30T12:38:01.528Z","title":"Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-98296","published":"2026-10-06T08:45:55.034Z","updated":"2026-10-19T09:17:07.243Z","title":"Bluetooth: btintel_pcie: validate TX skb length in send_sync","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98295","published":"2026-10-06T08:45:54.141Z","updated":"2026-10-19T09:17:06.302Z","title":"Bluetooth: coredump: Quiesce dump work on unregister","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98294","published":"2026-10-06T08:45:53.338Z","updated":"2026-10-19T09:17:05.335Z","title":"Bluetooth: hci_qca: Do not write to the serial port after it is closed","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98293","published":"2026-10-06T08:45:52.558Z","updated":"2026-10-19T09:17:04.348Z","title":"Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-98292","published":"2026-10-06T08:45:51.807Z","updated":"2026-10-19T09:17:03.377Z","title":"Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-98291","published":"2026-10-06T08:45:51.021Z","updated":"2026-10-19T09:17:02.456Z","title":"Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98290","published":"2026-10-06T08:45:50.299Z","updated":"2026-10-19T09:17:01.498Z","title":"Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2026-98289","published":"2026-10-06T08:45:49.641Z","updated":"2026-10-19T09:17:00.475Z","title":"af_unix: Unify scc_index when finalising SCC in __unix_walk_scc().","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98288","published":"2026-10-06T08:45:48.856Z","updated":"2026-10-19T09:16:59.513Z","title":"net: stmmac: fix TSO header length truncation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98287","published":"2026-10-06T08:45:47.998Z","updated":"2026-10-19T09:16:58.585Z","title":"pppoatm: ensure a writable skb header and linear data","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98286","published":"2026-10-06T08:45:47.167Z","updated":"2026-10-19T09:16:57.641Z","title":"drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98285","published":"2026-10-06T08:45:46.332Z","updated":"2026-10-19T09:16:56.666Z","title":"net: bridge: vlan: fix bugs caused by switchdev deletion errors","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98284","published":"2026-10-06T08:45:45.443Z","updated":"2026-10-19T09:16:55.695Z","title":"netlink: do not free nlk->groups while lockless readers can use it","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98283","published":"2026-10-06T08:45:44.593Z","updated":"2026-10-19T09:16:54.747Z","title":"KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-98282","published":"2026-10-06T08:45:43.775Z","updated":"2026-10-19T09:16:53.780Z","title":"powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-98281","published":"2026-10-06T08:45:40.719Z","updated":"2026-10-19T09:16:52.791Z","title":"futex: Also allocate private hash on vfork()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-98280","published":"2026-10-06T08:45:39.956Z","updated":"2026-10-19T09:16:51.832Z","title":"drm/xe/i2c: Disable IRQ on unbind","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98279","published":"2026-10-06T08:45:39.114Z","updated":"2026-10-19T09:16:50.852Z","title":"btrfs: handle lack of space when cleaning up verity items","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98278","published":"2026-10-06T08:45:38.346Z","updated":"2026-10-19T09:16:49.865Z","title":"net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98277","published":"2026-10-06T08:45:37.598Z","updated":"2026-10-19T09:16:48.825Z","title":"eth: fbnic: ring the doorbell if a burst ends in a drop","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-98276","published":"2026-10-06T08:45:36.837Z","updated":"2026-10-19T09:16:47.879Z","title":"net: lock the socket in sock_gettstamp()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-98275","published":"2026-10-06T08:45:36.081Z","updated":"2026-10-19T09:16:46.876Z","title":"net: ethernet: cortina: Ack RX overrun interrupt correctly","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98274","published":"2026-10-06T08:45:35.297Z","updated":"2026-10-19T09:16:45.903Z","title":"net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98273","published":"2026-10-06T08:45:34.645Z","updated":"2026-10-19T09:16:44.960Z","title":"x86/kprobes: Fix crash when probing CS CALL instructions","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98272","published":"2026-10-06T08:45:33.974Z","updated":"2026-10-19T09:16:44.017Z","title":"net: mvpp2: prevent buffer overflow in page_pool allocation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-98271","published":"2026-10-06T08:45:33.298Z","updated":"2026-10-19T09:16:41.976Z","title":"net: skbuff: do not leave stale header offsets after pskb_carve()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98270","published":"2026-10-06T08:45:32.506Z","updated":"2026-10-19T09:16:41.028Z","title":"drm/amdgpu: check ras and obj before dereference","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98269","published":"2026-10-06T08:45:31.727Z","updated":"2026-10-19T09:16:40.051Z","title":"btrfs: abort transaction on failure to update inode for hole punching and reflinking","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98268","published":"2026-10-06T08:45:30.917Z","updated":"2026-10-19T09:16:39.095Z","title":"perf: Fix null pointer access in is_include_guest_event()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98267","published":"2026-10-06T08:45:30.042Z","updated":"2026-10-19T09:16:38.154Z","title":"9p: Fix v9fs_issue_write() to update i_size and remote_i_size","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98266","published":"2026-10-06T08:45:29.236Z","updated":"2026-10-19T09:16:37.189Z","title":"ALSA: core: Fix potential UAF after asynchronous card release","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98265","published":"2026-10-06T08:45:28.438Z","updated":"2026-10-30T12:38:00.448Z","title":"ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98264","published":"2026-10-06T08:45:27.657Z","updated":"2026-10-30T12:37:59.365Z","title":"ALSA: virtio: reset device before deleting virtqueues","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98263","published":"2026-10-06T08:45:26.884Z","updated":"2026-10-19T09:16:34.265Z","title":"ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98262","published":"2026-10-06T08:45:26.118Z","updated":"2026-10-19T09:16:33.319Z","title":"ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98261","published":"2026-10-06T08:45:25.361Z","updated":"2026-10-19T09:16:32.334Z","title":"cifs: Fix server use-after-free in cifs_chan_skip_or_disable()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-98260","published":"2026-10-06T08:45:24.711Z","updated":"2026-10-30T12:37:58.294Z","title":"exec: Cleanup POSIX timers right after de_thread()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-98259","published":"2026-10-06T08:45:24.031Z","updated":"2026-10-19T09:16:30.392Z","title":"fs/dax: check zero or empty entry before converting xarray entry","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98258","published":"2026-10-06T08:45:23.379Z","updated":"2026-10-19T09:16:29.418Z","title":"posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-98257","published":"2026-10-06T08:45:22.722Z","updated":"2026-10-19T09:16:28.470Z","title":"rds: ib: use rds_conn_drop() on protocol version mismatch","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-98256","published":"2026-10-06T08:45:22.048Z","updated":"2026-10-19T09:16:27.502Z","title":"signal: Prevent exec() race","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-98255","published":"2026-10-06T08:45:21.397Z","updated":"2026-10-19T09:16:26.522Z","title":"tcp: exclude old ACKs from tcp fast path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98254","published":"2026-10-06T08:45:20.736Z","updated":"2026-10-19T09:16:25.551Z","title":"swiotlb: use the adjusted address for the highmem page lookup","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-98253","published":"2026-10-06T08:45:20.077Z","updated":"2026-10-19T09:16:24.567Z","title":"RDMA/ucma: Serialize join and leave on copy_to_user failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-98252","published":"2026-10-06T08:45:19.393Z","updated":"2026-10-19T09:16:23.591Z","title":"RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-98251","published":"2026-10-06T08:45:18.707Z","updated":"2026-10-19T09:16:22.619Z","title":"openvswitch: avoid reallocating confirmed conntrack labels","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-98250","published":"2026-10-06T08:45:18.060Z","updated":"2026-10-19T09:16:21.627Z","title":"nfsd: fix handling of NFSEXP_PNFS in the netlink codepath","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98249","published":"2026-10-06T08:45:17.414Z","updated":"2026-10-19T09:16:20.676Z","title":"arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98248","published":"2026-10-06T08:45:16.693Z","updated":"2026-10-19T09:16:19.730Z","title":"arm64: percpu: Fix LSE operations on {8,16}-bit types","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98247","published":"2026-10-06T08:45:16.048Z","updated":"2026-10-19T09:16:18.761Z","title":"Bluetooth: hci_codec: validate vendor codec count length","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-98246","published":"2026-10-06T08:45:15.411Z","updated":"2026-10-19T09:16:17.812Z","title":"Bluetooth: hci_sync: Serialize local codec list cleanup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98245","published":"2026-10-06T08:45:14.758Z","updated":"2026-10-30T12:37:57.233Z","title":"btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98244","published":"2026-10-06T08:45:14.120Z","updated":"2026-10-19T09:16:15.841Z","title":"btrfs: clear free space tree creation state on rebuild failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98243","published":"2026-10-06T08:45:13.411Z","updated":"2026-10-19T09:16:14.740Z","title":"dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-98242","published":"2026-10-06T08:45:12.662Z","updated":"2026-10-19T09:16:13.758Z","title":"dma-buf: Fix silent overflow for phys vec to sgt","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98241","published":"2026-10-06T08:45:11.954Z","updated":"2026-10-19T09:16:12.796Z","title":"ipv6: xfrm: use full sockets in local error paths","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-98240","published":"2026-10-06T08:45:11.284Z","updated":"2026-10-19T09:16:11.863Z","title":"net: ip_tunnel: initialize `options_len` before referencing options","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-98239","published":"2026-10-06T08:45:10.611Z","updated":"2026-10-19T09:16:10.911Z","title":"net: lan743x: fix RX checksum use-after-free","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2026-98238","published":"2026-10-06T08:45:09.953Z","updated":"2026-10-19T09:16:09.924Z","title":"net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98237","published":"2026-10-06T08:45:09.277Z","updated":"2026-10-19T09:16:08.988Z","title":"net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98236","published":"2026-10-06T08:45:08.600Z","updated":"2026-10-19T09:16:08.044Z","title":"net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98235","published":"2026-10-06T08:45:07.909Z","updated":"2026-10-19T09:16:07.068Z","title":"net/sched: act_api: release tail references on DELACTION failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98234","published":"2026-10-06T08:45:07.215Z","updated":"2026-10-19T09:16:06.128Z","title":"net/sched: hhf: cap hh_flows_limit at change time","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98233","published":"2026-10-06T08:45:06.533Z","updated":"2026-10-19T09:16:05.070Z","title":"net/packet: clear RX owner on VNET header error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98232","published":"2026-10-06T08:45:05.848Z","updated":"2026-10-19T09:16:04.072Z","title":"scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98231","published":"2026-10-06T08:45:05.183Z","updated":"2026-10-19T09:16:03.101Z","title":"xfrm: serialize state GC with device state flush","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98230","published":"2026-10-06T08:45:04.548Z","updated":"2026-10-19T09:16:02.121Z","title":"xfrm: use hlist_del_init_rcu for state_cache and state_cache_input","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2026-98229","published":"2026-10-06T08:45:03.904Z","updated":"2026-10-19T09:16:01.147Z","title":"xfrm: save input state data before secpath resets","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98228","published":"2026-10-06T08:45:03.154Z","updated":"2026-10-19T09:15:59.955Z","title":"mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-98227","published":"2026-10-06T08:45:02.265Z","updated":"2026-10-19T09:15:58.990Z","title":"memstick: ms_block: destroy io_queue workqueue on removal","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98226","published":"2026-10-06T08:45:01.370Z","updated":"2026-10-19T09:15:58.031Z","title":"mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98225","published":"2026-10-06T08:45:00.458Z","updated":"2026-10-19T09:15:57.057Z","title":"mm/shrinker: fix bogus set_shrinker_bit() with cgroup.memory=nokmem","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98224","published":"2026-10-06T08:44:59.349Z","updated":"2026-10-19T09:15:56.109Z","title":"mm/vma: correctly unaccount on mmap_prepare() failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98223","published":"2026-10-06T08:44:58.472Z","updated":"2026-10-19T09:15:55.143Z","title":"mm: filemap: retain mapped dropbehind folios","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98222","published":"2026-10-06T08:44:57.621Z","updated":"2026-10-19T09:15:54.199Z","title":"KEYS: encrypted: fix integer overflow of datablob_len","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98221","published":"2026-10-06T08:44:56.728Z","updated":"2026-10-19T09:15:53.271Z","title":"KEYS: trusted: Fix tpm2_load_cmd() boundary check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98220","published":"2026-10-06T08:44:55.843Z","updated":"2026-10-19T09:15:52.306Z","title":"sched_ext: Fix NULL sched deref in kfunc sub-sched error paths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-98219","published":"2026-10-06T08:44:54.943Z","updated":"2026-10-19T09:15:51.341Z","title":"sched_ext: Close the pre-enable ops error claim window","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98218","published":"2026-10-06T08:44:54.034Z","updated":"2026-10-19T09:15:49.004Z","title":"i2c: atr: fix dangling adapter pointer on add failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98217","published":"2026-10-06T08:44:53.152Z","updated":"2026-10-19T09:15:47.995Z","title":"IB/mlx4: Fix use-after-free on pkey sysfs registration failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98216","published":"2026-10-06T08:44:52.288Z","updated":"2026-10-19T09:15:47.022Z","title":"IB/hfi1: Fix the PIO_CRED credit-return mmap","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-98215","published":"2026-10-06T08:44:51.412Z","updated":"2026-10-19T09:15:46.038Z","title":"selinux: preserve user SID across nested backing files","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98214","published":"2026-10-06T08:44:50.209Z","updated":"2026-10-19T09:15:45.082Z","title":"selinux: recheck intermediate backing files on mprotect()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98213","published":"2026-10-06T08:44:49.352Z","updated":"2026-10-19T09:15:44.065Z","title":"mmc: core: Cancel SDIO IRQ work before freeing host","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-98212","published":"2026-10-06T08:44:48.498Z","updated":"2026-10-19T09:15:43.105Z","title":"mmc: hsq: Fix use-after-free in retry work","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98211","published":"2026-10-06T08:44:47.637Z","updated":"2026-10-19T09:15:42.136Z","title":"mmc: mmci: Fix use-after-free in busy-timeout work","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98210","published":"2026-10-06T08:44:46.788Z","updated":"2026-10-19T09:15:41.186Z","title":"mmc: mxcmmc: cancel data work and watchdog on remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98209","published":"2026-10-06T08:44:45.933Z","updated":"2026-10-19T09:15:40.223Z","title":"mmc: sdhci-of-aspeed: Remove children before releasing SDC resources","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98208","published":"2026-10-06T08:44:45.098Z","updated":"2026-10-19T09:15:39.242Z","title":"mmc: sdio_uart: fix xmit_fifo leak when the port table is full","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98207","published":"2026-10-06T08:44:44.241Z","updated":"2026-10-19T09:15:38.158Z","title":"mmc: spi: reset bytes_xfered before retrying CRC failures","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98206","published":"2026-10-06T08:44:43.399Z","updated":"2026-10-19T09:15:37.111Z","title":"Input: cyttsp5 - clamp the HID report size before memcpy","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98205","published":"2026-10-06T08:44:42.563Z","updated":"2026-10-19T09:15:36.157Z","title":"Input: evdev - zero absinfo before partial copy in EVIOCSABS","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98204","published":"2026-10-06T08:44:41.712Z","updated":"2026-10-19T09:15:35.168Z","title":"Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98203","published":"2026-10-06T08:44:40.883Z","updated":"2026-10-19T09:15:34.197Z","title":"Input: soc_button_array - check btns_desc->package.count","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98202","published":"2026-10-06T08:44:40.045Z","updated":"2026-10-19T09:15:33.226Z","title":"Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98201","published":"2026-10-06T08:44:38.952Z","updated":"2026-10-19T09:15:32.269Z","title":"Input: zero ff_effect before compat copy in input_ff_effect_from_user","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98200","published":"2026-10-06T08:44:38.289Z","updated":"2026-10-19T09:15:31.295Z","title":"hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98199","published":"2026-10-06T08:44:37.623Z","updated":"2026-10-19T09:15:30.300Z","title":"hwmon: (pmbus/core) increase number of phases and add new mask","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98198","published":"2026-10-06T08:44:36.944Z","updated":"2026-10-30T12:37:56.162Z","title":"hwmon: (pwm-fan) Stop RPM timer before freeing tach data","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98197","published":"2026-10-06T08:44:36.283Z","updated":"2026-10-19T09:15:28.363Z","title":"hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-98196","published":"2026-10-06T08:44:35.616Z","updated":"2026-10-19T09:15:27.411Z","title":"wifi: brcmsmac: fix UAF in brcms_free_timer()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98195","published":"2026-10-06T08:44:34.915Z","updated":"2026-10-19T09:15:26.463Z","title":"wifi: iwlegacy: fix broadcast stations deallocation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98194","published":"2026-10-06T08:44:34.253Z","updated":"2026-10-19T09:15:25.503Z","title":"wifi: libertas_tf: fix UAF in lbtf_free_adapter()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98193","published":"2026-10-06T08:44:33.584Z","updated":"2026-10-30T12:37:54.286Z","title":"wifi: libipw: reject TKIP frames without a full MIC","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98192","published":"2026-10-06T08:44:32.912Z","updated":"2026-10-30T12:37:53.227Z","title":"wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98191","published":"2026-10-06T08:44:32.240Z","updated":"2026-10-19T09:15:22.651Z","title":"wifi: wlcore: release runtime PM ref on regdomain config failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98190","published":"2026-10-06T08:44:31.520Z","updated":"2026-10-19T09:15:21.647Z","title":"wifi: wilc1000: fix out-of-bounds read in P2P public action frames","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98189","published":"2026-10-06T08:44:30.807Z","updated":"2026-10-19T09:15:20.667Z","title":"wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98188","published":"2026-10-06T08:44:30.096Z","updated":"2026-10-19T09:15:19.711Z","title":"wifi: p54: validate curve data length in the calibration curve converters","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98187","published":"2026-10-06T08:44:29.258Z","updated":"2026-10-19T09:15:18.735Z","title":"wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98186","published":"2026-10-06T08:44:28.429Z","updated":"2026-10-19T09:15:17.749Z","title":"wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98185","published":"2026-10-06T08:44:27.654Z","updated":"2026-10-19T09:15:16.426Z","title":"wifi: mwifiex: validate scan response extents","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98184","published":"2026-10-06T08:44:26.836Z","updated":"2026-10-19T09:15:15.381Z","title":"wifi: mwifiex: prevent authentication frame length truncation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2026-98183","published":"2026-10-06T08:44:26.024Z","updated":"2026-10-19T09:15:14.410Z","title":"wifi: mac80211: avoid out-of-bounds read for empty PREQ elements","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98182","published":"2026-10-06T08:44:25.219Z","updated":"2026-10-19T09:15:13.449Z","title":"wifi: mac80211: refuse to make a monitor active when it has no queue","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98181","published":"2026-10-06T08:44:24.284Z","updated":"2026-10-19T09:15:12.473Z","title":"drm/gud: fix out-of-bounds write in gud_plane_atomic_check()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98180","published":"2026-10-06T08:44:23.327Z","updated":"2026-10-19T09:15:11.540Z","title":"drm/msm: RCU-free the scheduler-containing ring and VM objects","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-98179","published":"2026-10-06T08:44:22.410Z","updated":"2026-10-19T09:15:10.578Z","title":"drm/amdgpu: fix rmmio iounmap skipped on device removal","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98178","published":"2026-10-06T08:44:21.602Z","updated":"2026-10-19T09:15:09.614Z","title":"drm/amdgpu: Skip KFD mapping clear before initialization","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98177","published":"2026-10-06T08:44:20.807Z","updated":"2026-10-19T09:15:08.686Z","title":"drm/amdkfd: Avoid integer underflow in EOP ring size calculation.","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98176","published":"2026-10-06T08:44:20.004Z","updated":"2026-10-19T09:15:07.720Z","title":"drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98175","published":"2026-10-06T08:44:19.155Z","updated":"2026-10-19T09:15:06.742Z","title":"smb: client: cancel reconnect work in clean_demultiplex_info()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2026-98174","published":"2026-10-06T08:44:18.350Z","updated":"2026-10-19T09:15:05.758Z","title":"smb: client: fix rlist race and missing initialization","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-98173","published":"2026-10-06T08:44:17.567Z","updated":"2026-10-30T12:37:52.156Z","title":"smb: client: fix use-after-free of iface in cifs_try_adding_channels()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-98172","published":"2026-10-06T08:44:16.721Z","updated":"2026-10-30T12:37:51.075Z","title":"smb: client: fix smbd_connection leak on cifs_get_tcp_session() error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98171","published":"2026-10-06T08:44:15.927Z","updated":"2026-10-30T12:37:50.015Z","title":"smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00537,"kevAdded":null},{"id":"CVE-2026-98170","published":"2026-10-06T08:44:15.138Z","updated":"2026-10-30T12:37:48.952Z","title":"smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98169","published":"2026-10-06T08:44:14.339Z","updated":"2026-10-30T12:37:47.892Z","title":"smb: client: fix potential OOB read in smb3_enum_snapshots()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00448,"kevAdded":null},{"id":"CVE-2026-98168","published":"2026-10-06T08:44:13.534Z","updated":"2026-10-21T12:54:47.190Z","title":"smb: client: fix reparse buffer bounds in cifs_query_reparse_point()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98167","published":"2026-10-06T08:44:12.731Z","updated":"2026-10-19T09:14:58.765Z","title":"smb: client: fix server->total_read for compound encrypted PDUs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2026-98166","published":"2026-10-06T08:44:11.927Z","updated":"2026-10-26T15:12:59.824Z","title":"drm/ttm: fix swapped-out resources never leaving their bulk_move range","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-98164","published":"2026-09-29T12:02:12.574Z","updated":"2026-10-07T06:49:16.773Z","title":"KVM: x86/mmu: Check write tracking in all address spaces","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2026-98163","published":"2026-09-26T08:31:50.899Z","updated":"2026-10-19T09:14:56.823Z","title":"cgroup: Avoid iteration of dying tasks with zero refcount","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00106,"kevAdded":null},{"id":"CVE-2026-98162","published":"2026-09-25T13:06:51.778Z","updated":"2026-10-21T12:54:46.112Z","title":"smb/server: fix tree connection leak in smb2_tree_connect()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-98161","published":"2026-09-25T13:06:51.138Z","updated":"2026-10-21T12:54:44.996Z","title":"nvdimm: pmem: keep PREFLUSH before data writes","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-98160","published":"2026-09-25T13:06:50.521Z","updated":"2026-10-19T09:14:53.943Z","title":"staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-100079","published":"2026-09-25T13:06:49.915Z","updated":"2026-10-19T08:43:11.422Z","title":"usb: typec: ucsi: unregister debugfs entries on teardown","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-100078","published":"2026-09-25T13:06:49.327Z","updated":"2026-10-19T08:43:10.437Z","title":"wifi: iwlwifi: mei: pass correct argument to function","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2026-100077","published":"2026-09-25T13:06:48.707Z","updated":"2026-10-30T12:23:39.810Z","title":"drm/msm: Recover HW before retire hung submit","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-100076","published":"2026-09-25T13:06:48.057Z","updated":"2026-10-30T12:23:38.744Z","title":"staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-100075","published":"2026-09-25T13:06:47.399Z","updated":"2026-10-19T08:43:07.444Z","title":"RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2026-100074","published":"2026-09-25T13:06:46.777Z","updated":"2026-10-21T12:38:46.286Z","title":"bpf: Mark bpf_refcount field as unique","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-100073","published":"2026-09-25T13:06:46.185Z","updated":"2026-10-19T08:43:05.446Z","title":"ext4: fix transaction overflow during writeback","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-100072","published":"2026-09-25T13:06:45.579Z","updated":"2026-10-21T12:38:45.183Z","title":"ACPI: platform: Use acpi_bus_get_primary_device()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-100071","published":"2026-09-25T13:06:44.956Z","updated":"2026-10-19T08:43:03.400Z","title":"net: hsr: free learned nodes on device setup failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-100070","published":"2026-09-25T13:06:44.311Z","updated":"2026-10-19T08:43:02.432Z","title":"netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2026-98159","published":"2026-09-25T10:36:28.206Z","updated":"2026-10-19T09:14:53.011Z","title":"wifi: mt76: mt7921: validate CLC firmware records","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-98158","published":"2026-09-25T10:36:27.608Z","updated":"2026-10-19T09:14:52.068Z","title":"ppp_async: drop the errored frame instead of resetting its headroom","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-98157","published":"2026-09-25T10:36:27.009Z","updated":"2026-10-19T09:14:51.107Z","title":"EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2026-98156","published":"2026-09-25T10:36:26.409Z","updated":"2026-10-21T12:54:43.922Z","title":"drm/virtio: use the DMA API for resource backing on Xen","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2026-98155","published":"2026-09-25T10:36:25.812Z","updated":"2026-10-19T09:14:49.119Z","title":"accel/qaic: Address potential out-of-bounds read in resp_worker()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-98154","published":"2026-09-25T10:36:25.215Z","updated":"2026-10-19T09:14:47.435Z","title":"nvme-rdma: fix -EIO cleanup order in queue_rq","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00113,"kevAdded":null},{"id":"CVE-2026-98153","published":"2026-09-25T10:36:24.622Z","updated":"2026-10-19T09:14:46.433Z","title":"nvme: fix racy access to FDP placement id array","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0008,"kevAdded":null},{"id":"CVE-2026-98152","published":"2026-09-25T10:36:24.020Z","updated":"2026-10-19T09:14:45.506Z","title":"nvmet-rdma: fix queue leak when connect backlog is exceeded","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-98151","published":"2026-09-25T10:36:23.412Z","updated":"2026-10-19T09:14:44.471Z","title":"bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-98150","published":"2026-09-25T10:36:22.774Z","updated":"2026-10-19T09:14:43.287Z","title":"bpf: Fix BPF_F_CPU validation for sparse CPU IDs","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00101,"kevAdded":null},{"id":"CVE-2026-98149","published":"2026-09-25T10:36:22.182Z","updated":"2026-10-19T09:14:42.350Z","title":"bpf: Fix percpu map update indexing with sparse CPU IDs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-98148","published":"2026-09-25T10:36:21.562Z","updated":"2026-10-21T12:54:42.819Z","title":"drm/gud: validate GUD_ROTATION_0 is present in supported rotations","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-98147","published":"2026-09-25T10:36:20.926Z","updated":"2026-10-21T12:54:41.721Z","title":"printk: Don't WARN on kthread_run failure.","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-98146","published":"2026-09-25T10:36:20.303Z","updated":"2026-10-19T09:14:39.513Z","title":"accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0009,"kevAdded":null},{"id":"CVE-2026-98145","published":"2026-09-25T10:36:19.692Z","updated":"2026-10-19T09:14:38.597Z","title":"accel/amdxdna: reject a command chain that carries no commands","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-98144","published":"2026-09-25T10:36:19.093Z","updated":"2026-10-19T09:14:37.650Z","title":"accel/amdxdna: put the chained BO when its mapping fails","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-98143","published":"2026-09-25T10:36:18.470Z","updated":"2026-10-19T09:14:36.709Z","title":"accel: ethosu: Don't read the U65 rounding mode as a storage mode","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-98142","published":"2026-09-25T10:36:17.832Z","updated":"2026-10-19T09:14:35.740Z","title":"drm/cirrus-qemu: Validate BAR0 size during probe","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-98141","published":"2026-09-25T10:36:17.213Z","updated":"2026-10-19T09:14:34.773Z","title":"ntfs: propagate reparse index insertion failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-98140","published":"2026-09-25T10:36:16.580Z","updated":"2026-10-19T09:14:33.821Z","title":"ntfs: fix kmap_local leak in write_mft_record_nolock() error paths","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-98139","published":"2026-09-25T10:36:15.974Z","updated":"2026-10-19T09:14:32.894Z","title":"ntfs: only count successfully cleared runs when freeing clusters","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-98138","published":"2026-09-25T10:36:15.349Z","updated":"2026-10-19T09:14:31.951Z","title":"ntfs: do not mark the volume clean in sync_fs when errors were recorded","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-98137","published":"2026-09-25T10:36:14.744Z","updated":"2026-10-19T09:14:31.014Z","title":"ntfs: treat any nonzero dio zero-range return as an error","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-98136","published":"2026-09-25T10:36:14.106Z","updated":"2026-10-19T09:14:30.051Z","title":"ntfs: bound $AttrDef table walk to the loaded table size","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0011,"kevAdded":null},{"id":"CVE-2026-98135","published":"2026-09-25T10:36:13.510Z","updated":"2026-10-19T09:14:29.078Z","title":"ntfs: reject invalid sectors_per_cluster in the boot sector","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-98134","published":"2026-09-25T10:36:12.919Z","updated":"2026-10-21T12:54:40.601Z","title":"bpf: check_cond_jmp_op(): properly infer if register is null","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98133","published":"2026-09-25T10:36:12.310Z","updated":"2026-10-19T09:14:27.179Z","title":"ntfs: leave HasEA flag untouched on setxattr failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-98132","published":"2026-09-25T10:36:11.662Z","updated":"2026-10-19T09:14:26.212Z","title":"bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00108,"kevAdded":null},{"id":"CVE-2026-98131","published":"2026-09-25T10:36:11.043Z","updated":"2026-10-21T12:54:39.509Z","title":"net: stmmac: fix dma mapping leak in stmmac_tso_xmit()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-98130","published":"2026-09-25T10:36:10.243Z","updated":"2026-10-19T09:14:23.404Z","title":"sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00453,"kevAdded":null},{"id":"CVE-2026-98129","published":"2026-09-25T10:36:09.614Z","updated":"2026-10-19T09:14:21.791Z","title":"scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-98128","published":"2026-09-25T10:36:09.014Z","updated":"2026-10-19T09:14:20.796Z","title":"scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-98127","published":"2026-09-25T10:36:08.406Z","updated":"2026-10-21T12:54:38.540Z","title":"smb/client: validate new EOF for insert range","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-98126","published":"2026-09-25T10:36:07.797Z","updated":"2026-10-21T12:54:37.445Z","title":"smb/client: validate new EOF for zero range","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-98125","published":"2026-09-25T10:36:07.163Z","updated":"2026-10-21T12:54:36.373Z","title":"smb/client: fix stale page cache in insert/collapse range","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-98124","published":"2026-09-25T10:36:06.581Z","updated":"2026-10-21T12:54:35.267Z","title":"smb/client: invalidate fscache for fallocate range operations","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-98123","published":"2026-09-25T10:36:05.993Z","updated":"2026-10-19T09:14:15.281Z","title":"sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-98122","published":"2026-09-25T10:36:05.369Z","updated":"2026-10-19T09:14:14.316Z","title":"vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-98121","published":"2026-09-25T10:36:04.765Z","updated":"2026-10-19T09:14:13.333Z","title":"watchdog: msc313e: Fix NULL pointer dereference in PM callbacks","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-98120","published":"2026-09-25T10:36:04.129Z","updated":"2026-10-19T09:14:12.388Z","title":"netfs: Fix subreq ref leak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-98119","published":"2026-09-25T10:36:03.524Z","updated":"2026-10-19T09:14:11.462Z","title":"netfs: break unbuffered write when netfs_alloc_subrequest() fails","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-98118","published":"2026-09-25T10:36:02.924Z","updated":"2026-10-19T09:14:10.484Z","title":"netfs: Fix readahead synchronisation issues by loading all folios upfront","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00091,"kevAdded":null},{"id":"CVE-2026-98117","published":"2026-09-25T10:36:02.319Z","updated":"2026-10-19T09:14:09.508Z","title":"cachefiles: Fix potential UAF/KASAN warning","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-98116","published":"2026-09-25T10:36:01.723Z","updated":"2026-10-19T09:14:08.504Z","title":"ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-98115","published":"2026-09-25T10:36:01.119Z","updated":"2026-10-19T09:14:07.523Z","title":"ksmbd: safely drain sessions during logoff","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2026-98114","published":"2026-09-25T10:36:00.514Z","updated":"2026-10-21T12:54:34.147Z","title":"ksmbd: propagate DACL parsing errors","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-98113","published":"2026-09-25T10:35:59.909Z","updated":"2026-10-19T09:14:05.620Z","title":"ksmbd: rate limit unmapped SID errors","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98112","published":"2026-09-25T10:35:59.319Z","updated":"2026-10-19T09:14:04.636Z","title":"ksmbd: fix listener task lifetime on netdev events","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00093,"kevAdded":null},{"id":"CVE-2026-98111","published":"2026-09-25T10:35:58.728Z","updated":"2026-10-19T09:14:03.665Z","title":"Bluetooth: btintel: validate version TLV value lengths","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-98110","published":"2026-09-25T10:35:58.136Z","updated":"2026-10-19T09:14:02.695Z","title":"Bluetooth: btintel: bound firmware ID by TLV length","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-98109","published":"2026-09-25T10:35:57.537Z","updated":"2026-10-19T09:14:01.739Z","title":"Bluetooth: hci_core: Fix race condition during device registration","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00089,"kevAdded":null},{"id":"CVE-2026-98108","published":"2026-09-25T10:35:56.935Z","updated":"2026-10-19T09:14:00.739Z","title":"Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2026-98107","published":"2026-09-25T10:35:56.340Z","updated":"2026-10-21T12:54:32.791Z","title":"Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98106","published":"2026-09-25T10:35:55.743Z","updated":"2026-10-19T09:13:58.755Z","title":"drm/pagemap: Prevent double migration of device pages","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98105","published":"2026-09-25T10:35:55.142Z","updated":"2026-10-19T09:13:57.780Z","title":"net: ethernet: oa_tc6: Improve the error recovery","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-98104","published":"2026-09-25T10:35:54.544Z","updated":"2026-10-19T09:13:56.808Z","title":"net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98103","published":"2026-09-25T10:35:53.942Z","updated":"2026-10-21T12:54:31.184Z","title":"igmp: convert struct ip_sf_list to RCU","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98102","published":"2026-09-25T10:35:53.332Z","updated":"2026-10-19T09:13:54.775Z","title":"ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98101","published":"2026-09-25T10:35:52.731Z","updated":"2026-10-19T09:13:53.770Z","title":"ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98099","published":"2026-09-25T10:24:28.929Z","updated":"2026-10-21T12:54:29.854Z","title":"ipv6: mcast: use rcu_assign_pointer() for __rcu list updates","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00091,"kevAdded":null},{"id":"CVE-2026-98098","published":"2026-09-25T10:24:28.298Z","updated":"2026-10-19T09:13:51.892Z","title":"tipc: fix NULL deref in tipc_named_node_up() on empty publication list","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-98097","published":"2026-09-25T10:24:27.700Z","updated":"2026-10-21T12:54:28.528Z","title":"tipc: Dont send random pad bytes in RESET/ACTIVATE messages","severity":"MEDIUM","score":5.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2026-98096","published":"2026-09-25T10:24:27.098Z","updated":"2026-10-19T09:13:48.508Z","title":"ipv6: sr: restore network header before routing and forwarding","severity":"HIGH","score":7.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00505,"kevAdded":null},{"id":"CVE-2026-98095","published":"2026-09-25T10:24:26.493Z","updated":"2026-10-19T09:13:47.304Z","title":"af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-98094","published":"2026-09-25T10:24:25.889Z","updated":"2026-10-19T09:13:46.321Z","title":"staging: fbtft: make dirty_lock IRQ-safe","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-98093","published":"2026-09-25T10:24:25.285Z","updated":"2026-10-19T09:13:45.359Z","title":"ASoC: fsl_micfil: balance mclk enable/disable","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-98092","published":"2026-09-25T10:24:24.693Z","updated":"2026-10-19T09:13:44.373Z","title":"ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-98091","published":"2026-09-25T10:24:24.082Z","updated":"2026-10-19T09:13:43.350Z","title":"btrfs: detach failed sprout device from transaction update list","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-98090","published":"2026-09-25T10:24:23.474Z","updated":"2026-10-19T09:13:42.367Z","title":"btrfs: restore active device pointers after failed sprout","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-98089","published":"2026-09-25T10:24:22.877Z","updated":"2026-10-19T09:13:41.394Z","title":"bonding: alb: fix uninitialized transport header access in alb_determine_nd()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98088","published":"2026-09-25T10:24:22.278Z","updated":"2026-10-19T09:13:40.407Z","title":"scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98087","published":"2026-09-25T10:24:21.680Z","updated":"2026-10-19T09:13:39.438Z","title":"sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98086","published":"2026-09-25T10:24:21.086Z","updated":"2026-10-19T09:13:38.462Z","title":"ALSA: ump: do not touch legacy_rmidi before it exists","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-98085","published":"2026-09-25T10:24:20.485Z","updated":"2026-10-21T12:54:27.055Z","title":"bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98084","published":"2026-09-25T10:24:19.881Z","updated":"2026-10-21T12:54:25.939Z","title":"bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98083","published":"2026-09-25T10:24:19.287Z","updated":"2026-10-19T09:13:35.601Z","title":"btrfs: fix transaction use-after-free in raid stripe insertion","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2026-98082","published":"2026-09-25T10:24:18.685Z","updated":"2026-10-19T09:13:34.616Z","title":"btrfs: fix the possible bioc_list memory leak during error","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-98081","published":"2026-09-25T10:24:18.091Z","updated":"2026-10-21T12:54:24.847Z","title":"btrfs: zoned: finish active block group cleanup if call_zone_finish() fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98080","published":"2026-09-25T10:24:17.491Z","updated":"2026-10-19T09:13:29.778Z","title":"btrfs: do not force reloc root creation during qgroup_account_snapshot()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-98079","published":"2026-09-25T10:24:16.892Z","updated":"2026-10-21T12:54:23.769Z","title":"btrfs: zstd: fix lost wakeup when waiting for a workspace","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98078","published":"2026-09-25T10:24:16.294Z","updated":"2026-10-19T09:13:27.823Z","title":"ipvs: fix reversed sequence option serialization","severity":"MEDIUM","score":4.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98077","published":"2026-09-25T10:24:15.691Z","updated":"2026-10-19T09:13:26.849Z","title":"netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98076","published":"2026-09-25T10:24:15.085Z","updated":"2026-10-19T09:13:25.874Z","title":"tracing/probes: Fix use-after-free on field name/type of events with multiple probes","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98075","published":"2026-09-25T10:24:14.472Z","updated":"2026-10-19T09:13:24.903Z","title":"bpf: reject BPF_PSEUDO_FUNC reference to the main program","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98074","published":"2026-09-25T10:24:13.870Z","updated":"2026-10-19T09:13:23.911Z","title":"bonding: do not clear curr_active_slave prematurely when releasing all slaves","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98073","published":"2026-09-25T10:24:13.277Z","updated":"2026-10-21T12:54:22.672Z","title":"net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-98072","published":"2026-09-25T10:24:12.675Z","updated":"2026-10-19T09:13:21.939Z","title":"net/rds: use wq_has_sleeper() in release_in_xmit()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98071","published":"2026-09-25T10:24:12.085Z","updated":"2026-10-19T09:13:20.944Z","title":"net/rds: clear cp_flags bits individually in rds_conn_path_reset()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98070","published":"2026-09-25T10:24:11.481Z","updated":"2026-10-19T09:13:19.953Z","title":"net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00469,"kevAdded":null},{"id":"CVE-2026-98069","published":"2026-09-25T10:24:10.887Z","updated":"2026-10-19T09:13:18.938Z","title":"net/rds: acquire the fastpath locks in rds_conn_shutdown()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00562,"kevAdded":null},{"id":"CVE-2026-98068","published":"2026-09-25T10:24:10.234Z","updated":"2026-10-19T09:13:17.906Z","title":"net/rds: don't let rds_conn_shutdown() consume a concurrent drop","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98067","published":"2026-09-25T10:24:09.610Z","updated":"2026-10-21T12:54:21.582Z","title":"erofs: disable LZ4 rolling decompression for now","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98066","published":"2026-09-25T10:24:08.999Z","updated":"2026-10-19T09:13:15.973Z","title":"ALSA: caiaq: Fix potential double-free at error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98065","published":"2026-09-25T10:24:08.406Z","updated":"2026-10-19T09:13:14.981Z","title":"bpf: Reject key-less BTF for hash maps","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98064","published":"2026-09-25T10:24:07.811Z","updated":"2026-10-19T09:13:14.000Z","title":"bpf: Fix NULL-ptr-deref when showing a void BTF type","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98063","published":"2026-09-25T10:24:07.203Z","updated":"2026-10-19T09:13:13.031Z","title":"bpf: Fix NULL-ptr-deref in btf_var_show()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98062","published":"2026-09-25T10:24:06.597Z","updated":"2026-10-21T12:54:20.506Z","title":"bpf: Mark signal tracepoint siginfo arguments as scalar","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98061","published":"2026-09-25T10:24:06.001Z","updated":"2026-10-19T09:13:09.930Z","title":"bpf: Reject tail calls directly from callback frames","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98060","published":"2026-09-25T10:24:05.380Z","updated":"2026-10-19T09:13:08.516Z","title":"bpf: Reject resilient lock operations in rbtree callbacks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-98059","published":"2026-09-25T10:24:04.788Z","updated":"2026-10-19T09:13:06.971Z","title":"bpf: Mark sched_process_wait argument as nullable","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-98058","published":"2026-09-25T10:24:04.190Z","updated":"2026-10-21T12:54:19.435Z","title":"bpf: Mark syscall helpers as sleepable","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98057","published":"2026-09-25T10:24:03.541Z","updated":"2026-10-19T09:13:03.914Z","title":"ring-buffer: Add checking nr_subbufs to persistent ring buffer validation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98056","published":"2026-09-25T10:24:02.919Z","updated":"2026-10-21T12:54:18.340Z","title":"nvme: remove stale namespaces by NSID range during scan","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00612,"kevAdded":null},{"id":"CVE-2026-98055","published":"2026-09-25T10:24:02.308Z","updated":"2026-10-19T09:13:01.189Z","title":"ASoC: Intel: avs: Clean up the bus when fetching ML caps fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98054","published":"2026-09-25T10:24:01.701Z","updated":"2026-10-19T09:13:00.189Z","title":"ASoC: Intel: avs: Fix unbalanced module reference count","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-98053","published":"2026-09-25T10:24:01.074Z","updated":"2026-10-21T12:54:17.218Z","title":"ASoC: Intel: avs: Refactor and fix init_config access","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-98052","published":"2026-09-25T10:24:00.441Z","updated":"2026-10-19T09:12:58.121Z","title":"net: bcmasp: clear txcb->last before writing each descriptor","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-98051","published":"2026-09-25T10:23:59.791Z","updated":"2026-10-19T09:12:57.148Z","title":"net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-98050","published":"2026-09-25T10:23:59.198Z","updated":"2026-10-19T09:12:56.194Z","title":"mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-98049","published":"2026-09-25T10:23:58.561Z","updated":"2026-10-21T12:54:16.141Z","title":"bpf: zero extend the result of an arena 32-bit cmpxchg","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98048","published":"2026-09-25T10:23:57.956Z","updated":"2026-10-21T12:54:15.043Z","title":"bpf: don't rewrite bpf_fastcall patterns entered by a jump","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98047","published":"2026-09-25T10:23:57.347Z","updated":"2026-10-21T12:54:13.942Z","title":"bpf: Check ancestor frames for rbtree callbacks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-98046","published":"2026-09-25T10:23:56.691Z","updated":"2026-10-19T09:12:52.051Z","title":"bpf: Mark bpf_btf_find_by_name_kind() as sleepable","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98045","published":"2026-09-25T10:23:56.089Z","updated":"2026-10-19T09:12:51.065Z","title":"bpf: Mark faultable stack helpers as sleepable","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98044","published":"2026-09-25T10:23:55.454Z","updated":"2026-10-21T12:54:12.833Z","title":"bpf: Reject legacy packet loads from callbacks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98043","published":"2026-09-25T10:23:54.865Z","updated":"2026-10-21T12:54:11.750Z","title":"bpf: Don't infer non-NULL from a pointer with an unbounded offset","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98042","published":"2026-09-25T10:23:54.242Z","updated":"2026-10-19T09:12:48.113Z","title":"bpf: Don't resurrect a scalar id dropped by collect_linked_regs()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-98041","published":"2026-09-25T10:23:53.619Z","updated":"2026-10-21T12:54:10.647Z","title":"bpf: Don't predict JMP32 pointer vs zero comparisons","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2026-98040","published":"2026-09-25T10:23:53.001Z","updated":"2026-10-19T09:12:46.084Z","title":"bpf: Mark the zero register precise for a register-form NULL check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2026-98039","published":"2026-09-25T10:23:52.360Z","updated":"2026-10-19T09:12:44.994Z","title":"bpf: Require MEM_PERCPU for percpu kptr stores","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98038","published":"2026-09-25T10:23:51.746Z","updated":"2026-10-21T12:54:09.561Z","title":"bpf: Keep refcount_acquire nullable for borrowed RCU kptrs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-98037","published":"2026-09-25T10:23:51.126Z","updated":"2026-10-19T09:12:42.963Z","title":"bpf: Reject untrusted allocated-object pointers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-98036","published":"2026-09-25T10:23:50.530Z","updated":"2026-10-19T09:12:41.963Z","title":"bpf: Preserve special fields in recycled rhtab elements","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-98035","published":"2026-09-25T10:23:49.935Z","updated":"2026-10-19T09:12:40.152Z","title":"bpf: Cancel special fields when recycling rhtab elements","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98034","published":"2026-09-25T10:23:49.352Z","updated":"2026-10-21T12:54:08.478Z","title":"bpf: Mark NULL kptr stores precise","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98033","published":"2026-09-25T10:23:48.761Z","updated":"2026-10-21T12:54:07.398Z","title":"bpf: Preserve inner map identity in callback frames","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-98032","published":"2026-09-25T10:23:48.169Z","updated":"2026-10-21T12:54:06.279Z","title":"tracing: Fix subbuf resize races with trace_pipe_raw readers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98031","published":"2026-09-25T10:23:47.562Z","updated":"2026-10-19T09:12:36.306Z","title":"nexthop: Initialize extack in remove_nh_grp_entry()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98030","published":"2026-09-25T10:23:46.959Z","updated":"2026-10-19T09:12:35.325Z","title":"net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-98029","published":"2026-09-25T10:23:46.347Z","updated":"2026-10-19T09:12:34.306Z","title":"eth: nfp: bound the ntuple rule dump by the caller's buffer size","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-98028","published":"2026-09-25T10:23:45.737Z","updated":"2026-10-19T09:12:33.311Z","title":"eth: nfp: drop the replaced rule from the list when reprogramming fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98027","published":"2026-09-25T10:23:45.123Z","updated":"2026-10-19T09:12:32.331Z","title":"net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-98026","published":"2026-09-25T10:23:44.505Z","updated":"2026-10-19T09:12:31.334Z","title":"net: bridge: mcast: properly convert mglist to rcu","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98025","published":"2026-09-25T10:23:43.906Z","updated":"2026-10-19T09:12:30.354Z","title":"net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-98024","published":"2026-09-25T10:23:43.306Z","updated":"2026-10-19T09:12:29.352Z","title":"s390/ism: folio_put() after error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98023","published":"2026-09-25T10:23:42.706Z","updated":"2026-10-19T09:12:28.386Z","title":"vxlan: reject dynamic fdb entries that reference a nexthop id","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-98022","published":"2026-09-25T10:23:42.116Z","updated":"2026-10-19T09:12:27.416Z","title":"net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98021","published":"2026-09-25T10:23:41.505Z","updated":"2026-10-21T12:54:05.196Z","title":"net: reject oversized tx_queue_len at netlink parse time","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98020","published":"2026-09-25T10:23:40.900Z","updated":"2026-10-19T09:12:25.476Z","title":"pds_core: fix cmd_regs access racing BAR unmap on reset","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98019","published":"2026-09-25T10:23:40.303Z","updated":"2026-10-21T12:54:04.100Z","title":"bpf: mark a NULL call argument precise","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98018","published":"2026-09-25T10:23:39.706Z","updated":"2026-10-19T09:12:23.555Z","title":"net: mctp: i3c: serialize probe with bus removal","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98017","published":"2026-09-25T10:23:39.107Z","updated":"2026-10-19T09:12:22.590Z","title":"net/sched: defer qdisc freeing after failed creation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-98016","published":"2026-09-25T10:23:38.316Z","updated":"2026-10-19T09:12:21.604Z","title":"net/mlx5e: Fix use-after-free race in sample_restore_put()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98015","published":"2026-09-25T10:23:37.724Z","updated":"2026-10-19T09:12:20.637Z","title":"net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98014","published":"2026-09-25T10:23:37.131Z","updated":"2026-10-19T09:12:19.664Z","title":"net/mlx5: E-Switch, prevent mc_list repopulation during vport disable","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98013","published":"2026-09-25T10:23:36.527Z","updated":"2026-10-19T09:12:18.653Z","title":"net/sched: fq_pie: clamp quantum in change path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-98012","published":"2026-09-25T10:23:35.934Z","updated":"2026-10-19T09:12:17.681Z","title":"net/sched: sfq: clamp quantum in change path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98011","published":"2026-09-25T10:23:35.338Z","updated":"2026-10-19T09:12:16.718Z","title":"net/sched: hhf: clamp quantum in change and init paths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98010","published":"2026-09-25T10:23:34.738Z","updated":"2026-10-19T09:12:15.743Z","title":"net/sched: drr: clamp quantum in change class","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98009","published":"2026-09-25T10:23:34.144Z","updated":"2026-10-19T09:12:14.751Z","title":"net/sched: ets: clamp quantum in parse and fallback paths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98008","published":"2026-09-25T10:23:33.532Z","updated":"2026-10-19T09:12:13.751Z","title":"net: macb: fix NULL pointer dereference on unbind with fixed-link","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-98007","published":"2026-09-25T10:23:32.939Z","updated":"2026-10-19T09:12:12.779Z","title":"bpf: Reject non-scalar bpf_loop iteration counts","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98006","published":"2026-09-25T10:23:32.334Z","updated":"2026-10-19T09:12:11.824Z","title":"ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-98005","published":"2026-09-25T10:23:31.722Z","updated":"2026-10-19T09:12:10.872Z","title":"erofs: delimit inode_share cache key components","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-98004","published":"2026-09-25T10:23:31.134Z","updated":"2026-10-19T09:12:09.901Z","title":"iommu/riscv: Serialize command queue publishing","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-98003","published":"2026-09-25T10:23:30.522Z","updated":"2026-10-21T12:54:02.989Z","title":"iommu/amd: Do not reallocate GA log buffers on resume","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98002","published":"2026-09-25T10:23:29.929Z","updated":"2026-10-19T09:12:07.970Z","title":"iommu/amd: Fix ineffective error check in nested domain allocation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00108,"kevAdded":null},{"id":"CVE-2026-98001","published":"2026-09-25T10:23:29.325Z","updated":"2026-10-19T09:12:07.015Z","title":"hwmon: (ltc4282) Make sure clk_init_data is fully initialized","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-98000","published":"2026-09-25T10:23:28.703Z","updated":"2026-10-19T09:12:06.063Z","title":"hwmon: Fix potential UAF in pec_store","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-97998","published":"2026-09-25T10:23:28.074Z","updated":"2026-10-19T09:12:05.094Z","title":"netfilter: nfnetlink_log: cope with concurrent instance destruction","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-97997","published":"2026-09-25T10:23:27.493Z","updated":"2026-10-21T12:54:01.948Z","title":"virtio_ring: fix stale descriptor flags after a failed packed add","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-97996","published":"2026-09-25T10:23:26.913Z","updated":"2026-10-19T09:12:03.153Z","title":"virtio: fix use-after-free in unregister_virtio_device()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-97995","published":"2026-09-25T10:23:26.307Z","updated":"2026-10-19T09:12:02.162Z","title":"virtio_console: do not free control-out buffers on remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-97994","published":"2026-09-25T10:23:25.719Z","updated":"2026-10-19T09:12:01.173Z","title":"vhost/vdpa: reject VRING_NUM larger than device max","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97993","published":"2026-09-25T10:23:25.110Z","updated":"2026-10-19T09:12:00.172Z","title":"vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-97992","published":"2026-09-25T10:23:24.472Z","updated":"2026-10-21T12:54:00.836Z","title":"vhost-vdpa: protect config_ctx from being freed under the config callback","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-97991","published":"2026-09-25T10:23:23.863Z","updated":"2026-10-19T09:11:58.242Z","title":"vdpa_sim_blk: reject out-of-range sector starts","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-97990","published":"2026-09-25T10:23:23.226Z","updated":"2026-10-19T09:11:57.260Z","title":"vdpa_sim_net: check TX pull result before RX copy","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2026-97989","published":"2026-09-25T10:23:22.620Z","updated":"2026-10-21T12:53:59.737Z","title":"vduse: validate virtqueue alignment","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-97988","published":"2026-09-25T10:23:21.998Z","updated":"2026-10-21T12:53:58.662Z","title":"vhost: invalidate vring access on IOTLB transitions","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-97987","published":"2026-09-25T10:23:21.388Z","updated":"2026-10-19T09:11:54.271Z","title":"virtio_input: reset device if input_register_device() fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97986","published":"2026-09-25T10:23:20.801Z","updated":"2026-10-19T09:11:53.304Z","title":"virtio_input: stop callbacks before unregistering input device","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97985","published":"2026-09-25T10:23:20.173Z","updated":"2026-10-21T12:53:57.548Z","title":"af_unix: Update last skb marker in manage_oob().","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-97984","published":"2026-09-25T10:23:19.568Z","updated":"2026-10-19T09:11:51.310Z","title":"net: ipv6: Fix UDP length overflow with PMTU discover and big MTU","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-97983","published":"2026-09-25T10:23:18.940Z","updated":"2026-10-19T09:11:50.328Z","title":"vduse: return compat ioctl results directly","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-97982","published":"2026-09-25T10:23:18.304Z","updated":"2026-10-19T09:11:49.378Z","title":"net: ethernet: cortina: Fix budget accounting","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-97981","published":"2026-09-25T10:23:17.703Z","updated":"2026-10-19T09:11:48.414Z","title":"net: ethernet: cortina: Count dropped frames as NAPI work","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-97980","published":"2026-09-25T10:23:17.075Z","updated":"2026-10-19T09:11:47.427Z","title":"s390/debug: Fix NULL pointer dereference in debug_set_level()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-97979","published":"2026-09-25T10:23:16.422Z","updated":"2026-10-19T09:11:46.482Z","title":"ice: add missing xa_destroy for sched_node_ids","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97978","published":"2026-09-25T10:23:15.831Z","updated":"2026-10-21T12:53:56.446Z","title":"eth: ice: don't dereference pointers from TP_printk()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-97977","published":"2026-09-25T10:23:15.198Z","updated":"2026-10-19T09:11:44.507Z","title":"Bluetooth: btusb: Fix UAF of btusb_data by rx_work","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97976","published":"2026-09-25T10:23:14.596Z","updated":"2026-10-19T09:11:43.531Z","title":"Bluetooth: btintel_pcie: validate packet_len before skb_put_data","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-97975","published":"2026-09-25T10:23:13.971Z","updated":"2026-10-21T12:53:55.330Z","title":"Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-97974","published":"2026-09-25T10:23:13.373Z","updated":"2026-10-19T09:11:40.075Z","title":"ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-97973","published":"2026-09-25T10:23:12.759Z","updated":"2026-10-19T09:11:39.063Z","title":"net: macb: destroy the phylink instance on the probe error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97972","published":"2026-09-25T10:23:12.139Z","updated":"2026-10-19T09:11:38.115Z","title":"net: macb: put the \"mdio\" child node reference on success","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-97971","published":"2026-09-25T10:23:11.539Z","updated":"2026-10-19T09:11:37.164Z","title":"nstree: check listing permission before taking a namespace reference","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-97970","published":"2026-09-25T10:23:10.932Z","updated":"2026-10-19T09:11:36.071Z","title":"watchdog: msc313e: Avoid division by zero","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-97969","published":"2026-09-25T10:23:10.333Z","updated":"2026-10-19T09:11:35.081Z","title":"watchdog: msc313e: Fix clock leak and spurious timer in settimeout()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-97968","published":"2026-09-25T10:23:09.737Z","updated":"2026-10-19T09:11:34.095Z","title":"hwmon: (corsair-cpro) Create debugfs entries after hwmon registration","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-97967","published":"2026-09-25T10:23:09.140Z","updated":"2026-10-19T09:11:33.053Z","title":"hwmon: (corsair-cpro) Remove debugfs entries when probe fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-97966","published":"2026-09-25T10:23:08.543Z","updated":"2026-10-19T09:11:32.067Z","title":"octeontx2-pf: reset HTB scheduler topology before freeing queues","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-97965","published":"2026-09-25T10:23:07.952Z","updated":"2026-10-21T12:53:54.233Z","title":"vxlan: initialize _md in vxlan_xmit_one()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-97964","published":"2026-09-25T10:23:07.350Z","updated":"2026-10-19T09:11:30.152Z","title":"ppp_synctty: ensure a writeable skb header","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97963","published":"2026-09-25T10:23:06.749Z","updated":"2026-10-19T09:11:29.173Z","title":"net: stmmac: initialize ptp_lock at probe time","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97962","published":"2026-09-25T10:23:06.150Z","updated":"2026-10-21T12:53:53.121Z","title":"net/mlx5e: Move representor vnic reporter to eswitch devlink port","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-97961","published":"2026-09-25T10:23:05.547Z","updated":"2026-10-21T12:53:52.027Z","title":"perf/core: Allow list_del during perf_event_overflow()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-97960","published":"2026-09-25T10:23:04.943Z","updated":"2026-10-21T12:53:50.943Z","title":"perf/x86/intel: Prevent drain_pebs() reentry","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-97959","published":"2026-09-25T10:23:04.348Z","updated":"2026-10-19T09:11:25.255Z","title":"net/sched: cls_route: free emptied bucket on filter move","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-97958","published":"2026-09-25T10:23:03.753Z","updated":"2026-10-19T09:11:24.306Z","title":"net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-97957","published":"2026-09-25T10:23:03.153Z","updated":"2026-10-19T09:11:23.333Z","title":"net: hinic: fix mailbox segment buffer overflow","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-97956","published":"2026-09-25T10:23:02.560Z","updated":"2026-10-19T09:11:22.384Z","title":"net: net_failover: Fix the deadlock in net_failover_slave_name_change()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-97955","published":"2026-09-25T10:23:01.968Z","updated":"2026-10-19T09:11:21.414Z","title":"net: mana: restore the XDP program pointer when pre-allocation fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-97954","published":"2026-09-25T10:23:01.364Z","updated":"2026-10-19T09:11:20.455Z","title":"net/rds: fix tcp stream corruption with large pages","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-97953","published":"2026-09-25T10:23:00.758Z","updated":"2026-10-21T12:53:49.828Z","title":"net: stmmac: fix TX descriptor availability check for TSO traffic","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-97952","published":"2026-09-25T10:23:00.161Z","updated":"2026-10-19T09:11:18.495Z","title":"sunvdc: unmap LDC cookies when the descriptor send fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-97951","published":"2026-09-25T10:22:59.559Z","updated":"2026-10-19T09:11:17.515Z","title":"scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-97950","published":"2026-09-25T10:22:58.970Z","updated":"2026-10-21T12:53:48.740Z","title":"configfs: pin the symlink target's dirent instead of chasing ->ci_dentry","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97949","published":"2026-09-25T10:22:58.375Z","updated":"2026-10-21T12:53:47.600Z","title":"configfs: unhash the dentry before dropping the item in rmdir","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-97948","published":"2026-09-25T10:22:57.757Z","updated":"2026-10-19T09:11:14.563Z","title":"powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-97947","published":"2026-09-25T10:22:57.163Z","updated":"2026-10-19T09:11:13.582Z","title":"x86/amd_node: Fix potential NULL pointer dereference","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-97946","published":"2026-09-25T10:22:56.572Z","updated":"2026-10-19T09:11:12.606Z","title":"x86/amd_node: Fix PCI device reference counting in amd_smn_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-97945","published":"2026-09-25T10:22:55.981Z","updated":"2026-10-19T09:11:11.655Z","title":"x86/mm: Fix user-space data loss with MADV_FREE and THP","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97944","published":"2026-09-25T10:22:55.382Z","updated":"2026-10-19T09:11:10.690Z","title":"x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-97943","published":"2026-09-25T10:22:54.787Z","updated":"2026-10-19T09:11:09.731Z","title":"x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2026-97942","published":"2026-09-25T10:22:54.188Z","updated":"2026-10-19T09:11:08.757Z","title":"x86/alternatives: Exclude text poking against change_page_attr()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2026-97941","published":"2026-09-25T10:22:53.556Z","updated":"2026-10-19T09:11:07.833Z","title":"mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97940","published":"2026-09-25T10:22:52.936Z","updated":"2026-10-19T09:11:06.854Z","title":"ipv6: fix fib6 walker UAF on seq stop","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-97939","published":"2026-09-25T10:22:52.332Z","updated":"2026-10-30T12:37:46.833Z","title":"ipmr: account multicast table and route memory","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-97938","published":"2026-09-25T10:22:51.720Z","updated":"2026-10-21T12:53:45.385Z","title":"reboot: fix cad_pid use-after-free race","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97937","published":"2026-09-25T10:22:51.075Z","updated":"2026-10-19T09:11:03.903Z","title":"ftrace: fork: Initialize function graph state before copy_exec_state()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-97936","published":"2026-09-25T10:22:50.446Z","updated":"2026-10-19T09:11:02.941Z","title":"tracing: Fix memory corruption from the histogram stacktrace modifier","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-97935","published":"2026-09-25T10:22:49.820Z","updated":"2026-10-30T12:37:45.761Z","title":"tracing: Set the trace clock before registering the histogram trigger","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-97934","published":"2026-09-25T10:22:49.212Z","updated":"2026-10-21T12:53:43.241Z","title":"tracing: Fix memory corruption from a \"STACKTRACE\" histogram key","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97933","published":"2026-09-25T10:22:48.591Z","updated":"2026-10-21T12:53:42.143Z","title":"tracing: Take trace_array reference when opening a tracer options file","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97932","published":"2026-09-25T10:22:47.994Z","updated":"2026-10-19T09:10:59.072Z","title":"tracing: Don't dereference trace_event_file in deferred trigger free","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-97931","published":"2026-09-25T10:22:47.382Z","updated":"2026-10-19T09:10:58.123Z","title":"ALSA: us122l: Prevent write upgrades for read mappings","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-97930","published":"2026-09-25T10:22:46.713Z","updated":"2026-10-19T09:10:57.146Z","title":"ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97929","published":"2026-09-25T10:22:46.082Z","updated":"2026-10-21T12:53:41.045Z","title":"ALSA: usbusx2y: validate URB actual_length in interrupt callback","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-97928","published":"2026-09-25T10:22:45.430Z","updated":"2026-10-21T12:53:39.969Z","title":"drm/amdgpu: skip the VMID 0 flush for VRAM","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-97927","published":"2026-09-25T10:22:44.834Z","updated":"2026-10-19T09:10:54.225Z","title":"ufs: create the root dentry after loading cylinder metadata","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-97926","published":"2026-09-25T10:22:44.197Z","updated":"2026-10-19T09:10:53.241Z","title":"ufs: validate cylinder group metadata before caching it","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-97925","published":"2026-09-25T10:22:43.552Z","updated":"2026-10-30T12:37:44.697Z","title":"tick/broadcast: Plug clockevents replacement race","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-97924","published":"2026-09-25T10:22:42.935Z","updated":"2026-10-30T12:37:43.618Z","title":"tracing/user_events: Don't destroy fields when event removal fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-97923","published":"2026-09-25T10:22:42.300Z","updated":"2026-10-19T09:10:50.106Z","title":"tracing: Free histogram the var ref when its initialization fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-97922","published":"2026-09-25T10:22:41.699Z","updated":"2026-10-19T09:10:49.154Z","title":"tracing: Free histogram var refs regardless of how often they are referenced","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-97921","published":"2026-09-25T10:22:41.081Z","updated":"2026-10-19T09:10:48.148Z","title":"tracing: Free histogram the field rejected for a bad modifier","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-97920","published":"2026-09-25T10:22:40.431Z","updated":"2026-10-19T09:10:47.192Z","title":"tracing: Keep the entry count when the histogram stats allocation fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97919","published":"2026-09-25T10:22:39.829Z","updated":"2026-10-21T12:53:38.904Z","title":"tracing: Take the reference before publishing the named histogram trigger","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97918","published":"2026-09-25T10:22:39.162Z","updated":"2026-10-21T12:53:37.796Z","title":"tracing: Undo the registration when enabling the histogram trigger fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97917","published":"2026-09-25T10:22:38.329Z","updated":"2026-10-21T12:53:36.737Z","title":"accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-97916","published":"2026-09-25T10:22:37.699Z","updated":"2026-10-21T12:53:35.648Z","title":"accel/ivpu: Validate firmware log buffer metadata","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-97915","published":"2026-09-25T10:22:37.117Z","updated":"2026-10-21T12:53:34.541Z","title":"accel/ivpu: Limit firmware log name prints to field size","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-97914","published":"2026-09-25T10:22:36.512Z","updated":"2026-10-19T09:10:41.339Z","title":"accel: ethosu: Fix ethosu_job_open() return value","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-97913","published":"2026-09-25T10:22:35.875Z","updated":"2026-10-19T09:10:40.371Z","title":"accel: ethosu: Ensure cmd stream ends with a stop op","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-97912","published":"2026-09-25T10:22:35.264Z","updated":"2026-10-19T09:10:38.497Z","title":"accel: ethosu: Ensure SRAM size is 0 on mapping failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-97911","published":"2026-09-25T10:22:34.639Z","updated":"2026-10-19T09:10:37.540Z","title":"accel: ethosu: Ensure SRAM region size matches job","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-97910","published":"2026-09-25T10:22:34.043Z","updated":"2026-10-19T09:10:36.571Z","title":"ASoC: sprd: validate compress buffer sizes against fixed allocations","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-97909","published":"2026-09-25T10:22:33.435Z","updated":"2026-10-19T09:10:35.607Z","title":"ASoC: sti: initialize IRQ lock before requesting IRQ","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-97908","published":"2026-09-25T10:22:32.837Z","updated":"2026-10-30T12:37:42.482Z","title":"Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-97907","published":"2026-09-25T10:22:32.244Z","updated":"2026-10-19T09:10:33.668Z","title":"Bluetooth: btrtl: Don't leak return code when parsing firmware format v2","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-97906","published":"2026-09-25T10:22:31.640Z","updated":"2026-10-21T12:53:32.335Z","title":"bootconfig: Fix integer overflow in initrd size check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-97905","published":"2026-09-25T10:22:31.046Z","updated":"2026-10-19T09:10:31.498Z","title":"cpufreq: zero-initialize policy cpumask before sysfs publication","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-97904","published":"2026-09-25T10:22:30.444Z","updated":"2026-10-19T09:10:30.506Z","title":"cpufreq: initialize policy rwsem before sysfs publication","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-97903","published":"2026-09-25T10:22:29.852Z","updated":"2026-10-19T09:10:29.542Z","title":"exit: hold a reference to thread_pid across proc_flush_pid","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-97902","published":"2026-09-25T10:22:29.259Z","updated":"2026-10-19T09:10:28.572Z","title":"fs: don't return -EINVAL for successful nested thaw","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97901","published":"2026-09-25T10:22:28.655Z","updated":"2026-10-30T12:37:41.407Z","title":"genetlink: pin family module during policy dump","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-97900","published":"2026-09-25T10:22:28.057Z","updated":"2026-10-19T09:10:26.649Z","title":"drm/drm_exec: fix up contended obj when num_objects is 0","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-97899","published":"2026-09-25T10:22:27.429Z","updated":"2026-10-19T09:10:25.686Z","title":"drm/i915: Fix memory leak in query_perf_config_list()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-97621","published":"2026-09-25T10:22:26.827Z","updated":"2026-10-19T09:10:24.742Z","title":"drm/rockchip: analogix_dp: fix unchecked bound endpoint name length","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-97620","published":"2026-09-25T10:22:26.242Z","updated":"2026-10-19T09:10:23.752Z","title":"drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97619","published":"2026-09-25T10:22:25.644Z","updated":"2026-10-30T12:37:40.339Z","title":"io_uring/rw: end write accounting from ->ki_complete","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-97618","published":"2026-09-25T10:22:25.049Z","updated":"2026-10-19T09:10:21.782Z","title":"io_uring/net: don't overconsume buffers when using MSG_TRUNC","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97617","published":"2026-09-25T10:22:24.436Z","updated":"2026-10-19T09:10:20.808Z","title":"ring-buffer: Check resize_disabled before publishing the new subbuf order","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97616","published":"2026-09-25T10:22:23.835Z","updated":"2026-10-30T12:37:39.265Z","title":"net/sched: act_api: release all action references on NEWACTION failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-97615","published":"2026-09-25T10:22:23.234Z","updated":"2026-10-30T12:37:38.197Z","title":"net: bridge: use option bits for CFM/MRP frame handlers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-97614","published":"2026-09-25T10:22:22.632Z","updated":"2026-10-19T09:10:17.955Z","title":"net: dsa: tag_brcm: legacy FCS: request needed tailroom","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-97613","published":"2026-09-25T10:22:22.026Z","updated":"2026-10-30T12:37:37.131Z","title":"net: mana: Reserve extra CQ slot for the fence completion CQE","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-97612","published":"2026-09-25T10:22:21.423Z","updated":"2026-10-19T09:10:16.030Z","title":"net: mpls: clear inner_protocol when the last label is popped","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-97611","published":"2026-09-25T10:22:20.827Z","updated":"2026-10-19T09:10:15.022Z","title":"net: openvswitch: fix use-after-free of the flow table mask array","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-97610","published":"2026-09-25T10:22:20.228Z","updated":"2026-10-19T09:10:14.001Z","title":"netfs: Fix uninitialized return value in netfs_unbuffered_write()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-97609","published":"2026-09-25T10:22:19.627Z","updated":"2026-10-30T12:37:36.059Z","title":"netfilter: cttimeout: prevent UAF during module unload","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-97608","published":"2026-09-25T10:22:19.030Z","updated":"2026-10-19T09:10:12.020Z","title":"netfilter: nf_log: unregister loggers before per-net teardown","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2026-97607","published":"2026-09-25T10:22:18.432Z","updated":"2026-10-19T09:10:11.060Z","title":"vdpa: ifcvf: Put device on unsupported feature error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-97606","published":"2026-09-25T10:22:17.835Z","updated":"2026-10-19T09:10:10.114Z","title":"fs: autofs: fix memory leak in autofs_fill_super()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97605","published":"2026-09-25T10:22:17.233Z","updated":"2026-10-30T12:37:34.983Z","title":"erofs: preserve LZMA decoders on resize failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97604","published":"2026-09-25T10:22:16.613Z","updated":"2026-10-19T09:10:08.190Z","title":"fbdev: vfb: defer cleanup until the last reference","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-97603","published":"2026-09-25T10:22:16.015Z","updated":"2026-10-19T09:10:07.248Z","title":"idpf: disable DIM work before freeing q_vectors","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97602","published":"2026-09-25T10:22:15.389Z","updated":"2026-10-19T09:10:06.270Z","title":"inet: frags: invalidate queues before flushing them","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-97601","published":"2026-09-25T10:22:14.792Z","updated":"2026-10-19T09:10:04.903Z","title":"ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-97600","published":"2026-09-25T10:22:14.197Z","updated":"2026-10-21T12:53:24.716Z","title":"ieee802154: cc2520: fix FIFOP work use-after-free","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-97599","published":"2026-09-25T10:22:13.606Z","updated":"2026-10-30T12:37:33.925Z","title":"ieee802154: hwsim: serialize pib updates to fix double-free","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-97598","published":"2026-09-25T10:22:12.972Z","updated":"2026-10-19T09:10:02.029Z","title":"ipv4: fib: bound automatic table ID allocation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-97597","published":"2026-09-25T10:22:12.378Z","updated":"2026-10-30T12:37:32.857Z","title":"ipv6: flowlabel: cap duplicate leases per socket","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2026-97596","published":"2026-09-25T10:22:11.784Z","updated":"2026-10-19T09:10:00.056Z","title":"ipvs: reject invalid states in connection template sync records","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-97595","published":"2026-09-25T10:22:11.134Z","updated":"2026-10-19T09:09:59.016Z","title":"mac802154: fix use-after-free of sdata via queued RX frames","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2026-97594","published":"2026-09-25T10:22:10.548Z","updated":"2026-10-30T12:37:31.781Z","title":"landlock: Fix use-after-free of the source's parent directory","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-97593","published":"2026-09-25T10:22:09.913Z","updated":"2026-10-19T09:09:57.117Z","title":"iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-97592","published":"2026-09-25T10:22:09.305Z","updated":"2026-10-19T09:09:56.137Z","title":"s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-97591","published":"2026-09-25T10:22:08.694Z","updated":"2026-10-19T09:09:55.087Z","title":"s390/crypto: Fix handling of EBUSY in PHMAC when req is pushed to crypto engine","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-97590","published":"2026-09-25T10:22:08.075Z","updated":"2026-10-19T09:09:54.100Z","title":"s390/crypto: Fix missing scrub of temp buffers with PAES algorithm","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-97589","published":"2026-09-25T10:22:07.441Z","updated":"2026-10-19T09:09:53.140Z","title":"s390/crypto: Fix wrong return code to engine in asynch callbacks","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-97588","published":"2026-09-25T10:22:06.796Z","updated":"2026-10-19T09:09:52.160Z","title":"s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-97587","published":"2026-09-25T10:22:06.177Z","updated":"2026-10-30T12:37:30.665Z","title":"perf: RISC-V: store available counter mask as bitmap","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97586","published":"2026-09-25T10:22:05.540Z","updated":"2026-10-19T09:09:49.898Z","title":"afs: Fix missing kunmap in afs_dir_search_bucket()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-97585","published":"2026-09-25T10:22:04.942Z","updated":"2026-10-19T09:09:48.929Z","title":"afs: Fix double-unmap of directory block","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-97584","published":"2026-09-25T10:22:04.322Z","updated":"2026-10-19T09:09:47.944Z","title":"afs: Fix incorrect free in candidate cleanup in afs_lookup_server()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-97583","published":"2026-09-25T10:22:03.666Z","updated":"2026-10-19T09:09:46.971Z","title":"afs: Clear stale peer app data after address list changes","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00413,"kevAdded":null},{"id":"CVE-2026-97582","published":"2026-09-25T10:22:03.041Z","updated":"2026-10-30T12:37:29.592Z","title":"hwmon: (gpio-fan) Fix use-after-free in alarm work","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-97581","published":"2026-09-25T10:22:02.415Z","updated":"2026-10-19T09:09:43.743Z","title":"media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-97580","published":"2026-09-25T10:22:01.832Z","updated":"2026-10-19T09:09:42.749Z","title":"media: rkvdec: bound HEVC tile loops and PPS id to the array capacity","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-97579","published":"2026-09-25T10:22:01.216Z","updated":"2026-10-19T09:09:41.776Z","title":"media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-97578","published":"2026-09-25T10:22:00.541Z","updated":"2026-10-19T09:09:40.795Z","title":"media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-97577","published":"2026-09-25T10:21:59.950Z","updated":"2026-10-19T09:09:39.822Z","title":"media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-97576","published":"2026-09-25T10:21:59.298Z","updated":"2026-10-19T09:09:38.813Z","title":"media: v4l2-ctrls: validate HEVC tile counts","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-97575","published":"2026-09-25T10:21:58.700Z","updated":"2026-10-19T09:09:37.843Z","title":"media: v4l2-ctrls: validate AV1 tile counts","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-97574","published":"2026-09-25T10:21:58.062Z","updated":"2026-10-19T09:09:36.867Z","title":"bnxt_en: Don't free the live ring's TPA state on queue restart failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97573","published":"2026-09-25T10:21:57.443Z","updated":"2026-10-19T09:09:35.902Z","title":"bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00604,"kevAdded":null},{"id":"CVE-2026-97572","published":"2026-09-25T10:21:56.826Z","updated":"2026-10-19T09:09:34.905Z","title":"bnxt_en: Propagate RX ring init failures in bnxt_init_nic()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-97571","published":"2026-09-25T10:21:56.208Z","updated":"2026-10-19T09:09:33.921Z","title":"bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97570","published":"2026-09-25T10:21:55.604Z","updated":"2026-10-19T09:09:32.950Z","title":"bnxt_en: Bound SW TPA IDs to prevent crashes","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00443,"kevAdded":null},{"id":"CVE-2026-97569","published":"2026-09-25T10:21:54.998Z","updated":"2026-10-19T09:09:31.977Z","title":"bnxt_en: Prevent queue stop with deferred completions","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-97568","published":"2026-09-25T10:21:54.269Z","updated":"2026-10-19T09:09:31.044Z","title":"mptcp: syncookies: remember the request backup flag","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-97567","published":"2026-09-25T10:21:53.677Z","updated":"2026-10-30T12:37:28.529Z","title":"mptcp: prevent race between disconnect() and rtx","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-97566","published":"2026-09-25T10:21:53.068Z","updated":"2026-10-30T12:37:27.459Z","title":"mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-97565","published":"2026-09-25T10:21:52.459Z","updated":"2026-10-19T09:09:28.115Z","title":"smb: client: reject short READ responses in CIFSSMBRead()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-97564","published":"2026-09-25T10:21:51.858Z","updated":"2026-10-30T12:37:26.400Z","title":"smb: client: reject userspace cifs.idmap descriptions","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-97563","published":"2026-09-25T10:21:51.261Z","updated":"2026-10-19T09:09:26.197Z","title":"smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-97562","published":"2026-09-25T10:21:50.664Z","updated":"2026-10-19T09:09:25.220Z","title":"smb: client: pin DFS superblock in iterator callback","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00413,"kevAdded":null},{"id":"CVE-2026-97561","published":"2026-09-25T10:21:50.067Z","updated":"2026-10-30T12:37:25.329Z","title":"smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-97560","published":"2026-09-25T10:21:49.462Z","updated":"2026-10-19T09:09:23.264Z","title":"smb: client: fix one-byte OOB read in smb2_parse_native_symlink()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-97559","published":"2026-09-25T10:21:48.866Z","updated":"2026-10-30T12:37:24.247Z","title":"smb: client: fail DACL rewrite when the new DACL exceeds 64K","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-97558","published":"2026-09-25T10:21:48.277Z","updated":"2026-10-30T12:37:23.189Z","title":"smb: client: fix cifsFileInfo reference leak in deferred close","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-97557","published":"2026-09-25T10:21:47.680Z","updated":"2026-10-30T12:37:22.126Z","title":"smb: client: avoid leaking refcount in cifs_queue_oplock_break()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00696,"kevAdded":null},{"id":"CVE-2026-97556","published":"2026-09-25T10:21:47.078Z","updated":"2026-10-30T12:37:21.053Z","title":"smb: client: avoid leaking refcount when cifs_sb_tlink() fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-97555","published":"2026-09-25T10:21:46.445Z","updated":"2026-10-30T12:37:19.991Z","title":"smb: client: fix heap overflow in DACL owner/group rewrite","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00584,"kevAdded":null},{"id":"CVE-2026-97554","published":"2026-09-25T10:21:45.851Z","updated":"2026-10-30T12:37:18.935Z","title":"smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-97553","published":"2026-09-25T10:21:45.260Z","updated":"2026-10-19T09:09:16.314Z","title":"xfs: lock the healthmon when inserting unmount event","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-97552","published":"2026-09-25T10:21:44.651Z","updated":"2026-10-19T09:09:15.341Z","title":"xfs: initialise error in xfs_defer_finish_one()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-97551","published":"2026-09-25T10:21:44.048Z","updated":"2026-10-19T09:09:14.354Z","title":"xfs: initialise args->total for parent pointer updates","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-97550","published":"2026-09-25T10:21:43.450Z","updated":"2026-10-19T09:09:13.372Z","title":"xfs: fix unit conversions in per_binval computation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-97549","published":"2026-09-25T10:21:42.852Z","updated":"2026-10-19T09:09:12.382Z","title":"xfs: fix under-reservation of blocks when repairing sf directories","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97548","published":"2026-09-25T10:21:42.239Z","updated":"2026-10-19T09:09:11.344Z","title":"xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-97547","published":"2026-09-25T10:21:41.636Z","updated":"2026-10-19T09:09:10.369Z","title":"xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-97546","published":"2026-09-25T10:21:41.029Z","updated":"2026-10-19T09:09:09.393Z","title":"xfs: don't spin forever on zero-length dirents when salvaging them","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-97545","published":"2026-09-25T10:21:40.433Z","updated":"2026-10-19T09:09:08.423Z","title":"xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97544","published":"2026-09-25T10:21:39.839Z","updated":"2026-10-19T09:09:06.381Z","title":"xfs: don't leak dqacct if rhashtable insertion fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-97543","published":"2026-09-25T10:21:39.249Z","updated":"2026-10-19T09:09:05.396Z","title":"xfs: destroy seen inode bitmap when we fail to add a dirpath","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-97542","published":"2026-09-25T10:21:38.646Z","updated":"2026-10-19T09:09:04.449Z","title":"xfs: bail out on bitmap errors in xrep_agfl_fill","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-97541","published":"2026-09-25T10:21:38.051Z","updated":"2026-10-19T09:09:03.471Z","title":"wifi: ath9k_htc: don't store usb_device_id","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97540","published":"2026-09-25T10:21:37.410Z","updated":"2026-10-19T09:09:02.510Z","title":"net: usb: pegasus: don't rely on id table pointer arithmetic","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-97539","published":"2026-09-25T10:21:36.810Z","updated":"2026-10-19T09:09:01.540Z","title":"usb: xusbatm: don't rely on id table pointer arithmetic","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-97538","published":"2026-09-25T10:21:36.208Z","updated":"2026-10-21T12:53:13.791Z","title":"hwmon: (asus_rog_ryujin) Validate HID report lengths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-97537","published":"2026-09-25T10:21:35.608Z","updated":"2026-10-30T12:37:17.869Z","title":"scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-97536","published":"2026-09-25T10:21:34.991Z","updated":"2026-10-30T12:37:16.823Z","title":"scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2026-97535","published":"2026-09-25T10:21:34.395Z","updated":"2026-10-30T12:37:15.714Z","title":"scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-97534","published":"2026-09-25T10:21:33.792Z","updated":"2026-10-30T12:37:14.657Z","title":"f2fs: accurately adjust free_sections during free_segment_range","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-97533","published":"2026-09-25T10:21:33.188Z","updated":"2026-10-19T09:08:55.793Z","title":"x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-97532","published":"2026-09-25T10:21:32.582Z","updated":"2026-10-30T12:37:13.602Z","title":"scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-97531","published":"2026-09-25T10:21:31.968Z","updated":"2026-10-30T12:37:12.533Z","title":"scsi: qla2xxx: Skip vport under deletion in report ID acquisition","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2026-97530","published":"2026-09-25T10:21:31.326Z","updated":"2026-10-30T12:37:11.464Z","title":"scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-97529","published":"2026-09-25T10:21:30.733Z","updated":"2026-10-30T12:37:10.411Z","title":"scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-97528","published":"2026-09-25T10:21:30.130Z","updated":"2026-10-21T12:53:03.891Z","title":"scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2026-97527","published":"2026-09-25T10:21:29.521Z","updated":"2026-10-21T12:53:02.776Z","title":"scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2026-97526","published":"2026-09-25T10:21:28.923Z","updated":"2026-10-19T09:08:44.650Z","title":"s390/pai: Support CPU hotplug for PMU PAI","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-97525","published":"2026-09-25T10:21:28.284Z","updated":"2026-10-19T09:08:43.483Z","title":"x86/mm/pat: Allocate split page tables as kernel page tables","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-97524","published":"2026-09-25T10:21:27.668Z","updated":"2026-10-19T09:08:42.302Z","title":"mptcp: avoid unneeded actions on subflow reset","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00745,"kevAdded":null},{"id":"CVE-2026-97523","published":"2026-09-25T10:21:27.042Z","updated":"2026-10-19T09:08:41.355Z","title":"mptcp: close race between scheduler and state change","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00728,"kevAdded":null},{"id":"CVE-2026-97522","published":"2026-09-25T10:21:26.420Z","updated":"2026-10-19T09:08:40.383Z","title":"mptcp: fix bad accounting in __mptcp_subflow_push_pending()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-97521","published":"2026-09-24T16:05:21.667Z","updated":"2026-09-28T05:30:59.436Z","title":"gfs2: fix quota init duplicate scan","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-97520","published":"2026-09-24T16:05:20.188Z","updated":"2026-09-28T05:30:58.172Z","title":"gfs2: move quota_init qc iterator increment","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-97519","published":"2026-09-24T16:05:19.278Z","updated":"2026-09-28T05:30:56.941Z","title":"drm/xe: Fix null pointer dereference in devcoredump cleanup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-97518","published":"2026-09-24T16:05:18.072Z","updated":"2026-10-30T12:37:09.335Z","title":"wifi: cfg80211: reject duplicate wiphy cipher suite entries","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-97517","published":"2026-09-24T16:05:16.009Z","updated":"2026-10-03T10:59:11.955Z","title":"wifi: nl80211: reject beacons with bad HE operation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-97516","published":"2026-09-24T16:05:14.263Z","updated":"2026-10-03T10:59:10.452Z","title":"wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-97515","published":"2026-09-24T16:05:13.124Z","updated":"2026-10-21T12:53:00.686Z","title":"i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-97514","published":"2026-09-24T16:05:12.059Z","updated":"2026-09-28T05:30:50.947Z","title":"media: chips-media: wave5: Fix Reports from Kernel Lock Validator","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-97513","published":"2026-09-24T16:05:10.589Z","updated":"2026-10-21T12:52:59.580Z","title":"media: chips-media: wave5: Release m2m_ctx after Instance Removed from List","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2026-97512","published":"2026-09-24T16:05:09.279Z","updated":"2026-10-30T12:37:08.258Z","title":"spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-97511","published":"2026-09-24T16:05:08.371Z","updated":"2026-09-28T05:30:47.250Z","title":"wifi: mac80211: avoid out-of-bounds access in monitor","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-97510","published":"2026-09-24T16:05:05.661Z","updated":"2026-10-03T10:59:08.226Z","title":"thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-97509","published":"2026-09-24T16:05:04.487Z","updated":"2026-10-03T10:59:07.153Z","title":"thunderbolt: Keep XDomain reference during the lifetime of a service","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-97508","published":"2026-09-24T16:04:58.740Z","updated":"2026-10-03T10:59:06.059Z","title":"thunderbolt: Set tb->root_switch to NULL when domain is stopped","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-97507","published":"2026-09-24T16:04:56.890Z","updated":"2026-10-03T10:59:04.970Z","title":"media: dm1105: fix missing error check for dma_alloc_coherent","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-97506","published":"2026-09-24T16:04:55.504Z","updated":"2026-10-03T10:59:03.858Z","title":"crypto: ixp4xx - fix buffer chain unwind on allocation failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-97505","published":"2026-09-24T16:04:54.215Z","updated":"2026-10-30T12:37:07.198Z","title":"PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-97504","published":"2026-09-24T16:04:52.618Z","updated":"2026-09-28T05:30:38.850Z","title":"watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-97503","published":"2026-09-24T16:04:50.412Z","updated":"2026-10-21T12:52:57.377Z","title":"genirq/proc: Size interrupt directory names for 10-digit interrupt numbers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-97502","published":"2026-09-24T16:04:49.056Z","updated":"2026-10-03T10:59:02.767Z","title":"mmc: davinci: avoid NULL deref of host->data in IRQ handler","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-97501","published":"2026-09-24T16:04:48.101Z","updated":"2026-10-30T12:37:06.130Z","title":"pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-97500","published":"2026-09-24T16:04:47.116Z","updated":"2026-10-30T12:37:05.075Z","title":"wifi: rtw89: phy: check length before parsing PHY status IE","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-97499","published":"2026-09-24T16:04:46.252Z","updated":"2026-09-28T05:30:32.658Z","title":"coresight: perf: Retrieve path and source from event data","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-97498","published":"2026-09-24T16:04:45.339Z","updated":"2026-09-28T05:30:31.430Z","title":"drm/amdgpu/userq: pin mqd and fw object bo to avoid eviction","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-97497","published":"2026-09-24T16:04:44.515Z","updated":"2026-10-03T10:59:00.579Z","title":"drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-97496","published":"2026-09-24T16:04:43.625Z","updated":"2026-10-03T10:58:59.453Z","title":"drm/amdkfd: Fix OOB memory exposure in get_wave_state()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-97495","published":"2026-09-24T16:04:42.808Z","updated":"2026-10-03T10:58:58.360Z","title":"drm/amdkfd: Check bounds on allocate_doorbell","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-97494","published":"2026-09-24T16:04:41.957Z","updated":"2026-10-30T12:37:04.017Z","title":"drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-97493","published":"2026-09-24T16:04:41.120Z","updated":"2026-10-30T12:37:02.957Z","title":"drm/amdgpu: Bound GPIO I2C table entry count from VBIOS","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-97492","published":"2026-09-24T16:04:40.294Z","updated":"2026-10-21T12:52:52.958Z","title":"wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97491","published":"2026-09-24T16:04:39.488Z","updated":"2026-10-03T10:58:56.169Z","title":"net/rds: Don't sleep inside rds_ib_conn_path_shutdown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97490","published":"2026-09-24T16:04:38.623Z","updated":"2026-10-03T10:58:55.076Z","title":"affs: handle set_blocksize failures","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97489","published":"2026-09-24T16:04:37.759Z","updated":"2026-10-03T10:58:53.984Z","title":"bfs: handle set_blocksize failures","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97488","published":"2026-09-24T16:04:35.423Z","updated":"2026-10-03T10:58:52.898Z","title":"qnx4: handle set_blocksize failures","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97487","published":"2026-09-24T16:04:32.648Z","updated":"2026-10-03T10:58:51.819Z","title":"jfs: handle set_blocksize failures","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97486","published":"2026-09-24T16:04:30.711Z","updated":"2026-10-03T10:58:50.727Z","title":"hpfs: handle set_blocksize failures","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97485","published":"2026-09-24T16:04:29.837Z","updated":"2026-10-03T10:58:49.642Z","title":"omfs: handle set_blocksize failures","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97484","published":"2026-09-24T16:04:27.978Z","updated":"2026-10-03T10:58:48.553Z","title":"usbip: vhci_hcd: fix NULL deref in status_show_vhci","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97483","published":"2026-09-24T16:04:27.070Z","updated":"2026-10-03T10:58:47.463Z","title":"usb: core: hcd: fix possible deadlock in rh control transfers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97482","published":"2026-09-24T16:04:25.874Z","updated":"2026-10-03T10:58:46.364Z","title":"usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97481","published":"2026-09-24T16:04:23.958Z","updated":"2026-10-03T10:58:45.270Z","title":"serial: 8250: fix possible ISR soft lockup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97480","published":"2026-09-24T16:04:22.893Z","updated":"2026-10-30T12:37:01.897Z","title":"tty: serial: 8250: protect against NULL uart->port.dev in register","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-97479","published":"2026-09-24T16:04:21.956Z","updated":"2026-10-30T12:37:00.836Z","title":"driver core: Avoid warning when removing a device while its supplier is unbinding","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-97478","published":"2026-09-24T16:04:20.263Z","updated":"2026-10-30T12:36:59.771Z","title":"virt: acrn: Fix irqfd use-after-free during eventfd shutdown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-97477","published":"2026-09-24T16:04:19.358Z","updated":"2026-10-30T12:36:58.713Z","title":"RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-97476","published":"2026-09-24T16:04:18.454Z","updated":"2026-10-03T10:58:44.187Z","title":"rds: filter RDS_INFO_* getsockopt by caller's netns","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97475","published":"2026-09-24T16:04:17.604Z","updated":"2026-10-03T10:58:43.093Z","title":"thermal/drivers/tegra/soctherma: Switch to devm cooling device registration","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97474","published":"2026-09-24T16:04:16.741Z","updated":"2026-09-28T05:30:02.441Z","title":"wifi: iwlwifi: mld: purge async notifications upon nic error","severity":"HIGH","score":7.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-97473","published":"2026-09-24T16:04:15.812Z","updated":"2026-09-28T05:30:01.317Z","title":"powercap: intel_rapl: Fix memory leak in rapl_add_package_cpuslocked()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-97472","published":"2026-09-24T16:04:14.951Z","updated":"2026-10-03T10:58:42.012Z","title":"ipv6: addrconf: fix temp address generation after prefix deprecation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97456","published":"2026-09-24T16:04:13.523Z","updated":"2026-10-03T10:58:40.914Z","title":"ACPICA: Fix condition check in acpi_ps_parse_loop()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97455","published":"2026-09-24T16:04:11.922Z","updated":"2026-10-03T10:58:39.822Z","title":"ACPICA: Fix use-after-free in acpi_ds_terminate_control_method()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2026-97454","published":"2026-09-24T16:04:10.819Z","updated":"2026-10-03T10:58:38.664Z","title":"ACPICA: add boundary checks in acpi_ps_get_next_field()","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-97453","published":"2026-09-24T16:04:09.924Z","updated":"2026-10-03T10:58:37.498Z","title":"ACPICA: validate byte_count in acpi_ps_get_next_package_length()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97452","published":"2026-09-24T16:04:08.401Z","updated":"2026-10-03T10:58:36.364Z","title":"ACPICA: Prevent adding invalid references","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-97451","published":"2026-09-24T16:04:07.520Z","updated":"2026-10-03T10:58:35.249Z","title":"ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-97450","published":"2026-09-24T16:04:06.092Z","updated":"2026-10-03T10:58:34.169Z","title":"ACPICA: validate handler object type in two places","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-97449","published":"2026-09-24T16:04:04.496Z","updated":"2026-10-03T10:58:33.084Z","title":"ACPICA: Add package limit checks in parser functions","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97448","published":"2026-09-24T16:04:03.667Z","updated":"2026-10-03T10:58:31.976Z","title":"ACPICA: Add validation for node in acpi_ns_build_normalized_path()","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-97447","published":"2026-09-24T16:04:02.731Z","updated":"2026-09-25T12:44:25.332Z","title":"ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-97446","published":"2026-09-24T16:04:01.612Z","updated":"2026-10-03T10:58:30.858Z","title":"ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97445","published":"2026-09-24T16:04:00.409Z","updated":"2026-10-03T10:58:29.784Z","title":"ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-97444","published":"2026-09-24T16:03:59.121Z","updated":"2026-10-03T10:58:28.686Z","title":"ACPICA: add boundary checks in two places","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-97443","published":"2026-09-24T16:03:57.790Z","updated":"2026-09-25T12:44:20.881Z","title":"perf/ftrace: Fix WARNING in __unregister_ftrace_function","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-97442","published":"2026-09-24T16:03:56.458Z","updated":"2026-10-03T10:58:27.589Z","title":"wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-97441","published":"2026-09-24T16:03:54.845Z","updated":"2026-10-03T10:58:26.486Z","title":"ata: ahci: fail probe if BAR too small for claimed ports","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97440","published":"2026-09-24T16:03:53.360Z","updated":"2026-10-03T10:58:25.396Z","title":"net: qrtr: fix node refcount leak on ctrl packet alloc failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97439","published":"2026-09-24T16:03:52.427Z","updated":"2026-10-03T10:58:24.299Z","title":"fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97438","published":"2026-09-24T16:03:51.466Z","updated":"2026-10-03T10:58:23.213Z","title":"fs/ntfs3: validate index entry key bounds","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-97437","published":"2026-09-24T16:03:50.105Z","updated":"2026-10-03T10:58:22.091Z","title":"ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-97436","published":"2026-09-24T16:03:49.183Z","updated":"2026-10-03T10:58:20.945Z","title":"dpaa2-switch: rework FDB management on the bridge leave path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97435","published":"2026-09-24T16:03:48.116Z","updated":"2026-10-03T10:58:19.848Z","title":"net: dsa: sja1105: flower: reject cross-chip redirect","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97434","published":"2026-09-24T16:03:47.069Z","updated":"2026-10-03T10:58:18.766Z","title":"dpaa2-switch: fix handling of NAPI on the remove path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97433","published":"2026-09-24T16:03:46.169Z","updated":"2026-09-25T12:44:10.016Z","title":"nvme: validate FDP configuration descriptor sizes","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00319,"kevAdded":null},{"id":"CVE-2026-97432","published":"2026-09-24T16:03:45.303Z","updated":"2026-10-21T12:52:47.469Z","title":"wifi: iwlwifi: mvm: fix P2P-Device binding handling","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-97431","published":"2026-09-24T16:03:44.385Z","updated":"2026-09-25T12:44:07.741Z","title":"drm/amd/display: Avoid DPMS-on for phantom stream","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-97430","published":"2026-09-24T16:03:43.491Z","updated":"2026-10-03T10:58:17.681Z","title":"xhci: Prevent queuing new commands if xhci is inaccessible","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97429","published":"2026-09-24T16:03:42.269Z","updated":"2026-10-03T10:58:16.575Z","title":"drm/amdkfd: fix UAF race in destroy_queue_cpsch","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-97428","published":"2026-09-24T16:03:41.103Z","updated":"2026-10-21T12:52:46.339Z","title":"drm/amdgpu: harden FRU PIA parsing with bounded helpers","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-97427","published":"2026-09-24T16:03:40.151Z","updated":"2026-10-03T10:58:15.472Z","title":"drm/amd/pm: bound pp_dpm_set_pp_table() memcpy","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-97426","published":"2026-09-24T16:03:39.074Z","updated":"2026-09-25T12:44:02.223Z","title":"drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-97425","published":"2026-09-24T16:03:38.183Z","updated":"2026-10-30T12:36:57.631Z","title":"drm/amdgpu: fix buffer overflow during vBIOS update","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-97424","published":"2026-09-24T16:03:37.028Z","updated":"2026-10-21T12:52:45.222Z","title":"drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-97423","published":"2026-09-24T16:03:35.458Z","updated":"2026-09-25T12:43:59.015Z","title":"cxl/region: Validate partition index before array access","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-97422","published":"2026-09-24T16:03:32.463Z","updated":"2026-10-30T12:36:55.282Z","title":"drm/amdkfd: fix SMI event cross-process information leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-97421","published":"2026-09-24T16:03:31.505Z","updated":"2026-10-03T10:58:13.282Z","title":"RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-97420","published":"2026-09-24T16:03:30.084Z","updated":"2026-10-03T10:58:12.202Z","title":"bpf: NUL-terminate replaced sysctl value","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97419","published":"2026-09-24T16:03:28.957Z","updated":"2026-10-03T10:58:11.119Z","title":"hsr: broadcast netlink notifications in the device's net namespace","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97418","published":"2026-09-24T16:03:27.939Z","updated":"2026-10-03T10:58:10.040Z","title":"ALSA: es18xx: check control allocation before private data setup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97417","published":"2026-09-24T16:03:27.069Z","updated":"2026-10-03T10:58:08.961Z","title":"netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0049,"kevAdded":null},{"id":"CVE-2026-97416","published":"2026-09-24T16:03:23.731Z","updated":"2026-10-03T10:58:07.862Z","title":"btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97415","published":"2026-09-24T16:03:22.780Z","updated":"2026-10-03T10:58:06.771Z","title":"btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-97414","published":"2026-09-24T16:03:21.936Z","updated":"2026-09-25T12:43:49.195Z","title":"ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-97413","published":"2026-09-24T16:03:21.010Z","updated":"2026-10-03T10:58:05.684Z","title":"RDMA/rtrs-srv: Fix integer underflow in process_read and process_write","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-97412","published":"2026-09-24T16:03:19.355Z","updated":"2026-10-21T12:52:43.054Z","title":"pds_core: quiesce DMA before freeing resources","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-97411","published":"2026-09-24T16:03:17.967Z","updated":"2026-10-03T10:58:04.560Z","title":"net: ibm: emac: mal: fix potential system hang in mal_remove()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97410","published":"2026-09-24T16:03:17.074Z","updated":"2026-09-25T12:43:44.870Z","title":"netconsole: take target_cleanup_list_lock in drop_netconsole_target()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-97409","published":"2026-09-24T16:03:16.195Z","updated":"2026-10-30T12:36:54.217Z","title":"nvme-fc: Do not cancel requests in io target before it is initialized","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-97408","published":"2026-09-24T16:03:15.141Z","updated":"2026-10-03T10:58:02.384Z","title":"Bluetooth: L2CAP: validate connectionless PSM length","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-97407","published":"2026-09-24T16:03:13.856Z","updated":"2026-10-03T10:58:01.288Z","title":"ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93830","published":"2026-09-24T16:03:12.818Z","updated":"2026-10-03T10:58:00.189Z","title":"net: stmmac: xgmac2: disable RBUE in default RX interrupt mask","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0049,"kevAdded":null},{"id":"CVE-2026-93829","published":"2026-09-24T16:03:11.886Z","updated":"2026-10-30T12:36:53.159Z","title":"smb: client: fix races in cifsd thread creation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-93828","published":"2026-09-24T16:03:08.417Z","updated":"2026-10-30T12:36:52.106Z","title":"exfat: fix handling of damaged volume in exfat_create_upcase_table()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-93827","published":"2026-09-24T16:03:05.795Z","updated":"2026-09-25T12:43:36.887Z","title":"virtio-fs: avoid double-free on failed queue setup","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2026-93826","published":"2026-09-24T16:03:04.711Z","updated":"2026-10-03T10:57:57.986Z","title":"HID: hidpp: fix potential UAF in hidpp_connect_event()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-93825","published":"2026-09-24T16:03:03.808Z","updated":"2026-10-03T10:57:56.861Z","title":"spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93824","published":"2026-09-24T16:03:02.783Z","updated":"2026-10-03T10:57:55.753Z","title":"tls: reject the combination of TLS and sockmap","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-93823","published":"2026-09-24T16:03:01.639Z","updated":"2026-10-30T12:36:51.053Z","title":"drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-93822","published":"2026-09-24T16:03:00.701Z","updated":"2026-10-03T10:57:53.564Z","title":"PCI: iproc: Protect root bus removal with rescan lock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93821","published":"2026-09-24T16:02:59.826Z","updated":"2026-10-03T10:57:52.467Z","title":"PCI: altera: Protect root bus removal with rescan lock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93820","published":"2026-09-24T16:02:58.625Z","updated":"2026-10-03T10:57:51.365Z","title":"PCI: rockchip: Protect root bus removal with rescan lock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93819","published":"2026-09-24T16:02:56.394Z","updated":"2026-10-03T10:57:50.269Z","title":"PCI: mediatek: Protect root bus removal with rescan lock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93818","published":"2026-09-24T16:02:54.890Z","updated":"2026-09-25T12:43:26.921Z","title":"PCI: plda: Protect root bus removal with rescan lock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-93817","published":"2026-09-24T16:02:54.039Z","updated":"2026-10-30T12:36:49.221Z","title":"perf: Fix addr_filter_ranges lifetime","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-93816","published":"2026-09-24T16:02:53.171Z","updated":"2026-10-03T10:57:49.180Z","title":"f2fs: validate inline dentry name lengths before conversion","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-93815","published":"2026-09-24T16:02:52.078Z","updated":"2026-10-03T10:57:48.033Z","title":"net: au1000: move free_irq out of the close-time spinlocked section","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93814","published":"2026-09-24T16:02:50.963Z","updated":"2026-10-03T10:57:46.916Z","title":"spi: core: Abort active target transfer on controller suspend","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-93813","published":"2026-09-24T16:02:49.907Z","updated":"2026-10-03T10:57:45.809Z","title":"btrfs: tree-checker: validate INODE_REF's namelen","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-93812","published":"2026-09-24T16:02:49.060Z","updated":"2026-10-03T10:57:44.701Z","title":"ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93811","published":"2026-09-24T16:02:47.745Z","updated":"2026-10-03T10:57:43.607Z","title":"ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93810","published":"2026-09-24T16:02:46.426Z","updated":"2026-10-03T10:57:42.502Z","title":"cachefiles: Fix double fput","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-93809","published":"2026-09-24T16:02:44.613Z","updated":"2026-09-25T12:43:17.218Z","title":"drm/amdgpu: flush pending RCU callbacks on module unload","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-93808","published":"2026-09-24T16:02:43.621Z","updated":"2026-10-03T10:57:41.411Z","title":"ALSA: usb-audio: caiaq: validate EP1 reply lengths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93807","published":"2026-09-24T16:02:41.356Z","updated":"2026-10-03T10:57:40.321Z","title":"wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93806","published":"2026-09-24T16:02:40.159Z","updated":"2026-10-03T10:57:39.214Z","title":"wifi: cfg80211: validate assoc response length before status and IE access","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-93805","published":"2026-09-24T16:02:39.248Z","updated":"2026-10-03T10:57:38.089Z","title":"wifi: cfg80211: validate rx/tx MLME callback frame lengths before access","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93804","published":"2026-09-24T16:02:38.223Z","updated":"2026-10-30T12:36:48.169Z","title":"wifi: mac80211: ibss: wait for in-flight TX on disconnect","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-93803","published":"2026-09-24T16:02:37.324Z","updated":"2026-10-03T10:57:36.957Z","title":"wifi: libipw: fix key index receive bound checks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93802","published":"2026-09-24T16:02:36.341Z","updated":"2026-10-03T10:57:35.833Z","title":"wifi: rsi: validate beacon length before fixed buffer copy","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93801","published":"2026-09-24T16:02:35.496Z","updated":"2026-10-21T12:52:38.635Z","title":"smb/client: zero-initialize stack-allocated cifs_open_info_data","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-93800","published":"2026-09-24T16:02:34.370Z","updated":"2026-10-03T10:57:34.733Z","title":"btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93799","published":"2026-09-24T16:02:32.174Z","updated":"2026-10-03T10:57:33.642Z","title":"wifi: iwlwifi: mvm: validate sta_id in BA window status notif","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2026-93798","published":"2026-09-24T16:02:31.291Z","updated":"2026-10-03T10:57:32.550Z","title":"btrfs: fix reloc root cleanup in merge_reloc_roots()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-93797","published":"2026-09-24T16:02:30.333Z","updated":"2026-10-03T10:57:31.431Z","title":"wifi: iwlwifi: mvm: fix an off-by-1 boundary check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93796","published":"2026-09-24T16:02:29.478Z","updated":"2026-10-30T12:36:47.103Z","title":"wifi: iwlwifi: pcie: null RX pointers after free","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-93795","published":"2026-09-24T16:02:28.654Z","updated":"2026-10-03T10:57:30.314Z","title":"blk-cgroup: fix leaks and online flag on radix_tree_insert failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93794","published":"2026-09-24T16:02:27.716Z","updated":"2026-10-30T12:36:46.042Z","title":"smb/client: flush dirty data before punching a hole","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-93793","published":"2026-09-24T16:02:26.708Z","updated":"2026-10-30T12:36:44.982Z","title":"wifi: iwlwifi: mvm: validate TX_CMD response layout","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2026-93792","published":"2026-09-24T16:02:25.848Z","updated":"2026-10-30T12:36:43.899Z","title":"wifi: iwlwifi: mvm: fix a possible underflow","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-93791","published":"2026-09-24T16:02:24.968Z","updated":"2026-10-30T12:36:42.840Z","title":"wifi: iwlwifi: mvm: add a check on the tid coming from the firmware","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-93790","published":"2026-09-24T16:02:24.091Z","updated":"2026-10-30T12:36:41.784Z","title":"wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-93789","published":"2026-09-24T16:02:23.252Z","updated":"2026-10-03T10:57:24.712Z","title":"wifi: iwlwifi: bound aligned TLV advance in FW parser","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93788","published":"2026-09-24T16:02:21.751Z","updated":"2026-10-03T10:57:23.599Z","title":"wifi: iwlwifi: acpi: validate WGDS table revision index","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-93787","published":"2026-09-24T16:02:20.872Z","updated":"2026-10-03T10:57:22.488Z","title":"smb: client: bound dirent name against end of SMB response in cifs_filldir","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2026-93786","published":"2026-09-24T16:02:19.798Z","updated":"2026-10-30T12:36:40.711Z","title":"ksmbd: preserve VFS inherited POSIX ACL mask","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00341,"kevAdded":null},{"id":"CVE-2026-93785","published":"2026-09-24T16:02:18.964Z","updated":"2026-10-03T10:57:20.267Z","title":"cifs: validate idmap key payload length","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93784","published":"2026-09-24T16:02:18.067Z","updated":"2026-10-03T10:57:19.164Z","title":"wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93783","published":"2026-09-24T16:02:17.149Z","updated":"2026-10-03T10:57:18.054Z","title":"Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93782","published":"2026-09-24T16:02:14.457Z","updated":"2026-10-03T10:57:16.951Z","title":"vhost-scsi: flush backend after device ioctls","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-93781","published":"2026-09-24T16:02:13.599Z","updated":"2026-10-03T10:57:15.829Z","title":"scsi: core: Do not block on tag allocation in scsi_eh_lock_door()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-93288","published":"2026-09-24T16:02:12.144Z","updated":"2026-10-03T10:57:14.695Z","title":"netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-93287","published":"2026-09-24T16:02:11.296Z","updated":"2026-10-03T10:57:13.466Z","title":"i2c: smbus: reject oversized block transfers in the common path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-93286","published":"2026-09-24T16:02:10.463Z","updated":"2026-10-03T10:57:12.356Z","title":"net: appletalk: fix NULL pointer dereference in aarp_send_ddp()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93285","published":"2026-09-24T16:02:09.388Z","updated":"2026-10-30T12:36:39.663Z","title":"f2fs: embed f2fs_gc_kthread in f2fs_sb_info","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-93284","published":"2026-09-24T16:02:08.527Z","updated":"2026-10-19T09:08:38.485Z","title":"drm/pagemap: dma-unmap pages before handling migration errors","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-93283","published":"2026-09-24T15:52:26.252Z","updated":"2026-10-19T09:08:37.502Z","title":"i3c: master: Fix device_register() error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-93282","published":"2026-09-24T15:52:24.603Z","updated":"2026-10-30T12:36:38.607Z","title":"ksmbd: fix maximum allowed access checks","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00377,"kevAdded":null},{"id":"CVE-2026-93281","published":"2026-09-24T15:52:23.240Z","updated":"2026-10-19T09:08:35.587Z","title":"wifi: rtw89: fix HE extended capability length check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2026-93280","published":"2026-09-24T15:52:22.253Z","updated":"2026-10-19T09:08:34.610Z","title":"greybus: audio: bound the topology section sizes against the fetched size","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2026-93279","published":"2026-09-24T15:52:21.275Z","updated":"2026-10-19T09:08:33.590Z","title":"staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-93278","published":"2026-09-24T15:52:20.416Z","updated":"2026-10-19T09:08:32.599Z","title":"staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2026-93277","published":"2026-09-24T15:52:19.490Z","updated":"2026-10-19T09:08:31.636Z","title":"RDMA/bnxt_re: Validate udata before executing commands","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-93276","published":"2026-09-24T15:52:18.567Z","updated":"2026-10-19T09:08:30.634Z","title":"phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-93275","published":"2026-09-24T15:52:17.064Z","updated":"2026-10-19T09:08:29.668Z","title":"perf/x86/intel/pt: Fix stop/start with no update","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-93274","published":"2026-09-24T15:52:16.117Z","updated":"2026-10-19T09:08:28.712Z","title":"pinctrl: bcm2835: Don't remove an unregistered GPIO chip","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-93273","published":"2026-09-24T15:52:15.213Z","updated":"2026-10-19T09:08:27.727Z","title":"regulator: tps6594: Fix device node reference leaks in multiphase loop","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-93272","published":"2026-09-24T15:52:14.274Z","updated":"2026-10-30T12:36:37.528Z","title":"remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2026-93271","published":"2026-09-24T15:52:13.287Z","updated":"2026-10-19T09:08:25.791Z","title":"wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-93270","published":"2026-09-24T15:52:09.868Z","updated":"2026-10-19T09:08:24.811Z","title":"bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-93269","published":"2026-09-24T15:52:09.047Z","updated":"2026-10-30T12:36:36.458Z","title":"ext4: fix circular lock dependency in ext4_ext_migrate","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-93268","published":"2026-09-24T15:52:07.310Z","updated":"2026-10-19T09:08:22.372Z","title":"ext4: skip extra isize expansion during mount to prevent deadlock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-93267","published":"2026-09-24T15:52:06.415Z","updated":"2026-10-19T09:08:20.283Z","title":"RDMA/core: Fix potential use after free in uverbs_free_dmah()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-93266","published":"2026-09-24T15:52:05.559Z","updated":"2026-10-19T09:08:19.340Z","title":"arm64: RSI: fix field-spanning write warning in attestation token init","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-93265","published":"2026-09-24T15:52:04.646Z","updated":"2026-10-19T09:08:18.380Z","title":"PCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-93264","published":"2026-09-24T15:52:03.741Z","updated":"2026-10-19T09:08:17.409Z","title":"RDMA/efa: Fix PBL chunk length computation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-93263","published":"2026-09-24T15:52:02.877Z","updated":"2026-10-19T09:08:16.442Z","title":"clk: eswin: Zero-initialize stack-allocated clk_init_data","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-93262","published":"2026-09-24T15:52:01.886Z","updated":"2026-10-19T09:08:15.484Z","title":"md/raid5-ppl: fix use-after-free in ppl_do_flush()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2026-93261","published":"2026-09-24T15:51:59.638Z","updated":"2026-10-19T09:08:14.521Z","title":"locking/lockdep: Fix NULL pointer dereference in __lock_set_class()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-93260","published":"2026-09-24T15:51:46.703Z","updated":"2026-10-30T12:36:35.383Z","title":"powerpc/xive: propagate IPI init errors to prevent use-after-free","severity":"HIGH","score":7.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-93259","published":"2026-09-24T15:51:45.772Z","updated":"2026-10-19T09:08:12.589Z","title":"powerpc/irq: Fix missing r2 clobber in PCREL inline assembly","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-93258","published":"2026-09-24T15:51:44.882Z","updated":"2026-10-19T09:08:11.620Z","title":"ocfs2: do not use make_bad_inode() in ocfs2_read_inode_block_full()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-93257","published":"2026-09-24T15:51:43.978Z","updated":"2026-10-19T09:08:10.647Z","title":"block: handle nogenerate/noverify properly in fs-integrity","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-93256","published":"2026-09-24T15:51:43.080Z","updated":"2026-10-19T09:08:09.709Z","title":"arm64: hibernate: mask DAIF before restoring hibernated kernel","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-93255","published":"2026-09-24T15:51:42.056Z","updated":"2026-10-19T09:08:08.727Z","title":"btrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-93254","published":"2026-09-24T15:51:40.955Z","updated":"2026-10-19T09:08:07.781Z","title":"arm64: entry: Avoid unnecessary local_irq_disable() on kernel exit","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-93253","published":"2026-09-24T15:51:29.259Z","updated":"2026-10-19T09:08:06.840Z","title":"sched/isolation: Defer freeing of cpumask memblock memory to initcall","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-93252","published":"2026-09-24T15:51:28.355Z","updated":"2026-10-19T09:08:05.879Z","title":"ocfs2: fix circular locking dependency in ocfs2_init_acl()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-93251","published":"2026-09-24T15:51:27.511Z","updated":"2026-10-30T12:36:32.328Z","title":"ACPI: bus: Introduce acpi_bus_get_primary_device()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-93250","published":"2026-09-24T15:51:15.108Z","updated":"2026-10-19T09:08:03.974Z","title":"vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-93249","published":"2026-09-24T15:51:14.111Z","updated":"2026-10-19T09:08:02.994Z","title":"spi: amlogic-spisg: Make sure clk_init_data is fully initialized","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-93248","published":"2026-09-24T15:51:13.108Z","updated":"2026-10-19T09:08:01.870Z","title":"drm/xe: don't WARN on kernel job timeout when device already wedged","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-93247","published":"2026-09-24T15:51:04.897Z","updated":"2026-10-19T09:08:00.296Z","title":"Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-93246","published":"2026-09-24T15:51:03.587Z","updated":"2026-10-19T09:07:58.955Z","title":"octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-93245","published":"2026-09-24T15:51:02.369Z","updated":"2026-10-19T09:07:57.662Z","title":"apparmor: policy_int make sure list heads are initialized before fail path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-93244","published":"2026-09-24T15:40:29.560Z","updated":"2026-10-30T12:36:31.259Z","title":"drm/sysfb: simpledrm: Improve stride validation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-93243","published":"2026-09-24T15:40:27.606Z","updated":"2026-10-30T12:36:30.192Z","title":"mm/secretmem: properly account locked pages","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2026-93242","published":"2026-09-24T15:40:26.570Z","updated":"2026-10-19T09:07:53.904Z","title":"scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-93241","published":"2026-09-24T15:34:36.237Z","updated":"2026-10-19T09:07:52.930Z","title":"memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-93240","published":"2026-09-24T15:34:32.134Z","updated":"2026-10-21T12:52:27.295Z","title":"memcg: make the v1 soft limit knob inert","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-93239","published":"2026-09-24T15:34:27.219Z","updated":"2026-10-30T12:36:29.121Z","title":"arm64: mm: Fix the lockless page-table walk in show_pte()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-93238","published":"2026-09-24T15:34:11.543Z","updated":"2026-10-19T09:07:49.811Z","title":"s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-93237","published":"2026-09-24T15:33:51.702Z","updated":"2026-10-19T09:07:48.863Z","title":"LoongArch: Add DIRECT_MAP_PHYSMEM_END definition","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93236","published":"2026-09-24T15:33:35.013Z","updated":"2026-10-19T09:07:47.914Z","title":"media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-93235","published":"2026-09-24T15:33:33.241Z","updated":"2026-10-19T09:07:46.831Z","title":"f2fs: fix to zero post-EOF data when extending file size","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-93234","published":"2026-09-24T15:33:31.617Z","updated":"2026-10-19T09:07:45.893Z","title":"drm/gud: validate TV mode names before creating enum property","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-93233","published":"2026-09-24T15:32:51.743Z","updated":"2026-10-19T09:07:44.949Z","title":"drm/nouveau/dmem: fix callocated underflow on large folio split","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-93232","published":"2026-09-24T15:29:22.699Z","updated":"2026-10-19T09:07:43.993Z","title":"mm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-93231","published":"2026-09-24T15:29:19.786Z","updated":"2026-10-30T12:36:28.057Z","title":"lockd: fix swapped arguments in nlmsvc_match_ip()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-93230","published":"2026-09-24T15:29:16.067Z","updated":"2026-10-21T12:52:25.122Z","title":"mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-93229","published":"2026-09-24T15:29:14.322Z","updated":"2026-10-19T09:07:41.099Z","title":"nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-93228","published":"2026-09-24T15:29:10.087Z","updated":"2026-10-30T12:36:26.967Z","title":"svcrdma: Reject Write/Reply chunks with segcount 0","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-93227","published":"2026-09-24T15:29:00.289Z","updated":"2026-10-19T09:07:38.667Z","title":"mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-93226","published":"2026-09-24T15:28:55.977Z","updated":"2026-10-19T09:07:37.714Z","title":"ipv6: use RCU iterator to dump route exceptions","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-93225","published":"2026-09-24T15:21:12.635Z","updated":"2026-10-19T09:07:36.752Z","title":"phy: fsl-imx8mq-usb: fix typec switch leak on probe error path","severity":"HIGH","score":7.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-93224","published":"2026-09-24T15:21:10.542Z","updated":"2026-10-19T09:07:35.798Z","title":"svcrdma: Fix unmatched rn_unregister on failed accept","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00447,"kevAdded":null},{"id":"CVE-2026-93223","published":"2026-09-24T15:21:06.983Z","updated":"2026-10-19T09:07:34.828Z","title":"staging: media: tegra-video: fix of_node_put() on VIP parse errors","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-93222","published":"2026-09-24T15:21:04.961Z","updated":"2026-10-19T09:07:33.885Z","title":"signal: avoid shared siginfo namespace rewrites","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-93221","published":"2026-09-24T15:10:44.598Z","updated":"2026-10-21T12:52:22.888Z","title":"nfsd: convert nfsd_net boolean flags to unsigned long flags word","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-93220","published":"2026-09-24T15:10:43.770Z","updated":"2026-10-19T09:07:31.931Z","title":"sched_ext: Keep kick_sync waiting on the rq's own CPU","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-93219","published":"2026-09-24T15:10:42.900Z","updated":"2026-10-19T09:07:31.003Z","title":"clocksource/drivers/timer-sun4i: Advertise a real minimum delta","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-93218","published":"2026-09-24T15:10:41.370Z","updated":"2026-10-19T09:07:29.994Z","title":"mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-93217","published":"2026-09-24T15:10:40.487Z","updated":"2026-10-19T09:07:29.053Z","title":"mm/madvise: skip device-private PMDs in cold and pageout walks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-93216","published":"2026-09-24T15:10:38.702Z","updated":"2026-10-21T12:52:21.777Z","title":"mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-93215","published":"2026-09-24T15:10:37.863Z","updated":"2026-10-19T09:07:27.148Z","title":"cdx: Fix double free when sysfs file creation fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-93214","published":"2026-09-24T15:10:36.975Z","updated":"2026-10-19T09:07:26.196Z","title":"usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-93213","published":"2026-09-24T15:10:36.166Z","updated":"2026-10-19T09:07:25.242Z","title":"of: fix out-of-bounds read in of_alias_scan() stem parser","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-93212","published":"2026-09-24T15:10:35.280Z","updated":"2026-10-19T09:07:24.291Z","title":"nfsd: guard nfsd_serv deref in nfsd_file_net_dispose","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-93211","published":"2026-09-24T15:10:34.407Z","updated":"2026-10-19T09:07:23.361Z","title":"nfsd: initialize DRC hash table before registering shrinker","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-93210","published":"2026-09-24T15:10:33.577Z","updated":"2026-10-19T09:07:22.393Z","title":"smb: client: harden DFS cache against invalid target hints","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93209","published":"2026-09-24T15:10:32.762Z","updated":"2026-10-19T09:07:21.427Z","title":"Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93208","published":"2026-09-24T15:10:31.888Z","updated":"2026-10-30T12:36:25.897Z","title":"kasan: fix cache shrink race with CPU hotplug","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93207","published":"2026-09-24T15:10:30.942Z","updated":"2026-10-19T09:07:19.480Z","title":"SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-93206","published":"2026-09-24T15:10:29.326Z","updated":"2026-10-19T09:07:18.484Z","title":"PCI/proc: Use file_ns_capable() when checking config space read access","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-93205","published":"2026-09-24T15:10:28.406Z","updated":"2026-10-30T12:36:24.824Z","title":"iommu/arm-smmu-v3: Manage teardown with devm","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93204","published":"2026-09-17T16:12:24.403Z","updated":"2026-10-19T09:07:16.519Z","title":"batman-adv: dat: atomically update mac addresses","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-93203","published":"2026-09-17T16:12:23.742Z","updated":"2026-10-19T09:07:15.551Z","title":"batman-adv: bla: avoid CRC corruption due to parallel claim add","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00336,"kevAdded":null},{"id":"CVE-2026-93202","published":"2026-09-17T16:12:23.071Z","updated":"2026-10-30T12:36:23.762Z","title":"i3c: master: Fix recursive locking during device registration","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-93201","published":"2026-09-17T16:12:22.392Z","updated":"2026-10-19T09:07:13.558Z","title":"dm-pcache: validate seg_id fields from persistent memory","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93200","published":"2026-09-17T16:12:21.751Z","updated":"2026-10-30T12:36:22.707Z","title":"i3c: master: Fix use-after-free of master->this","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-93199","published":"2026-09-17T16:12:21.081Z","updated":"2026-10-30T12:36:21.655Z","title":"i3c: master: Do not treat master device as a duplicate target","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-93198","published":"2026-09-17T16:12:20.439Z","updated":"2026-10-19T09:07:10.545Z","title":"dm-pcache: validate the persisted dirty_tail chain at load","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-93197","published":"2026-09-17T16:12:19.776Z","updated":"2026-10-19T09:07:09.510Z","title":"memcg: move LRU size accounting on reparenting instead of copying it","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-93196","published":"2026-09-17T16:12:19.125Z","updated":"2026-10-30T12:36:20.592Z","title":"nvdimm: virtio_pmem: refcount requests for token lifetime","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-93195","published":"2026-09-17T16:12:18.457Z","updated":"2026-10-19T09:07:07.595Z","title":"drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-93194","published":"2026-09-17T16:12:17.802Z","updated":"2026-10-19T09:07:06.681Z","title":"drm/rockchip: dw_dp: Release core resources","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-93193","published":"2026-09-17T16:12:17.117Z","updated":"2026-10-19T09:07:05.743Z","title":"drm/rockchip: analogix_dp: Fix OF node reference leak via auto cleanup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-93192","published":"2026-09-17T16:12:16.428Z","updated":"2026-10-30T12:36:19.527Z","title":"drm/v3d: Clear queue->active_job when v3d_fence_create() fails","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-93191","published":"2026-09-17T16:12:15.765Z","updated":"2026-10-19T09:07:03.807Z","title":"smack: fix incorrect task context in smack_msg_queue_msgrcv","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-93190","published":"2026-09-17T16:12:14.956Z","updated":"2026-10-19T09:07:02.865Z","title":"platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-93189","published":"2026-09-17T16:12:14.234Z","updated":"2026-10-19T09:07:01.914Z","title":"HID: core: quiesce input in hid_hw_stop() to prevent use-after-free","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2026-93188","published":"2026-09-17T16:12:13.482Z","updated":"2026-10-19T09:07:00.899Z","title":"HID: roccat: bound device-supplied profile index","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-93187","published":"2026-09-17T16:12:12.795Z","updated":"2026-10-19T09:06:59.972Z","title":"ASoC: SOF: ipc4-topology: Return error for invalid number of formats","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-93186","published":"2026-09-17T16:12:12.121Z","updated":"2026-10-30T12:36:18.449Z","title":"cxl/mbox: Clamp mailbox output allocation to the payload size","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2026-93185","published":"2026-09-17T16:12:11.454Z","updated":"2026-10-19T09:06:58.067Z","title":"ASoC: rt700-sdw: always drain jack work on remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-93184","published":"2026-09-17T16:12:10.782Z","updated":"2026-10-19T09:06:57.098Z","title":"ASoC: fsl_audmix: rework runtime PM handling in probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-93183","published":"2026-09-17T16:12:10.072Z","updated":"2026-10-19T09:06:56.138Z","title":"drm/lima: call drm_mm_init() with a valid allocation range","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-93182","published":"2026-09-17T16:12:09.381Z","updated":"2026-10-19T09:06:55.184Z","title":"sched/fair: Fix overflow in update_tg_cfs_runnable()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-93181","published":"2026-09-17T16:12:08.716Z","updated":"2026-10-21T12:52:12.996Z","title":"perf/x86/intel/uncore: Fix uncore_box ref/unref ordering","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-93180","published":"2026-09-17T16:12:08.005Z","updated":"2026-10-19T09:06:52.352Z","title":"drm/panthor: Fix NPD issue on partial unmap of an evicted BO","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-93179","published":"2026-09-17T16:12:07.307Z","updated":"2026-10-30T12:36:17.392Z","title":"drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-93178","published":"2026-09-17T16:12:06.631Z","updated":"2026-10-19T09:06:50.344Z","title":"drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-93177","published":"2026-09-17T16:12:05.955Z","updated":"2026-10-19T09:06:49.236Z","title":"drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-93176","published":"2026-09-17T16:12:05.278Z","updated":"2026-10-30T12:36:16.325Z","title":"drm/amd/display: Fix dangling pointer in plane reset function","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-93175","published":"2026-09-17T16:12:04.609Z","updated":"2026-10-30T12:36:15.241Z","title":"drm/amd/display: Fix dangling pointer in CRTC reset function","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-93174","published":"2026-09-17T16:12:03.946Z","updated":"2026-10-30T12:36:14.183Z","title":"bpf: Copy per-CPU map value padding in copy_map_value_long()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-93173","published":"2026-09-17T16:12:03.229Z","updated":"2026-10-19T09:06:44.824Z","title":"bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-93172","published":"2026-09-17T16:12:02.544Z","updated":"2026-10-30T12:36:13.116Z","title":"mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-93171","published":"2026-09-17T16:12:01.897Z","updated":"2026-10-19T09:06:42.888Z","title":"leds: lp5860: Fix a potential double-unlock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-93170","published":"2026-09-17T16:12:01.249Z","updated":"2026-10-19T09:06:41.936Z","title":"dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-93169","published":"2026-09-17T16:12:00.570Z","updated":"2026-10-19T09:06:40.948Z","title":"dmaengine: zynqmp_dma: fix race between runtime PM and device removal","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-93168","published":"2026-09-17T16:11:59.904Z","updated":"2026-10-30T12:36:12.039Z","title":"dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93167","published":"2026-09-17T16:11:59.234Z","updated":"2026-10-19T09:06:39.063Z","title":"csky: Fix a4/a5 restoration in syscall trace path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-93166","published":"2026-09-17T16:11:58.577Z","updated":"2026-10-19T09:06:38.093Z","title":"wifi: rtw89: debug: fix off by on in rtw89_ppdu_str()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-93165","published":"2026-09-17T16:11:57.922Z","updated":"2026-10-19T09:06:37.145Z","title":"platform/chrome: sensorhub: Fix memory overread in ring handler","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-93164","published":"2026-09-17T16:11:57.248Z","updated":"2026-10-19T09:06:36.169Z","title":"uprobes/x86: Move optimized uprobe from nop5 to nop10","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-93163","published":"2026-09-17T16:11:56.570Z","updated":"2026-10-30T12:36:10.984Z","title":"hwrng: core - fix rng list on registration error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-93162","published":"2026-09-17T16:11:55.896Z","updated":"2026-10-19T09:06:34.239Z","title":"crypto: qat - cancel work on re-enable SR-IOV timeout","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-93161","published":"2026-09-17T16:11:55.212Z","updated":"2026-10-19T09:06:33.265Z","title":"crypto: qat - clear AES key schedule from stack","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-93160","published":"2026-09-17T16:11:54.517Z","updated":"2026-10-19T09:06:32.331Z","title":"crypto: atmel-ecc - reject hardware ECDH without a public key","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-93159","published":"2026-09-17T16:11:53.852Z","updated":"2026-10-19T09:06:31.352Z","title":"crypto: atmel-sha204a - fix heap info leak on I2C transfer failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-93158","published":"2026-09-17T16:11:53.144Z","updated":"2026-10-19T09:06:30.180Z","title":"crypto: sa2ul - stop probe if context pool creation fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-93157","published":"2026-09-17T16:11:52.459Z","updated":"2026-10-19T09:06:29.228Z","title":"hwrng: xilinx-trng - propagate timeout before any data is read","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-93156","published":"2026-09-17T16:11:51.461Z","updated":"2026-10-19T09:06:28.260Z","title":"crypto: rk3288 - fail ahash requests on HASH idle timeout","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-93155","published":"2026-09-17T16:11:50.792Z","updated":"2026-10-30T12:36:09.918Z","title":"crypto: keembay - Fix AEAD unregister count in error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-93154","published":"2026-09-17T16:11:50.107Z","updated":"2026-10-19T09:06:26.358Z","title":"RDMA/irdma: Add refcounting to user ring MRs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-93153","published":"2026-09-17T16:11:49.443Z","updated":"2026-10-19T09:06:25.393Z","title":"RDMA/bng_re: return a timeout when firmware responses stall","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-93152","published":"2026-09-17T16:11:48.782Z","updated":"2026-10-19T09:06:24.479Z","title":"nvme-apple: Use acquire/release for queue enabled state","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-93151","published":"2026-09-17T16:11:47.559Z","updated":"2026-10-19T09:06:23.530Z","title":"nvmet-rdma: fix response resource leak on queue teardown","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0068,"kevAdded":null},{"id":"CVE-2026-93150","published":"2026-09-17T16:11:46.799Z","updated":"2026-10-30T12:36:08.842Z","title":"cgroup/cpuset: Make nr_deadline_tasks an atomic_t","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-93149","published":"2026-09-17T16:11:46.136Z","updated":"2026-10-19T09:06:21.596Z","title":"wifi: mac80211_hwsim: avoid NULL skb in stop queue drain","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-93148","published":"2026-09-17T16:11:45.457Z","updated":"2026-10-21T12:52:04.267Z","title":"bpf: Reject MEM_ALLOC BTF accesses past object bounds","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-93147","published":"2026-09-17T16:11:44.793Z","updated":"2026-10-19T09:06:19.689Z","title":"s390/bpf: Replace ly instruction with llgf","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-93146","published":"2026-09-17T16:11:44.117Z","updated":"2026-10-30T12:36:07.785Z","title":"time/namespace: Validate nanosecond field in proc_timens_set_offset()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-93145","published":"2026-09-17T16:11:43.421Z","updated":"2026-10-19T09:06:17.744Z","title":"clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-93144","published":"2026-09-17T16:11:42.757Z","updated":"2026-10-21T12:52:02.003Z","title":"bpf: Reject writes through untrusted BTF pointers","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-93143","published":"2026-09-17T16:11:42.099Z","updated":"2026-10-19T09:06:15.789Z","title":"staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-93142","published":"2026-09-17T16:11:41.430Z","updated":"2026-10-19T09:06:14.866Z","title":"thermal/drivers/rcar: Fix error checking in probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-93141","published":"2026-09-17T16:11:40.761Z","updated":"2026-10-19T09:06:13.931Z","title":"usb: gadget: r8a66597: avoid double free of ep0_req in probe error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-93140","published":"2026-09-17T16:11:40.099Z","updated":"2026-10-19T09:06:12.969Z","title":"udf: Mark LVID buffer as uptodate before marking it dirty","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-93139","published":"2026-09-17T16:11:39.448Z","updated":"2026-10-19T09:06:12.015Z","title":"drm/amdgpu/mes: Fix hung_queue_db_array loop limit for multi-XCC","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-93138","published":"2026-09-17T16:11:38.795Z","updated":"2026-10-19T09:06:11.046Z","title":"bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-93137","published":"2026-09-17T16:11:38.135Z","updated":"2026-10-19T09:06:10.069Z","title":"bpf: Fix use-after-free on mm_struct in bpf_find_vma()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-93136","published":"2026-09-17T16:11:37.459Z","updated":"2026-10-19T09:06:09.105Z","title":"bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-93135","published":"2026-09-17T16:11:36.771Z","updated":"2026-10-19T09:06:08.106Z","title":"bpf: Reject programs with inlined helpers if JIT is not available","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-93134","published":"2026-09-17T16:11:36.077Z","updated":"2026-10-19T09:06:07.190Z","title":"printk: Fix possible console use-after-free","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-93133","published":"2026-09-17T16:11:35.383Z","updated":"2026-10-19T09:06:06.270Z","title":"ACPI: RISC-V: Check acpi_get_handle() status in riscv_acpi_add_prt_dep()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-93132","published":"2026-09-17T16:11:34.708Z","updated":"2026-10-19T09:06:05.310Z","title":"ACPI: RISC-V: Fix riscv_acpi_add_prt_dep() loop handling","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-93131","published":"2026-09-17T16:11:34.019Z","updated":"2026-10-19T09:06:04.371Z","title":"platform/x86: dell-privacy: Fix race condition","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-93130","published":"2026-09-17T16:11:33.275Z","updated":"2026-10-19T09:06:03.419Z","title":"platform/x86: dell-wmi-base: Fix resource leak on module load failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-93129","published":"2026-09-17T16:11:32.609Z","updated":"2026-10-30T12:36:06.719Z","title":"platform/x86: dell-wmi-base: Fix handling of ultra performance key","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-93128","published":"2026-09-17T16:11:31.933Z","updated":"2026-10-30T12:36:05.653Z","title":"platform/x86: lg-laptop: Fix LED resource handling","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-93127","published":"2026-09-17T16:11:31.253Z","updated":"2026-10-19T09:06:00.545Z","title":"bpf: Drop scalar id on sign-extending narrowing stack fills","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-93126","published":"2026-09-17T16:11:30.565Z","updated":"2026-10-19T09:05:59.582Z","title":"remoteproc: qcom_q6v5_adsp: Fix reference leak for device node","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-93125","published":"2026-09-17T16:11:29.895Z","updated":"2026-10-30T12:36:03.562Z","title":"bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-93124","published":"2026-09-17T16:11:29.223Z","updated":"2026-10-19T09:05:57.673Z","title":"platform/x86: asus-wireless: Fail probe when there is no ACPI match","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-93123","published":"2026-09-17T16:11:28.552Z","updated":"2026-10-19T09:05:56.717Z","title":"serial: qcom-geni: do not advance stale DMA completions","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-93122","published":"2026-09-17T16:11:27.890Z","updated":"2026-10-30T12:36:02.508Z","title":"usb: gadget: uac: validate rate list length before storing","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-93121","published":"2026-09-17T16:11:27.220Z","updated":"2026-10-19T09:05:54.766Z","title":"usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-93120","published":"2026-09-17T16:11:26.548Z","updated":"2026-10-19T09:05:53.824Z","title":"usb: gadget: configfs: fix out-of-bounds read of qw_sign","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-93119","published":"2026-09-17T16:11:25.867Z","updated":"2026-10-19T09:05:52.849Z","title":"usb: ljca: bound bank_num in ljca_enumerate_gpio()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-93118","published":"2026-09-17T16:11:25.186Z","updated":"2026-10-19T09:05:51.880Z","title":"usb: gadget: aspeed_udc: check endpoint DMA allocation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93117","published":"2026-09-17T16:11:24.509Z","updated":"2026-10-19T09:05:50.941Z","title":"usb: fix UAF when probe runs concurrent to dyn ID removal","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-93116","published":"2026-09-17T16:11:23.852Z","updated":"2026-10-30T12:36:01.447Z","title":"platform/x86: asus-wmi: fix resource leaks on probe failure","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-93115","published":"2026-09-17T16:11:23.145Z","updated":"2026-10-19T09:05:49.022Z","title":"platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-93114","published":"2026-09-17T16:11:22.463Z","updated":"2026-10-19T09:05:48.069Z","title":"platform/surface: acpi-notify: Check ACPI companion before use","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-93113","published":"2026-09-17T16:11:21.796Z","updated":"2026-10-19T09:05:46.963Z","title":"clk: qcom: camcc-sc8280xp: unregister CAMCC_GDSC_CLK","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-93112","published":"2026-09-17T16:11:21.122Z","updated":"2026-10-19T09:05:45.809Z","title":"bpf: Require a BPF cpumask for bpf_cpumask_populate()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-93111","published":"2026-09-17T16:11:20.464Z","updated":"2026-10-19T09:05:44.850Z","title":"bpf: Mark tracing_multi trampolines as ftrace managed","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-93110","published":"2026-09-17T16:11:19.805Z","updated":"2026-10-19T09:05:43.865Z","title":"RDMA/core: Wait for RCU callbacks before unloading ib_core","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-93109","published":"2026-09-17T16:11:19.135Z","updated":"2026-10-19T09:05:41.900Z","title":"RDMA/mlx5: Drain RCU callbacks during module teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-93108","published":"2026-09-17T16:11:18.455Z","updated":"2026-10-19T09:05:40.951Z","title":"RDMA/ipoib: Drain RCU callbacks during module teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-93107","published":"2026-09-17T16:11:17.791Z","updated":"2026-10-19T09:05:39.979Z","title":"RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00544,"kevAdded":null},{"id":"CVE-2026-93106","published":"2026-09-17T16:11:17.136Z","updated":"2026-10-19T09:05:39.034Z","title":"crash_dump: release keyring reference at the correct time","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-93105","published":"2026-09-17T16:11:16.442Z","updated":"2026-10-30T12:36:00.346Z","title":"esp: do not unref managed frag pages in esp_ssg_unref()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-93104","published":"2026-09-17T16:11:15.760Z","updated":"2026-10-30T12:35:59.264Z","title":"RDMA/rvt: Return NULL after port allocation failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-93103","published":"2026-09-17T16:11:15.105Z","updated":"2026-10-19T09:05:36.156Z","title":"RDMA/hfi1: Preserve unit 0 on allocation failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-93102","published":"2026-09-17T16:11:14.413Z","updated":"2026-10-19T09:05:35.200Z","title":"RDMA/hfi1: Free RX data on late probe failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93101","published":"2026-09-17T16:11:13.738Z","updated":"2026-10-19T09:05:34.229Z","title":"media: v4l2-async: Unregister sub-device if asc_list is empty","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-93100","published":"2026-09-17T16:11:13.077Z","updated":"2026-10-30T12:35:58.210Z","title":"fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-93099","published":"2026-09-17T16:11:12.373Z","updated":"2026-10-19T09:05:32.346Z","title":"fs/resctrl: Fix UAF from worker threads when domains are removed","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-93098","published":"2026-09-17T16:11:11.703Z","updated":"2026-10-19T09:05:31.403Z","title":"rpmsg: glink: fix deadlock in endpoint destroy during driver detach","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-93097","published":"2026-09-17T16:11:11.025Z","updated":"2026-10-19T09:05:30.426Z","title":"cxl/mbox: Break poison list loop on an empty payload","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-93096","published":"2026-09-17T16:11:10.359Z","updated":"2026-10-19T09:05:29.455Z","title":"cxl/features: Serialize multi-part Get/Set Feature transfers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-93095","published":"2026-09-17T16:11:09.694Z","updated":"2026-10-19T09:05:28.487Z","title":"hfsplus: validate thread record before delete key rebuild","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-93094","published":"2026-09-17T16:11:09.034Z","updated":"2026-10-19T09:05:27.516Z","title":"wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollback","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-93093","published":"2026-09-17T16:11:08.360Z","updated":"2026-10-30T12:35:57.144Z","title":"firmware: arm_scmi: Publish channel state before callbacks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93092","published":"2026-09-17T16:11:07.715Z","updated":"2026-10-30T12:35:56.077Z","title":"firmware: arm_scmi: Unregister device notifier before IDR teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93091","published":"2026-09-17T16:11:07.055Z","updated":"2026-10-19T09:05:24.667Z","title":"firmware: arm_scmi: Quiesce notifications before teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-93090","published":"2026-09-17T16:11:06.381Z","updated":"2026-10-30T12:35:55.027Z","title":"firmware: arm_scmi: Clean up channels on setup failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-93089","published":"2026-09-17T16:11:05.713Z","updated":"2026-10-30T12:35:53.943Z","title":"firmware: arm_scmi: Free transport channel on IDR failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-93086","published":"2026-09-17T16:11:05.025Z","updated":"2026-10-30T12:35:52.863Z","title":"firmware: arm_scmi: Avoid IDR updates while cleaning channels","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-93085","published":"2026-09-17T16:11:04.355Z","updated":"2026-10-30T12:35:51.790Z","title":"firmware: arm_scmi: Reject out of range DT protocol IDs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-93084","published":"2026-09-17T16:11:03.659Z","updated":"2026-10-30T12:35:50.721Z","title":"firmware: arm_scmi: Drop handle on protocol bind failures","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-93083","published":"2026-09-17T16:11:02.997Z","updated":"2026-10-21T12:51:50.003Z","title":"firmware: arm_scmi: Unwind TX receiver mailbox setup failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-93082","published":"2026-09-17T16:11:02.339Z","updated":"2026-10-19T09:05:17.992Z","title":"firmware: arm_scmi: Unwind P2A receiver mailbox setup failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-93081","published":"2026-09-17T16:11:01.679Z","updated":"2026-10-30T12:35:49.648Z","title":"firmware: arm_scmi: Fix SCMI device destroy lifetimes","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-93080","published":"2026-09-17T16:11:01.005Z","updated":"2026-10-19T09:05:16.032Z","title":"firmware: arm_scmi: Fix transport device teardown lookup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-93079","published":"2026-09-17T16:11:00.350Z","updated":"2026-10-19T09:05:15.062Z","title":"cxl/features: Reject Get Feature count larger than the output buffer","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93078","published":"2026-09-17T16:10:59.686Z","updated":"2026-10-19T09:05:14.083Z","title":"cxl/features: Reject Set Features output buffer smaller than the header","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-93077","published":"2026-09-17T16:10:59.026Z","updated":"2026-10-19T09:05:12.937Z","title":"cxl/features: Clamp Get Feature output size to the remaining buffer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-93076","published":"2026-09-17T16:10:58.370Z","updated":"2026-10-19T09:05:11.949Z","title":"dax/fsdev: clear vmemmap_shift when binding static pgmap","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-93075","published":"2026-09-17T16:10:57.699Z","updated":"2026-10-19T09:05:11.005Z","title":"dax/fsdev: clear pgmap ops and owner on unbind","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-93074","published":"2026-09-17T16:10:57.051Z","updated":"2026-10-19T09:05:10.055Z","title":"dax/fsdev: use __va(phys) for kaddr in direct_access","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-93073","published":"2026-09-17T16:10:56.405Z","updated":"2026-10-19T09:05:09.113Z","title":"dax: read holder_ops once in dax_holder_notify_failure()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-93072","published":"2026-09-17T16:10:55.755Z","updated":"2026-10-19T09:05:08.128Z","title":"irqchip/renesas-irqc: Fix generic interrupt chip leak on remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-93071","published":"2026-09-17T16:10:55.092Z","updated":"2026-10-19T09:05:07.078Z","title":"media: bcm2835-unicam: Fix asc leaked in error/remove path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-93070","published":"2026-09-17T16:10:54.393Z","updated":"2026-10-19T09:05:06.091Z","title":"media: ipu6: Do not free aux device pdata after init","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-93069","published":"2026-09-17T16:10:53.642Z","updated":"2026-10-19T09:05:05.118Z","title":"OPP: Fix cleanup ordering","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-93068","published":"2026-09-17T16:10:52.971Z","updated":"2026-10-19T09:05:04.158Z","title":"drm/amd/display: Fix DM I2C teardown race","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-93067","published":"2026-09-17T16:10:52.288Z","updated":"2026-10-19T09:05:03.173Z","title":"drm/bridge: tc358767: clamp the reported AUX read size to the request","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-93066","published":"2026-09-17T16:10:51.612Z","updated":"2026-10-19T09:05:02.188Z","title":"x86/mm/pat: Take cpa_lock around large-page collapse","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-93065","published":"2026-09-17T16:10:50.940Z","updated":"2026-10-19T09:05:01.183Z","title":"wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-93064","published":"2026-09-17T16:10:50.254Z","updated":"2026-10-19T09:05:00.188Z","title":"wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-93063","published":"2026-09-17T16:10:49.112Z","updated":"2026-10-19T09:04:59.220Z","title":"wifi: iwlwifi: mei: check SAP message length before reading it","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-93062","published":"2026-09-17T16:10:48.451Z","updated":"2026-10-30T12:35:48.583Z","title":"wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-93061","published":"2026-09-17T16:10:47.786Z","updated":"2026-10-19T09:04:57.193Z","title":"gpu: host1x: Avoid stack over-read in debug output helpers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-93060","published":"2026-09-17T16:10:47.123Z","updated":"2026-10-19T09:04:56.208Z","title":"drm/msm/adreno: fix use after free on error path in a6xx_gpu_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-93059","published":"2026-09-17T16:10:46.457Z","updated":"2026-10-19T09:04:55.257Z","title":"drm/msm: Fix task_struct reference leak in recover_worker","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-93058","published":"2026-09-17T16:10:45.793Z","updated":"2026-10-30T12:35:47.517Z","title":"drm/msm: Only fini scheduler after successful init","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-93057","published":"2026-09-17T16:10:45.108Z","updated":"2026-10-19T09:04:53.229Z","title":"scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-93056","published":"2026-09-17T16:10:44.442Z","updated":"2026-10-19T09:04:52.242Z","title":"usb: gadget: f_uac1_legacy: remove broken string configfs attributes","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-93055","published":"2026-09-17T16:10:43.779Z","updated":"2026-10-19T09:04:50.172Z","title":"UDF symlink pathComponent header OOB read","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-93054","published":"2026-09-17T16:10:43.104Z","updated":"2026-10-19T09:04:49.183Z","title":"uio: Fix stale info pointer in failed registration path","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2026-93053","published":"2026-09-17T16:10:42.397Z","updated":"2026-10-19T09:04:48.197Z","title":"speakup: keyhelp: guard letter_offsets possible out-of-range indexing","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-93052","published":"2026-09-17T16:10:41.716Z","updated":"2026-10-19T09:04:47.240Z","title":"misc: bcm-vk: Use acquire/release for msgq_inited","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-93051","published":"2026-09-17T16:10:41.052Z","updated":"2026-10-19T09:04:46.273Z","title":"misc: ad525x_dpot: use driver core groups for sysfs files","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-93050","published":"2026-09-17T16:10:40.360Z","updated":"2026-10-19T09:04:45.286Z","title":"ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-93049","published":"2026-09-17T16:10:39.679Z","updated":"2026-10-19T09:04:44.322Z","title":"mtd: mtdswap: Avoid freeing registered blktrans device twice","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-93048","published":"2026-09-17T16:10:39.008Z","updated":"2026-10-19T09:04:43.363Z","title":"mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-93047","published":"2026-09-17T16:10:38.350Z","updated":"2026-10-19T09:04:42.363Z","title":"drm/v3d: Associate BOs with every job that accesses them","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-93046","published":"2026-09-17T16:10:37.691Z","updated":"2026-10-19T09:04:41.369Z","title":"software node: Fix software_node_get_reference_args() with index -1","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2026-93045","published":"2026-09-17T16:10:36.988Z","updated":"2026-10-19T09:04:40.316Z","title":"bpf: Reject arena frees below the arena base","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-93044","published":"2026-09-17T16:10:36.285Z","updated":"2026-10-19T09:04:39.165Z","title":"bpf: Disallow interpreter fallback for arena-related insns","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-93043","published":"2026-09-17T16:10:35.602Z","updated":"2026-10-19T09:04:38.184Z","title":"bpf: Disallow interpreter fallback for gotox insn","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-93042","published":"2026-09-17T16:10:34.911Z","updated":"2026-10-30T12:35:46.423Z","title":"dmaengine: dw-edma: Terminate all descriptors without callbacks","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2026-93041","published":"2026-09-17T16:10:34.232Z","updated":"2026-10-19T09:04:36.246Z","title":"dmaengine: dw-edma: Serialize abort state updates","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-93040","published":"2026-09-17T16:10:33.499Z","updated":"2026-10-19T09:04:35.266Z","title":"dmaengine: dw-edma: Serialize channel state checks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-93039","published":"2026-09-17T16:10:32.812Z","updated":"2026-10-19T09:04:34.291Z","title":"ASoC: meson: Keep link pointers valid on realloc failure","severity":"HIGH","score":7.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-93038","published":"2026-09-17T16:10:32.132Z","updated":"2026-10-19T09:04:33.325Z","title":"iio: dac: ad5686: missing NULL check on match data","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-93037","published":"2026-09-17T16:10:31.452Z","updated":"2026-10-19T09:04:32.386Z","title":"RDMA/hfi1: Propagate sdma_txinit_ahg() errors","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-92525","published":"2026-09-17T16:10:30.789Z","updated":"2026-10-19T09:04:31.432Z","title":"RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-92524","published":"2026-09-17T16:10:30.135Z","updated":"2026-10-19T09:04:30.467Z","title":"irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-92523","published":"2026-09-17T16:10:29.474Z","updated":"2026-10-19T09:04:29.518Z","title":"RDMA/nldev: validate dynamic counter attribute length","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-92522","published":"2026-09-17T16:10:28.823Z","updated":"2026-10-19T09:04:28.548Z","title":"ACPI: processor: validate MADT IOAPIC entry bounds","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2026-92521","published":"2026-09-17T16:10:28.144Z","updated":"2026-10-19T09:04:27.575Z","title":"ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-92520","published":"2026-09-17T16:10:27.447Z","updated":"2026-10-30T12:35:45.323Z","title":"bpf: Zero queue and stack outputs on lock failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-92519","published":"2026-09-17T16:10:26.791Z","updated":"2026-10-21T12:51:45.726Z","title":"riscv, bpf: Fix memory leak in bpf_jit_free","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-92518","published":"2026-09-17T16:10:26.136Z","updated":"2026-10-19T09:04:24.705Z","title":"riscv, bpf: Fix kernel stack corruption in tailcall with CFI","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-92517","published":"2026-09-17T16:10:25.482Z","updated":"2026-10-19T09:04:23.742Z","title":"bpf, riscv: Fix extable handling for arena load_acquire","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-92516","published":"2026-09-17T16:10:24.804Z","updated":"2026-10-19T09:04:22.764Z","title":"bpf: Fix offset warn check for bpf_res_spin_lock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-92515","published":"2026-09-17T16:10:24.159Z","updated":"2026-10-19T09:04:21.819Z","title":"bpf: Preserve unique-field state across nested structs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-92514","published":"2026-09-17T16:10:23.462Z","updated":"2026-10-19T09:04:20.857Z","title":"RDMA/erdma: Fix CEQ tasklet use-after-free on removal","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-92513","published":"2026-09-17T16:10:22.793Z","updated":"2026-10-19T09:04:19.875Z","title":"RDMA/mana_ib: drain QP references after partial table insertion","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-92512","published":"2026-09-17T16:10:22.114Z","updated":"2026-10-19T09:04:18.829Z","title":"RDMA/core: Fix use after free in ib_query_qp()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-92511","published":"2026-09-17T16:10:21.449Z","updated":"2026-10-19T09:04:17.289Z","title":"RDMA/core: Fix potential use after free in ib_destroy_cq_user()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-92510","published":"2026-09-17T16:10:20.775Z","updated":"2026-10-19T09:04:16.292Z","title":"RDMA/core: Fix potential use after free in ib_destroy_srq_user()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-92509","published":"2026-09-17T16:10:20.100Z","updated":"2026-10-19T09:04:15.303Z","title":"RDMA/core: Fix potential use after free in counter_release()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-92508","published":"2026-09-17T16:10:19.443Z","updated":"2026-10-19T09:04:14.344Z","title":"RDMA/core: Fix potential use after free in ib_free_cq()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-92507","published":"2026-09-17T16:10:18.748Z","updated":"2026-10-19T09:04:13.346Z","title":"RDMA/core: Fix potential use after free in ib_dealloc_pd_user()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-92506","published":"2026-09-17T16:10:18.067Z","updated":"2026-10-30T12:35:44.199Z","title":"firmware: arm_scmi: Fix requested device removal race","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-92505","published":"2026-09-17T16:10:17.389Z","updated":"2026-10-19T09:04:11.374Z","title":"iommu/amd: Fix undefined behavior in devid_write debugfs function","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-92504","published":"2026-09-17T16:10:16.731Z","updated":"2026-10-19T09:04:10.385Z","title":"thermal: intel: int3400: clean up ODVP on probe failures","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2026-92503","published":"2026-09-17T16:10:16.062Z","updated":"2026-10-30T12:35:43.123Z","title":"ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-92502","published":"2026-09-17T16:10:15.399Z","updated":"2026-10-19T09:04:08.456Z","title":"ext4: clear stale xarray tags on folios skipped during writeback","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-92501","published":"2026-09-17T16:10:14.753Z","updated":"2026-10-19T09:04:07.250Z","title":"ext4: drain in-flight DIO before buffered write fallback","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-92500","published":"2026-09-17T16:10:14.073Z","updated":"2026-10-19T09:04:06.284Z","title":"ext4: use fsdata to track inline data write state and fix race","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-92499","published":"2026-09-17T16:10:13.391Z","updated":"2026-10-19T09:04:05.335Z","title":"ext4: validate readdir offset before accessing dirent","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-92498","published":"2026-09-17T16:10:12.732Z","updated":"2026-10-19T09:04:04.402Z","title":"wifi: ath6kl: avoid buffer overreads in WMI event handlers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-92497","published":"2026-09-17T16:10:12.081Z","updated":"2026-10-19T09:04:03.429Z","title":"wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-92496","published":"2026-09-17T16:10:11.423Z","updated":"2026-10-19T09:04:02.474Z","title":"wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-92495","published":"2026-09-17T16:10:10.747Z","updated":"2026-10-19T09:04:01.510Z","title":"RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-92494","published":"2026-09-17T16:10:10.073Z","updated":"2026-10-19T09:04:00.500Z","title":"ext4: fix buffer_head leak in ext4_init_orphan_info","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-92493","published":"2026-09-17T16:10:09.008Z","updated":"2026-10-19T09:03:59.534Z","title":"cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-92492","published":"2026-09-17T16:10:07.957Z","updated":"2026-10-19T09:03:58.605Z","title":"cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-92491","published":"2026-09-17T16:10:06.627Z","updated":"2026-10-30T12:35:42.033Z","title":"firmware: arm_scmi: Roll back partial protocol table registration","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-92490","published":"2026-09-17T16:10:05.347Z","updated":"2026-10-30T12:35:40.981Z","title":"firmware: arm_scmi: Unrequest devices if driver registration fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-92489","published":"2026-09-17T16:10:04.126Z","updated":"2026-10-19T09:03:55.784Z","title":"xfrm: Fix skb double-free in xfrm_dev_direct_output()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00457,"kevAdded":null},{"id":"CVE-2026-92488","published":"2026-09-17T16:10:02.962Z","updated":"2026-10-30T12:35:39.917Z","title":"RDMA/erdma: complete object teardown when the destroy command fails","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-92487","published":"2026-09-17T16:10:02.317Z","updated":"2026-10-19T09:03:53.813Z","title":"exfat: fix valid_size extension over a shared writable mapping","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-92486","published":"2026-09-17T16:10:01.654Z","updated":"2026-10-19T09:03:52.858Z","title":"bpf: Fix CFI mismatch in task work callback","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-92485","published":"2026-09-17T16:10:00.999Z","updated":"2026-10-30T12:35:38.840Z","title":"bpf: Fix WARNING in bpf_tracing_link_release","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-92484","published":"2026-09-17T16:10:00.333Z","updated":"2026-10-19T09:03:50.812Z","title":"cxl/region: Fix use-after-free in find_pos_and_ways() error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-92483","published":"2026-09-17T16:09:59.673Z","updated":"2026-10-19T09:03:49.835Z","title":"liveupdate: Remember FLB retrieve() status","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-92482","published":"2026-09-17T16:09:59.019Z","updated":"2026-10-30T12:35:37.777Z","title":"pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-92481","published":"2026-09-17T16:09:58.378Z","updated":"2026-10-19T09:03:47.420Z","title":"pinctrl: mediatek: free EINT resources on unbind","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-92480","published":"2026-09-17T16:09:57.719Z","updated":"2026-10-30T12:35:36.682Z","title":"scsi: ufs: core: Validate string descriptors","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-92479","published":"2026-09-17T16:09:57.058Z","updated":"2026-10-19T09:03:45.515Z","title":"scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-92478","published":"2026-09-17T16:09:56.397Z","updated":"2026-10-19T09:03:44.528Z","title":"scsi: ufs: core: Validate connected lane counts","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-92477","published":"2026-09-17T16:09:55.741Z","updated":"2026-10-19T09:03:43.608Z","title":"scsi: ufs: debugfs: Reserve space for a string terminator","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-92476","published":"2026-09-17T16:09:55.083Z","updated":"2026-10-19T09:03:42.363Z","title":"crypto: keembay - Initialize completion before requesting IRQ","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90435","published":"2026-09-17T16:09:54.399Z","updated":"2026-10-19T09:03:41.405Z","title":"RDMA/mlx5: Fix integer overflow of user QP buffer size","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-90434","published":"2026-09-17T16:09:53.716Z","updated":"2026-10-19T09:03:39.223Z","title":"isofs: release zisofs block pointer buffer head","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90433","published":"2026-09-17T16:09:53.085Z","updated":"2026-10-30T12:35:35.625Z","title":"spi: oc-tiny: switch to managed controller allocation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90432","published":"2026-09-17T16:09:52.429Z","updated":"2026-10-19T09:03:37.039Z","title":"sched_ext: Abort directly from the hardlockup handler","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90431","published":"2026-09-17T16:09:51.759Z","updated":"2026-10-19T09:03:35.182Z","title":"remoteproc: Prevent crash handling to race with rproc_del()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90430","published":"2026-09-17T16:09:51.101Z","updated":"2026-10-19T09:03:33.781Z","title":"iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-90429","published":"2026-09-17T16:09:50.442Z","updated":"2026-10-19T09:03:32.827Z","title":"iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-90428","published":"2026-09-17T16:09:49.783Z","updated":"2026-10-19T09:03:31.894Z","title":"iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-90427","published":"2026-09-17T16:09:49.121Z","updated":"2026-10-21T12:51:38.034Z","title":"iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc()","severity":"HIGH","score":7.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-90426","published":"2026-09-17T16:09:48.460Z","updated":"2026-10-19T09:03:29.972Z","title":"iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-90425","published":"2026-09-17T16:09:47.810Z","updated":"2026-10-19T09:03:29.009Z","title":"iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-90424","published":"2026-09-17T16:09:47.165Z","updated":"2026-10-21T12:51:36.906Z","title":"iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-90423","published":"2026-09-17T16:09:46.513Z","updated":"2026-10-19T09:03:27.119Z","title":"RDMA/rxe: Fix UAF in ODP init error-handling path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-90422","published":"2026-09-17T16:09:45.830Z","updated":"2026-10-21T12:51:35.803Z","title":"clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-90421","published":"2026-09-17T16:09:45.185Z","updated":"2026-10-30T12:35:34.567Z","title":"PCI: Fix UAF when probe runs concurrent to dyn ID removal","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90420","published":"2026-09-17T16:09:44.558Z","updated":"2026-10-19T09:03:24.266Z","title":"nilfs2: fix infinite loop in nilfs_clean_segments()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-90419","published":"2026-09-17T16:09:43.880Z","updated":"2026-10-19T09:03:23.291Z","title":"nilfs2: prevent out-of-bounds read in super root block parsing","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-90418","published":"2026-09-17T16:09:43.223Z","updated":"2026-10-30T12:35:33.513Z","title":"nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-90417","published":"2026-09-17T16:09:42.342Z","updated":"2026-10-30T12:35:32.436Z","title":"RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-90416","published":"2026-09-17T16:09:41.372Z","updated":"2026-10-19T09:03:20.401Z","title":"RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90415","published":"2026-09-17T16:09:40.714Z","updated":"2026-10-19T09:03:19.452Z","title":"RDMA/cxgb4: free STAG index when TPT entry write fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-90414","published":"2026-09-17T16:09:40.045Z","updated":"2026-10-19T09:03:18.486Z","title":"IB/isert: reject PDUs declaring more data than was received","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-90413","published":"2026-09-17T16:09:39.383Z","updated":"2026-10-19T09:03:17.470Z","title":"IB/isert: reject login PDUs declaring more data than was received","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00841,"kevAdded":null},{"id":"CVE-2026-90412","published":"2026-09-17T16:09:38.732Z","updated":"2026-10-19T09:03:16.487Z","title":"nvmet: fix return status of RMI log page on allocation failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90411","published":"2026-09-17T16:09:38.077Z","updated":"2026-10-19T09:03:15.517Z","title":"nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90410","published":"2026-09-17T16:09:37.397Z","updated":"2026-10-30T12:35:31.362Z","title":"spi: davinci: switch to managed controller allocation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90409","published":"2026-09-17T16:09:36.740Z","updated":"2026-10-21T12:51:32.495Z","title":"drm/panthor: Add vm_bind region with kbo range overlap check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-90408","published":"2026-09-17T16:09:36.089Z","updated":"2026-10-21T12:51:31.378Z","title":"wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-90407","published":"2026-09-17T16:09:35.420Z","updated":"2026-10-30T12:35:30.286Z","title":"wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-90406","published":"2026-09-17T16:09:34.775Z","updated":"2026-10-19T09:03:10.727Z","title":"media: qcom: iris: handle runtime PM resume failure in core deinit","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90405","published":"2026-09-17T16:09:34.122Z","updated":"2026-10-19T09:03:09.783Z","title":"media: stm32: dcmi: fix some error handling bugs in probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90404","published":"2026-09-17T16:09:33.472Z","updated":"2026-10-19T09:03:08.821Z","title":"platform/chrome: cros_ec_debugfs: Unregister panic notifier","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90403","published":"2026-09-17T16:09:32.824Z","updated":"2026-10-19T09:03:07.825Z","title":"wifi: rtlwifi: pci: fix error path in rtl_pci_probe()","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2026-90402","published":"2026-09-17T16:09:32.194Z","updated":"2026-10-19T09:03:06.272Z","title":"bus: mhi: host: Fix controller cleanup on EDL sysfs failure","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-90401","published":"2026-09-17T16:09:31.556Z","updated":"2026-10-19T09:03:05.286Z","title":"md: remove REQ_NOWAIT support from raid1/10/456","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-90400","published":"2026-09-17T16:09:30.915Z","updated":"2026-10-19T09:03:04.317Z","title":"md: recheck spare changes before starting sync","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-90399","published":"2026-09-17T16:09:30.273Z","updated":"2026-10-21T12:51:30.270Z","title":"wifi: ath12k: fix stride mismatch in mac_phy_caps_parse()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-90398","published":"2026-09-17T16:09:29.626Z","updated":"2026-10-30T12:35:29.208Z","title":"wifi: ath11k: fix stride mismatch in mac_phy_caps_parse()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-90397","published":"2026-09-17T16:09:28.967Z","updated":"2026-10-21T12:51:27.984Z","title":"firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-90396","published":"2026-09-17T16:09:28.339Z","updated":"2026-10-19T09:03:00.491Z","title":"block: fix dio leak on metadata mapping error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90395","published":"2026-09-17T16:09:27.705Z","updated":"2026-10-19T09:02:59.557Z","title":"power: supply: isp1704_charger: cancel work on remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-90394","published":"2026-09-17T16:09:27.050Z","updated":"2026-10-19T09:02:58.609Z","title":"power: supply: sc2731_charger: cancel work on remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-90393","published":"2026-09-17T16:09:26.388Z","updated":"2026-10-19T09:02:57.658Z","title":"bpf: Fix potential UAF in bpf_netns_link_update_prog","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2026-90392","published":"2026-09-17T16:09:25.738Z","updated":"2026-10-30T12:35:28.141Z","title":"bpf: Fix potential UAF when reading bpf link info","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-90391","published":"2026-09-17T16:09:25.083Z","updated":"2026-10-19T09:02:55.602Z","title":"lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-90390","published":"2026-09-17T16:09:24.405Z","updated":"2026-10-19T09:02:54.358Z","title":"md/bitmap: resume array on backlog_store() error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-90389","published":"2026-09-17T16:09:23.767Z","updated":"2026-10-19T09:02:53.050Z","title":"md: scope memalloc_noio to allocation critical sections","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-90388","published":"2026-09-17T16:09:23.140Z","updated":"2026-10-19T09:02:51.717Z","title":"iommu/dma: Check atomic pool allocation result directly","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-90387","published":"2026-09-17T16:09:22.493Z","updated":"2026-10-19T09:02:50.001Z","title":"swiotlb: Preserve allocation virtual address for dynamic pools","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-90386","published":"2026-09-17T16:09:21.842Z","updated":"2026-10-19T09:02:48.790Z","title":"i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-90385","published":"2026-09-17T16:09:21.198Z","updated":"2026-10-30T12:35:27.082Z","title":"md/raid1: create serial pool adding rdev to array with serialize_policy=1","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90384","published":"2026-09-17T16:09:20.536Z","updated":"2026-10-19T09:02:46.849Z","title":"iomap: release the folio batch on iomap callback failures","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-90383","published":"2026-09-17T16:09:19.875Z","updated":"2026-10-30T12:35:26.007Z","title":"misc: sgi-gru: remove interrupt-context page-table walks","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-90382","published":"2026-09-17T16:09:19.247Z","updated":"2026-10-19T09:02:43.423Z","title":"wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90381","published":"2026-09-17T16:09:18.603Z","updated":"2026-10-19T09:02:40.869Z","title":"wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-90380","published":"2026-09-17T16:09:17.948Z","updated":"2026-10-19T09:02:39.607Z","title":"wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00312,"kevAdded":null},{"id":"CVE-2026-90379","published":"2026-09-17T16:09:17.297Z","updated":"2026-10-19T09:02:37.854Z","title":"wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-90378","published":"2026-09-17T16:09:16.655Z","updated":"2026-10-19T09:02:36.822Z","title":"wifi: mt76: mt792x: Fix memory leak in SDIO TX path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90377","published":"2026-09-17T16:09:16.009Z","updated":"2026-10-19T09:02:35.874Z","title":"wifi: mt76: fix RX data queuing of RRO 3.0","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90376","published":"2026-09-17T16:09:15.361Z","updated":"2026-10-19T09:02:34.912Z","title":"wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90375","published":"2026-09-17T16:09:14.730Z","updated":"2026-10-30T12:35:24.917Z","title":"wifi: mt76: fix non-AQL packet accounting for MLO stations","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-90374","published":"2026-09-17T16:09:14.067Z","updated":"2026-10-21T12:51:23.581Z","title":"wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-90373","published":"2026-09-17T16:09:13.368Z","updated":"2026-10-30T12:35:23.858Z","title":"wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-90372","published":"2026-09-17T16:09:12.733Z","updated":"2026-10-19T09:02:31.113Z","title":"wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2026-90371","published":"2026-09-17T16:09:12.046Z","updated":"2026-10-19T09:02:30.177Z","title":"wifi: mt76: fix RXDMAD_C buffer recycling race","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-90370","published":"2026-09-17T16:09:11.398Z","updated":"2026-10-19T09:02:29.217Z","title":"wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-90369","published":"2026-09-17T16:09:10.738Z","updated":"2026-10-19T09:02:28.270Z","title":"wifi: mt76: fix out-of-bounds access in mmio copy helpers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90368","published":"2026-09-17T16:09:10.084Z","updated":"2026-10-30T12:35:22.798Z","title":"wifi: mt76: mt7915: unwind state on add_interface failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90367","published":"2026-09-17T16:09:09.430Z","updated":"2026-10-21T12:51:20.196Z","title":"wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2026-90366","published":"2026-09-17T16:09:08.785Z","updated":"2026-10-19T09:02:25.401Z","title":"wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-90365","published":"2026-09-17T16:09:08.127Z","updated":"2026-10-30T12:35:21.725Z","title":"wifi: mt76: cancel reset and rc work on device unregister","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90364","published":"2026-09-17T16:09:07.474Z","updated":"2026-10-19T09:02:23.517Z","title":"ACPI: processor: Unregister cpufreq notifier on init failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90363","published":"2026-09-17T16:09:06.817Z","updated":"2026-10-21T12:51:17.907Z","title":"drm/msm: don't tear down KMS twice when KMS init fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-90362","published":"2026-09-17T16:09:06.172Z","updated":"2026-10-19T09:02:21.606Z","title":"drm/msm/dsi: Drop dev_pm_opp_set_rate(0)","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90361","published":"2026-09-17T16:09:05.505Z","updated":"2026-10-19T09:02:17.503Z","title":"wifi: ath11k: fix leak in ath11k_service_ready_ext_event()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90360","published":"2026-09-17T16:09:04.861Z","updated":"2026-10-19T09:02:16.545Z","title":"regulator: core: use system_freezable_wq for init complete work","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2026-90359","published":"2026-09-17T16:09:04.187Z","updated":"2026-10-21T12:51:16.798Z","title":"bpf: Reject >8 byte return values on return-reading trampoline paths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-90358","published":"2026-09-17T16:09:03.531Z","updated":"2026-10-30T12:35:20.664Z","title":"bpf, x86: Fix trampoline stack size for 128-bit arguments","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-90357","published":"2026-09-17T16:09:02.873Z","updated":"2026-10-19T09:02:13.637Z","title":"wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00341,"kevAdded":null},{"id":"CVE-2026-90356","published":"2026-09-17T16:09:02.189Z","updated":"2026-10-19T09:02:12.676Z","title":"wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90355","published":"2026-09-17T16:09:01.543Z","updated":"2026-10-19T09:02:11.737Z","title":"wifi: mt76: mt7996: clear stale link state on full reset","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90354","published":"2026-09-17T16:09:00.880Z","updated":"2026-10-19T09:02:10.824Z","title":"wifi: mt76: mt7915: fix double hif2 init on the non-WED path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-90353","published":"2026-09-17T16:09:00.217Z","updated":"2026-10-19T09:02:09.864Z","title":"wifi: mt76: mt7915: fix ext PHY use-after-free on register error path","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2026-90352","published":"2026-09-17T16:08:59.557Z","updated":"2026-10-19T09:02:08.899Z","title":"wifi: mt76: mt7915: release hif2 reference on probe IRQ failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-90351","published":"2026-09-17T16:08:58.905Z","updated":"2026-10-21T12:51:14.533Z","title":"wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-90350","published":"2026-09-17T16:08:58.226Z","updated":"2026-10-19T09:02:06.980Z","title":"wifi: mt76: reject out-of-range link ids in mt76_vif_link()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90349","published":"2026-09-17T16:08:57.539Z","updated":"2026-10-19T09:02:06.019Z","title":"wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90348","published":"2026-09-17T16:08:56.885Z","updated":"2026-10-19T09:02:05.059Z","title":"wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-90347","published":"2026-09-17T16:08:56.232Z","updated":"2026-10-30T12:35:19.601Z","title":"arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-90346","published":"2026-09-17T16:08:55.591Z","updated":"2026-10-30T12:35:18.517Z","title":"wifi: nl80211: clean up color-change beacon data on errors","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90345","published":"2026-09-17T16:08:54.958Z","updated":"2026-10-30T12:35:17.441Z","title":"wifi: brcmfmac: fix P2P action frame handling without device vif","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90344","published":"2026-09-17T16:08:54.311Z","updated":"2026-10-19T09:02:01.149Z","title":"wifi: mac80211: disconnect on CSA to channel 0","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-90343","published":"2026-09-17T16:08:53.670Z","updated":"2026-10-30T12:35:16.376Z","title":"wifi: cfg80211: stop PMSR before P2P and NAN teardown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-90342","published":"2026-09-17T16:08:53.010Z","updated":"2026-10-19T09:01:59.207Z","title":"bpf: Fix mmap_lock deadlock on arena lock failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90341","published":"2026-09-17T16:08:52.307Z","updated":"2026-10-19T09:01:58.280Z","title":"firmware: coreboot: Validate table bounds","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-90340","published":"2026-09-17T16:08:51.635Z","updated":"2026-10-19T09:01:57.296Z","title":"pinctrl: generic: free maps on pinctrl_generic_to_map() failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90339","published":"2026-09-17T16:08:50.990Z","updated":"2026-10-19T09:01:56.327Z","title":"powerpc/syscall: Fix syscall skip handling for seccomp and ptrace","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90338","published":"2026-09-17T16:08:50.331Z","updated":"2026-10-19T09:01:55.369Z","title":"serial: amba-pl011: keep console clock enabled for atomic writes","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90337","published":"2026-09-17T16:08:49.687Z","updated":"2026-10-30T12:35:15.311Z","title":"serial: core: do fallible allocations before the console can be registered","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90336","published":"2026-09-17T16:08:49.016Z","updated":"2026-10-30T12:35:14.252Z","title":"serial: core: clear freed pointers on uart_register_driver() failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90335","published":"2026-09-17T16:08:48.127Z","updated":"2026-10-30T12:35:13.192Z","title":"tty: skip cdev_del() when no cdev is registered","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90334","published":"2026-09-17T16:08:47.462Z","updated":"2026-10-19T09:01:51.379Z","title":"tty: clear cdev pointer after cdev_add() failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90333","published":"2026-09-17T16:08:46.805Z","updated":"2026-10-21T12:51:03.593Z","title":"dm-integrity: replace forgeable discard filler with a keyed sector marker","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-90332","published":"2026-09-17T16:08:46.154Z","updated":"2026-10-19T09:01:49.150Z","title":"PCI: dwc: ep: Flush cached MSI write before unmapping the iATU","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2026-90331","published":"2026-09-17T16:08:45.496Z","updated":"2026-10-19T09:01:48.189Z","title":"HID: asus: refactor the two workqueues and init sequence","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90330","published":"2026-09-17T16:08:43.953Z","updated":"2026-10-30T12:35:12.113Z","title":"HID: logitech-hidpp: Fix FF device cleanup on init failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90329","published":"2026-09-17T16:08:43.304Z","updated":"2026-10-19T09:01:46.257Z","title":"HID: synchronize input before cleaning up a failed probe","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2026-90328","published":"2026-09-17T16:08:42.642Z","updated":"2026-10-30T12:35:11.051Z","title":"HID: steam: Reject short reads","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90327","published":"2026-09-17T16:08:42.017Z","updated":"2026-10-19T09:01:44.321Z","title":"phonet: pep: do not write beyond optlen in getsockopt","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90326","published":"2026-09-17T16:08:41.374Z","updated":"2026-10-21T12:51:00.266Z","title":"blk-cgroup: fix race between policy activation and blkg destruction","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-90325","published":"2026-09-17T16:08:40.710Z","updated":"2026-10-19T09:01:42.317Z","title":"blk-cgroup: skip dying blkg in blkcg_activate_policy()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-90324","published":"2026-09-17T16:08:40.077Z","updated":"2026-10-21T12:50:58.953Z","title":"ublk: check import_ubuf() return value","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-90323","published":"2026-09-17T16:08:39.434Z","updated":"2026-10-19T09:01:39.373Z","title":"ublk: validate auto buf reg before taking uring_cmd","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90322","published":"2026-09-17T16:08:38.768Z","updated":"2026-10-30T12:35:09.985Z","title":"ocfs2/cluster: keep heartbeat local node stable","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90321","published":"2026-09-17T16:08:38.138Z","updated":"2026-10-21T12:50:56.779Z","title":"ocfs2: validate inline xattrs during inode block validation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-90320","published":"2026-09-17T16:08:37.497Z","updated":"2026-10-21T12:50:55.685Z","title":"ocfs2: validate external xattr entries when reading metadata","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-90319","published":"2026-09-17T16:08:36.840Z","updated":"2026-10-19T09:01:35.572Z","title":"rapidio: clear mport->net when rio_add_net() fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-90318","published":"2026-09-17T16:08:36.174Z","updated":"2026-10-19T09:01:34.596Z","title":"fat: release buffer head after rebuilding parent","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90317","published":"2026-09-17T16:08:35.537Z","updated":"2026-10-19T09:01:33.647Z","title":"bpf: Invalidate RCU pointers after final spin unlock","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-90316","published":"2026-09-17T16:08:34.875Z","updated":"2026-10-19T09:01:32.683Z","title":"drm/omap: dsi: Do not copy isr table","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-90315","published":"2026-09-17T16:08:34.218Z","updated":"2026-10-19T09:01:31.722Z","title":"PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90314","published":"2026-09-17T16:08:33.568Z","updated":"2026-10-19T09:01:30.762Z","title":"remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-90313","published":"2026-09-17T16:08:32.932Z","updated":"2026-10-30T12:35:08.910Z","title":"bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-90312","published":"2026-09-17T16:08:32.287Z","updated":"2026-10-19T09:01:28.834Z","title":"bpf: Check load-acquire src ptr type before the load","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-90311","published":"2026-09-17T16:08:31.645Z","updated":"2026-10-30T12:35:07.854Z","title":"thermal: hwmon: Remove hwmon class device along with its parent","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90309","published":"2026-09-17T16:08:30.346Z","updated":"2026-10-19T09:01:26.909Z","title":"RDMA/erdma: Hold CQ references when processing EQ events","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-90308","published":"2026-09-17T16:08:29.704Z","updated":"2026-10-30T12:35:06.808Z","title":"RDMA/erdma: Hold QP references for AE and CM processing","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-90307","published":"2026-09-17T16:08:29.045Z","updated":"2026-10-19T09:01:24.980Z","title":"RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90306","published":"2026-09-17T16:08:28.387Z","updated":"2026-10-19T09:01:24.034Z","title":"ARM: 9481/2: breakpoint: CFI breakpoints only on demand","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90305","published":"2026-09-17T16:08:27.742Z","updated":"2026-10-19T09:01:23.094Z","title":"ARM: 9483/1: select HAVE_POSIX_CPU_TIMERS_TASK_WORK","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90304","published":"2026-09-17T16:08:27.095Z","updated":"2026-10-19T09:01:22.158Z","title":"ARM: 9484/1: enable interrupts when unhandled user faults are triggered","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90303","published":"2026-09-17T16:08:26.455Z","updated":"2026-10-19T09:01:21.209Z","title":"ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-90302","published":"2026-09-17T16:08:25.808Z","updated":"2026-10-19T09:01:20.232Z","title":"ocfs2: synchronize heartbeat callbacks with o2net teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90301","published":"2026-09-17T16:08:25.152Z","updated":"2026-10-30T12:35:05.737Z","title":"ocfs2: o2hb: quiesce negotiate handlers and timeout work","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00593,"kevAdded":null},{"id":"CVE-2026-90300","published":"2026-09-17T16:08:24.515Z","updated":"2026-10-30T12:35:04.681Z","title":"bpf: Clear buf on error in __bpf_get_task_stack","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90299","published":"2026-09-17T16:08:23.888Z","updated":"2026-10-19T09:01:17.297Z","title":"bpf: Fix sleepable check for tracing/lsm prog","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-90298","published":"2026-09-17T16:08:23.249Z","updated":"2026-10-19T09:01:16.357Z","title":"drm/sun4i: tcon: Drop TCON TOP device reference","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-90297","published":"2026-09-17T16:08:22.594Z","updated":"2026-10-19T09:01:15.411Z","title":"drm/sun4i: crtc: Propagate layer initialization error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-90296","published":"2026-09-17T16:08:21.951Z","updated":"2026-10-19T09:01:14.414Z","title":"cpufreq: imx6q: fix devres accumulation across driver rebind","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-90295","published":"2026-09-17T16:08:21.295Z","updated":"2026-10-19T09:01:13.419Z","title":"cpufreq: imx6q: fix out-of-bounds write when probed more than once","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-90294","published":"2026-09-17T16:08:20.664Z","updated":"2026-10-19T09:01:12.433Z","title":"IB/isert: delay the final Login Response until the session is registered","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00696,"kevAdded":null},{"id":"CVE-2026-90293","published":"2026-09-17T16:08:20.033Z","updated":"2026-10-19T09:01:11.440Z","title":"IB/isert: post the full-feature receive buffers after session registration","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00696,"kevAdded":null},{"id":"CVE-2026-90292","published":"2026-09-17T16:08:19.350Z","updated":"2026-10-19T09:01:10.469Z","title":"RDMA/siw: Fix use-after-free in siw_accept()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-90291","published":"2026-09-17T16:08:18.700Z","updated":"2026-10-21T12:50:49.946Z","title":"module/dups: Fix use-after-free in kmod_dup_req lifetime handling","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-90290","published":"2026-09-17T16:08:18.058Z","updated":"2026-10-19T09:01:08.552Z","title":"arm64: hibernate: Restore DAIF state on error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90289","published":"2026-09-17T16:08:17.368Z","updated":"2026-10-30T12:35:03.620Z","title":"drm/amd/display: Resize MST HDCP per-connector arrays to 32","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-90288","published":"2026-09-17T16:08:16.686Z","updated":"2026-10-19T09:01:06.628Z","title":"phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure","severity":"HIGH","score":7.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-90287","published":"2026-09-17T16:08:16.004Z","updated":"2026-10-19T09:01:05.681Z","title":"phy: sunplus: fix error handling in sp_uphy_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90286","published":"2026-09-17T16:08:15.335Z","updated":"2026-10-19T09:01:04.715Z","title":"drm/amdgpu/gfx6: Use PFP on the compute queues too","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-90285","published":"2026-09-17T16:08:14.661Z","updated":"2026-10-19T09:01:03.776Z","title":"scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90284","published":"2026-09-17T16:08:13.993Z","updated":"2026-10-19T09:01:02.825Z","title":"firmware_loader: do not queue completed sysfs fallback requests","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90283","published":"2026-09-17T16:08:13.356Z","updated":"2026-10-19T09:01:01.727Z","title":"hugetlbfs: release subpool on fill_super failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-90282","published":"2026-09-17T16:08:12.681Z","updated":"2026-10-19T09:01:00.707Z","title":"phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-90281","published":"2026-09-17T16:08:11.916Z","updated":"2026-10-19T09:00:59.723Z","title":"phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-90280","published":"2026-09-17T16:08:11.281Z","updated":"2026-10-19T09:00:58.766Z","title":"phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-90279","published":"2026-09-17T16:08:10.654Z","updated":"2026-10-19T09:00:57.773Z","title":"md/raid5: round bitmap stripes with sector division","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-90278","published":"2026-09-17T16:08:09.992Z","updated":"2026-10-19T09:00:55.904Z","title":"md: wait for behind writes before destroying bitmap","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90277","published":"2026-09-17T16:08:09.328Z","updated":"2026-10-19T09:00:54.917Z","title":"md/md-llbitmap: prevent create failure bitmap UAF","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90276","published":"2026-09-17T16:08:08.697Z","updated":"2026-10-19T09:00:53.942Z","title":"md/md-llbitmap: stop daemon timer rearm on destroy","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90275","published":"2026-09-17T16:08:08.053Z","updated":"2026-10-19T09:00:52.887Z","title":"md/raid1: don't set array_frozen in raid1_takeover()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-90274","published":"2026-09-17T16:08:07.269Z","updated":"2026-10-19T09:00:51.909Z","title":"coresight: etm4x: fix underflow for usage of (nrseqstate - 1)","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-90273","published":"2026-09-17T16:08:06.638Z","updated":"2026-10-30T12:35:02.543Z","title":"coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90272","published":"2026-09-17T16:08:05.965Z","updated":"2026-10-19T09:00:49.810Z","title":"perf: arm_pmuv3: Zero initialize hw_id branch stack field","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90271","published":"2026-09-17T16:08:05.304Z","updated":"2026-10-19T09:00:48.861Z","title":"arm_mpam: Fix a NULL pointer dereference on unbinding after an error interrupt","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90270","published":"2026-09-17T16:08:04.648Z","updated":"2026-10-19T09:00:47.928Z","title":"arm_mpam: Disable driver unbind to avoid UAF","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90269","published":"2026-09-17T16:08:03.996Z","updated":"2026-10-19T09:00:46.990Z","title":"bpf: Reject load-acquire from pointers requiring fault protection","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90268","published":"2026-09-17T16:08:03.312Z","updated":"2026-10-19T09:00:45.863Z","title":"scsi: sd: Fix error handling in sd_probe() after large pool creation failure","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00454,"kevAdded":null},{"id":"CVE-2026-90267","published":"2026-09-17T16:08:02.624Z","updated":"2026-10-30T12:35:01.469Z","title":"scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90266","published":"2026-09-17T16:08:01.995Z","updated":"2026-10-19T09:00:43.942Z","title":"btrfs: zoned: don't force read-only on transient -EAGAIN from reloc merge","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90265","published":"2026-09-17T16:08:01.372Z","updated":"2026-10-30T12:35:00.365Z","title":"btrfs: defrag: fix deadlock between defrag and delalloc space reservation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-90264","published":"2026-09-17T16:08:00.740Z","updated":"2026-10-30T12:34:59.305Z","title":"btrfs: always wait for ordered extents to avoid OE races","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90263","published":"2026-09-17T16:08:00.085Z","updated":"2026-10-30T12:34:58.242Z","title":"btrfs: check if root is readonly when setting posix acl","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90262","published":"2026-09-17T16:07:59.435Z","updated":"2026-10-19T09:00:38.640Z","title":"btrfs: retry verity reads for not-uptodate Merkle folios","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-90261","published":"2026-09-17T16:07:58.806Z","updated":"2026-10-19T09:00:37.715Z","title":"btrfs: zoned: flush active metadata block group at btree_writepages() start","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90260","published":"2026-09-17T16:07:58.102Z","updated":"2026-10-21T12:50:42.251Z","title":"btrfs: zoned: don't clobber the extent buffer when zeroing it out","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-90259","published":"2026-09-17T16:07:57.416Z","updated":"2026-10-30T12:34:57.189Z","title":"btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-90258","published":"2026-09-17T16:07:56.730Z","updated":"2026-10-19T09:00:34.817Z","title":"pinctrl: airoha: add missed IRQ resource helpers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90257","published":"2026-09-17T16:07:56.089Z","updated":"2026-10-19T09:00:33.856Z","title":"Bluetooth: virtio_bt: avoid OOB read of build info string","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90256","published":"2026-09-17T16:07:55.427Z","updated":"2026-10-21T12:50:40.034Z","title":"Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00379,"kevAdded":null},{"id":"CVE-2026-90255","published":"2026-09-17T16:07:54.775Z","updated":"2026-10-19T09:00:31.949Z","title":"Bluetooth: hci_conn: fix the SCO setup context lifetime","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00337,"kevAdded":null},{"id":"CVE-2026-90254","published":"2026-09-17T16:07:54.123Z","updated":"2026-10-19T09:00:30.990Z","title":"Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90253","published":"2026-09-17T16:07:53.435Z","updated":"2026-10-19T09:00:30.044Z","title":"Bluetooth: MGMT: free the mesh send cancel command when it is cancelled","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-90252","published":"2026-09-17T16:07:52.738Z","updated":"2026-10-19T09:00:29.101Z","title":"Bluetooth: MGMT: free the HCI command when it is cancelled","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90251","published":"2026-09-17T16:07:52.066Z","updated":"2026-10-19T09:00:28.154Z","title":"Bluetooth: MSFT: validate evt_prefix_len against the response length","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-90250","published":"2026-09-17T16:07:51.403Z","updated":"2026-10-30T12:34:56.117Z","title":"bpf, cgroup: Fix storage null-ptr-deref after replacing prog","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90249","published":"2026-09-17T16:07:50.766Z","updated":"2026-10-19T09:00:24.980Z","title":"iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-90248","published":"2026-09-17T16:07:50.104Z","updated":"2026-10-19T09:00:24.022Z","title":"net/sched: cls_api: fix teardown of an adopted proto on insert-race loss","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-90247","published":"2026-09-17T16:07:49.444Z","updated":"2026-10-30T12:34:55.059Z","title":"bpf: Fix mmap_lock leak in irq_work path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90246","published":"2026-09-17T16:07:48.524Z","updated":"2026-10-19T09:00:22.097Z","title":"apparmor: fix integer overflow in verify_tags() bounds check","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-90245","published":"2026-09-17T16:07:47.765Z","updated":"2026-10-19T09:00:21.124Z","title":"fbdev: kyro: Validate overlay viewport coordinates","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-90244","published":"2026-09-17T16:07:47.121Z","updated":"2026-10-19T09:00:20.156Z","title":"iommu/dma: Restore locking around msi_page_list","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-90243","published":"2026-09-17T16:07:46.488Z","updated":"2026-10-19T09:00:19.209Z","title":"iommu/vt-d: Clear Present bit before tearing down copied context entry","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-90242","published":"2026-09-17T16:07:45.817Z","updated":"2026-10-19T09:00:18.248Z","title":"iommu/vt-d: Fix iopf_refcount leak on RID domain replacement","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90241","published":"2026-09-17T16:07:45.168Z","updated":"2026-10-19T09:00:17.291Z","title":"iommu/vt-d: Tear down scalable-mode context on probe failure","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-90240","published":"2026-09-17T16:07:44.445Z","updated":"2026-10-21T12:50:36.295Z","title":"iommu/vt-d: Flush context cache with correct SID when tearing down aliases","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-90239","published":"2026-09-17T16:07:43.787Z","updated":"2026-10-19T09:00:15.339Z","title":"media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumem()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90238","published":"2026-09-17T16:07:43.159Z","updated":"2026-10-19T09:00:14.412Z","title":"media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90237","published":"2026-09-17T16:07:42.524Z","updated":"2026-10-19T09:00:13.485Z","title":"netfilter: nft_ct: move custom expectation support to helper","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-90236","published":"2026-09-17T16:07:41.898Z","updated":"2026-10-19T09:00:12.535Z","title":"NFSD: Release the export reference when reaping open stateids","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-90235","published":"2026-09-17T16:07:41.251Z","updated":"2026-10-30T12:34:53.963Z","title":"sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00664,"kevAdded":null},{"id":"CVE-2026-90234","published":"2026-09-17T16:07:40.584Z","updated":"2026-10-30T12:34:52.905Z","title":"NFS: Return a delegation the client fails to record","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00684,"kevAdded":null},{"id":"CVE-2026-90233","published":"2026-09-17T16:07:39.941Z","updated":"2026-10-19T09:00:09.595Z","title":"nvme-pci: release descriptor pools on probe failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90232","published":"2026-09-17T16:07:39.279Z","updated":"2026-10-30T12:34:51.853Z","title":"amt: Don't support cross-netns setup.","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90231","published":"2026-09-17T16:07:38.613Z","updated":"2026-10-21T12:50:32.348Z","title":"apparmor: fix unconfined user namespace restriction forced stack","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-90230","published":"2026-09-17T16:07:37.940Z","updated":"2026-10-19T09:00:06.762Z","title":"nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00457,"kevAdded":null},{"id":"CVE-2026-90229","published":"2026-09-17T16:07:37.285Z","updated":"2026-10-30T12:34:50.787Z","title":"nvme-apple: Destroy the admin queue on removal","severity":"HIGH","score":7.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-90228","published":"2026-09-17T16:07:36.625Z","updated":"2026-10-19T09:00:04.748Z","title":"nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0068,"kevAdded":null},{"id":"CVE-2026-90227","published":"2026-09-17T16:07:35.989Z","updated":"2026-10-19T09:00:03.749Z","title":"nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-90226","published":"2026-09-17T16:07:35.322Z","updated":"2026-10-19T09:00:02.755Z","title":"nfc: llcp: avoid userspace overflow on invalid optlen","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-90225","published":"2026-09-17T16:07:34.658Z","updated":"2026-10-19T09:00:01.803Z","title":"nfc: llcp: read llcp_sock->local under the socket lock in getsockopt","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-90224","published":"2026-09-17T16:07:34.009Z","updated":"2026-10-19T09:00:00.751Z","title":"nfc: nci: fix double completion race in nci_data_exchange_complete","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-90223","published":"2026-09-17T16:07:33.355Z","updated":"2026-10-19T08:59:59.669Z","title":"nfc: llcp: bound SNL TLV parsing to the skb and add length checks","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00413,"kevAdded":null},{"id":"CVE-2026-90222","published":"2026-09-17T16:07:32.717Z","updated":"2026-10-19T08:59:58.674Z","title":"nfc: pn533: hold a reference to the request skb during send_frame","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-90221","published":"2026-09-17T16:07:32.070Z","updated":"2026-10-19T08:59:57.703Z","title":"nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90220","published":"2026-09-17T16:07:31.423Z","updated":"2026-10-30T12:34:49.721Z","title":"ALSA: seq: Don't leak the extension cell pointer in the bounce payload","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-90219","published":"2026-09-17T16:07:30.778Z","updated":"2026-10-19T08:59:55.119Z","title":"RDMA/cxgb4: Free debugfs on registration failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-90218","published":"2026-09-17T16:07:30.076Z","updated":"2026-10-19T08:59:54.084Z","title":"RDMA/cma: Fix WARNING in res_to_rt","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90217","published":"2026-09-17T16:07:29.409Z","updated":"2026-10-21T12:50:30.155Z","title":"bpf: Compare iterator types during state pruning","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-90216","published":"2026-09-17T16:07:28.730Z","updated":"2026-10-19T08:59:52.143Z","title":"ubi: Fix rollback for explicit UBI device numbers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-90215","published":"2026-09-17T16:07:28.071Z","updated":"2026-10-19T08:59:51.207Z","title":"mtd: ubi: Release device reference on busy detach","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-90214","published":"2026-09-17T16:07:27.407Z","updated":"2026-10-19T08:59:50.241Z","title":"ASoC: xilinx: formatter_pcm: fix stream_data leak on open error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-90213","published":"2026-09-17T16:07:26.756Z","updated":"2026-10-30T12:34:48.656Z","title":"firewire: core: fix memory leak in error path of build_tree()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-90212","published":"2026-09-17T16:07:26.104Z","updated":"2026-10-19T08:59:48.329Z","title":"arm64/efi: Avoid voluntary preemption with efi_mm installed","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90211","published":"2026-09-17T16:07:25.454Z","updated":"2026-10-19T08:59:47.377Z","title":"bpf, s390: Clear fetch destination on faulting arena atomic","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90210","published":"2026-09-17T16:07:24.772Z","updated":"2026-10-19T08:59:46.406Z","title":"bpf: Fix UAF in bpf_trampoline_multi_attach_free on update failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-90209","published":"2026-09-17T16:07:24.126Z","updated":"2026-10-19T08:59:45.470Z","title":"s390/debug: Fix deadlock during unregister","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90208","published":"2026-09-17T16:07:23.479Z","updated":"2026-10-30T12:34:47.590Z","title":"clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90207","published":"2026-09-17T16:07:22.825Z","updated":"2026-10-19T08:59:43.508Z","title":"ALSA: seq: midi: Serialize input teardown with event_input","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-90206","published":"2026-09-17T16:07:22.173Z","updated":"2026-10-30T12:34:46.536Z","title":"nvmet: fix max_qid race between configfs and controller allocation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90205","published":"2026-09-17T16:07:21.521Z","updated":"2026-10-30T12:34:45.443Z","title":"ocfs2: validate orphan slot during inode read","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-90204","published":"2026-09-17T16:07:20.845Z","updated":"2026-10-30T12:34:44.238Z","title":"ocfs2: validate DIO orphan slot during inode read","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-90203","published":"2026-09-17T16:07:20.180Z","updated":"2026-10-19T08:59:39.333Z","title":"Squashfs: check block offset is not negative","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-90202","published":"2026-09-17T16:07:19.514Z","updated":"2026-10-19T08:59:38.353Z","title":"scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90201","published":"2026-09-17T16:07:18.838Z","updated":"2026-10-19T08:59:37.392Z","title":"net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90200","published":"2026-09-17T16:07:18.182Z","updated":"2026-10-30T12:34:43.132Z","title":"fs/ntfs3: fix integer overflow in MFT cluster validation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-90199","published":"2026-09-17T16:07:17.550Z","updated":"2026-10-19T08:59:35.489Z","title":"fs/ntfs3: reject out-of-range evcn in mi_enum_attr()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-90198","published":"2026-09-17T16:07:16.923Z","updated":"2026-10-19T08:59:34.497Z","title":"ALSA: core: Fix use-after-free in snd_card_do_free()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-90197","published":"2026-09-17T16:07:16.281Z","updated":"2026-10-19T08:59:33.533Z","title":"HID: haptic: don't write an uninitialized value to unhandled usages","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90196","published":"2026-09-17T16:07:15.610Z","updated":"2026-10-19T08:59:32.595Z","title":"ASoC: SOF: validate topology volume range before allocation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-90195","published":"2026-09-17T16:07:14.979Z","updated":"2026-10-19T08:59:31.672Z","title":"riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-90194","published":"2026-09-17T16:07:14.317Z","updated":"2026-10-19T08:59:30.730Z","title":"ACPI: scan: fix bus ID cleanup on device_add() failures","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-90193","published":"2026-09-17T16:07:13.672Z","updated":"2026-10-19T08:59:29.783Z","title":"mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-90192","published":"2026-09-17T16:07:12.995Z","updated":"2026-10-19T08:59:28.843Z","title":"mailbox: qcom-cpucp: handle NULL data in send_data callback","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-90191","published":"2026-09-17T16:07:12.339Z","updated":"2026-10-19T08:59:27.897Z","title":"mailbox: riscv-sbi-mpxy: validate RPMI notification lengths","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-90190","published":"2026-09-17T16:07:11.654Z","updated":"2026-10-19T08:59:26.940Z","title":"null_blk: use DEFINE_MUTEX for the file-scope mutex","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-90189","published":"2026-09-17T16:07:10.992Z","updated":"2026-10-19T08:59:25.945Z","title":"null_blk: register configfs subsystem after creating default devices","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-90188","published":"2026-09-17T16:07:10.349Z","updated":"2026-10-19T08:59:24.972Z","title":"null_blk: free global tag_set on init error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90187","published":"2026-09-17T16:07:09.683Z","updated":"2026-10-30T12:34:40.977Z","title":"null_blk: free zones array on device power-off","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90186","published":"2026-09-17T16:07:09.047Z","updated":"2026-10-19T08:59:23.057Z","title":"null_blk: reject per-device queue resize for shared tag set","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90185","published":"2026-09-17T16:07:08.392Z","updated":"2026-10-19T08:59:22.077Z","title":"null_blk: serialize configfs attribute stores with the lock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90184","published":"2026-09-17T16:07:07.728Z","updated":"2026-10-19T08:59:21.103Z","title":"null_blk: serialize configfs attribute updates with device setup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90183","published":"2026-09-17T16:07:07.045Z","updated":"2026-10-30T12:34:39.908Z","title":"blk-iolatency: clear delay state when freeing policy data","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90182","published":"2026-09-17T16:07:06.388Z","updated":"2026-10-30T12:34:38.845Z","title":"blk-iocost: clear delay state when freeing policy data","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90181","published":"2026-09-17T16:07:05.725Z","updated":"2026-10-19T08:59:18.253Z","title":"ublk: avoid teardown retry loop on xarray allocation failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-90180","published":"2026-09-17T16:07:05.083Z","updated":"2026-10-19T08:59:17.283Z","title":"block: mtip32xx: synchronize ioctls with device removal","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-90179","published":"2026-09-17T16:07:04.413Z","updated":"2026-10-30T12:34:37.762Z","title":"apparmor: fix deadlock in complain-mode change_hat","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90178","published":"2026-09-17T16:07:03.759Z","updated":"2026-10-19T08:59:15.321Z","title":"hwmon: (coretemp) Fix core_data leak on CPUs without PTS","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-90177","published":"2026-09-17T16:07:03.097Z","updated":"2026-10-21T12:50:19.113Z","title":"bpf: Check pointer type for all atomic RMW paths","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-90176","published":"2026-09-17T16:07:02.433Z","updated":"2026-10-19T08:59:13.411Z","title":"ksmbd: Do not skip lock checks for single-byte ranges","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-90175","published":"2026-09-17T16:07:01.769Z","updated":"2026-10-19T08:59:12.437Z","title":"smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-90174","published":"2026-09-17T16:07:01.106Z","updated":"2026-10-30T12:34:36.698Z","title":"ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-90173","published":"2026-09-17T16:07:00.463Z","updated":"2026-10-19T08:59:10.504Z","title":"smb: smbdirect: free completion queues with ib_free_cq()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-90172","published":"2026-09-17T16:06:59.794Z","updated":"2026-10-19T08:59:09.521Z","title":"smb: smbdirect: destroy QP before mem pools on accept failure","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-90171","published":"2026-09-17T16:06:59.150Z","updated":"2026-10-19T08:59:08.551Z","title":"smb: smbdirect: release pending child sockets outside the handler lock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90170","published":"2026-09-17T16:06:58.486Z","updated":"2026-10-30T12:34:35.628Z","title":"ksmbd: validate ipc response length before dereferencing its fields","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-90169","published":"2026-09-17T16:06:57.814Z","updated":"2026-10-30T12:34:34.562Z","title":"ksmbd: free preauth sessions on connection teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2026-90167","published":"2026-09-17T16:06:56.507Z","updated":"2026-10-30T12:34:33.398Z","title":"ksmbd: serialize oplock close with pending break ownership","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90166","published":"2026-09-17T16:06:55.863Z","updated":"2026-10-30T12:34:32.329Z","title":"smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90165","published":"2026-09-17T16:06:55.196Z","updated":"2026-10-19T08:59:03.684Z","title":"smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-90164","published":"2026-09-17T16:06:54.504Z","updated":"2026-10-19T08:59:02.709Z","title":"smb/server: abort initialization when proc setup fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90163","published":"2026-09-17T16:06:53.809Z","updated":"2026-10-19T08:59:01.754Z","title":"smb/server: call ksmbd_proc_cleanup() on module init failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90162","published":"2026-09-17T16:06:53.136Z","updated":"2026-10-30T12:34:31.271Z","title":"ksmbd: defer publishing granted locks to prevent UAF/double-free race","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00702,"kevAdded":null},{"id":"CVE-2026-90161","published":"2026-09-17T16:06:52.470Z","updated":"2026-10-30T12:34:30.214Z","title":"erofs: fix interlaced ztailpacking pclusters","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-90160","published":"2026-09-17T16:06:51.806Z","updated":"2026-10-19T08:58:58.842Z","title":"lwt_bpf: Restore reserved headroom after xmit program","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90159","published":"2026-09-17T16:06:51.151Z","updated":"2026-10-19T08:58:57.864Z","title":"bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-90158","published":"2026-09-17T16:06:49.735Z","updated":"2026-10-19T08:58:56.902Z","title":"m68k: nfcon: Do not call console_is_registered() in nfcon_device()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-90157","published":"2026-09-17T16:06:49.081Z","updated":"2026-10-19T08:58:55.961Z","title":"bpf: Reject negative optlen in cgroup getsockopt hook","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90156","published":"2026-09-17T16:06:48.393Z","updated":"2026-10-30T12:34:29.152Z","title":"ksmbd: safely discard unregistered deferred locks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90155","published":"2026-09-17T16:06:47.716Z","updated":"2026-10-30T12:34:28.100Z","title":"ksmbd: detach blocked lock requests before freeing","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90154","published":"2026-09-17T16:06:47.046Z","updated":"2026-10-21T12:50:09.901Z","title":"ksmbd: scope session state changes to bound connections","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-90153","published":"2026-09-17T16:06:46.296Z","updated":"2026-10-30T12:34:27.032Z","title":"ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00522,"kevAdded":null},{"id":"CVE-2026-90152","published":"2026-09-17T16:06:45.641Z","updated":"2026-10-30T12:34:25.965Z","title":"smb/server: fix session leak in ksmbd_session_register()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90151","published":"2026-09-17T16:06:44.987Z","updated":"2026-10-19T08:58:50.239Z","title":"NFSv4: remove callback IDR entry on client allocation failure","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00749,"kevAdded":null},{"id":"CVE-2026-90150","published":"2026-09-17T16:06:44.320Z","updated":"2026-10-30T12:34:24.912Z","title":"pnfs/blocklayout: Fix device leaks on parse failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-90149","published":"2026-09-17T16:06:43.671Z","updated":"2026-10-30T12:34:23.855Z","title":"NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00665,"kevAdded":null},{"id":"CVE-2026-90148","published":"2026-09-17T16:06:42.992Z","updated":"2026-10-30T12:34:22.770Z","title":"NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-90147","published":"2026-09-17T16:06:42.342Z","updated":"2026-10-19T08:58:46.427Z","title":"clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-90146","published":"2026-09-17T16:06:41.695Z","updated":"2026-10-30T12:34:21.703Z","title":"bpf, xdp: move offload check into dev_xdp_install()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-90145","published":"2026-09-17T16:06:41.055Z","updated":"2026-10-19T08:58:44.481Z","title":"hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-90144","published":"2026-09-17T16:06:40.413Z","updated":"2026-10-21T12:50:03.630Z","title":"dpll: fix NULL deref in dpll_device_ops() during teardown race","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-90143","published":"2026-09-17T16:06:39.775Z","updated":"2026-10-19T08:58:41.623Z","title":"net: kcm: Hold RCU read lock while running BPF parser","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-90142","published":"2026-09-17T16:06:39.122Z","updated":"2026-10-21T12:50:02.541Z","title":"virtio_net: Fix resize of the RX ring","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-90141","published":"2026-09-17T16:06:38.478Z","updated":"2026-10-19T08:58:39.290Z","title":"ipvs: fix integer overflow in ftp helper port/address parsing","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2026-90140","published":"2026-09-17T16:06:37.824Z","updated":"2026-10-19T08:58:38.281Z","title":"cuse: wait for pending RCU callbacks on module exit","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-90139","published":"2026-09-17T16:06:37.179Z","updated":"2026-10-30T12:34:20.640Z","title":"fuse: check for NULL root inode in fuse_fill_super_submount","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-90138","published":"2026-09-17T16:06:36.528Z","updated":"2026-10-30T12:34:19.577Z","title":"vsock: don't check the listener's sk_err in vsock_accept()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-90137","published":"2026-09-17T16:06:35.829Z","updated":"2026-10-19T08:58:35.353Z","title":"platform/x86: hp-bioscfg: fix password encoding bounds check","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-90136","published":"2026-09-17T16:06:35.190Z","updated":"2026-10-19T08:58:34.349Z","title":"platform/x86/amd/hsmp: Reject negative power cap writes in hwmon","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90135","published":"2026-09-17T16:06:34.543Z","updated":"2026-10-30T12:34:18.512Z","title":"net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90134","published":"2026-09-17T16:06:33.888Z","updated":"2026-10-19T08:58:32.441Z","title":"ntfs: fix kmap_local_page() usage in compress","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90133","published":"2026-09-17T16:06:33.234Z","updated":"2026-10-19T08:58:31.458Z","title":"ntfs: Fix index_root heap OOB write in ntfs_ir_to_ib()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-90132","published":"2026-09-17T16:06:32.576Z","updated":"2026-10-19T08:58:30.496Z","title":"ntfs: reject unprivileged writes to reserved $LX* xattrs","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-90131","published":"2026-09-17T16:06:31.913Z","updated":"2026-10-19T08:58:29.513Z","title":"ntfs: serialize resident iomap reads with mrec_lock","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-90130","published":"2026-09-17T16:06:31.216Z","updated":"2026-10-19T08:58:28.532Z","title":"vdpa_sim: fix cleanup after worker creation failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-90129","published":"2026-09-17T16:06:30.537Z","updated":"2026-10-30T12:34:17.423Z","title":"virtio_balloon: quiesce balloon work before device shutdown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90128","published":"2026-09-17T16:06:29.877Z","updated":"2026-10-19T08:58:26.549Z","title":"vdpa/mlx5: fix wrong list iterated in add_direct_chain error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90127","published":"2026-09-17T16:06:29.219Z","updated":"2026-10-19T08:58:25.555Z","title":"virtio: rtc: time out alarm requests","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90126","published":"2026-09-17T16:06:28.568Z","updated":"2026-10-19T08:58:24.498Z","title":"rtc: pcf8563: fix clock provider leak on unbind","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90125","published":"2026-09-17T16:06:27.924Z","updated":"2026-10-30T12:34:16.330Z","title":"smb: client: fix request buffer leak in smb2_new_read_req()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90124","published":"2026-09-17T16:06:27.254Z","updated":"2026-10-19T08:58:22.566Z","title":"irqchip/renesas-rzg2l: Fix loss of interrupt","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-90123","published":"2026-09-17T16:06:26.567Z","updated":"2026-10-19T08:58:21.572Z","title":"irqchip/ast2700-intc: Avoid allocating in the irq_domain activate() callback","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90122","published":"2026-09-17T16:06:25.910Z","updated":"2026-10-19T08:58:20.601Z","title":"clk: visconti: Make sure clk_init_data is fully initialized","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-90121","published":"2026-09-17T16:06:25.253Z","updated":"2026-10-19T08:58:19.637Z","title":"irqchip/gic-v5: Clear per-CPU IRS data on teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90120","published":"2026-09-17T16:06:24.607Z","updated":"2026-10-19T08:58:18.680Z","title":"irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-90119","published":"2026-09-17T16:06:23.962Z","updated":"2026-10-19T08:58:17.720Z","title":"ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-90118","published":"2026-09-17T16:06:23.333Z","updated":"2026-10-19T08:58:16.740Z","title":"ntfs: fix off-by-one page overflow in ntfs_decompress()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-90117","published":"2026-09-17T16:06:22.705Z","updated":"2026-10-19T08:58:15.750Z","title":"ntfs: validate usa_ofs before preserving the update sequence number","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90116","published":"2026-09-17T16:06:22.065Z","updated":"2026-10-30T12:34:15.218Z","title":"ALSA: mtpav: shut down output timer before card teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90115","published":"2026-09-17T16:06:21.376Z","updated":"2026-10-19T08:58:13.777Z","title":"xsk: fix NULL pointer dereference in __xsk_rcv()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90114","published":"2026-09-17T16:06:20.741Z","updated":"2026-10-19T08:58:12.785Z","title":"net: bridge: Reject descending VLAN tunnel ranges","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90113","published":"2026-09-17T16:06:20.070Z","updated":"2026-10-19T08:58:11.732Z","title":"netdevsim: update queue NAPI association on queue reset","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90112","published":"2026-09-17T16:06:19.419Z","updated":"2026-10-30T12:34:14.158Z","title":"net: qlcnic: validate unified ROM sections before loading","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90111","published":"2026-09-17T16:06:18.779Z","updated":"2026-10-30T12:34:13.088Z","title":"ip6mr: do not clone dst in ip6mr_cache_report()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-90110","published":"2026-09-17T16:06:18.113Z","updated":"2026-10-19T08:58:08.724Z","title":"inetpeer: randomize RB-tree node comparison using SipHash","severity":"CRITICAL","score":9.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00612,"kevAdded":null},{"id":"CVE-2026-90109","published":"2026-09-17T16:06:17.465Z","updated":"2026-10-30T12:34:12.023Z","title":"net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-90108","published":"2026-09-17T16:06:16.813Z","updated":"2026-10-19T08:58:06.785Z","title":"net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90107","published":"2026-09-17T16:06:16.157Z","updated":"2026-10-19T08:58:05.815Z","title":"net/smc: free pending qentry in smc_llc_flow_stop() before memset","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90106","published":"2026-09-17T16:06:15.470Z","updated":"2026-10-30T12:34:10.967Z","title":"net: bridge: arp/nd proxy: fix reading neigh ha","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90105","published":"2026-09-17T16:06:14.829Z","updated":"2026-10-30T12:34:09.898Z","title":"vxlan: fix reading neigh ha","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90104","published":"2026-09-17T16:06:14.191Z","updated":"2026-10-30T12:34:08.837Z","title":"NFSv4.1: zero referring call lists before decoding","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00682,"kevAdded":null},{"id":"CVE-2026-90103","published":"2026-09-17T16:06:13.519Z","updated":"2026-10-19T08:58:01.236Z","title":"NFSv4.2: fix LAYOUTSTATS send buffer exhaustion","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00696,"kevAdded":null},{"id":"CVE-2026-90102","published":"2026-09-17T16:06:12.873Z","updated":"2026-10-19T08:58:00.244Z","title":"NFSv4/pnfs: key the data server cache on the NFS version","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00696,"kevAdded":null},{"id":"CVE-2026-90101","published":"2026-09-17T16:06:12.213Z","updated":"2026-10-19T08:57:59.246Z","title":"bnxt_en: Fix call to hardware monitoring event handler","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90100","published":"2026-09-17T16:06:11.515Z","updated":"2026-10-19T08:57:58.302Z","title":"ptp: netc: fix period truncation and potential divide-by-zero in PEROUT","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90099","published":"2026-09-17T16:06:10.858Z","updated":"2026-10-30T12:34:07.767Z","title":"net/sched: account classifier filter allocations to memcg","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90098","published":"2026-09-17T16:06:10.203Z","updated":"2026-10-19T08:57:56.415Z","title":"net: sparx5: fix sleep in atomic context in MAC table access","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90097","published":"2026-09-17T16:06:09.529Z","updated":"2026-10-30T12:34:06.704Z","title":"Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-90096","published":"2026-09-17T16:06:08.870Z","updated":"2026-10-19T08:57:54.506Z","title":"fuse: invalidate the correct range after O_APPEND direct write","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90095","published":"2026-09-17T16:06:08.197Z","updated":"2026-10-19T08:57:53.596Z","title":"fuse: Fix the condition to enable over-io-uring","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90094","published":"2026-09-17T16:06:07.494Z","updated":"2026-10-19T08:57:52.615Z","title":"arm64: process: Fix context switching MTE store-only tag check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90093","published":"2026-09-17T16:06:06.843Z","updated":"2026-10-30T12:34:05.630Z","title":"Bluetooth: L2CAP: access chan->conn safely in get/setsockopt","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-90092","published":"2026-09-17T16:06:06.197Z","updated":"2026-10-19T08:57:50.446Z","title":"Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN","severity":"HIGH","score":8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00362,"kevAdded":null},{"id":"CVE-2026-90091","published":"2026-09-17T16:06:05.478Z","updated":"2026-10-19T08:57:49.423Z","title":"Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan","severity":"HIGH","score":8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00362,"kevAdded":null},{"id":"CVE-2026-90090","published":"2026-09-17T16:06:04.844Z","updated":"2026-10-19T08:57:48.356Z","title":"Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-90089","published":"2026-09-17T16:06:04.201Z","updated":"2026-10-19T08:57:47.078Z","title":"Bluetooth: btnxpuart: Validate the FW dump header length","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2026-90088","published":"2026-09-17T16:06:03.527Z","updated":"2026-10-19T08:57:45.766Z","title":"Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90087","published":"2026-09-17T16:06:02.872Z","updated":"2026-10-30T12:34:04.553Z","title":"Bluetooth: do not leak an hci_conn when a second LE connect is rejected","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90086","published":"2026-09-17T16:06:02.212Z","updated":"2026-10-21T12:49:45.759Z","title":"xsk: honor XDP_TX_METADATA in zero-copy path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-90085","published":"2026-09-17T16:06:01.525Z","updated":"2026-10-19T08:57:41.513Z","title":"octeontx2-af: fix NULL deref in NIX TM tree debugfs read path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-90084","published":"2026-09-17T16:06:00.839Z","updated":"2026-10-30T12:34:03.492Z","title":"octeontx2-vf: fix workqueue and netdev race in probe/remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90083","published":"2026-09-17T16:06:00.185Z","updated":"2026-10-30T12:34:02.434Z","title":"net/sched: act_ife: Only operate on Ethernet frames","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90082","published":"2026-09-17T16:05:59.532Z","updated":"2026-10-19T08:57:38.727Z","title":"net: mana: Cap MSI-X vectors to the device MSI-X table size","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90081","published":"2026-09-17T16:05:58.866Z","updated":"2026-10-19T08:57:37.791Z","title":"net/rds: use wq_has_sleeper() in rds_cong_map_updated()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90080","published":"2026-09-17T16:05:58.199Z","updated":"2026-10-19T08:57:36.840Z","title":"octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90079","published":"2026-09-17T16:05:57.541Z","updated":"2026-10-19T08:57:35.887Z","title":"octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90078","published":"2026-09-17T16:05:56.878Z","updated":"2026-10-19T08:57:34.924Z","title":"net/sched: act_skbmod: fix length calculations and avoid invalid header warnings","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-90077","published":"2026-09-17T16:05:56.226Z","updated":"2026-10-19T08:57:33.991Z","title":"net: fix a resource leak in copy_net_ns() error handling path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90076","published":"2026-09-17T16:05:55.517Z","updated":"2026-10-30T12:34:01.376Z","title":"net/sched: fq: add overflow bounds to quantum and initial quantum","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-90075","published":"2026-09-17T16:05:54.851Z","updated":"2026-10-19T08:57:32.110Z","title":"net/sched: fq_codel: clamp default quantum and mtu","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90074","published":"2026-09-17T16:05:54.214Z","updated":"2026-10-19T08:57:31.165Z","title":"net/sched: fq_pie: clamp default quantum to avoid signed overflow","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90073","published":"2026-09-17T16:05:53.562Z","updated":"2026-10-19T08:57:30.227Z","title":"net/sched: hhf: clamp quantum before hhf_change() to avoid overflow","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90072","published":"2026-09-17T16:05:52.905Z","updated":"2026-10-19T08:57:29.264Z","title":"net/sched: sfq: clamp quantum to avoid signed overflow soft lockup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90071","published":"2026-09-17T16:05:52.245Z","updated":"2026-10-19T08:57:28.331Z","title":"net/sched: sch_teql: restore skb->dev on the slave failure path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-90070","published":"2026-09-17T16:05:51.585Z","updated":"2026-10-19T08:57:27.372Z","title":"tpm: st33zp24: Return zero on status read failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90069","published":"2026-09-17T16:05:50.894Z","updated":"2026-10-19T08:57:26.441Z","title":"crypto: acomp - allocate async request context when cloning","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-90068","published":"2026-09-17T16:05:50.251Z","updated":"2026-10-19T08:57:25.478Z","title":"ASoC: dapm: Fix off-by-one check on the second enum channel","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90067","published":"2026-09-17T16:05:49.600Z","updated":"2026-10-19T08:57:24.503Z","title":"libceph: validate banner payload length","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0068,"kevAdded":null},{"id":"CVE-2026-90066","published":"2026-09-17T16:05:48.921Z","updated":"2026-10-30T12:34:00.306Z","title":"samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90065","published":"2026-09-17T16:05:48.269Z","updated":"2026-10-19T08:57:22.598Z","title":"net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-90064","published":"2026-09-17T16:05:47.607Z","updated":"2026-10-19T08:57:21.604Z","title":"drm/xe: Reject page faults from non-fault-mode scratch VMs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90063","published":"2026-09-17T16:05:46.968Z","updated":"2026-10-19T08:57:20.621Z","title":"virtio-net: Ensure that TCP packets don't overflow gso_segs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-90062","published":"2026-09-17T16:05:45.853Z","updated":"2026-10-19T08:57:19.597Z","title":"netfilter: nf_tables: move hardware offload step after building the chain blob","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-90061","published":"2026-09-17T16:05:45.182Z","updated":"2026-10-30T12:33:59.233Z","title":"netfilter: nf_tables: skip double clone set expressions on element insert","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90060","published":"2026-09-17T16:05:44.515Z","updated":"2026-10-21T12:49:38.739Z","title":"ALSA: control: Don't add invalid kcontrols to LED layer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-90059","published":"2026-09-17T16:05:43.855Z","updated":"2026-10-19T08:57:16.635Z","title":"net: stmmac: restore NET_IP_ALIGN in the RX DMA offset","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-90058","published":"2026-09-17T16:05:43.184Z","updated":"2026-10-19T08:57:15.626Z","title":"net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90057","published":"2026-09-17T16:05:41.670Z","updated":"2026-10-19T08:57:14.597Z","title":"slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-90056","published":"2026-09-17T16:05:41.003Z","updated":"2026-10-19T08:57:13.609Z","title":"net: fec: only stop PTP if it was initialized","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90055","published":"2026-09-17T16:05:40.304Z","updated":"2026-10-19T08:57:12.606Z","title":"usb: atm: usbatm: fix invalid ci_range initialization","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90054","published":"2026-09-17T16:05:39.632Z","updated":"2026-10-19T08:57:11.615Z","title":"tcp: fix corruption of urgent data on multi-segment retransmit","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90053","published":"2026-09-17T16:05:38.957Z","updated":"2026-10-19T08:57:10.615Z","title":"net/sched: sch_htb: limit htb_classify inner-class filter hops","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-90051","published":"2026-09-17T16:05:37.620Z","updated":"2026-10-19T08:57:09.627Z","title":"tcp: reject non zerocopy devmem tx","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-90049","published":"2026-09-16T10:33:45.259Z","updated":"2026-10-19T08:57:08.616Z","title":"net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-90048","published":"2026-09-16T10:33:44.538Z","updated":"2026-10-30T12:33:58.173Z","title":"fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00721,"kevAdded":null},{"id":"CVE-2026-90047","published":"2026-09-16T10:33:43.851Z","updated":"2026-10-19T08:57:06.434Z","title":"drm/xe: Don't hand out the flat CCS storage as usable VRAM","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-90046","published":"2026-09-16T10:33:43.156Z","updated":"2026-10-19T08:57:04.231Z","title":"mm/page_alloc: don't spin_trylock() in NMI on UP","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-90045","published":"2026-09-16T10:33:42.411Z","updated":"2026-10-30T12:33:57.106Z","title":"USB: gadget: ffs: fix mm lifetime handling","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-90044","published":"2026-09-16T10:33:41.695Z","updated":"2026-10-30T12:33:56.040Z","title":"usb: gadget: f_fs: Fix Use-After-Free in AIO error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-90043","published":"2026-09-16T10:33:40.907Z","updated":"2026-10-19T08:57:01.055Z","title":"zram: fix slot lock bit position on big-endian 64-bit","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-90042","published":"2026-09-16T10:33:40.210Z","updated":"2026-10-21T12:49:35.535Z","title":"ceph: properly decrypt filenames in vmalloc() buffers","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00502,"kevAdded":null},{"id":"CVE-2026-90041","published":"2026-09-16T10:33:39.499Z","updated":"2026-10-30T12:33:54.982Z","title":"HID: sony: clean up device list on probe failure","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00315,"kevAdded":null},{"id":"CVE-2026-90040","published":"2026-09-16T10:33:38.790Z","updated":"2026-10-19T08:56:57.861Z","title":"KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90039","published":"2026-09-16T10:33:38.091Z","updated":"2026-10-19T08:56:56.714Z","title":"NFSD: Guard admin state-revocation walks with NFSD_NET_UP","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-90038","published":"2026-09-16T10:33:37.366Z","updated":"2026-10-19T08:56:55.673Z","title":"NFSD: Prevent client use-after-free during export state revocation","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-90037","published":"2026-09-16T10:33:36.673Z","updated":"2026-10-30T12:33:53.924Z","title":"NFSD: Prevent client use-after-free during close_lru reaping","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-90036","published":"2026-09-16T10:33:35.967Z","updated":"2026-10-21T12:49:32.115Z","title":"NFSD: Prevent client use-after-free during blocked-lock reaping","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2026-90035","published":"2026-09-16T10:33:35.281Z","updated":"2026-10-19T08:56:52.337Z","title":"drm/amd/display: fix division by zero in get_estimated_bw()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-90034","published":"2026-09-16T10:33:34.586Z","updated":"2026-10-19T08:56:51.238Z","title":"usb: image: mdc800: change kmalloc() to kzalloc()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-90033","published":"2026-09-16T10:33:33.899Z","updated":"2026-10-19T08:56:50.205Z","title":"ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-90032","published":"2026-09-16T10:33:33.197Z","updated":"2026-10-19T08:56:49.082Z","title":"media: usbtv: keep device alive while ALSA card exists","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-90031","published":"2026-09-16T10:33:32.524Z","updated":"2026-10-19T08:56:48.010Z","title":"usb-storage: ene_ub6250: fix race between scan work and probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-90030","published":"2026-09-16T10:33:31.801Z","updated":"2026-10-21T12:49:31.009Z","title":"usb: dwc3: clear forceRM when issuing EndTransfer","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-90029","published":"2026-09-16T10:33:31.117Z","updated":"2026-10-30T12:33:52.606Z","title":"usb: storage: realtek_cr: fix use-after-free on disconnect","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90028","published":"2026-09-16T10:33:30.400Z","updated":"2026-10-19T08:56:44.782Z","title":"usb: typec: hd3ss3220: track VBUS enable state per consumer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90027","published":"2026-09-16T10:33:29.700Z","updated":"2026-10-19T08:56:43.664Z","title":"usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-90026","published":"2026-09-16T10:33:29.008Z","updated":"2026-10-19T08:56:42.448Z","title":"usb: typec: qcom-pmic: cancel reset_work on stop","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-90025","published":"2026-09-16T10:33:28.313Z","updated":"2026-10-19T08:56:39.915Z","title":"usb: typec: ucsi: displayport: Fix OOB altmode array index","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-90024","published":"2026-09-16T10:33:27.624Z","updated":"2026-10-19T08:56:38.894Z","title":"usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-90023","published":"2026-09-16T10:33:26.905Z","updated":"2026-10-30T12:33:51.550Z","title":"usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-90022","published":"2026-09-16T10:33:26.238Z","updated":"2026-10-19T08:56:35.790Z","title":"usb: gadget: f_midi2: fix use-after-free in string attribute show path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-90021","published":"2026-09-16T10:33:25.560Z","updated":"2026-10-30T12:33:50.484Z","title":"usb: gadget: f_midi: initialize work in f_midi_alloc()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-90020","published":"2026-09-16T10:33:24.866Z","updated":"2026-10-19T08:56:33.831Z","title":"USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-90019","published":"2026-09-16T10:33:24.173Z","updated":"2026-10-19T08:56:32.862Z","title":"usb: gadget: fix null pointer dereference in usb_put_function_instance()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90018","published":"2026-09-16T10:33:23.489Z","updated":"2026-10-19T08:56:31.878Z","title":"staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00447,"kevAdded":null},{"id":"CVE-2026-90017","published":"2026-09-16T10:33:22.827Z","updated":"2026-10-19T08:56:30.908Z","title":"staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2026-90016","published":"2026-09-16T10:33:22.148Z","updated":"2026-10-30T12:33:49.384Z","title":"staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00396,"kevAdded":null},{"id":"CVE-2026-90015","published":"2026-09-16T10:33:21.471Z","updated":"2026-10-19T08:56:28.983Z","title":"xhci: fix lost bounce buffers on TDs spanning several ring segments","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-90014","published":"2026-09-16T10:33:20.791Z","updated":"2026-10-19T08:56:28.002Z","title":"tracing: Have show_event_filters/triggers files take trace array ref","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-90013","published":"2026-09-16T10:33:20.136Z","updated":"2026-10-30T12:33:48.287Z","title":"tracing: Take trace_array reference when opening options file","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-90012","published":"2026-09-16T10:33:19.463Z","updated":"2026-10-19T08:56:26.039Z","title":"spi: Fix DMA mapping ownership on partial map failure","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00626,"kevAdded":null},{"id":"CVE-2026-90011","published":"2026-09-16T10:33:18.793Z","updated":"2026-10-19T08:56:25.054Z","title":"scsi: target: iscsi: Reserve a terminator byte for the login payload","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00841,"kevAdded":null},{"id":"CVE-2026-90010","published":"2026-09-16T10:33:18.118Z","updated":"2026-10-19T08:56:24.094Z","title":"scsi: bsg: Cap io_uring sense copy to max_response_len","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-90009","published":"2026-09-16T10:33:17.446Z","updated":"2026-10-19T08:56:23.130Z","title":"scsi: bsg: Fix TOCTOU in io_uring passthrough command setup","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-90008","published":"2026-09-16T10:33:16.772Z","updated":"2026-10-19T08:56:22.147Z","title":"scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-90007","published":"2026-09-16T10:33:16.098Z","updated":"2026-10-19T08:56:21.169Z","title":"scsi: pm8001: Use rollback index when freeing MSI-X vectors","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-90006","published":"2026-09-16T10:33:15.423Z","updated":"2026-10-19T08:56:20.156Z","title":"samples/damon/mtier: handle damon_stop() failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2026-90005","published":"2026-09-16T10:33:14.753Z","updated":"2026-10-19T08:56:19.196Z","title":"samples/damon/wsse: handle damon_start() failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-90004","published":"2026-09-16T10:33:14.085Z","updated":"2026-10-19T08:56:18.224Z","title":"mm/damon/core: handle region split failure in apply_min_nr_regions()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-90003","published":"2026-09-16T10:33:13.420Z","updated":"2026-10-19T08:56:17.256Z","title":"futex: Prevent rcuwait use-after-free during requeue PI","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-90002","published":"2026-09-16T10:33:12.734Z","updated":"2026-10-30T12:33:46.379Z","title":"ftrace: Take trace_array reference before accessing its ftrace_ops","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-90001","published":"2026-09-16T10:33:12.063Z","updated":"2026-10-19T08:56:15.260Z","title":"HID: bpf: serialize device reference release in struct_ops destroy path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-90000","published":"2026-09-16T10:33:11.380Z","updated":"2026-10-19T08:56:14.271Z","title":"HID: rmi: fix OOB access with undersized RMI reports","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00354,"kevAdded":null},{"id":"CVE-2026-89999","published":"2026-09-16T10:33:10.683Z","updated":"2026-10-19T08:56:13.267Z","title":"HID: wacom: validate report length in wacom_intuos_pro2_bt_irq","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2026-89998","published":"2026-09-16T10:33:10.012Z","updated":"2026-10-19T08:56:12.250Z","title":"dm: fix race when loading and unloading a table","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89997","published":"2026-09-16T10:33:09.302Z","updated":"2026-10-19T08:56:11.292Z","title":"dm: fix resume-vs-remove race","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-89996","published":"2026-09-16T10:33:08.620Z","updated":"2026-10-30T12:33:45.249Z","title":"dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-89995","published":"2026-09-16T10:33:07.962Z","updated":"2026-10-30T12:33:44.174Z","title":"dma-direct: return struct page from dma_direct_alloc_from_pool()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0035,"kevAdded":null},{"id":"CVE-2026-89994","published":"2026-09-16T10:33:07.292Z","updated":"2026-10-19T08:56:08.384Z","title":"dmaengine: fsl-edma: tracing: no ptr dereference during log output","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89993","published":"2026-09-16T10:33:06.611Z","updated":"2026-10-19T08:56:07.415Z","title":"dmaengine: dw-edma: Initialize IRQ data before requesting IRQs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-89992","published":"2026-09-16T10:33:05.925Z","updated":"2026-10-19T08:56:06.466Z","title":"cpuidle: dt_idle_genpd: kfree() the original name allocation","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-89991","published":"2026-09-16T10:33:05.097Z","updated":"2026-10-19T08:56:05.536Z","title":"bpf: Fix infinite loop in pcpu_freelist push with one possible CPU","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89990","published":"2026-09-16T10:33:04.371Z","updated":"2026-10-19T08:56:04.591Z","title":"ceph: lock mutex in ceph_mds_check_access()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00608,"kevAdded":null},{"id":"CVE-2026-89989","published":"2026-09-16T10:33:03.703Z","updated":"2026-10-19T08:56:03.599Z","title":"ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-89988","published":"2026-09-16T10:33:03.003Z","updated":"2026-10-30T12:33:43.080Z","title":"kprobes: Protect kprobe_blacklist with RCU","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89987","published":"2026-09-16T10:33:02.270Z","updated":"2026-10-30T12:33:41.932Z","title":"mm/huge_memory: transfer the pmd dirty bit to the folio on zap","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-89986","published":"2026-09-16T10:33:01.545Z","updated":"2026-10-19T08:56:00.678Z","title":"mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-89985","published":"2026-09-16T10:33:00.848Z","updated":"2026-10-19T08:55:59.716Z","title":"memcg: keep folio's objcg same as its node","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-89984","published":"2026-09-16T10:33:00.162Z","updated":"2026-10-19T08:55:58.750Z","title":"perf/x86/intel: Fix kernel address leakages in LBR stack","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89983","published":"2026-09-16T10:32:59.461Z","updated":"2026-10-19T08:55:57.766Z","title":"i2c: core: fix debugfs UAF on adapter removal","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-89982","published":"2026-09-16T10:32:58.747Z","updated":"2026-10-19T08:55:56.803Z","title":"i2c: mux: Fix channel node leak on adapter add failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89981","published":"2026-09-16T10:32:58.056Z","updated":"2026-10-19T08:55:55.850Z","title":"arm64: Don't read GMID_EL1 when MTE is disabled","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89980","published":"2026-09-16T10:32:57.355Z","updated":"2026-10-30T12:33:40.858Z","title":"ALSA: harmony: initialize locks before requesting IRQ","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-89979","published":"2026-09-16T10:32:56.643Z","updated":"2026-10-19T08:55:53.958Z","title":"ALSA: pcm: Fix race between non-atomic ops and trigger-start","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89978","published":"2026-09-16T10:32:55.928Z","updated":"2026-10-19T08:55:52.997Z","title":"accel/amdxdna: return early from a zero-length flush","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89977","published":"2026-09-16T10:32:55.212Z","updated":"2026-10-19T08:55:52.061Z","title":"accel/ethosu: check MMIO mapping errors in probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89976","published":"2026-09-16T10:32:54.518Z","updated":"2026-10-19T08:55:51.093Z","title":"accel/ethosu: fix job completion fence cleanup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89975","published":"2026-09-16T10:32:53.836Z","updated":"2026-10-30T12:33:39.796Z","title":"nvme-fabrics: fix DHCHAP secret leak on parse failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-89974","published":"2026-09-16T10:32:53.124Z","updated":"2026-10-19T08:55:49.156Z","title":"nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-89973","published":"2026-09-16T10:32:52.409Z","updated":"2026-10-19T08:55:48.143Z","title":"nvme-tcp: check the data direction of a C2HData PDU","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00615,"kevAdded":null},{"id":"CVE-2026-89972","published":"2026-09-16T10:32:51.701Z","updated":"2026-10-30T12:33:38.726Z","title":"nvme: add missing SRCU grace period in error path","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-89971","published":"2026-09-16T10:32:50.995Z","updated":"2026-10-19T08:55:46.135Z","title":"nvme: skip the zoned limits update if the zone info query failed","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00612,"kevAdded":null},{"id":"CVE-2026-89970","published":"2026-09-16T10:32:50.306Z","updated":"2026-10-19T08:55:43.826Z","title":"nvmet-auth: Synchronize timeout work during SQ teardown","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00803,"kevAdded":null},{"id":"CVE-2026-89969","published":"2026-09-16T10:32:49.603Z","updated":"2026-10-19T08:55:42.820Z","title":"nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-89968","published":"2026-09-16T10:32:48.852Z","updated":"2026-10-19T08:55:41.809Z","title":"nvmet-tcp: reject unsolicited H2CData PDUs","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0082,"kevAdded":null},{"id":"CVE-2026-89967","published":"2026-09-16T10:32:48.164Z","updated":"2026-10-19T08:55:40.822Z","title":"mm/migrate_device: avoid out-of-bounds writes for compound folios","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-89966","published":"2026-09-16T10:32:47.482Z","updated":"2026-10-19T08:55:39.844Z","title":"mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89965","published":"2026-09-16T10:32:46.769Z","updated":"2026-10-19T08:55:38.886Z","title":"nvdimm/btt: reject an arena whose nfree is below the lane count","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89964","published":"2026-09-16T10:32:46.078Z","updated":"2026-10-19T08:55:37.917Z","title":"parisc: eisa: Fix infinite loop when parsing invalid IRQ value","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-89963","published":"2026-09-16T10:32:45.336Z","updated":"2026-10-19T08:55:36.947Z","title":"powerpc/kexec_file: Fix null-ptr-def in extra size calculation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-89962","published":"2026-09-16T10:32:44.623Z","updated":"2026-10-30T12:33:37.662Z","title":"powerpc/kexec_file: Prevent kexec range truncation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-89961","published":"2026-09-16T10:32:43.921Z","updated":"2026-10-19T08:55:35.034Z","title":"powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-89960","published":"2026-09-16T10:32:42.618Z","updated":"2026-10-30T12:33:36.599Z","title":"s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-89959","published":"2026-09-16T10:32:41.908Z","updated":"2026-10-19T08:55:33.075Z","title":"s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89958","published":"2026-09-16T10:32:41.239Z","updated":"2026-10-30T12:33:35.536Z","title":"s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-89957","published":"2026-09-16T10:32:40.546Z","updated":"2026-10-19T08:55:31.145Z","title":"s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-89956","published":"2026-09-16T10:32:39.847Z","updated":"2026-10-30T12:33:34.479Z","title":"s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-89955","published":"2026-09-16T10:32:39.064Z","updated":"2026-10-30T12:33:33.417Z","title":"s390/vfio-ap: Fix NULL deref in status_show() during queue probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-89954","published":"2026-09-16T10:32:38.355Z","updated":"2026-10-19T08:55:28.240Z","title":"mtd: afs: validate v2 image info bounds","severity":"HIGH","score":8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-89953","published":"2026-09-16T10:32:37.676Z","updated":"2026-10-19T08:55:27.271Z","title":"mtd: mtdoops: free page bitmap when the backing MTD is removed","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89952","published":"2026-09-16T10:32:36.910Z","updated":"2026-10-19T08:55:26.302Z","title":"mtd: rawnand: validate ONFI extended parameter page sections","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89951","published":"2026-09-16T10:32:36.179Z","updated":"2026-10-19T08:55:25.323Z","title":"batman-adv: fix stale receive device on merged fragments","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00354,"kevAdded":null},{"id":"CVE-2026-89950","published":"2026-09-16T10:32:35.485Z","updated":"2026-10-19T08:55:24.361Z","title":"batman-adv: mcast: linearize skbuff for packet generation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-89949","published":"2026-09-16T10:32:34.794Z","updated":"2026-10-19T08:55:23.408Z","title":"batman-adv: dat: avoid unaligned fault in IP extraction","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89948","published":"2026-09-16T10:32:34.089Z","updated":"2026-10-19T08:55:22.451Z","title":"batman-adv: bla: fix freeing of claims on meshif deletion","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89947","published":"2026-09-16T10:32:33.387Z","updated":"2026-10-19T08:55:21.465Z","title":"clk: meson: align gxbb_32k_clk_sel number of parents with actual count","severity":"HIGH","score":8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-89946","published":"2026-09-16T10:32:32.675Z","updated":"2026-10-19T08:55:20.503Z","title":"ASoC: cs35l33: drain threaded IRQ before runtime suspend","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-89945","published":"2026-09-16T10:32:31.951Z","updated":"2026-10-19T08:55:19.518Z","title":"ASoC: cs35l34: drain threaded IRQ before runtime suspend","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89944","published":"2026-09-16T10:32:31.253Z","updated":"2026-10-30T12:33:32.358Z","title":"ASoC: hdac_hda: Fix hlink refcount leak on component registration failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89943","published":"2026-09-16T10:32:30.527Z","updated":"2026-10-19T08:55:17.585Z","title":"ASoC: loongson: Fix error handling in ACPI property parsing","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-89942","published":"2026-09-16T10:32:29.836Z","updated":"2026-10-19T08:55:16.630Z","title":"iio: buffer: Fix potential use-after-free in anonymous buffer release","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-89941","published":"2026-09-16T10:32:29.148Z","updated":"2026-10-19T08:55:15.605Z","title":"iio: buffer: Make IIO DMA fence release RCU-safe","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-89940","published":"2026-09-16T10:32:28.395Z","updated":"2026-10-19T08:55:14.651Z","title":"iio: buffer: Tie IIO dma fence lock lifetime to the fence","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-89939","published":"2026-09-16T10:32:27.704Z","updated":"2026-10-19T08:55:13.701Z","title":"iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89938","published":"2026-09-16T10:32:27.012Z","updated":"2026-10-19T08:55:12.734Z","title":"iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-89937","published":"2026-09-16T10:32:26.316Z","updated":"2026-10-19T08:55:11.756Z","title":"iio: chemical: sgp30: Handle IAQ thread creation failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-89936","published":"2026-09-16T10:32:25.608Z","updated":"2026-10-19T08:55:10.788Z","title":"iio: dac: m62332: Fix regulator reference count imbalance","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89935","published":"2026-09-16T10:32:24.921Z","updated":"2026-10-19T08:55:09.815Z","title":"iio: light: apds9306: fix PM reference leak in apds9306_read_data()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89934","published":"2026-09-16T10:32:24.240Z","updated":"2026-10-30T12:33:31.290Z","title":"iio: light: ltrf216a: fix runtime PM reference leak in error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-89933","published":"2026-09-16T10:32:23.550Z","updated":"2026-10-30T12:33:30.220Z","title":"iio: pressure: dps310: fix NULL pointer dereference on ACPI probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-89932","published":"2026-09-16T10:32:22.886Z","updated":"2026-10-19T08:55:06.898Z","title":"KVM: nVMX: Always flush vpid02 on first use","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89931","published":"2026-09-16T10:32:22.202Z","updated":"2026-10-19T08:55:05.944Z","title":"KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89930","published":"2026-09-16T10:32:21.535Z","updated":"2026-10-30T12:33:29.160Z","title":"KVM: nVMX: Service local TLB flushes on failed nested VM-Enter","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-89929","published":"2026-09-16T10:32:20.855Z","updated":"2026-10-21T12:49:11.793Z","title":"KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-89928","published":"2026-09-16T10:32:20.173Z","updated":"2026-10-19T08:55:03.077Z","title":"KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-89927","published":"2026-09-16T10:32:19.473Z","updated":"2026-10-19T08:55:02.078Z","title":"KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-89926","published":"2026-09-16T10:32:18.785Z","updated":"2026-10-30T12:33:28.105Z","title":"KVM: s390: Fix length check __import_wp_info()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-89925","published":"2026-09-16T10:32:18.111Z","updated":"2026-10-19T08:55:00.155Z","title":"KVM: s390: Fix memory leak in guest debug handling","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-89924","published":"2026-09-16T10:32:17.442Z","updated":"2026-10-19T08:54:59.186Z","title":"KVM: s390: Fix old_data leak in guest debug error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89923","published":"2026-09-16T10:32:16.765Z","updated":"2026-10-19T08:54:58.219Z","title":"KVM: s390: Free guest debug data on vcpu destroy","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-89922","published":"2026-09-16T10:32:16.110Z","updated":"2026-10-19T08:54:57.247Z","title":"KVM: s390: Take srcu when importing watchpoint data","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-89921","published":"2026-09-16T10:32:15.413Z","updated":"2026-10-30T12:33:27.039Z","title":"KVM: s390: Zero initialize data structures for inject_pfault_token","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-89920","published":"2026-09-16T10:32:14.735Z","updated":"2026-10-30T12:33:25.963Z","title":"KVM: s390: Fix memory corruption by not reinjecting CK machine checks","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-89919","published":"2026-09-16T10:32:14.013Z","updated":"2026-10-19T08:54:53.667Z","title":"KVM: s390: keyop: use mmu_lock to read gmap->asce","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-89918","published":"2026-09-16T10:32:13.304Z","updated":"2026-10-19T08:54:52.658Z","title":"KVM: arm64: Correctly handle end of VA space TLBI invalidation","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-89917","published":"2026-09-16T10:32:12.629Z","updated":"2026-10-19T08:54:51.694Z","title":"KVM: arm64: Handle VNCR TLB invalidation race with vcpu_put() VNCR unmapping","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89916","published":"2026-09-16T10:32:11.967Z","updated":"2026-10-19T08:54:49.796Z","title":"KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-89915","published":"2026-09-16T10:32:11.309Z","updated":"2026-10-19T08:54:48.826Z","title":"KVM: arm64: Remove VM-wide VNCR mapping counter","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-89914","published":"2026-09-16T10:32:10.631Z","updated":"2026-10-19T08:54:47.824Z","title":"KVM: arm64: Sign-extend VA for range-based TLBI invalidation","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-89913","published":"2026-09-16T10:32:09.947Z","updated":"2026-10-21T12:49:08.468Z","title":"KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-89912","published":"2026-09-16T10:32:09.272Z","updated":"2026-10-30T12:33:24.892Z","title":"KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-89911","published":"2026-09-16T10:32:08.598Z","updated":"2026-10-19T08:54:44.772Z","title":"KVM: arm64: Correctly cap TLBI Range to the architural limit","severity":"HIGH","score":7.9,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-89910","published":"2026-09-16T10:32:07.951Z","updated":"2026-10-19T08:54:43.786Z","title":"LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2026-89909","published":"2026-09-16T10:32:07.278Z","updated":"2026-10-19T08:54:42.797Z","title":"LoongArch: KVM: Free init resources if kvm_init() fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-89908","published":"2026-09-16T10:32:06.599Z","updated":"2026-10-19T08:54:40.893Z","title":"LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-89907","published":"2026-09-16T10:32:05.925Z","updated":"2026-10-19T08:54:39.939Z","title":"LoongArch: KVM: Validate MSI data before routing it to EIOINTC","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89906","published":"2026-09-16T10:32:05.157Z","updated":"2026-10-21T12:49:06.262Z","title":"LoongArch: BPF: Refactor jump offset calculation in tail call","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-89905","published":"2026-09-16T10:32:04.470Z","updated":"2026-10-19T08:54:37.983Z","title":"LoongArch: BPF: Move arena register slot below TCC context","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89904","published":"2026-09-16T10:32:03.752Z","updated":"2026-10-19T08:54:37.029Z","title":"LoongArch: Fix acpi_package_ids[] array overflow","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-89903","published":"2026-09-16T10:32:03.038Z","updated":"2026-10-19T08:54:36.064Z","title":"LoongArch: Do not save/restore percpu base register in rethook trampoline","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-89902","published":"2026-09-16T10:32:01.655Z","updated":"2026-10-19T08:54:35.100Z","title":"LoongArch: Avoid preempt count underflow without probe","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-89901","published":"2026-09-16T10:32:00.997Z","updated":"2026-10-19T08:54:34.110Z","title":"media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-89900","published":"2026-09-16T10:32:00.289Z","updated":"2026-10-19T08:54:33.144Z","title":"media: cec: core: Fix kmemleak due to missed rc_free_device() call","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-89899","published":"2026-09-16T10:31:59.589Z","updated":"2026-10-19T08:54:32.139Z","title":"media: cec: disable delayed work before freeing an interrupted transmit","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-89898","published":"2026-09-16T10:31:58.901Z","updated":"2026-10-19T08:54:31.163Z","title":"media: cec: extron-da-hd-4k-plus: add sanity check","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00379,"kevAdded":null},{"id":"CVE-2026-89897","published":"2026-09-16T10:31:58.184Z","updated":"2026-10-19T08:54:30.169Z","title":"media: cec: Serialize exclusive follower delivery","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00307,"kevAdded":null},{"id":"CVE-2026-89896","published":"2026-09-16T10:31:57.504Z","updated":"2026-10-19T08:54:29.201Z","title":"media: cedrus: fix memory leak in cedrus_init_ctrls()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-89895","published":"2026-09-16T10:31:56.817Z","updated":"2026-10-19T08:54:28.227Z","title":"media: cobalt: Avoid freeing ALSA private data twice","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89894","published":"2026-09-16T10:31:56.101Z","updated":"2026-10-19T08:54:27.208Z","title":"media: cx231xx: reject geometry changes while the VBI queue is busy","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89893","published":"2026-09-16T10:31:55.374Z","updated":"2026-10-19T08:54:26.213Z","title":"media: cx23885: cancel NetUP CI work before teardown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89892","published":"2026-09-16T10:31:54.665Z","updated":"2026-10-19T08:54:25.221Z","title":"media: em28xx: defer audio-only extension registration","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89891","published":"2026-09-16T10:31:53.963Z","updated":"2026-10-19T08:54:24.249Z","title":"media: em28xx: fix use-after-free of dev_next->devlist on disconnect","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89890","published":"2026-09-16T10:31:53.276Z","updated":"2026-10-19T08:54:23.263Z","title":"media: go7007: defer the ALSA v4l2 put until card release","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89889","published":"2026-09-16T10:31:52.597Z","updated":"2026-10-19T08:54:22.304Z","title":"media: i2c: imx415: Release runtime PM reference on VBLANK error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89888","published":"2026-09-16T10:31:51.892Z","updated":"2026-10-19T08:54:21.332Z","title":"media: i2c: ov02a10: fix endpoint parsing use-after-free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-89887","published":"2026-09-16T10:31:51.195Z","updated":"2026-10-19T08:54:20.308Z","title":"media: i2c: ov7740: fix use-after-destroy in remove","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89886","published":"2026-09-16T10:31:50.497Z","updated":"2026-10-19T08:54:19.350Z","title":"media: intel/ipu6: fix async notifier cleanup leak on parse error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-89885","published":"2026-09-16T10:31:49.746Z","updated":"2026-10-19T08:54:18.396Z","title":"media: platform: mtk-mdp3: Fix SCP device refcounting","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-89884","published":"2026-09-16T10:31:49.063Z","updated":"2026-10-30T12:33:23.831Z","title":"media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-89883","published":"2026-09-16T10:31:48.378Z","updated":"2026-10-19T08:54:16.454Z","title":"media: rc: sunxi-cir: Unregister rc device on probe failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89882","published":"2026-09-16T10:31:47.644Z","updated":"2026-10-19T08:54:15.482Z","title":"media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-89881","published":"2026-09-16T10:31:46.966Z","updated":"2026-10-19T08:54:14.095Z","title":"media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89880","published":"2026-09-16T10:31:46.260Z","updated":"2026-10-19T08:54:13.058Z","title":"media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89879","published":"2026-09-16T10:31:45.564Z","updated":"2026-10-19T08:54:12.050Z","title":"media: s2255: bound JPEG frame size before copying into the buffer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89878","published":"2026-09-16T10:31:44.876Z","updated":"2026-10-19T08:54:11.089Z","title":"media: s2255: check firmware size before reading trailing marker","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89877","published":"2026-09-16T10:31:44.194Z","updated":"2026-10-30T12:33:22.773Z","title":"media: saa7164: fix cleanup on resource allocation failure","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-89876","published":"2026-09-16T10:31:43.473Z","updated":"2026-10-19T08:54:09.158Z","title":"media: tda18250: fix possible integer overflow","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89875","published":"2026-09-16T10:31:42.777Z","updated":"2026-10-19T08:54:08.215Z","title":"media: ti: vpe: quiesce overflow recovery before freeing streams","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-89874","published":"2026-09-16T10:31:42.054Z","updated":"2026-10-19T08:54:07.245Z","title":"media: v4l2-async: avoid deleting unlinked ASC entry on link error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89873","published":"2026-09-16T10:31:41.341Z","updated":"2026-10-19T08:54:06.310Z","title":"media: v4l2-ctrls: validate HEVC EXT SPS RPS counts","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-89872","published":"2026-09-16T10:31:40.647Z","updated":"2026-10-19T08:54:05.348Z","title":"media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89871","published":"2026-09-16T10:31:39.961Z","updated":"2026-10-19T08:54:04.386Z","title":"media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89870","published":"2026-09-16T10:31:39.271Z","updated":"2026-10-30T12:33:21.701Z","title":"media: zoran: Avoid freeing a registered video_device twice","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89869","published":"2026-09-16T10:31:38.572Z","updated":"2026-10-19T08:54:02.427Z","title":"media: qcom: iris: use disable_irq() during power-off","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89868","published":"2026-09-16T10:31:37.872Z","updated":"2026-10-19T08:54:01.483Z","title":"media: chips-media: wave5: Add timeout while stop_streaming","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89867","published":"2026-09-16T10:31:37.185Z","updated":"2026-10-19T08:54:00.501Z","title":"media: chips-media: wave5: Defer job_finish() only when a DEC_PIC was queued","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89866","published":"2026-09-16T10:31:36.480Z","updated":"2026-10-19T08:53:59.539Z","title":"media: chips-media: wave5: Resume device before setting EOS flag","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89865","published":"2026-09-16T10:31:35.758Z","updated":"2026-10-19T08:53:58.579Z","title":"scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89864","published":"2026-09-16T10:31:35.068Z","updated":"2026-10-19T08:53:57.594Z","title":"scsi: qla2xxx: Bound i2c->length in I2C bsg handlers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89863","published":"2026-09-16T10:31:34.377Z","updated":"2026-10-19T08:53:56.648Z","title":"scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0068,"kevAdded":null},{"id":"CVE-2026-89862","published":"2026-09-16T10:31:33.698Z","updated":"2026-10-19T08:53:55.681Z","title":"scsi: qla2xxx: Fix BSG job leak on validate flash image error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-89861","published":"2026-09-16T10:31:32.987Z","updated":"2026-10-19T08:53:53.884Z","title":"scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00587,"kevAdded":null},{"id":"CVE-2026-89860","published":"2026-09-16T10:31:32.263Z","updated":"2026-10-30T12:33:20.624Z","title":"scsi: qla2xxx: Initialize NVMe abort_work once at submission","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-89859","published":"2026-09-16T10:31:31.554Z","updated":"2026-10-30T12:33:19.549Z","title":"scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-89858","published":"2026-09-16T10:31:30.876Z","updated":"2026-10-19T08:53:50.969Z","title":"scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89857","published":"2026-09-16T10:31:30.193Z","updated":"2026-10-19T08:53:49.961Z","title":"scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00618,"kevAdded":null},{"id":"CVE-2026-89856","published":"2026-09-16T10:31:29.517Z","updated":"2026-10-19T08:53:48.987Z","title":"scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-89855","published":"2026-09-16T10:31:28.836Z","updated":"2026-10-19T08:53:48.034Z","title":"scsi: qla2xxx: Serialize flash version read in reset handler","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89854","published":"2026-09-16T10:31:27.906Z","updated":"2026-10-19T08:53:47.075Z","title":"scsi: qla2xxx: Fix cs84xx use-after-free on host teardown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-89853","published":"2026-09-16T10:31:27.008Z","updated":"2026-10-19T08:53:46.098Z","title":"scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89852","published":"2026-09-16T10:31:26.012Z","updated":"2026-10-19T08:53:45.110Z","title":"scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89851","published":"2026-09-16T10:31:25.069Z","updated":"2026-10-19T08:53:44.152Z","title":"scsi: qla2xxx: Fix FCE trace enable parsing in debugfs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89850","published":"2026-09-16T10:31:24.121Z","updated":"2026-10-19T08:53:43.182Z","title":"scsi: qla2xxx: Don't query firmware state while chip is down","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89849","published":"2026-09-16T10:31:23.180Z","updated":"2026-10-19T08:53:42.181Z","title":"scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00363,"kevAdded":null},{"id":"CVE-2026-89848","published":"2026-09-16T10:31:22.197Z","updated":"2026-10-30T12:33:18.481Z","title":"scsi: qla2xxx: Quiesce response IRQ before freeing request queue","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00587,"kevAdded":null},{"id":"CVE-2026-89847","published":"2026-09-16T10:31:21.286Z","updated":"2026-10-19T08:53:40.165Z","title":"scsi: qla2xxx: Avoid double completion in async IOCB timeout","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00694,"kevAdded":null},{"id":"CVE-2026-89846","published":"2026-09-16T10:31:20.306Z","updated":"2026-10-19T08:53:39.169Z","title":"scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-89845","published":"2026-09-16T10:31:19.374Z","updated":"2026-10-19T08:53:38.186Z","title":"scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89844","published":"2026-09-16T10:31:18.439Z","updated":"2026-10-19T08:53:37.236Z","title":"scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-89843","published":"2026-09-16T10:31:17.474Z","updated":"2026-10-19T08:53:36.264Z","title":"scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89842","published":"2026-09-16T10:31:16.544Z","updated":"2026-10-19T08:53:35.290Z","title":"scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89841","published":"2026-09-16T10:31:15.578Z","updated":"2026-10-19T08:53:34.362Z","title":"f2fs: only redirty pinned folios in redirty_blocks","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89840","published":"2026-09-16T10:31:14.646Z","updated":"2026-10-30T12:33:17.413Z","title":"f2fs: validate MOVE_RANGE destination size","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-89839","published":"2026-09-16T10:31:13.727Z","updated":"2026-10-19T08:53:32.430Z","title":"f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-89838","published":"2026-09-16T10:31:12.746Z","updated":"2026-10-30T12:33:16.337Z","title":"f2fs: limit recovery filename logging to stored length","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-89837","published":"2026-09-16T10:31:11.557Z","updated":"2026-10-30T12:33:15.238Z","title":"f2fs: fix dentry folio leak in find_in_level","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-89836","published":"2026-09-16T10:31:10.233Z","updated":"2026-10-19T08:53:29.553Z","title":"f2fs: fix folio_nr_pages() race after put in large folio invalidate","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-89835","published":"2026-09-16T10:31:08.636Z","updated":"2026-10-30T12:33:14.173Z","title":"f2fs: avoid NULL checkpoint thread access in sysfs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-89834","published":"2026-09-16T10:31:07.093Z","updated":"2026-10-30T12:33:13.082Z","title":"f2fs: fix to migrate all curseg types during free_segment_range","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-89833","published":"2026-09-16T10:31:05.680Z","updated":"2026-10-30T12:33:12.025Z","title":"f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-89832","published":"2026-09-16T10:31:04.691Z","updated":"2026-10-30T12:33:10.966Z","title":"f2fs: fix to clear dirty flag on folio in error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89831","published":"2026-09-16T10:31:03.702Z","updated":"2026-10-19T08:53:24.792Z","title":"f2fs: protect critical_task_priority updates with s_umount","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89830","published":"2026-09-16T10:31:02.688Z","updated":"2026-10-19T08:53:23.860Z","title":"f2fs: fix valid block count leak on data block allocation failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-89829","published":"2026-09-16T10:31:01.761Z","updated":"2026-10-19T08:53:22.927Z","title":"f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89828","published":"2026-09-16T10:31:00.827Z","updated":"2026-10-19T08:53:21.989Z","title":"drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-89827","published":"2026-09-16T10:30:59.419Z","updated":"2026-10-21T12:48:54.673Z","title":"drm/amdgpu: avoid force-completing uninitialized UVD rings","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89826","published":"2026-09-16T10:30:58.435Z","updated":"2026-10-19T08:53:20.074Z","title":"drm/panthor: harden firmware build-info bounds checks","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-89825","published":"2026-09-16T10:30:57.497Z","updated":"2026-10-19T08:53:19.123Z","title":"drm/panthor: fix firmware control interface bounds checks","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-89824","published":"2026-09-16T10:30:56.587Z","updated":"2026-10-19T08:53:18.168Z","title":"drm/panel-edp: fix i2c adapter leak on probe failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89823","published":"2026-09-16T10:30:55.534Z","updated":"2026-10-19T08:53:17.224Z","title":"drm: fix race between partial drm_dev_register() failure and ioctl","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89822","published":"2026-09-16T10:30:54.573Z","updated":"2026-10-19T08:53:16.228Z","title":"drm/i915: Guard against NULL driver_data in i915_pci_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-89821","published":"2026-09-16T10:30:53.689Z","updated":"2026-10-19T08:53:15.267Z","title":"drm/amd/display: avoid divide-by-zero in __is_lut_linear()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89820","published":"2026-09-16T10:30:52.803Z","updated":"2026-10-19T08:53:14.297Z","title":"drm/amd/display: fix dc_lock leak on GPU reset error paths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89819","published":"2026-09-16T10:30:51.898Z","updated":"2026-10-19T08:53:13.333Z","title":"drm/amd/display: validate plane degamma LUT size for private color prop","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-89818","published":"2026-09-16T10:30:50.946Z","updated":"2026-10-19T08:53:12.347Z","title":"drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-89817","published":"2026-09-16T10:30:49.977Z","updated":"2026-10-19T08:53:11.379Z","title":"drm/gud: NUL-terminate TV mode names read from the device","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-89816","published":"2026-09-16T10:30:49.052Z","updated":"2026-10-19T08:53:10.436Z","title":"drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89815","published":"2026-09-16T10:30:48.133Z","updated":"2026-10-19T08:53:09.454Z","title":"drm/ttm: Drop tt->restore after successful restore","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89814","published":"2026-09-16T10:30:47.167Z","updated":"2026-10-19T08:53:08.487Z","title":"drm/amdgpu: clamp the isolation index for rings outside a partition","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89813","published":"2026-09-16T10:30:46.201Z","updated":"2026-10-30T12:33:09.910Z","title":"drm/amdgpu: force complete the KIQ ring fences on reset","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-89812","published":"2026-09-16T10:30:45.246Z","updated":"2026-10-21T12:48:52.492Z","title":"drm/amdgpu: force complete the MES ring fences on reset","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-89811","published":"2026-09-16T10:30:44.274Z","updated":"2026-10-30T12:33:08.863Z","title":"drm/amdkfd: Add TLB flush after MES queue eviction/suspension","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-89810","published":"2026-09-16T10:30:43.350Z","updated":"2026-10-30T12:33:07.807Z","title":"drm/amdkfd: Fix error path at svm_migrate_copy_to_ram","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-89809","published":"2026-09-16T10:30:42.445Z","updated":"2026-10-19T08:53:03.694Z","title":"drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89808","published":"2026-09-16T10:30:41.508Z","updated":"2026-10-30T12:33:06.729Z","title":"drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-89807","published":"2026-09-16T10:30:40.572Z","updated":"2026-10-19T08:53:01.788Z","title":"drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-89806","published":"2026-09-16T10:30:39.548Z","updated":"2026-10-21T12:48:48.055Z","title":"drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-89805","published":"2026-09-16T10:30:38.606Z","updated":"2026-10-19T08:52:59.787Z","title":"drm/pagemap: Fix folio allocation fallback and use-after-put","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-89804","published":"2026-09-16T10:30:37.638Z","updated":"2026-10-19T08:52:58.820Z","title":"drm/nouveau/dmem: fix mismatched DMA unmap size for large folios","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-89803","published":"2026-09-16T10:30:36.738Z","updated":"2026-10-30T12:33:05.661Z","title":"drm/nouveau: unsubscribe the channel-kill event before the fence context","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-89802","published":"2026-09-16T10:30:35.738Z","updated":"2026-10-21T12:48:45.811Z","title":"drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-89801","published":"2026-09-16T10:30:34.458Z","updated":"2026-10-19T08:52:55.925Z","title":"drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-89800","published":"2026-09-16T10:30:33.097Z","updated":"2026-10-19T08:52:54.946Z","title":"drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-89799","published":"2026-09-16T10:30:31.487Z","updated":"2026-10-30T12:33:04.585Z","title":"bpf: Disable preemption in bpf_get_stackid","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-89798","published":"2026-09-16T10:30:29.930Z","updated":"2026-10-19T08:52:52.994Z","title":"rpcrdma: arm rn_done before publishing the notification","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89797","published":"2026-09-16T10:30:28.484Z","updated":"2026-10-19T08:52:52.019Z","title":"power: supply: ab8500_fg: fix use-after-free on remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89796","published":"2026-09-16T10:30:27.478Z","updated":"2026-10-19T08:52:51.066Z","title":"mm/damon/core: avoid infinite kdamond_merge_regions() internal loop","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-89795","published":"2026-09-16T10:30:26.529Z","updated":"2026-10-30T12:33:03.457Z","title":"PCI: Allow per function PCI slots to fix slot reset on s390","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-89794","published":"2026-09-16T10:30:25.592Z","updated":"2026-10-30T12:33:02.393Z","title":"ksmbd: zero pipe read compound padding","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-89793","published":"2026-09-16T09:54:33.678Z","updated":"2026-10-19T08:52:48.148Z","title":"ublk: clear VM_MAYWRITE on read-only ublk char device mmap","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-89792","published":"2026-09-16T08:50:06.516Z","updated":"2026-10-19T08:52:47.159Z","title":"ksmbd: prevent out-of-bounds reads in share config responses","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-89791","published":"2026-09-16T08:48:27.020Z","updated":"2026-10-19T08:52:45.122Z","title":"perf: Fix use-after-free when perf mmap() revival races with the last munmap()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-89790","published":"2026-09-16T08:48:26.343Z","updated":"2026-10-19T08:52:44.129Z","title":"ipv6: avoid divide by zero in rt6_multipath_rebalance","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89789","published":"2026-09-16T08:48:25.689Z","updated":"2026-10-19T08:52:43.083Z","title":"gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-89788","published":"2026-09-16T08:48:25.049Z","updated":"2026-10-30T12:33:01.334Z","title":"ksmbd: fix tree connection use-after-free in smb2_tree_connect()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00652,"kevAdded":null},{"id":"CVE-2026-89787","published":"2026-09-16T08:48:24.403Z","updated":"2026-10-19T08:52:40.961Z","title":"ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-89786","published":"2026-09-16T08:48:23.730Z","updated":"2026-10-19T08:52:39.655Z","title":"ext4: fix out-of-bounds read in ext4_read_inline_dir()","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00697,"kevAdded":null},{"id":"CVE-2026-89785","published":"2026-09-16T08:48:23.084Z","updated":"2026-10-19T08:52:38.323Z","title":"fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-89784","published":"2026-09-16T08:48:22.404Z","updated":"2026-10-19T08:52:36.983Z","title":"SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89783","published":"2026-09-16T08:48:21.761Z","updated":"2026-10-19T08:52:35.697Z","title":"xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-89782","published":"2026-09-16T08:48:21.093Z","updated":"2026-10-19T08:52:34.456Z","title":"fs/ntfs3: reject restart table growth beyond U16_MAX entries","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-89781","published":"2026-09-16T08:48:20.425Z","updated":"2026-10-19T08:52:33.476Z","title":"fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-89780","published":"2026-09-16T08:48:19.760Z","updated":"2026-10-19T08:52:32.479Z","title":"net: qualcomm: rmnet: restore skb->dev on deaggregated frames","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89779","published":"2026-09-16T08:48:19.083Z","updated":"2026-10-19T08:52:31.490Z","title":"fs/ntfs3: validate ef->size covers the record's name and value","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00697,"kevAdded":null},{"id":"CVE-2026-89778","published":"2026-09-16T08:48:18.407Z","updated":"2026-10-19T08:52:30.510Z","title":"isofs: fix out-of-bounds page array access on empty zisofs block","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00697,"kevAdded":null},{"id":"CVE-2026-89777","published":"2026-09-16T08:48:17.754Z","updated":"2026-10-19T08:52:29.546Z","title":"vfio/pci: clear vdev->msi_perm after freeing it on init failure","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-89776","published":"2026-09-16T08:48:17.084Z","updated":"2026-10-19T08:52:28.559Z","title":"vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-89775","published":"2026-09-16T08:39:16.109Z","updated":"2026-10-19T08:52:27.588Z","title":"KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2026-89774","published":"2026-09-16T08:24:21.248Z","updated":"2026-09-16T14:38:26.042Z","title":"Bluetooth: SCO: hold sk properly in sco_conn_ready","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2026-89773","published":"2026-09-11T19:47:11.855Z","updated":"2026-10-19T08:52:26.631Z","title":"drm/amd/display: Skip Update HDCP Config In Transition State","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89772","published":"2026-09-11T19:47:11.125Z","updated":"2026-10-19T08:52:25.691Z","title":"btrfs: write-protect folios during data writeback","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89771","published":"2026-09-11T19:47:10.381Z","updated":"2026-10-19T08:52:24.715Z","title":"ring-buffer: Fix subbuf resize race with ring buffer readers","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-89770","published":"2026-09-11T19:47:09.630Z","updated":"2026-10-19T08:52:23.735Z","title":"iomap: don't free integrity payload that doesn't exist","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89769","published":"2026-09-11T19:47:08.870Z","updated":"2026-10-19T08:52:22.773Z","title":"clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path","severity":"HIGH","score":7.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-89768","published":"2026-09-11T19:47:08.119Z","updated":"2026-10-19T08:52:21.786Z","title":"fs: fix user path of nested backing files","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-89767","published":"2026-09-11T19:47:07.353Z","updated":"2026-10-19T08:52:20.802Z","title":"ovl: fix double end_creating() on the casefold-mismatch path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89766","published":"2026-09-11T19:47:06.597Z","updated":"2026-10-19T08:52:19.816Z","title":"pidfd: hold exec_update_lock around namespace ioctl","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-89765","published":"2026-09-11T19:47:05.851Z","updated":"2026-10-19T08:52:18.849Z","title":"timers/itimer: Zero-init old itimerval before copy to userspace","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-89764","published":"2026-09-11T19:47:05.092Z","updated":"2026-10-19T08:52:17.882Z","title":"rust: devres: fix race between concurrent revokers","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-89763","published":"2026-09-11T19:47:04.352Z","updated":"2026-10-30T12:33:00.263Z","title":"KEYS: trusted: Fix TPM teardown ordering","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-89762","published":"2026-09-11T19:47:03.601Z","updated":"2026-10-30T12:32:59.196Z","title":"apparmor: fix cred UAF caused by begin_current_label_crit_section()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-89761","published":"2026-09-11T19:47:02.837Z","updated":"2026-10-30T12:32:58.134Z","title":"apparmor: fix out-of-bounds write when null terminating a label vec","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-89760","published":"2026-09-11T19:47:02.090Z","updated":"2026-10-19T08:52:13.808Z","title":"mm, swap: don't free a hibernation slot that is in the swap cache","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-89759","published":"2026-09-11T19:47:01.313Z","updated":"2026-10-30T12:32:57.075Z","title":"mm/kmemleak: avoid soft lockup when scanning task stacks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89758","published":"2026-09-11T19:47:00.562Z","updated":"2026-10-19T08:52:11.845Z","title":"mm/mempolicy: skip non-present PMDs when queueing folios","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-89757","published":"2026-09-11T19:46:59.830Z","updated":"2026-10-30T12:32:56.012Z","title":"mm/mglru: fix and remove redundant unevictable folio handling","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-89756","published":"2026-09-11T19:46:59.093Z","updated":"2026-10-19T08:52:09.900Z","title":"mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-89755","published":"2026-09-11T19:46:58.295Z","updated":"2026-10-21T12:48:34.692Z","title":"mm/migrate_device: clear stale mapping after freeing swapcache","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-89754","published":"2026-09-11T19:46:57.534Z","updated":"2026-10-19T08:52:07.951Z","title":"mm/pagewalk: fix stale walk->action escaping walk_pmd_range()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-89753","published":"2026-09-11T19:46:56.806Z","updated":"2026-10-19T08:52:06.974Z","title":"mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-89752","published":"2026-09-11T19:46:56.059Z","updated":"2026-10-19T08:52:05.993Z","title":"mm: memcg: stop reclaim when a limit update is superseded","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-89751","published":"2026-09-11T19:46:55.314Z","updated":"2026-10-19T08:52:05.025Z","title":"x86/tdx: Fix off-by-one in port I/O handling","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89750","published":"2026-09-11T19:46:54.565Z","updated":"2026-10-19T08:52:04.079Z","title":"tracing/user_events: Clear copied tracing state before fork duplication","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-89749","published":"2026-09-11T19:46:53.822Z","updated":"2026-10-19T08:52:03.128Z","title":"tracing: Fix crash passing ERR_PTR to kthread_stop()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-89748","published":"2026-09-11T19:46:53.070Z","updated":"2026-10-19T08:52:02.172Z","title":"tracing: Fix retry exhaustion in simple ring buffer reader swap","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-89747","published":"2026-09-11T19:46:52.268Z","updated":"2026-10-19T08:52:01.177Z","title":"tracing: Fix use-after-free in trace_pipe read on sub-buffer order change","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-89746","published":"2026-09-11T19:46:51.529Z","updated":"2026-10-19T08:52:00.175Z","title":"tracing: Fix use-after-free with same-name named triggers","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-89745","published":"2026-09-11T19:46:50.758Z","updated":"2026-10-19T08:51:59.176Z","title":"debugfs: Fix lockdown check for mmap_prepare","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89744","published":"2026-09-11T19:46:50.020Z","updated":"2026-10-30T12:32:54.954Z","title":"device property: fix infinite loop in fwnode_for_each_child_node()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-89743","published":"2026-09-11T19:46:49.261Z","updated":"2026-10-19T08:51:57.186Z","title":"misc: nsm: bound the device-reported response length","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-89742","published":"2026-09-11T19:46:48.522Z","updated":"2026-10-19T08:51:56.183Z","title":"rapidio: mport_cdev: fix use-after-free in dma_req_free()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-89741","published":"2026-09-11T19:46:47.877Z","updated":"2026-10-19T08:51:55.196Z","title":"Revert \"media: v4l2-dev: fix error handling in __video_register_device()\"","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89740","published":"2026-09-11T19:46:47.250Z","updated":"2026-10-30T12:32:53.898Z","title":"serial: imx: serialize imx_uart_ports[] lifetime","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-89739","published":"2026-09-11T19:46:46.545Z","updated":"2026-10-21T12:48:32.502Z","title":"usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-89738","published":"2026-09-11T19:46:45.898Z","updated":"2026-10-30T12:32:52.839Z","title":"usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2026-89737","published":"2026-09-11T19:46:45.250Z","updated":"2026-10-19T08:51:51.314Z","title":"usb: typec: thunderbolt: Disable work before freeing tbt on remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89736","published":"2026-09-11T19:46:44.608Z","updated":"2026-10-19T08:51:50.340Z","title":"usb: gadget: u_audio: Fix use-after-free on sound card disconnect","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-89735","published":"2026-09-11T19:46:43.899Z","updated":"2026-10-19T08:51:48.488Z","title":"usb: gadget: midi2: remove default configfs groups on teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-89734","published":"2026-09-11T19:46:43.261Z","updated":"2026-10-19T08:51:47.513Z","title":"usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89733","published":"2026-09-11T19:46:42.613Z","updated":"2026-10-19T08:51:46.538Z","title":"usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89732","published":"2026-09-11T19:46:41.974Z","updated":"2026-10-19T08:51:45.542Z","title":"usb: gadget: f_fs: Prevent deadlock during ep0 read loop","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2026-89731","published":"2026-09-11T19:46:41.312Z","updated":"2026-10-19T08:51:44.551Z","title":"cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-89730","published":"2026-09-11T19:46:40.581Z","updated":"2026-10-19T08:51:43.578Z","title":"fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89729","published":"2026-09-11T19:46:39.823Z","updated":"2026-10-19T08:51:42.570Z","title":"HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00355,"kevAdded":null},{"id":"CVE-2026-89728","published":"2026-09-11T19:46:39.040Z","updated":"2026-10-19T08:51:41.560Z","title":"i3c: renesas: Fix out-of-bounds access for newdevs mask","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89727","published":"2026-09-11T19:46:38.291Z","updated":"2026-10-19T08:51:40.580Z","title":"KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89726","published":"2026-09-11T19:46:37.480Z","updated":"2026-10-19T08:51:39.437Z","title":"lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-89725","published":"2026-09-11T19:46:36.679Z","updated":"2026-10-19T08:51:38.472Z","title":"media: cec: stm32: prevent out-of-bounds write on RX overflow","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2026-89724","published":"2026-09-11T19:46:35.914Z","updated":"2026-10-19T08:51:37.470Z","title":"media: vicodec: fix out-of-bounds write in FWHT encoder","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89723","published":"2026-09-11T19:46:35.161Z","updated":"2026-10-19T08:51:35.942Z","title":"nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89722","published":"2026-09-11T19:46:34.427Z","updated":"2026-10-19T08:51:34.940Z","title":"PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89721","published":"2026-09-11T19:46:33.680Z","updated":"2026-10-19T08:51:33.997Z","title":"phy: rockchip-samsung-dcphy: fix out-of-range max_register","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89720","published":"2026-09-11T19:46:32.923Z","updated":"2026-10-19T08:51:33.033Z","title":"ubifs: fix out-of-bounds read in signature length check","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-89719","published":"2026-09-11T19:46:32.185Z","updated":"2026-10-30T12:32:51.769Z","title":"zram: fix out-of-bounds access in read_block_state()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-89718","published":"2026-09-11T19:46:31.443Z","updated":"2026-10-30T12:32:49.752Z","title":"zram: fix out-of-bounds access in writeback_store()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89717","published":"2026-09-11T19:46:30.698Z","updated":"2026-10-21T12:48:28.119Z","title":"zram: set default primary compressor in zram_destroy_comps()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-89716","published":"2026-09-11T19:46:29.953Z","updated":"2026-10-19T08:51:29.156Z","title":"zram: validate deflate params","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89715","published":"2026-09-11T19:46:29.227Z","updated":"2026-10-19T08:51:28.178Z","title":"NFS/localio: fix ref leak on nfs_uuid_add_file failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89714","published":"2026-09-11T19:46:28.476Z","updated":"2026-10-19T08:51:27.182Z","title":"NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89713","published":"2026-09-11T19:46:27.752Z","updated":"2026-10-30T12:32:48.688Z","title":"NFSD: check truncate permission under inode lock","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00665,"kevAdded":null},{"id":"CVE-2026-89712","published":"2026-09-11T19:46:27.018Z","updated":"2026-10-19T08:51:25.202Z","title":"NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-89711","published":"2026-09-11T19:46:26.269Z","updated":"2026-10-19T08:51:24.221Z","title":"NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00443,"kevAdded":null},{"id":"CVE-2026-89710","published":"2026-09-11T19:46:25.534Z","updated":"2026-10-19T08:51:23.214Z","title":"NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89709","published":"2026-09-11T19:46:24.803Z","updated":"2026-10-30T12:32:47.602Z","title":"lockd, nfsd: RCU-protect nlmsvc_ops dispatch","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00593,"kevAdded":null},{"id":"CVE-2026-89708","published":"2026-09-11T19:46:24.061Z","updated":"2026-10-19T08:51:21.242Z","title":"nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00444,"kevAdded":null},{"id":"CVE-2026-89707","published":"2026-09-11T19:46:23.293Z","updated":"2026-10-30T12:32:46.529Z","title":"nfsd: release path refs on follow_down() error","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00696,"kevAdded":null},{"id":"CVE-2026-89706","published":"2026-09-11T19:46:22.561Z","updated":"2026-10-19T08:51:19.292Z","title":"nfsd: Reset write verifier when async COPY writeback fails","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00526,"kevAdded":null},{"id":"CVE-2026-89705","published":"2026-09-11T19:46:21.832Z","updated":"2026-10-21T12:48:24.485Z","title":"nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-89704","published":"2026-09-11T19:46:21.039Z","updated":"2026-10-19T08:51:17.323Z","title":"nfsd: sample writeback error cursor before async COPY loop","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00526,"kevAdded":null},{"id":"CVE-2026-89703","published":"2026-09-11T19:46:20.280Z","updated":"2026-10-19T08:51:16.319Z","title":"nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00617,"kevAdded":null},{"id":"CVE-2026-89702","published":"2026-09-11T19:46:19.537Z","updated":"2026-10-30T12:32:45.423Z","title":"nfsd: size fh_verify server sockaddr slot by xpt_locallen","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00502,"kevAdded":null},{"id":"CVE-2026-89701","published":"2026-09-11T19:46:18.807Z","updated":"2026-10-19T08:51:14.339Z","title":"nfsd: validate nseconds in TIME_DELEG decode paths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89700","published":"2026-09-11T19:46:18.076Z","updated":"2026-10-19T08:51:13.379Z","title":"nfsd: validate sockaddr length per family in listener_set","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-89699","published":"2026-09-11T19:46:17.293Z","updated":"2026-10-19T08:51:12.396Z","title":"nfsd: validate symlink target length in NFSv4 CREATE","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-89698","published":"2026-09-11T19:46:16.551Z","updated":"2026-10-19T08:51:11.410Z","title":"nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89697","published":"2026-09-11T19:46:15.772Z","updated":"2026-10-19T08:51:10.455Z","title":"nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00696,"kevAdded":null},{"id":"CVE-2026-89696","published":"2026-09-11T19:46:15.030Z","updated":"2026-10-19T08:51:09.479Z","title":"nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00752,"kevAdded":null},{"id":"CVE-2026-89695","published":"2026-09-11T19:46:14.258Z","updated":"2026-10-19T08:51:08.488Z","title":"nfsd: cap decoded POSIX ACL count to bound sort cost","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-89694","published":"2026-09-11T19:46:13.519Z","updated":"2026-10-19T08:51:07.514Z","title":"nfsd: check client ownership when cancelling a copy-notify stateid","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89693","published":"2026-09-11T19:46:12.775Z","updated":"2026-10-30T12:32:44.295Z","title":"nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-89692","published":"2026-09-11T19:46:12.040Z","updated":"2026-10-19T08:51:05.555Z","title":"nfsd: clear CALLBACK_RUNNING on failed delegation recall queue","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-89691","published":"2026-09-11T19:46:11.284Z","updated":"2026-10-19T08:51:04.497Z","title":"nfsd: clear opcnt on compound arg release to prevent OOB read","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-89690","published":"2026-09-11T19:46:10.632Z","updated":"2026-10-19T08:51:03.524Z","title":"nfsd: defer vfree of compound ops to fix rpc_status UAF","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-89689","published":"2026-09-11T19:46:09.976Z","updated":"2026-10-19T08:51:02.559Z","title":"nfsd: don't free session slots that are still in use","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00614,"kevAdded":null},{"id":"CVE-2026-89688","published":"2026-09-11T19:46:09.322Z","updated":"2026-10-19T08:51:01.558Z","title":"nfsd: drop the stateid, not the stateowner, on seqid_op replay retry","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00736,"kevAdded":null},{"id":"CVE-2026-89687","published":"2026-09-11T19:46:08.630Z","updated":"2026-10-19T08:51:00.577Z","title":"nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-89686","published":"2026-09-11T19:46:07.877Z","updated":"2026-10-30T12:32:43.218Z","title":"nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00712,"kevAdded":null},{"id":"CVE-2026-89685","published":"2026-09-11T19:46:07.116Z","updated":"2026-10-30T12:32:41.984Z","title":"nfsd: fix clock domain mismatch in clients_still_reclaiming()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00612,"kevAdded":null},{"id":"CVE-2026-89684","published":"2026-09-11T19:46:06.374Z","updated":"2026-10-19T08:50:57.622Z","title":"nfsd: fix cpntf publish race in nfs4_init_cp_state","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-89683","published":"2026-09-11T19:46:05.635Z","updated":"2026-10-19T08:50:56.607Z","title":"nfsd: fix dentry ref leak on V4ROOT export filehandle lookup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-89682","published":"2026-09-11T19:46:04.882Z","updated":"2026-10-30T12:32:40.915Z","title":"nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00593,"kevAdded":null},{"id":"CVE-2026-89681","published":"2026-09-11T19:46:04.121Z","updated":"2026-10-19T08:50:54.644Z","title":"nfsd: fix layout fence worker double-reference race","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-89680","published":"2026-09-11T19:46:03.468Z","updated":"2026-10-30T12:32:39.849Z","title":"nfsd: fix nfsd_file leak on inter-server COPY setup failure","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0074,"kevAdded":null},{"id":"CVE-2026-89679","published":"2026-09-11T19:46:02.833Z","updated":"2026-10-19T08:50:52.556Z","title":"nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00718,"kevAdded":null},{"id":"CVE-2026-89678","published":"2026-09-11T19:46:02.184Z","updated":"2026-10-19T08:50:51.587Z","title":"nfsd: fix partial-write detection in nfsd_direct_write","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0038,"kevAdded":null},{"id":"CVE-2026-89677","published":"2026-09-11T19:46:01.185Z","updated":"2026-10-19T08:50:50.591Z","title":"nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-89676","published":"2026-09-11T19:46:00.382Z","updated":"2026-10-30T12:32:38.755Z","title":"nfsd: fix stale s2s_cp_stateids IDR entry for async COPY","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00491,"kevAdded":null},{"id":"CVE-2026-89675","published":"2026-09-11T19:45:59.635Z","updated":"2026-10-19T08:50:48.585Z","title":"nfsd: fix UAF in async copy cancel and shutdown","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00442,"kevAdded":null},{"id":"CVE-2026-89674","published":"2026-09-11T19:45:58.883Z","updated":"2026-10-19T08:50:47.609Z","title":"nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-89673","published":"2026-09-11T19:45:58.149Z","updated":"2026-10-24T14:15:11.211Z","title":"nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89672","published":"2026-09-11T19:45:57.414Z","updated":"2026-10-30T12:32:37.687Z","title":"nfsd: gate nfs2 setacl by argp->mask","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00596,"kevAdded":null},{"id":"CVE-2026-89671","published":"2026-09-11T19:45:56.604Z","updated":"2026-10-30T12:32:36.627Z","title":"nfsd: gate nfs3 setacl by argp->mask","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00545,"kevAdded":null},{"id":"CVE-2026-89670","published":"2026-09-11T19:45:55.846Z","updated":"2026-10-19T08:50:43.628Z","title":"nfsd: hold rcu across localio cmpxchg retry","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89669","published":"2026-09-11T19:45:55.111Z","updated":"2026-10-19T08:50:42.637Z","title":"nfsd: initialize copy-notify stateid before publishing it","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00694,"kevAdded":null},{"id":"CVE-2026-89668","published":"2026-09-11T19:45:54.354Z","updated":"2026-10-19T08:50:41.624Z","title":"nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-89667","published":"2026-09-11T19:45:53.609Z","updated":"2026-10-19T08:50:40.641Z","title":"nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00537,"kevAdded":null},{"id":"CVE-2026-89666","published":"2026-09-11T19:45:52.864Z","updated":"2026-10-30T12:32:35.549Z","title":"nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89665","published":"2026-09-11T19:45:52.102Z","updated":"2026-10-19T08:50:36.772Z","title":"nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00621,"kevAdded":null},{"id":"CVE-2026-89664","published":"2026-09-11T19:45:51.319Z","updated":"2026-10-19T08:50:35.770Z","title":"nfsd: release OPEN-decoded posix ACLs via op_release","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-89663","published":"2026-09-11T19:45:50.577Z","updated":"2026-10-19T08:50:34.792Z","title":"nfsd: revoke copy-notify stateids before dropping their reference","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2026-89662","published":"2026-09-11T19:45:49.833Z","updated":"2026-10-19T08:50:33.792Z","title":"NFSD: Prevent lock owner use-after-free during client teardown","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00694,"kevAdded":null},{"id":"CVE-2026-89661","published":"2026-09-11T19:45:49.086Z","updated":"2026-10-19T08:50:32.806Z","title":"NFSD: Prevent post-shutdown use-after-free in unlock_filesystem","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89660","published":"2026-09-11T19:45:48.341Z","updated":"2026-10-19T08:50:31.845Z","title":"NFSD: Prevent client use-after-free during admin state revocation","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00617,"kevAdded":null},{"id":"CVE-2026-89659","published":"2026-09-11T19:45:47.587Z","updated":"2026-10-30T12:32:34.470Z","title":"NFSD: Prevent client use-after-free during delegation revoke","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00477,"kevAdded":null},{"id":"CVE-2026-89658","published":"2026-09-11T19:45:46.857Z","updated":"2026-10-19T08:50:29.852Z","title":"NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00617,"kevAdded":null},{"id":"CVE-2026-89657","published":"2026-09-11T19:45:46.118Z","updated":"2026-10-19T08:50:28.836Z","title":"libceph: validate OSD extent maps before cursor advance","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00612,"kevAdded":null},{"id":"CVE-2026-89656","published":"2026-09-11T19:45:45.483Z","updated":"2026-10-19T08:50:27.849Z","title":"libceph: reject buckets with mismatched CRUSH ids","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-89655","published":"2026-09-11T19:45:44.841Z","updated":"2026-10-19T08:50:26.879Z","title":"ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-89654","published":"2026-09-11T19:45:44.086Z","updated":"2026-10-30T12:32:33.412Z","title":"ceph: fix UAF in check_new_map() on session freed during unlock","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00721,"kevAdded":null},{"id":"CVE-2026-89653","published":"2026-09-11T19:45:43.261Z","updated":"2026-10-19T08:50:24.862Z","title":"ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00502,"kevAdded":null},{"id":"CVE-2026-89652","published":"2026-09-11T19:45:42.443Z","updated":"2026-10-30T12:32:32.345Z","title":"ceph: bound copied dentry name length in NFS export get_name","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-89651","published":"2026-09-11T19:45:41.620Z","updated":"2026-10-19T08:50:22.893Z","title":"ceph: bound MDSCapAuth path and fs_name decode in handle_session()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00635,"kevAdded":null},{"id":"CVE-2026-89650","published":"2026-09-11T19:45:40.867Z","updated":"2026-10-30T12:32:31.274Z","title":"ceph: bound num_export_targets array for mds info v2/v3","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-89649","published":"2026-09-11T19:45:40.118Z","updated":"2026-10-19T08:50:20.912Z","title":"ceph: bound xattr value length in __build_xattrs()","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00678,"kevAdded":null},{"id":"CVE-2026-89648","published":"2026-09-11T19:45:39.375Z","updated":"2026-10-30T12:32:30.205Z","title":"ceph: cap delegated inode count in ceph_parse_deleg_inos()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00675,"kevAdded":null},{"id":"CVE-2026-89647","published":"2026-09-11T19:45:38.593Z","updated":"2026-10-30T12:32:29.127Z","title":"ceph: do not repeat ceph_trim_dentries() if no progress possible","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00675,"kevAdded":null},{"id":"CVE-2026-89646","published":"2026-09-11T19:45:37.767Z","updated":"2026-10-19T08:50:17.976Z","title":"ceph: fix leaked inode reference on writeback abort at umount","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89645","published":"2026-09-11T19:45:37.016Z","updated":"2026-10-30T12:32:28.070Z","title":"btrfs: drop recovered reloc root refs on recovery failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2026-89644","published":"2026-09-11T19:45:36.268Z","updated":"2026-10-30T12:32:27.002Z","title":"btrfs: fix extent map leak in NOCOW direct I/O write","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89643","published":"2026-09-11T19:45:35.523Z","updated":"2026-10-19T08:50:15.077Z","title":"audit: avoid dropping live tree ref on fsnotify rule autoremove","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-89642","published":"2026-09-11T19:45:34.778Z","updated":"2026-10-30T12:32:25.947Z","title":"cifs: call pagecache_isize_extended() in cifs_setsize() when extending","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89641","published":"2026-09-11T19:45:34.036Z","updated":"2026-10-19T08:50:13.143Z","title":"cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2026-89640","published":"2026-09-11T19:45:33.289Z","updated":"2026-10-30T12:32:24.876Z","title":"cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-89639","published":"2026-09-11T19:45:32.532Z","updated":"2026-10-19T08:50:11.190Z","title":"cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-89638","published":"2026-09-11T19:45:31.791Z","updated":"2026-10-30T12:32:23.806Z","title":"smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-89637","published":"2026-09-11T19:45:31.048Z","updated":"2026-10-19T08:50:09.230Z","title":"smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00597,"kevAdded":null},{"id":"CVE-2026-89636","published":"2026-09-11T19:45:30.283Z","updated":"2026-10-19T08:50:08.281Z","title":"smb: client: clear ce->tgthint in free_tgts()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00663,"kevAdded":null},{"id":"CVE-2026-89635","published":"2026-09-11T19:45:29.551Z","updated":"2026-10-19T08:50:07.282Z","title":"ksmbd: only rebind the reopened file's own oplock on durable reconnect","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-89634","published":"2026-09-11T19:45:28.823Z","updated":"2026-10-19T08:50:06.331Z","title":"smb: client: fix ALIGN() overflow in symlink_data() error context loop","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00693,"kevAdded":null},{"id":"CVE-2026-89633","published":"2026-09-11T19:45:28.083Z","updated":"2026-10-30T12:32:22.744Z","title":"smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00552,"kevAdded":null},{"id":"CVE-2026-89632","published":"2026-09-11T19:45:27.325Z","updated":"2026-10-21T12:48:04.460Z","title":"smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00551,"kevAdded":null},{"id":"CVE-2026-89631","published":"2026-09-11T19:45:26.444Z","updated":"2026-10-30T12:32:21.680Z","title":"smb: client: reject a tree connect response whose byte count is too small","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00491,"kevAdded":null},{"id":"CVE-2026-89630","published":"2026-09-11T19:45:25.697Z","updated":"2026-10-19T08:50:02.437Z","title":"smb: client: restore the data_offset bound in is_valid_oplock_break()","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00539,"kevAdded":null},{"id":"CVE-2026-89629","published":"2026-09-11T19:45:24.953Z","updated":"2026-10-19T08:50:01.489Z","title":"HID: corsair-void: Check size of status and firmware events before reading them","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89628","published":"2026-09-11T19:45:24.203Z","updated":"2026-10-19T08:50:00.490Z","title":"HID: picolcd: clamp eeprom debugfs read to bytes actually received","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-89627","published":"2026-09-11T19:45:23.479Z","updated":"2026-10-19T08:49:59.521Z","title":"HID: roccat: free buffered reports when destroying device","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89626","published":"2026-09-11T19:45:22.769Z","updated":"2026-10-19T08:49:58.552Z","title":"HID: sensor: custom: Fix field sysfs group cleanup on failure","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00354,"kevAdded":null},{"id":"CVE-2026-89625","published":"2026-09-11T19:45:22.097Z","updated":"2026-10-30T12:32:20.618Z","title":"HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89624","published":"2026-09-11T19:45:21.438Z","updated":"2026-10-21T12:48:01.115Z","title":"HID: universal-pidff: stop the device when force-feedback init fails","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-89623","published":"2026-09-11T19:45:20.758Z","updated":"2026-10-24T14:14:00.813Z","title":"HID: mcp2221: stop device IO before hid_hw_stop","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-89622","published":"2026-09-11T19:45:20.090Z","updated":"2026-10-30T12:32:19.551Z","title":"HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-89621","published":"2026-09-11T19:45:19.420Z","updated":"2026-10-19T08:49:53.686Z","title":"HID: mcp2221: validate report size in mcp2221_raw_event()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-89620","published":"2026-09-11T19:45:18.758Z","updated":"2026-10-19T08:49:52.704Z","title":"HID: intel-thc-hid: intel-quickspi: validate report size before copy","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89619","published":"2026-09-11T19:45:18.073Z","updated":"2026-10-19T08:49:51.744Z","title":"HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89618","published":"2026-09-11T19:45:17.397Z","updated":"2026-10-19T08:49:50.770Z","title":"eventfs: Initialize ei->children and ei->list in init_ei()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-89617","published":"2026-09-11T19:45:16.737Z","updated":"2026-10-19T08:49:49.792Z","title":"fs/ntfs3: validate dirty page table on log replay","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-89616","published":"2026-09-11T19:45:16.064Z","updated":"2026-10-19T08:49:48.800Z","title":"fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00415,"kevAdded":null},{"id":"CVE-2026-89615","published":"2026-09-11T19:45:15.397Z","updated":"2026-10-19T08:49:47.839Z","title":"fs/ntfs3: bound page_lcns[] index by the log record","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-89614","published":"2026-09-11T19:45:14.747Z","updated":"2026-10-19T08:49:46.853Z","title":"ntfs: bound the free-cluster bitmap scan to the volume","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-89613","published":"2026-09-11T19:45:14.081Z","updated":"2026-10-19T08:49:45.874Z","title":"ntfs: reject invalid empty mapping pairs","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-89612","published":"2026-09-11T19:45:13.415Z","updated":"2026-10-19T08:49:44.526Z","title":"ntfs: reject invalid MFT LCNs from boot sector","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-89611","published":"2026-09-11T19:45:12.646Z","updated":"2026-10-19T08:49:43.569Z","title":"ntfs: validate non-resident attribute offsets","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-89610","published":"2026-09-11T19:45:11.864Z","updated":"2026-10-19T08:49:42.613Z","title":"ntfs: verify run length exceeding volume boundary","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-89609","published":"2026-09-11T19:45:11.086Z","updated":"2026-10-19T08:49:41.609Z","title":"ecryptfs: hold msg ctx list lock when cleaning daemon queue","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-89608","published":"2026-09-11T19:45:10.318Z","updated":"2026-10-19T08:49:40.341Z","title":"ecryptfs: pass packet set buffer size to parser","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-89607","published":"2026-09-11T19:45:09.583Z","updated":"2026-10-19T08:49:39.398Z","title":"ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89606","published":"2026-09-11T19:45:08.832Z","updated":"2026-10-19T08:49:37.417Z","title":"ecryptfs: reject too-small tag 70 packets","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-89605","published":"2026-09-11T19:45:08.101Z","updated":"2026-10-19T08:49:36.445Z","title":"ecryptfs: release message context on send failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89604","published":"2026-09-11T19:45:07.365Z","updated":"2026-10-19T08:49:35.476Z","title":"efivarfs: Rate limit statfs() handler","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-89602","published":"2026-09-11T19:45:05.783Z","updated":"2026-10-19T08:49:34.524Z","title":"erofs: skip sufficiently large global buffers when resizing","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-89601","published":"2026-09-11T19:45:04.667Z","updated":"2026-10-30T12:32:18.488Z","title":"ext2: Fix lost inode updates for IS_SYNC inodes","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00648,"kevAdded":null},{"id":"CVE-2026-89600","published":"2026-09-11T19:45:03.450Z","updated":"2026-10-19T08:49:32.566Z","title":"fanotify: fix use-after-free of file range info","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-89599","published":"2026-09-11T19:45:02.112Z","updated":"2026-10-19T08:49:31.606Z","title":"fbdev: omapfb: panel-dsi-cm: initialize lock before registering display","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-89598","published":"2026-09-11T19:45:00.778Z","updated":"2026-10-30T12:32:17.422Z","title":"fbdev: ssd1307fb: defer I2C transfers from damage callbacks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89597","published":"2026-09-11T19:44:59.538Z","updated":"2026-10-19T08:49:29.665Z","title":"fbdev: uvesafb: unregister connector callback on init failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89596","published":"2026-09-11T19:44:58.797Z","updated":"2026-10-19T08:49:28.680Z","title":"forcedeth: fix off-by-one when saving/restoring non-PCI config space","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-89595","published":"2026-09-11T19:44:58.057Z","updated":"2026-10-19T08:49:27.690Z","title":"fsnotify: Fix stale object mask after concurrent mark updates","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89594","published":"2026-09-11T19:44:57.291Z","updated":"2026-10-19T08:49:26.718Z","title":"hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89593","published":"2026-09-11T19:44:56.557Z","updated":"2026-10-19T08:49:25.740Z","title":"hugetlb: only adjust reservation during unmapping if mapcount is 0","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-89592","published":"2026-09-11T19:44:55.813Z","updated":"2026-10-19T08:49:24.772Z","title":"accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89591","published":"2026-09-11T19:44:55.080Z","updated":"2026-10-19T08:49:23.816Z","title":"accel/rocket: initialize job domain before cleanup paths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89590","published":"2026-09-11T19:44:54.328Z","updated":"2026-10-19T08:49:22.866Z","title":"accel/rocket: Fix error path handling in rocket_job_run()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89589","published":"2026-09-11T19:44:53.578Z","updated":"2026-10-19T08:49:21.919Z","title":"acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-89588","published":"2026-09-11T19:44:52.842Z","updated":"2026-10-19T08:49:20.945Z","title":"ACPI: APEI: GHES: fix ARM section length accounting after header","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-89587","published":"2026-09-11T19:44:52.066Z","updated":"2026-10-19T08:49:19.962Z","title":"ACPI: pfr_update: fix stack buffer overflow in query_capability()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-89586","published":"2026-09-11T19:44:51.322Z","updated":"2026-10-19T08:49:18.983Z","title":"ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00615,"kevAdded":null},{"id":"CVE-2026-89585","published":"2026-09-11T19:44:50.592Z","updated":"2026-10-19T08:49:17.989Z","title":"auxdisplay: charlcd: cancel backlight work on registration failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89584","published":"2026-09-11T19:44:49.838Z","updated":"2026-10-19T08:49:17.054Z","title":"block: validate user space vectors during extraction","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-89583","published":"2026-09-11T19:44:49.094Z","updated":"2026-10-19T08:49:16.094Z","title":"Bluetooth: eir: Fix OOB read in eir_get_service_data()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2026-89582","published":"2026-09-11T19:44:48.336Z","updated":"2026-10-19T08:49:15.111Z","title":"bnx2x: fix double free in bnx2x_init_firmware() error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-89581","published":"2026-09-11T19:44:47.581Z","updated":"2026-10-19T08:49:14.144Z","title":"bpf, x86: Fix per-CPU address resolution into an extended register","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-89580","published":"2026-09-11T19:44:46.846Z","updated":"2026-10-30T12:32:16.360Z","title":"bpf: Disable preemption in __bpf_get_stack","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-89579","published":"2026-09-11T19:44:46.110Z","updated":"2026-10-19T08:49:12.203Z","title":"bpf: Harden bloom filter sizing and indexing on 32-bit kernels","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-89578","published":"2026-09-11T19:44:45.364Z","updated":"2026-10-19T08:49:11.220Z","title":"dm-io: clone the source bio instead of copying its biovec","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89577","published":"2026-09-11T19:44:44.617Z","updated":"2026-10-19T08:49:10.301Z","title":"dm-io: report non-retryable errors separatedly","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2026-89576","published":"2026-09-11T19:44:43.777Z","updated":"2026-10-19T08:49:09.363Z","title":"dm-era: fix shadowed superblock leak on take-snap failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89575","published":"2026-09-11T19:44:43.139Z","updated":"2026-10-19T08:49:08.414Z","title":"dm raid1: reserve space for NUL-terminator in build_constructor_string()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-89574","published":"2026-09-11T19:44:42.494Z","updated":"2026-10-30T12:32:15.267Z","title":"dm array: validate array block headers on read","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89573","published":"2026-09-11T19:44:41.851Z","updated":"2026-10-19T08:49:06.476Z","title":"dm array: reject an array block whose value size is not the caller's","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-89572","published":"2026-09-11T19:44:41.072Z","updated":"2026-10-21T12:47:55.785Z","title":"cpufreq: apple-soc: Fix OPP table cleanup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-89571","published":"2026-09-11T19:44:40.328Z","updated":"2026-10-19T08:49:04.541Z","title":"cxl/features: bound fwctl command payload to the input buffer","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-89570","published":"2026-09-11T19:44:39.584Z","updated":"2026-10-19T08:49:03.602Z","title":"cxl/mce: Make the MCE notifier per-region","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-89569","published":"2026-09-11T19:44:38.838Z","updated":"2026-10-19T08:49:02.628Z","title":"Bluetooth: RFCOMM: serialize security confirmation handling","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2026-89568","published":"2026-09-11T19:44:38.078Z","updated":"2026-10-19T08:49:01.653Z","title":"kho: fix size calculation in kho_preserved_memory_reserve()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89567","published":"2026-09-11T19:44:37.332Z","updated":"2026-10-21T12:47:54.662Z","title":"jbd2: bound shrinker scans by examined checkpoint buffers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89566","published":"2026-09-11T19:44:36.599Z","updated":"2026-10-21T12:47:53.628Z","title":"jbd2: check need_resched() when skipping busy checkpoint buffers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89565","published":"2026-09-11T19:44:35.858Z","updated":"2026-10-19T08:48:58.760Z","title":"ipip: fix skb leak in collect_md mode when metadata_dst allocation fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89564","published":"2026-09-11T19:44:35.131Z","updated":"2026-10-30T12:32:14.200Z","title":"ip: orphan prefetched skbs before multicast forwarding","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-89563","published":"2026-09-11T19:44:34.375Z","updated":"2026-10-19T08:48:56.784Z","title":"ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-89562","published":"2026-09-11T19:44:33.576Z","updated":"2026-10-19T08:48:55.787Z","title":"ip6_gre: fix hardware header length for NBMA tunnels","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-89561","published":"2026-09-11T19:44:32.822Z","updated":"2026-10-30T12:32:13.148Z","title":"ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-89560","published":"2026-09-11T19:44:32.085Z","updated":"2026-10-19T08:48:53.816Z","title":"landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-89559","published":"2026-09-11T19:44:31.337Z","updated":"2026-10-19T08:48:52.683Z","title":"libnvdimm/labels: Prevent integer overflow in __nd_label_validate()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89558","published":"2026-09-11T19:44:30.588Z","updated":"2026-10-19T08:48:51.700Z","title":"md/raid10: fix still_degraded being inverted in raid10_sync_request()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00635,"kevAdded":null},{"id":"CVE-2026-89557","published":"2026-09-11T19:44:29.857Z","updated":"2026-10-19T08:48:50.070Z","title":"md: do overflow check for sb->bblog_shift in super_1_load()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89556","published":"2026-09-11T19:44:29.080Z","updated":"2026-10-19T08:48:49.102Z","title":"module: validate string table section types","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2026-89555","published":"2026-09-11T19:44:28.331Z","updated":"2026-10-19T08:48:48.093Z","title":"mpls: reload header after pskb_may_pull()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00694,"kevAdded":null},{"id":"CVE-2026-89554","published":"2026-09-11T19:44:27.586Z","updated":"2026-10-19T08:48:47.068Z","title":"mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00598,"kevAdded":null},{"id":"CVE-2026-89553","published":"2026-09-11T19:44:26.836Z","updated":"2026-10-30T12:32:12.068Z","title":"nouveau/gem: reserve the bo in the info ioctl around the vma lookup","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-89552","published":"2026-09-11T19:44:26.091Z","updated":"2026-10-30T12:32:11.008Z","title":"params: fix charp corruption on allocation failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-89551","published":"2026-09-11T19:44:25.327Z","updated":"2026-10-19T08:48:44.059Z","title":"SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-89550","published":"2026-09-11T19:44:24.572Z","updated":"2026-10-30T12:32:09.952Z","title":"SUNRPC: svcauth_gss: enforce krb5 token minimum length","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00491,"kevAdded":null},{"id":"CVE-2026-89549","published":"2026-09-11T19:44:23.928Z","updated":"2026-10-19T08:48:42.059Z","title":"sunrpc: route to a populated pool in svc_pool_for_cpu()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00707,"kevAdded":null},{"id":"CVE-2026-89548","published":"2026-09-11T19:44:23.298Z","updated":"2026-10-19T08:48:41.057Z","title":"SUNRPC: always drain cache_cleaner before destroying a cache_detail","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-89547","published":"2026-09-11T19:44:22.644Z","updated":"2026-10-19T08:48:38.898Z","title":"SUNRPC: Check svc pool percpu counter allocation","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00561,"kevAdded":null},{"id":"CVE-2026-89546","published":"2026-09-11T19:44:21.898Z","updated":"2026-10-19T08:48:37.920Z","title":"SUNRPC: close backchannel before destroying callback service","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-89545","published":"2026-09-11T19:44:21.161Z","updated":"2026-10-30T12:32:08.877Z","title":"sunrpc: defer rq_argp and rq_resp free until after RCU grace period","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-89544","published":"2026-09-11T19:44:20.424Z","updated":"2026-10-30T12:32:07.817Z","title":"SUNRPC: fix gssx_dec_option_array error path bugs","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00724,"kevAdded":null},{"id":"CVE-2026-89543","published":"2026-09-11T19:44:19.679Z","updated":"2026-10-30T12:32:06.731Z","title":"sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-89542","published":"2026-09-11T19:44:18.931Z","updated":"2026-10-19T08:48:33.941Z","title":"SUNRPC: harden gss_krb5_unwrap_v2 against short tokens","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-89541","published":"2026-09-11T19:44:18.188Z","updated":"2026-10-19T08:48:32.929Z","title":"SUNRPC: harden gss_unwrap_resp_priv length checks","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-89540","published":"2026-09-11T19:44:17.440Z","updated":"2026-10-19T08:48:31.930Z","title":"sunrpc: init gssp_lock before publishing proc entry","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-89539","published":"2026-09-11T19:44:16.699Z","updated":"2026-10-30T12:32:05.658Z","title":"SUNRPC: reject duplicate CREDS_VALUE options","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-89538","published":"2026-09-11T19:44:15.953Z","updated":"2026-10-19T08:48:29.976Z","title":"SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-89537","published":"2026-09-11T19:44:15.216Z","updated":"2026-10-30T12:32:04.586Z","title":"SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00702,"kevAdded":null},{"id":"CVE-2026-89536","published":"2026-09-11T19:44:14.473Z","updated":"2026-10-19T08:48:28.030Z","title":"SUNRPC: wait for in-flight client TLS handshake callback","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00635,"kevAdded":null},{"id":"CVE-2026-89535","published":"2026-09-11T19:44:13.733Z","updated":"2026-10-19T08:48:26.908Z","title":"svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00537,"kevAdded":null},{"id":"CVE-2026-89534","published":"2026-09-11T19:44:12.987Z","updated":"2026-10-30T12:32:03.526Z","title":"svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-89533","published":"2026-09-11T19:44:12.236Z","updated":"2026-10-19T08:48:24.875Z","title":"svcrdma: Fix offset arithmetic in read_chunk_range","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00502,"kevAdded":null},{"id":"CVE-2026-89532","published":"2026-09-11T19:44:11.495Z","updated":"2026-10-19T08:48:23.895Z","title":"svcrdma: Fix pcl_for_each_segment for empty chunks","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00502,"kevAdded":null},{"id":"CVE-2026-89531","published":"2026-09-11T19:44:10.769Z","updated":"2026-10-30T12:32:02.456Z","title":"svcrdma: Reject connection when transport allocation fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89530","published":"2026-09-11T19:44:10.024Z","updated":"2026-10-30T12:32:01.396Z","title":"svcrdma: Reject inline replies that overflow the pull-up buffer","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00491,"kevAdded":null},{"id":"CVE-2026-89529","published":"2026-09-11T19:44:09.259Z","updated":"2026-10-19T08:48:20.953Z","title":"svcrdma: Reject oversized Read segments at decode time","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89528","published":"2026-09-11T19:44:08.514Z","updated":"2026-10-30T12:32:00.323Z","title":"svcrdma: Reject Read lists that exceed the page budget","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00707,"kevAdded":null},{"id":"CVE-2026-89527","published":"2026-09-11T19:44:07.785Z","updated":"2026-10-30T12:31:59.254Z","title":"svcrdma: Use svc_xprt_put to free listener on create failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2026-89526","published":"2026-09-11T19:44:07.043Z","updated":"2026-10-30T12:31:58.197Z","title":"svcrdma: Validate Read chunk positions before reconstruction","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00682,"kevAdded":null},{"id":"CVE-2026-89525","published":"2026-09-11T19:44:06.296Z","updated":"2026-10-19T08:48:16.507Z","title":"udf: reject VAT indexes equal to the entry count","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-89524","published":"2026-09-11T19:44:05.548Z","updated":"2026-10-19T08:48:15.538Z","title":"wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-89523","published":"2026-09-11T19:44:04.796Z","updated":"2026-10-19T08:48:14.517Z","title":"wifi: mt76: mt7925: cancel pending mlo_pm_work","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89522","published":"2026-09-11T19:44:04.052Z","updated":"2026-10-19T08:48:13.544Z","title":"media: staging/ipu7: fix async notifier UAF on probe error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-89521","published":"2026-09-11T19:44:03.257Z","updated":"2026-10-19T08:48:12.536Z","title":"sched/core: Handle pick_task() releasing the rq lock","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2026-89520","published":"2026-09-11T19:44:02.510Z","updated":"2026-10-30T12:31:57.122Z","title":"sched/core: Make core-sched flips wait for in-flight selections","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89519","published":"2026-09-11T19:44:01.858Z","updated":"2026-10-19T08:48:10.533Z","title":"sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89518","published":"2026-09-11T19:44:01.222Z","updated":"2026-10-19T08:48:09.565Z","title":"sched_ext: Fix this_rq() assumptions in dispatch kfuncs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89517","published":"2026-09-11T19:44:00.576Z","updated":"2026-10-19T08:48:08.592Z","title":"sched_ext: Fix rq->core_pick corruption under core scheduling","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89516","published":"2026-09-11T19:43:59.941Z","updated":"2026-10-19T08:48:07.582Z","title":"sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89515","published":"2026-09-11T19:43:59.300Z","updated":"2026-10-19T08:48:06.602Z","title":"scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-89514","published":"2026-09-11T19:43:58.621Z","updated":"2026-10-19T08:48:05.615Z","title":"scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89513","published":"2026-09-11T19:43:57.960Z","updated":"2026-10-19T08:48:04.610Z","title":"RISC-V: KVM: Fix PMU event info array size overflow","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89512","published":"2026-09-11T19:43:57.286Z","updated":"2026-10-19T08:48:03.643Z","title":"remoteproc: scp: Fix device reference leak on failed lookup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89511","published":"2026-09-11T19:43:56.640Z","updated":"2026-10-19T08:48:02.658Z","title":"qede: Fix NULL pointer dereference in TPA fragment processing","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00707,"kevAdded":null},{"id":"CVE-2026-89510","published":"2026-09-11T19:43:55.989Z","updated":"2026-10-19T08:48:01.638Z","title":"RDMA/cxgb4: Cancel reg_work before freeing device on remove","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-89509","published":"2026-09-11T19:43:55.336Z","updated":"2026-10-19T08:48:00.667Z","title":"RDMA/ionic: Embed counter driver data in rdma_counter allocation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89508","published":"2026-09-11T19:43:54.682Z","updated":"2026-10-19T08:47:59.672Z","title":"RDMA/ucma: Lock the handler in ucma_set_ib_path()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-89507","published":"2026-09-11T19:43:54.013Z","updated":"2026-10-19T08:47:58.674Z","title":"RDMA/ucma: Lock the handler in ucma_write_cm_event()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-89506","published":"2026-09-11T19:43:53.350Z","updated":"2026-10-19T08:47:57.692Z","title":"RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89505","published":"2026-09-11T19:43:52.690Z","updated":"2026-10-19T08:47:56.727Z","title":"RDMA/uverbs: Guard legacy bundles without method_elm","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-89504","published":"2026-09-11T19:43:52.024Z","updated":"2026-10-19T08:47:55.766Z","title":"regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-89503","published":"2026-09-11T19:43:51.357Z","updated":"2026-10-19T08:47:54.761Z","title":"ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-89502","published":"2026-09-11T19:43:50.700Z","updated":"2026-10-19T08:47:53.802Z","title":"ring-buffer: Free cpu_buffer::free_page with subbuf_order","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89501","published":"2026-09-11T19:43:50.063Z","updated":"2026-10-19T08:47:52.839Z","title":"ring-buffer: Hold cpu_buffer::lock when resizing a subbuf","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-89500","published":"2026-09-11T19:43:49.392Z","updated":"2026-10-19T08:47:51.845Z","title":"ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-89499","published":"2026-09-11T19:43:48.752Z","updated":"2026-10-19T08:47:50.883Z","title":"ring-buffer: Stop remote reader update when page swap fails","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-89498","published":"2026-09-11T19:43:48.096Z","updated":"2026-10-19T08:47:49.902Z","title":"orangefs: fix double-free of trailer_buf on readdir copy failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-89497","published":"2026-09-11T19:43:47.439Z","updated":"2026-10-19T08:47:48.916Z","title":"orangefs: skip leading spaces before parsing client debug masks","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-89496","published":"2026-09-11T19:43:46.772Z","updated":"2026-10-19T08:47:47.928Z","title":"ocfs2: always run deallocs on copy-on-write completion","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-89495","published":"2026-09-11T19:43:46.107Z","updated":"2026-10-19T08:47:46.925Z","title":"ocfs2: bound namelen in dlm_migrate_request_handler","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-89494","published":"2026-09-11T19:43:45.455Z","updated":"2026-10-19T08:47:45.937Z","title":"ocfs2: validate lengths in dlm_mig_lockres_handler","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-89493","published":"2026-09-11T19:43:44.803Z","updated":"2026-10-19T08:47:44.950Z","title":"ocfs2: validate rl_used against rl_count in refcount block validator","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0065,"kevAdded":null},{"id":"CVE-2026-89492","published":"2026-09-11T19:43:44.137Z","updated":"2026-10-30T12:31:56.057Z","title":"ocfs2: validate directory-index entry counts when reading metadata","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-89491","published":"2026-09-11T19:43:43.466Z","updated":"2026-10-19T08:47:43.000Z","title":"ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89490","published":"2026-09-11T19:43:42.808Z","updated":"2026-10-19T08:47:41.930Z","title":"ocfs2: fix readdir position truncation on 32-bit kernels","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-89489","published":"2026-09-11T19:43:42.164Z","updated":"2026-10-19T08:47:40.968Z","title":"openrisc: fix arbitrary kernel memory access via or1k_atomic syscall","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-89488","published":"2026-09-11T19:43:41.471Z","updated":"2026-10-19T08:47:38.827Z","title":"openvswitch: Fix CT limit teardown use-after-free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-89487","published":"2026-09-11T19:43:40.776Z","updated":"2026-10-19T08:47:37.837Z","title":"openvswitch: only skb_tx_error() a packet we are about to drop","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-89486","published":"2026-09-11T19:43:40.116Z","updated":"2026-10-19T08:47:36.844Z","title":"ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-89485","published":"2026-09-11T19:43:39.403Z","updated":"2026-10-19T08:47:35.868Z","title":"lockd: pin next file across nlm_inspect_file lock-drop","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-89484","published":"2026-09-11T19:43:38.740Z","updated":"2026-10-30T12:31:54.911Z","title":"lockd: fix NULL dereference on lockowner allocation failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-89483","published":"2026-09-11T19:43:38.076Z","updated":"2026-10-19T08:47:33.684Z","title":"nvme: zero the discard fallback page","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00571,"kevAdded":null},{"id":"CVE-2026-89482","published":"2026-09-11T19:43:37.236Z","updated":"2026-10-19T08:47:32.356Z","title":"nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-89481","published":"2026-09-11T19:43:36.589Z","updated":"2026-10-30T12:31:53.844Z","title":"nvme-tcp: fix host memory disclosure on R2T for a read command","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00432,"kevAdded":null},{"id":"CVE-2026-89480","published":"2026-09-11T19:43:35.930Z","updated":"2026-10-30T12:31:52.756Z","title":"nvme-tcp: reject a read that transferred too few bytes","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00425,"kevAdded":null},{"id":"CVE-2026-89479","published":"2026-09-11T19:43:35.263Z","updated":"2026-10-19T08:47:28.375Z","title":"sctp: stop processing a packet once its association is deleted","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.005,"kevAdded":null},{"id":"CVE-2026-89478","published":"2026-09-11T19:43:34.588Z","updated":"2026-10-19T08:47:27.202Z","title":"sctp: drop a chunk if its transport was removed","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-89477","published":"2026-09-11T19:43:33.851Z","updated":"2026-10-19T08:47:26.175Z","title":"sctp: fix NULL deref on untransmitted RECONF completion","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-89476","published":"2026-09-11T19:43:33.193Z","updated":"2026-10-19T08:47:25.179Z","title":"sctp: fix stream->outcnt underflow on duplicate RECONF responses","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00696,"kevAdded":null},{"id":"CVE-2026-89475","published":"2026-09-11T19:43:32.537Z","updated":"2026-10-30T12:31:51.693Z","title":"power: supply: bq24257: fix use-after-free on remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89474","published":"2026-09-11T19:43:31.882Z","updated":"2026-10-19T08:47:23.191Z","title":"power: supply: bq256xx: drain usb_work before freeing the charger","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89473","published":"2026-09-11T19:43:31.214Z","updated":"2026-10-19T08:47:22.219Z","title":"power: supply: bq25890: Fix power_supply reference leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89472","published":"2026-09-11T19:43:30.536Z","updated":"2026-10-30T12:31:50.628Z","title":"power: supply: charger-manager: register regulators before exposing sysfs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-89471","published":"2026-09-11T19:43:29.867Z","updated":"2026-10-19T08:47:20.319Z","title":"power: supply: cros_usbpd-charger: bound the EC-reported port count","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-89470","published":"2026-09-11T19:43:29.206Z","updated":"2026-10-19T08:47:19.356Z","title":"power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-89469","published":"2026-09-11T19:43:28.560Z","updated":"2026-10-19T08:47:18.365Z","title":"power: supply: lp8727: fix use-after-free in lp8727_release_irq()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-89468","published":"2026-09-11T19:43:27.906Z","updated":"2026-10-30T12:31:49.548Z","title":"power: supply: lp8788-charger: fix use-after-free on remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89467","published":"2026-09-11T19:43:27.247Z","updated":"2026-10-21T12:47:32.936Z","title":"power: supply: qcom_battmgr: fix use-after-free","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-89466","published":"2026-09-11T19:43:26.621Z","updated":"2026-10-19T08:47:15.439Z","title":"power: supply: qcom_battmgr: terminate the strings from firmware","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-89465","published":"2026-09-11T19:43:25.950Z","updated":"2026-10-30T12:31:47.294Z","title":"power: supply: rt9455: quiesce delayed work before teardown","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-89464","published":"2026-09-11T19:43:25.282Z","updated":"2026-10-19T08:47:13.492Z","title":"power: supply: twl4030_charger: cancel workers via devm","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89463","published":"2026-09-11T19:43:24.629Z","updated":"2026-10-30T12:31:46.232Z","title":"power: supply: ucs1002: fix use-after-free on remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89462","published":"2026-09-11T19:43:23.984Z","updated":"2026-10-30T12:31:45.157Z","title":"power: supply: max17040: propagate register read errors","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89461","published":"2026-09-11T19:43:23.323Z","updated":"2026-10-19T08:47:10.579Z","title":"power: supply: max17040: synchronize work cancellation on suspend","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-89460","published":"2026-09-11T19:43:22.664Z","updated":"2026-10-19T08:47:09.624Z","title":"s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-89459","published":"2026-09-11T19:43:22.007Z","updated":"2026-10-19T08:47:08.639Z","title":"s390/percpu: Fix MVIY_PERCPU() with older binutils","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2026-89458","published":"2026-09-11T19:43:21.346Z","updated":"2026-10-19T08:47:07.708Z","title":"s390/dasd: Do not complete a failed ESE read as successful","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-89457","published":"2026-09-11T19:43:20.701Z","updated":"2026-10-19T08:47:06.711Z","title":"s390/dasd: Guard sysfs discipline callbacks against unallocated private data","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-89456","published":"2026-09-11T19:43:20.037Z","updated":"2026-10-19T08:47:05.735Z","title":"s390/dasd: Propagate partial completion length across ERP recovery","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2026-89455","published":"2026-09-11T19:43:19.370Z","updated":"2026-10-19T08:47:04.758Z","title":"PCI: plda: Fix use-after-free of event IRQs during teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89454","published":"2026-09-11T19:43:18.717Z","updated":"2026-10-19T08:47:03.777Z","title":"PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89453","published":"2026-09-11T19:43:18.068Z","updated":"2026-10-19T08:47:02.825Z","title":"iommu/amd: Put PCI device after handling PPR faults","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89452","published":"2026-09-11T19:43:17.405Z","updated":"2026-10-30T12:31:44.077Z","title":"iommu/msm: Unwind probe state on registration failure","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-89451","published":"2026-09-11T19:43:16.730Z","updated":"2026-10-21T12:47:29.668Z","title":"iommu/sva: Set handle->dev before the SVA handle is visible","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89450","published":"2026-09-11T19:43:16.060Z","updated":"2026-10-19T08:46:59.901Z","title":"iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-89449","published":"2026-09-11T19:43:15.397Z","updated":"2026-10-19T08:46:58.738Z","title":"iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89448","published":"2026-09-11T19:43:14.746Z","updated":"2026-10-30T12:31:42.885Z","title":"iommu/vt-d: Force requesting ACS when tboot is enabled","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-89447","published":"2026-09-11T19:43:14.094Z","updated":"2026-10-19T08:46:56.784Z","title":"iommufd: Avoid locking internal accesses during unmap","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-89446","published":"2026-09-11T19:43:13.431Z","updated":"2026-10-19T08:46:55.828Z","title":"iommufd: Release current IOAS on xa_store() failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89445","published":"2026-09-11T19:43:12.765Z","updated":"2026-10-19T08:46:54.686Z","title":"iommufd: Fix UAF in selftest IOPF reporting","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-89444","published":"2026-09-11T19:43:12.076Z","updated":"2026-10-19T08:46:53.734Z","title":"platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-89443","published":"2026-09-11T19:43:11.407Z","updated":"2026-10-19T08:46:52.766Z","title":"platform/x86: ISST: Validate level in perf mask ioctls","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-89442","published":"2026-09-11T19:43:10.753Z","updated":"2026-10-19T08:46:51.770Z","title":"platform/x86: ISST: Validate socket ID in clos_assoc ioctl","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-89441","published":"2026-09-11T19:43:10.083Z","updated":"2026-10-30T12:31:41.816Z","title":"mmc: via-sdmmc: cancel card-detect work on remove","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-89440","published":"2026-09-11T19:43:09.402Z","updated":"2026-10-19T08:46:49.770Z","title":"mmc: via-sdmmc: stop card-detect handling on probe failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-89439","published":"2026-09-11T19:43:08.745Z","updated":"2026-10-21T12:47:27.422Z","title":"platform/x86: ISST: Add a NULL check for sst_inst[]","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89438","published":"2026-09-11T19:43:08.077Z","updated":"2026-10-19T08:46:46.711Z","title":"platform/x86: ISST: Validate logical CPU id and clos id","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-89437","published":"2026-09-11T19:43:07.377Z","updated":"2026-10-30T12:31:40.747Z","title":"platform/x86: int1092: Fix potential memory leak in sar_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-89436","published":"2026-09-11T19:43:06.732Z","updated":"2026-10-19T08:46:44.750Z","title":"platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[]","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-81018","published":"2026-09-11T19:43:06.080Z","updated":"2026-10-19T08:46:43.567Z","title":"platform/x86: think-lmi: Free system certificate signatures","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-81017","published":"2026-09-11T19:43:05.409Z","updated":"2026-10-19T08:46:42.592Z","title":"platform/chrome: sensorhub: Bound the EC-reported sensor number","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-81016","published":"2026-09-11T19:43:04.740Z","updated":"2026-10-30T12:31:39.670Z","title":"platform/x86/amd/pmc: Propagate SMU errors and validate S2D address","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-81015","published":"2026-09-11T19:43:04.063Z","updated":"2026-10-19T08:46:40.596Z","title":"platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-81014","published":"2026-09-11T19:43:03.397Z","updated":"2026-10-19T08:46:39.559Z","title":"platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-81013","published":"2026-09-11T19:43:02.741Z","updated":"2026-10-19T08:46:38.578Z","title":"platform/x86: hp-bioscfg: fix heap OOB read on empty password write","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-81012","published":"2026-09-11T19:43:02.082Z","updated":"2026-10-19T08:46:37.440Z","title":"platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-81011","published":"2026-09-11T19:43:01.422Z","updated":"2026-10-19T08:46:36.444Z","title":"platform/x86: hp-bioscfg: pass validated element count to package parsers","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-81010","published":"2026-09-11T19:43:00.754Z","updated":"2026-10-19T08:46:35.449Z","title":"io_uring/waitid: honor task_work cancellation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-81009","published":"2026-09-11T19:43:00.074Z","updated":"2026-10-19T08:46:34.500Z","title":"io_uring/query: cap user size passed to copy_struct_to_user","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-81008","published":"2026-09-11T19:42:59.405Z","updated":"2026-10-19T08:46:33.532Z","title":"interconnect: Fix use after free in icc_get() and of_icc_get_by_index()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-81007","published":"2026-09-11T19:42:58.751Z","updated":"2026-10-19T08:46:32.534Z","title":"ipmi: ipmb: validate write message length","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-81006","published":"2026-09-11T19:42:58.111Z","updated":"2026-10-19T08:46:31.551Z","title":"ipmi: Remove all sysfs files on registration failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-81005","published":"2026-09-11T19:42:57.460Z","updated":"2026-10-19T08:46:29.573Z","title":"ipmi: si: Fix NULL pointer dereference after failed registration","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-81004","published":"2026-09-11T19:42:56.813Z","updated":"2026-10-19T08:46:28.597Z","title":"ipmi:msghandler: Cancel work cleanly on an error","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-81003","published":"2026-09-11T19:42:56.172Z","updated":"2026-10-19T08:46:27.617Z","title":"net/iucv: filter frames in afiucv_hs_rcv() by ingress device","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00309,"kevAdded":null},{"id":"CVE-2026-81002","published":"2026-09-11T19:42:55.506Z","updated":"2026-10-19T08:46:26.611Z","title":"xdp: fix zero-copy frame layout","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-81001","published":"2026-09-11T19:42:54.846Z","updated":"2026-10-19T08:46:25.639Z","title":"slip: fix use-after-free in sl_sync()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-81000","published":"2026-09-11T19:42:54.181Z","updated":"2026-10-19T08:46:24.640Z","title":"net: tun: bound receive headroom","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-80999","published":"2026-09-11T19:42:53.509Z","updated":"2026-10-19T08:46:23.651Z","title":"net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80998","published":"2026-09-11T19:42:52.861Z","updated":"2026-10-19T08:46:22.468Z","title":"net: bnxt: ring the doorbell when SW USO exits early","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-80997","published":"2026-09-11T19:42:52.215Z","updated":"2026-10-19T08:46:21.504Z","title":"net: ipa: fix stalled modem TX queue after runtime resume","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00612,"kevAdded":null},{"id":"CVE-2026-80996","published":"2026-09-11T19:42:51.542Z","updated":"2026-10-30T12:31:38.596Z","title":"net: l2tp: do not propagate multicast notification errors","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80995","published":"2026-09-11T19:42:50.866Z","updated":"2026-10-19T08:46:19.571Z","title":"net: mctp: hold a reference to the route device in mctp_route_lookup()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-80994","published":"2026-09-11T19:42:50.199Z","updated":"2026-10-19T08:46:18.623Z","title":"net: openvswitch: fix flow mask use-after-free on flow deletion","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-80993","published":"2026-09-11T19:42:49.521Z","updated":"2026-10-19T08:46:17.653Z","title":"net: phylink: correctly validate returned PCS in phylink_inband_caps","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80992","published":"2026-09-11T19:42:48.855Z","updated":"2026-10-19T08:46:16.688Z","title":"net: ravb: avoid dereferencing an invalid PTP clock","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-80991","published":"2026-09-11T19:42:48.187Z","updated":"2026-10-30T12:31:37.536Z","title":"net: ravb: serialize PTP clock teardown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-80990","published":"2026-09-11T19:42:47.534Z","updated":"2026-10-30T12:31:36.465Z","title":"net: thunderbolt: Release the Rx HopID that was handed out on mismatch","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-80989","published":"2026-09-11T19:42:46.872Z","updated":"2026-10-30T12:31:35.373Z","title":"net: thunderbolt: Mark the connection down when bringing it up fails","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-80988","published":"2026-09-11T19:42:46.228Z","updated":"2026-10-19T08:46:12.548Z","title":"NTB: ntb_transport: Fail TX enqueue when the QP link is down","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-80987","published":"2026-09-11T19:42:45.574Z","updated":"2026-10-19T08:46:11.577Z","title":"NTB: ntb_transport: Reject oversized TX buffers","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-80986","published":"2026-09-11T19:42:44.904Z","updated":"2026-10-19T08:46:10.570Z","title":"net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00649,"kevAdded":null},{"id":"CVE-2026-80985","published":"2026-09-11T19:42:44.243Z","updated":"2026-10-19T08:46:09.624Z","title":"net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00526,"kevAdded":null},{"id":"CVE-2026-80984","published":"2026-09-11T19:42:43.573Z","updated":"2026-10-19T08:46:08.671Z","title":"net/smc: do not dereference an unset send buffer on the SMC-D teardown path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80983","published":"2026-09-11T19:42:42.912Z","updated":"2026-10-30T12:31:34.279Z","title":"net/smc: fix socket refcount leak in smc_switch_conns()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-80982","published":"2026-09-11T19:42:42.243Z","updated":"2026-10-19T08:46:06.717Z","title":"net/smc: fix use-after-free in smc_rx_pipe_buf_release()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-80981","published":"2026-09-11T19:42:41.543Z","updated":"2026-10-19T08:46:05.740Z","title":"net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00631,"kevAdded":null},{"id":"CVE-2026-80980","published":"2026-09-11T19:42:40.832Z","updated":"2026-10-30T12:31:33.078Z","title":"net/smc: stop killed, freed and out_of_sync sharing a byte","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00682,"kevAdded":null},{"id":"CVE-2026-80979","published":"2026-09-11T19:42:40.171Z","updated":"2026-10-19T08:46:03.770Z","title":"net/smc: unregister the connection before draining the rx tasklet","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-80978","published":"2026-09-11T19:42:39.496Z","updated":"2026-10-19T08:46:02.787Z","title":"net: cap advertised IP tunnel headroom","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-80977","published":"2026-09-11T19:42:38.862Z","updated":"2026-10-19T08:46:01.788Z","title":"net: skbuff: don't touch shared zerocopy state in skb_tx_error()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-80976","published":"2026-09-11T19:42:38.215Z","updated":"2026-10-19T08:46:00.756Z","title":"seg6: reset IP6CB after IPv6 decapsulation","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-80975","published":"2026-09-11T19:42:37.086Z","updated":"2026-10-19T08:45:59.772Z","title":"mfd: qnap-mcu: keep the reply buffer alive past a command timeout","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80974","published":"2026-09-11T19:42:36.399Z","updated":"2026-10-30T12:31:32.012Z","title":"mfd: sm501: Fix potential memory leaks during remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2026-80973","published":"2026-09-11T19:42:35.751Z","updated":"2026-10-19T08:45:57.889Z","title":"ALSA: 6fire: bound the MIDI event length from the device","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-80972","published":"2026-09-11T19:42:35.085Z","updated":"2026-10-19T08:45:56.953Z","title":"ALSA: aloop: Check card index validity at probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80971","published":"2026-09-11T19:42:34.441Z","updated":"2026-10-19T08:45:55.974Z","title":"ALSA: bcd2000: clear the URB pointers on disconnect","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-80970","published":"2026-09-11T19:42:33.789Z","updated":"2026-10-19T08:45:54.980Z","title":"ALSA: FCP: do not copy out an uninitialised init response","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80969","published":"2026-09-11T19:42:33.128Z","updated":"2026-10-19T08:45:54.014Z","title":"ALSA: mpu401: Check card index validity at probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-80968","published":"2026-09-11T19:42:32.473Z","updated":"2026-10-19T08:45:53.065Z","title":"ALSA: mts64: Check card index validity at probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-80967","published":"2026-09-11T19:42:31.811Z","updated":"2026-10-30T12:31:30.940Z","title":"ALSA: pcxhr: initialize mutexes before requesting threaded IRQ","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-80966","published":"2026-09-11T19:42:31.160Z","updated":"2026-10-19T08:45:50.251Z","title":"ALSA: portman2x4: Check card index validity at probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-80965","published":"2026-09-11T19:42:30.507Z","updated":"2026-10-19T08:45:49.194Z","title":"ALSA: serial-u16550: Check card index validity at probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-80964","published":"2026-09-11T19:42:29.844Z","updated":"2026-10-19T08:45:48.212Z","title":"ALSA: virmidi: Check card index validity at probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80963","published":"2026-09-11T19:42:29.172Z","updated":"2026-10-19T08:45:47.190Z","title":"dm-stats: fix a crash if allocation of per-cpu data fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-80962","published":"2026-09-11T19:42:28.500Z","updated":"2026-10-19T08:45:46.216Z","title":"dm-pcache: validate geometry fields from on-disk cache_info","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80961","published":"2026-09-11T19:42:27.847Z","updated":"2026-10-19T08:45:45.271Z","title":"dm-pcache: validate kset key_num and intra-segment bounds","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80960","published":"2026-09-11T19:42:27.182Z","updated":"2026-10-19T08:45:44.213Z","title":"dm-pcache: validate on-media seg_num against the cache device size","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80959","published":"2026-09-11T19:42:26.514Z","updated":"2026-10-19T08:45:43.213Z","title":"dm-pcache: bound the persisted tail-position offset","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80958","published":"2026-09-11T19:42:25.861Z","updated":"2026-10-19T08:45:42.221Z","title":"dm-pcache: clamp the tail kset read to the segment data region","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-80957","published":"2026-09-11T19:42:25.194Z","updated":"2026-10-19T08:45:41.225Z","title":"dm-pcache: detect a cycle in the last-kset chain during replay","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80956","published":"2026-09-11T19:42:24.541Z","updated":"2026-10-19T08:45:40.093Z","title":"dm-pcache: only hand out initialized cache segments","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80955","published":"2026-09-11T19:42:23.838Z","updated":"2026-10-19T08:45:39.156Z","title":"dm-pcache: fix use-after-free and invalid seg operations in kset_replay()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80954","published":"2026-09-11T19:42:23.169Z","updated":"2026-10-19T08:45:38.169Z","title":"i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-80953","published":"2026-09-11T19:42:22.515Z","updated":"2026-10-19T08:45:37.183Z","title":"i3c: master: adi: initialize the lock before enabling interrupts","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-80952","published":"2026-09-11T19:42:21.868Z","updated":"2026-10-19T08:45:36.170Z","title":"i3c: master: Fix info leak and UAF in device unregister path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-80951","published":"2026-09-11T19:42:21.115Z","updated":"2026-10-19T08:45:35.194Z","title":"i3c: master: svc: bound IBI payload to the requested max_payload_len","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-80950","published":"2026-09-11T19:42:20.360Z","updated":"2026-10-19T08:45:34.205Z","title":"i3c: renesas: Check that the transfer is valid before accessing it","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80949","published":"2026-09-11T19:42:19.707Z","updated":"2026-10-19T08:45:33.207Z","title":"wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-80948","published":"2026-09-11T19:42:19.048Z","updated":"2026-10-30T12:31:29.878Z","title":"wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-80947","published":"2026-09-11T19:42:18.282Z","updated":"2026-10-30T12:31:28.821Z","title":"wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-80946","published":"2026-09-11T19:42:17.576Z","updated":"2026-10-19T08:45:30.291Z","title":"fuse: copy request headers via a stack buffer for io-uring","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-80945","published":"2026-09-11T19:42:16.824Z","updated":"2026-10-19T08:45:29.322Z","title":"crypto: iaa - unmap dst before software fallback on decompress","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-80944","published":"2026-09-11T19:42:16.076Z","updated":"2026-10-19T08:45:28.363Z","title":"wifi: mwifiex: Detach sync cmd buffer on interrupted wait","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-80943","published":"2026-09-11T19:42:15.341Z","updated":"2026-10-19T08:45:27.392Z","title":"wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids","severity":"HIGH","score":7.6,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2026-80942","published":"2026-09-11T19:42:14.589Z","updated":"2026-10-19T08:45:26.138Z","title":"wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80941","published":"2026-09-11T19:42:13.854Z","updated":"2026-10-19T08:45:25.151Z","title":"wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-80940","published":"2026-09-11T19:42:13.084Z","updated":"2026-10-19T08:45:24.150Z","title":"wifi: rtw88: pci: fix resource leak on failed NAPI setup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80939","published":"2026-09-11T19:42:12.340Z","updated":"2026-10-19T08:45:23.179Z","title":"wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80938","published":"2026-09-11T19:42:11.588Z","updated":"2026-10-19T08:45:22.189Z","title":"wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80937","published":"2026-09-11T19:42:10.822Z","updated":"2026-10-30T12:31:27.755Z","title":"wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00347,"kevAdded":null},{"id":"CVE-2026-80936","published":"2026-09-11T19:42:10.034Z","updated":"2026-10-19T08:45:19.996Z","title":"wifi: mt76: mt7925: cancel mlo_pm_work on stop","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80935","published":"2026-09-11T19:42:09.286Z","updated":"2026-10-21T12:47:15.492Z","title":"wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2026-80934","published":"2026-09-11T19:42:08.494Z","updated":"2026-10-19T08:45:18.030Z","title":"wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80933","published":"2026-09-11T19:42:07.754Z","updated":"2026-10-19T08:45:17.026Z","title":"wifi: mt76: mt7996: validate default EEPROM firmware size","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-80932","published":"2026-09-11T19:42:07.012Z","updated":"2026-10-19T08:45:16.044Z","title":"vsock/virtio: flush works in dependency order","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-80931","published":"2026-09-11T19:42:06.272Z","updated":"2026-10-19T08:45:15.065Z","title":"w1: ds28e17: reject an oversize length on an I2C block read","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-80930","published":"2026-09-11T19:42:05.528Z","updated":"2026-10-19T08:45:14.086Z","title":"tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-80929","published":"2026-09-11T19:42:04.778Z","updated":"2026-10-19T08:45:13.127Z","title":"sysctl: move the \"cad_pid\" entry from pid_table[] to kern_reboot_table[]","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-80928","published":"2026-09-11T19:42:04.044Z","updated":"2026-10-19T08:45:12.134Z","title":"smack: fix cred UAF in smack_file_send_sigiotask()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-80927","published":"2026-09-11T19:42:03.257Z","updated":"2026-10-19T08:45:11.147Z","title":"timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80926","published":"2026-09-11T19:37:29.855Z","updated":"2026-10-19T08:45:10.176Z","title":"ksmbd: fix use-after-free in oplock break notification","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00444,"kevAdded":null},{"id":"CVE-2026-80925","published":"2026-09-09T16:19:44.748Z","updated":"2026-10-30T12:31:26.687Z","title":"vlan: fix skb_under_panic and races when toggling HW VLAN offload","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-80924","published":"2026-09-09T16:19:44.150Z","updated":"2026-10-19T08:45:08.269Z","title":"crypto: krb5 - use kfree_sensitive() for derived key buffers","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2026-80923","published":"2026-09-09T16:19:43.538Z","updated":"2026-10-19T08:45:07.298Z","title":"xhci: dbgtty: Fix unregister on tty_register_driver() failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-80922","published":"2026-09-09T16:19:42.937Z","updated":"2026-10-19T08:45:05.971Z","title":"crypto: qcom-rng - Allow zero as a random number","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-80921","published":"2026-09-09T16:19:42.335Z","updated":"2026-10-19T08:45:04.791Z","title":"KVM: s390: vsie: zero stale crypto bits","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-80920","published":"2026-09-09T16:13:17.023Z","updated":"2026-10-21T12:47:14.401Z","title":"io_uring: defer eventfd signaling when queued from a wakeup handler","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-80919","published":"2026-09-09T16:13:16.415Z","updated":"2026-09-09T16:13:16.415Z","title":"drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-80918","published":"2026-09-09T16:13:15.799Z","updated":"2026-10-19T08:45:02.656Z","title":"HID: core: fix number/pointer type confusion on long items","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-80917","published":"2026-09-09T16:13:15.202Z","updated":"2026-10-19T08:45:01.637Z","title":"PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-80916","published":"2026-09-09T16:13:14.587Z","updated":"2026-10-19T08:45:00.547Z","title":"kcov: fix data corruption and race conditions on PREEMPT_RT","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-80915","published":"2026-09-09T16:13:13.979Z","updated":"2026-09-09T16:13:13.979Z","title":"drm/xe: Fix DPT allocation paths.","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-80914","published":"2026-09-09T16:10:58.675Z","updated":"2026-10-19T08:44:59.509Z","title":"Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2026-80913","published":"2026-09-04T17:19:23.975Z","updated":"2026-09-04T17:19:23.975Z","title":"selinux: require every boolean value to be defined","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-80912","published":"2026-09-04T17:19:23.066Z","updated":"2026-09-14T11:58:53.633Z","title":"selinux: reject an unclaimed class value in security_get_classes()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-80911","published":"2026-09-04T17:19:22.045Z","updated":"2026-09-04T17:19:22.045Z","title":"ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-80910","published":"2026-09-04T17:19:21.079Z","updated":"2026-09-04T17:19:21.079Z","title":"ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-80909","published":"2026-09-04T17:19:20.085Z","updated":"2026-09-07T14:21:32.011Z","title":"drm/amdgpu: Reject UVD message with invalid number of h265 refs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-80908","published":"2026-09-04T17:19:19.155Z","updated":"2026-09-07T14:21:30.299Z","title":"drm/amdgpu: Reject UVD message with dimensions above 4096","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-80907","published":"2026-09-04T17:19:18.052Z","updated":"2026-10-30T12:31:25.612Z","title":"drm/amdgpu: Fix UVD dpb min size calculation for H264","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-80906","published":"2026-09-04T17:19:16.531Z","updated":"2026-09-04T17:19:16.531Z","title":"net: packet: fix wrong transport_header when sending VLAN-tagged frame","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-80905","published":"2026-09-04T17:19:15.289Z","updated":"2026-10-30T12:31:24.447Z","title":"net: tap: fix wrong transport_header when sending VLAN-tagged frame","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-80904","published":"2026-09-04T17:19:14.391Z","updated":"2026-09-04T17:19:14.391Z","title":"net/tls: Fail tls_sw_splice_read() after a failed async decrypt","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-80903","published":"2026-09-04T17:19:13.464Z","updated":"2026-09-04T17:19:13.464Z","title":"drm/xe/oa: Fix sync entry leak on OA config emit failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-80902","published":"2026-09-04T17:11:17.510Z","updated":"2026-09-04T17:11:17.510Z","title":"dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-80901","published":"2026-09-04T17:11:15.780Z","updated":"2026-09-04T17:11:15.780Z","title":"ipvs: fix the checksum validations","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-80900","published":"2026-09-04T17:11:14.939Z","updated":"2026-09-04T17:11:14.939Z","title":"ASoC: SDCA: Make UMP message size check more robust","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-80899","published":"2026-09-04T17:11:14.158Z","updated":"2026-09-07T14:21:26.371Z","title":"erofs: remove fscache backend entirely","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-80898","published":"2026-09-04T17:11:13.337Z","updated":"2026-09-04T17:11:13.337Z","title":"netfs: clear PG_private_2 on copy-to-cache append failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80897","published":"2026-09-04T17:11:12.499Z","updated":"2026-10-21T12:47:12.430Z","title":"netfs: release readahead folios on iterator preparation failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-80896","published":"2026-09-04T17:11:11.689Z","updated":"2026-09-04T17:11:11.689Z","title":"mshv: Fix race in mshv_irqfd_deassign","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80895","published":"2026-09-04T17:11:10.880Z","updated":"2026-09-04T17:11:10.880Z","title":"mshv: Order pt_vp_array publish against irqfd assertion path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-80894","published":"2026-09-04T17:11:10.093Z","updated":"2026-09-04T17:11:10.093Z","title":"iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80893","published":"2026-09-04T17:11:09.199Z","updated":"2026-09-04T17:11:09.199Z","title":"mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80892","published":"2026-09-04T17:11:08.391Z","updated":"2026-09-04T17:11:08.391Z","title":"erofs: cap LZMA stream pool size","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80891","published":"2026-09-04T17:11:07.555Z","updated":"2026-09-04T17:11:07.555Z","title":"KVM: s390: pci: Validate AIBV and AISB before pinning guest pages","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-80890","published":"2026-09-04T17:11:06.742Z","updated":"2026-09-04T17:11:06.742Z","title":"sctp: reject stale cookies with mismatched verification tags","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-80889","published":"2026-09-04T17:11:05.854Z","updated":"2026-09-04T17:11:05.854Z","title":"can: isotp: fix timer drain order, wakeup handling and tx_gen ordering","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-80888","published":"2026-09-04T17:11:04.975Z","updated":"2026-09-14T11:58:52.563Z","title":"drm/vmwgfx: drop dma_buf reference on foreign-fd prime import","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-80887","published":"2026-09-04T17:11:04.063Z","updated":"2026-09-04T17:11:04.063Z","title":"drm/vmwgfx: use check_add_overflow for shader size+offset bound","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80886","published":"2026-09-04T16:49:35.864Z","updated":"2026-09-04T16:49:35.864Z","title":"serial: msm: Disable DMA for kernel console UART","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-80885","published":"2026-09-04T16:49:34.486Z","updated":"2026-09-04T16:49:34.486Z","title":"afs: Fix uncancelled rxrpc OOB message handler","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80884","published":"2026-09-04T16:49:31.751Z","updated":"2026-10-30T12:31:23.382Z","title":"ntb: Store original DMA address for future release","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-80883","published":"2026-09-04T16:49:24.462Z","updated":"2026-10-30T12:31:22.320Z","title":"drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-80882","published":"2026-09-04T16:49:19.908Z","updated":"2026-09-04T16:49:19.908Z","title":"crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-80881","published":"2026-09-04T16:49:11.758Z","updated":"2026-09-04T16:49:11.758Z","title":"ocfs2: fix buffer head management in ocfs2_read_blocks()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-80880","published":"2026-09-04T16:49:05.562Z","updated":"2026-09-04T16:49:05.562Z","title":"IB/mlx5: Properly support implicit ODP rereg_mr","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-80879","published":"2026-09-04T16:49:02.905Z","updated":"2026-09-04T16:49:02.905Z","title":"ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-80878","published":"2026-09-04T16:48:59.112Z","updated":"2026-09-14T11:58:51.486Z","title":"afs: Fix leak of ungot volume","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-80877","published":"2026-09-04T16:48:56.638Z","updated":"2026-09-04T16:48:56.638Z","title":"afs: Fix vllist leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-80876","published":"2026-09-04T16:48:50.082Z","updated":"2026-09-04T16:48:50.082Z","title":"ring-buffer: Fix event length with forced 8-byte alignment","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-80875","published":"2026-09-04T16:48:48.307Z","updated":"2026-09-04T16:48:48.307Z","title":"ipvs: use parsed transport offset in TCP state lookup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-80874","published":"2026-09-04T16:48:46.209Z","updated":"2026-09-04T16:48:46.209Z","title":"arm64: dts: renesas: ironhide: Describe inline ECC carveouts","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-80873","published":"2026-09-04T16:48:40.889Z","updated":"2026-09-04T16:48:40.889Z","title":"KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80872","published":"2026-09-04T16:48:37.011Z","updated":"2026-09-04T16:48:37.011Z","title":"ALSA: hda/tas2781: Cancel async firmware request at unbind","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80871","published":"2026-09-04T16:48:34.587Z","updated":"2026-09-04T16:48:34.587Z","title":"crypto: xilinx-trng - Remove crypto_rng interface","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80870","published":"2026-09-04T16:48:31.902Z","updated":"2026-09-04T16:48:31.902Z","title":"drm/amdkfd: Validate CRIU-restored IDs before idr_alloc","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-80869","published":"2026-09-04T16:48:27.068Z","updated":"2026-09-04T16:48:27.068Z","title":"ntfs: bound the attribute-list entry in ntfs_read_inode_mount()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-80868","published":"2026-09-04T16:48:23.333Z","updated":"2026-09-04T16:48:23.333Z","title":"ntfs3: Allocate iomap inline_data using alloc_page","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-80867","published":"2026-09-04T16:48:15.723Z","updated":"2026-09-04T16:48:15.723Z","title":"alpha/PCI: Add security_locked_down() check to pci_mmap_resource()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-80866","published":"2026-09-04T16:48:11.682Z","updated":"2026-10-30T12:31:21.261Z","title":"tipc: avoid busy looping in tipc_exit_net()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-80865","published":"2026-09-04T16:48:08.582Z","updated":"2026-09-04T16:48:08.582Z","title":"bpf: Add missing access_ok call to copy_user_syms","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-80864","published":"2026-09-04T15:55:18.791Z","updated":"2026-10-30T12:31:20.192Z","title":"RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-80863","published":"2026-09-04T15:55:17.668Z","updated":"2026-10-19T08:44:57.409Z","title":"RDMA/rxe: Fix OOB in free_rd_atomic_resources()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-80862","published":"2026-09-04T15:55:16.653Z","updated":"2026-10-21T12:47:08.178Z","title":"nvme-tcp: fix usage of page_frag_cache","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-80861","published":"2026-09-04T15:55:15.491Z","updated":"2026-10-30T12:31:19.114Z","title":"usb: xhci: bail out of setup if the controller is inaccessible","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-80860","published":"2026-09-04T15:55:14.285Z","updated":"2026-10-19T08:44:54.232Z","title":"fuse: fix race between interrupt and resend","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-80859","published":"2026-09-04T15:55:13.378Z","updated":"2026-10-19T08:44:53.169Z","title":"fuse: fix missing barrier when checking io-uring readiness","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-80858","published":"2026-09-04T15:55:12.442Z","updated":"2026-10-19T08:44:52.217Z","title":"fuse: publish io-uring queues with release semantics","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-80857","published":"2026-09-04T15:55:10.641Z","updated":"2026-10-19T08:44:51.239Z","title":"fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-80856","published":"2026-09-04T15:55:09.250Z","updated":"2026-10-30T12:31:18.058Z","title":"fuse: fix invalidate lock leak on setattr writeback failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-80855","published":"2026-09-04T15:55:07.864Z","updated":"2026-10-30T12:31:16.183Z","title":"fuse: fix invalidate lock leak on open O_TRUNC DAX failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-80854","published":"2026-09-04T15:55:06.478Z","updated":"2026-10-19T08:44:48.320Z","title":"usb: gadget: f_tcm: keep port count until LUN teardown completes","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-80853","published":"2026-09-04T15:55:05.021Z","updated":"2026-10-19T08:44:47.327Z","title":"KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-80852","published":"2026-09-04T15:55:02.806Z","updated":"2026-10-30T12:31:15.036Z","title":"tls: device: fix out-of-bounds write in tls_append_frag()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-80851","published":"2026-09-04T15:55:01.667Z","updated":"2026-10-30T12:31:13.973Z","title":"gtp: serialize PDP context updates","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80850","published":"2026-09-04T15:55:00.588Z","updated":"2026-10-19T08:44:44.397Z","title":"tcp: fix AO info use-after-free in tcp_ao_connect_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-80849","published":"2026-09-04T15:54:59.412Z","updated":"2026-10-19T08:44:43.405Z","title":"net/tcp-ao: fix use-after-free of current_key on reconnect to another peer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80848","published":"2026-09-04T15:54:58.427Z","updated":"2026-10-19T08:44:42.445Z","title":"xfrm: espintcp: fix UAF during close","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80847","published":"2026-09-04T15:54:57.441Z","updated":"2026-10-30T12:31:12.904Z","title":"tcp: clamp route advmss to TCP_MIN_MSS","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-80846","published":"2026-09-04T15:54:56.492Z","updated":"2026-10-19T08:44:40.508Z","title":"xfrm: drop ESP-in-TCP packets with no ingress device","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80845","published":"2026-09-04T15:54:55.489Z","updated":"2026-10-19T08:44:39.455Z","title":"xfrm: avoid lock inversion in nat keepalive work","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80844","published":"2026-09-04T15:54:54.295Z","updated":"2026-10-19T08:44:37.342Z","title":"xfrm: ah6: validate routing header segments_left","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00434,"kevAdded":null},{"id":"CVE-2026-80843","published":"2026-09-04T15:54:53.328Z","updated":"2026-10-19T08:44:36.352Z","title":"xfrm: fix xfrm_state_construct() auth-trunc leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80842","published":"2026-09-04T15:54:52.459Z","updated":"2026-10-19T08:44:35.389Z","title":"net: bridge: mcast: fix use-after-free of a master VLAN's multicast context","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-80841","published":"2026-09-04T15:54:51.459Z","updated":"2026-10-30T12:31:11.820Z","title":"net/packet: defer vmalloc TX_RING free until skbs finish","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80840","published":"2026-09-04T15:54:50.403Z","updated":"2026-10-19T08:44:33.475Z","title":"ipv6: seg6: clear IPv4 control block on IPIP decapsulation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-80839","published":"2026-09-04T15:54:49.378Z","updated":"2026-10-19T08:44:32.478Z","title":"batman-adv: reject unrepresentable multicast TVLV offsets","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80838","published":"2026-09-04T15:54:48.371Z","updated":"2026-10-19T08:44:30.457Z","title":"vxlan: keep the last remote linked during FDB flush","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80837","published":"2026-09-04T15:54:47.179Z","updated":"2026-10-30T12:31:10.733Z","title":"netfilter: nf_tables: don't queue packet path object notifications","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80836","published":"2026-09-04T15:54:44.981Z","updated":"2026-10-30T12:31:09.682Z","title":"crypto: virtio - bound the akcipher result length","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80835","published":"2026-09-04T15:54:44.116Z","updated":"2026-10-19T08:44:27.558Z","title":"crypto: qcom-rng - Remove crypto_rng interface","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80834","published":"2026-09-04T15:54:42.951Z","updated":"2026-10-19T08:44:26.581Z","title":"crypto: sun8i-ce - Remove crypto_rng interface","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-80833","published":"2026-09-04T15:54:41.795Z","updated":"2026-10-19T08:44:25.619Z","title":"crypto: sun8i-ss - Remove crypto_rng interface","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-80832","published":"2026-09-04T15:54:40.017Z","updated":"2026-10-19T08:44:24.636Z","title":"crypto: qce - fix CCM AAD buffer underallocation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-80831","published":"2026-09-04T15:54:36.250Z","updated":"2026-10-19T08:44:23.654Z","title":"crypto: mxs-dcp - fix source scatterlist length access","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-80830","published":"2026-09-04T15:54:35.169Z","updated":"2026-10-19T08:44:22.699Z","title":"usb: core: Add lock to usb_wakeup_notification()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80829","published":"2026-09-04T15:54:33.981Z","updated":"2026-10-19T08:44:21.713Z","title":"ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80828","published":"2026-09-04T15:54:32.894Z","updated":"2026-10-19T08:44:20.734Z","title":"ALSA: usb-audio: Complete cleanup after system-resume errors","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-80827","published":"2026-09-04T15:54:31.111Z","updated":"2026-10-19T08:44:19.753Z","title":"USB: serial: option: fix slab OOB read in interrupt URB callback","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80826","published":"2026-09-04T15:54:30.131Z","updated":"2026-10-19T08:44:18.781Z","title":"USB: c67x00: fix use-after-free in c67x00_add_iso_urb()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80825","published":"2026-09-04T15:54:29.224Z","updated":"2026-10-19T08:44:17.799Z","title":"wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80824","published":"2026-09-04T15:54:28.038Z","updated":"2026-10-19T08:44:16.840Z","title":"usb: usbfs: fix use-after-free of usb_device in usbdev_release()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80823","published":"2026-09-04T15:27:46.153Z","updated":"2026-10-19T08:44:15.864Z","title":"nfc: st21nfca: validate ATR_REQ length against the received frame","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-80822","published":"2026-09-04T15:27:45.268Z","updated":"2026-10-19T08:44:14.874Z","title":"mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80821","published":"2026-09-04T15:27:42.612Z","updated":"2026-10-19T08:44:13.912Z","title":"nvmet: pci-epf: put CQ ref on create_cq mapping failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-80820","published":"2026-09-04T15:13:41.355Z","updated":"2026-09-04T15:13:41.355Z","title":"xfs: don't livelock in scrub on a circular unlinked list","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80819","published":"2026-09-04T15:13:40.309Z","updated":"2026-10-19T08:44:12.945Z","title":"Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80818","published":"2026-09-04T15:13:39.273Z","updated":"2026-10-19T08:44:11.934Z","title":"iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-80817","published":"2026-09-04T15:13:38.303Z","updated":"2026-10-19T08:44:10.972Z","title":"iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-80816","published":"2026-09-04T15:13:37.310Z","updated":"2026-10-19T08:44:09.982Z","title":"ALSA: FCP: Use a private URB for the notification endpoint","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-80815","published":"2026-09-04T15:13:35.740Z","updated":"2026-10-19T08:44:09.029Z","title":"ALSA: scarlett2: Use a private URB for the notification endpoint","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80814","published":"2026-09-04T15:13:34.711Z","updated":"2026-10-19T08:44:08.040Z","title":"rndis_host: add overflow check in rndis_rx_fixup()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80813","published":"2026-09-04T15:13:33.761Z","updated":"2026-10-19T08:44:07.048Z","title":"nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-80812","published":"2026-09-04T15:13:32.732Z","updated":"2026-10-19T08:44:05.644Z","title":"ALSA: dummy: Check card index validity at probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-80811","published":"2026-09-04T15:13:31.761Z","updated":"2026-10-19T08:44:04.686Z","title":"io_uring/cmd: fix iovec leak when the async cmd is not recycled","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-80810","published":"2026-09-04T15:13:30.800Z","updated":"2026-10-19T08:44:03.724Z","title":"io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-80809","published":"2026-09-04T15:13:29.769Z","updated":"2026-10-19T08:44:02.755Z","title":"ocfs2: fix missing metadata reservation for large xattrs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80808","published":"2026-09-04T15:13:28.562Z","updated":"2026-10-19T08:44:01.677Z","title":"ext4: stop retrying saturated xattr cache entries","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80807","published":"2026-09-04T15:13:23.605Z","updated":"2026-10-19T08:44:00.360Z","title":"nilfs2: reject invalid block index in GC ioctl","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-80806","published":"2026-09-04T15:13:20.282Z","updated":"2026-10-19T08:43:59.390Z","title":"ext4: don't enable DAX on new encrypted files","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80805","published":"2026-09-04T15:13:19.239Z","updated":"2026-10-19T08:43:58.417Z","title":"xfs: validate attr entry pointer before field access","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80804","published":"2026-09-04T15:13:18.282Z","updated":"2026-10-19T08:43:57.464Z","title":"xfs: restore nofs context unconditionally in xfs_trans_roll","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80803","published":"2026-09-04T15:13:17.298Z","updated":"2026-10-19T08:43:56.485Z","title":"nfc: digital: clamp SENSF_RES length to the destination buffer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-80802","published":"2026-09-04T15:13:16.241Z","updated":"2026-10-19T08:43:55.498Z","title":"nfc: fdp: bound the device-reported read length and fix an skb leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-80801","published":"2026-09-04T15:13:15.263Z","updated":"2026-10-19T08:43:54.522Z","title":"nfc: microread: validate target discovery payload lengths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-80800","published":"2026-09-04T15:13:14.271Z","updated":"2026-10-19T08:43:53.425Z","title":"nfc: llcp: bound the connect_sn TLV walk to the skb","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-80799","published":"2026-09-04T15:13:13.311Z","updated":"2026-10-19T08:43:52.451Z","title":"nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-80798","published":"2026-09-04T15:13:12.282Z","updated":"2026-10-19T08:43:51.441Z","title":"nfc: llcp: reject PDUs shorter than the LLCP header","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-80797","published":"2026-09-04T15:13:10.911Z","updated":"2026-10-19T08:43:50.463Z","title":"nfc: pn533: purge fragmented skbs during cleanup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-80796","published":"2026-09-04T15:13:09.857Z","updated":"2026-10-19T08:43:49.470Z","title":"nfc: nci: add data_len bound checks to activation parameter extractors","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80795","published":"2026-09-04T15:13:08.640Z","updated":"2026-10-19T08:43:48.491Z","title":"nfc: nci: fix out-of-bounds write in nci_target_auto_activated()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-80794","published":"2026-09-04T15:13:07.169Z","updated":"2026-10-19T08:43:47.481Z","title":"nfc: nci: fix uninit-value in the RF discover/activated NTF handlers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-80793","published":"2026-09-04T15:13:05.814Z","updated":"2026-10-19T08:43:46.499Z","title":"ipv4: reject undersized MTUs in ip_do_fragment()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80792","published":"2026-09-04T15:13:04.537Z","updated":"2026-10-19T08:43:45.535Z","title":"ipv6: fix use-after-free in ip6_finish_output2()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80791","published":"2026-09-04T15:13:03.204Z","updated":"2026-10-19T08:43:44.536Z","title":"nvmet-auth: zero the AUTH_RECEIVE response buffer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-80790","published":"2026-09-04T15:13:02.193Z","updated":"2026-10-19T08:43:43.513Z","title":"nvmet-fc: fix invalid free in LS IOD error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80789","published":"2026-09-04T15:13:01.161Z","updated":"2026-10-19T08:43:42.439Z","title":"nvmet-tcp: bound SGL data length before allocating command buffers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-80788","published":"2026-09-04T15:12:59.912Z","updated":"2026-10-19T08:43:40.496Z","title":"nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80787","published":"2026-09-04T15:12:58.796Z","updated":"2026-10-19T08:43:39.519Z","title":"nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-80786","published":"2026-09-04T15:12:57.927Z","updated":"2026-10-30T12:31:08.620Z","title":"fbdev: Wrap user-invoked calls to fb_set_var() in helper","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-80785","published":"2026-09-04T15:12:57.076Z","updated":"2026-09-07T14:21:08.600Z","title":"fbdev: serialize mode sysfs access with lock_fb_info()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-80784","published":"2026-09-04T15:12:56.125Z","updated":"2026-09-04T15:12:56.125Z","title":"mptcp: pm: fix memory leak from alloc-during-teardown race","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80783","published":"2026-09-04T15:12:54.859Z","updated":"2026-10-19T08:43:38.543Z","title":"HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80782","published":"2026-09-04T15:12:53.933Z","updated":"2026-10-19T08:43:37.541Z","title":"HID: magicmouse: do not keep a stale msc->input if no input is claimed","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80781","published":"2026-09-04T15:12:52.980Z","updated":"2026-10-19T08:43:36.573Z","title":"HID: core: fix OOB read of field->usage in hid_set_field()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80780","published":"2026-09-04T15:12:52.009Z","updated":"2026-10-19T08:43:35.596Z","title":"HID: pidff: fix OOB write when hid->inputs is empty","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-80779","published":"2026-09-04T15:12:51.103Z","updated":"2026-10-19T08:43:34.624Z","title":"net/ionic: avoid OOB TX partner lookup for hwstamp RXQ","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80778","published":"2026-09-04T15:12:50.117Z","updated":"2026-10-19T08:43:33.681Z","title":"futex/pi: Reject cross-mm private futex owners","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80777","published":"2026-09-04T15:12:49.215Z","updated":"2026-10-19T08:43:32.707Z","title":"futex/pi: Plug private futex exec() race","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-80776","published":"2026-09-04T15:12:48.314Z","updated":"2026-09-04T15:12:48.314Z","title":"futex: Fix race in futex_pivot_pending() during private hash resize","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-80775","published":"2026-09-04T15:12:47.391Z","updated":"2026-10-19T08:43:31.761Z","title":"futex: Fix race on the initial mm->futex.phash.ref allocation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-80774","published":"2026-09-04T15:12:46.498Z","updated":"2026-10-19T08:43:30.740Z","title":"HID: asus: fix missing hid_is_usb() check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80773","published":"2026-09-04T15:12:45.387Z","updated":"2026-10-19T08:43:29.691Z","title":"HID: huawei: fix missing hid_is_usb() check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80772","published":"2026-09-04T15:12:44.445Z","updated":"2026-10-19T08:43:28.729Z","title":"HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-80771","published":"2026-09-04T15:12:43.246Z","updated":"2026-10-30T12:31:07.549Z","title":"HID: nintendo: register input device after capabilities are set","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-80770","published":"2026-09-04T15:12:42.327Z","updated":"2026-10-19T08:43:26.772Z","title":"HID: nintendo: stop device IO before hid_hw_stop on probe failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-80769","published":"2026-09-04T15:12:41.413Z","updated":"2026-10-19T08:43:25.736Z","title":"HID: rapoo: fix missing hid_is_usb() check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80768","published":"2026-09-04T15:12:40.374Z","updated":"2026-10-19T08:43:24.771Z","title":"HID: ft260: fix stack-use-after-return write in I2C read race","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-80767","published":"2026-09-04T15:12:39.363Z","updated":"2026-10-19T08:43:23.786Z","title":"HID: sensor: custom: Fix use-after-free in enable_sensor","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80766","published":"2026-09-04T15:12:38.520Z","updated":"2026-10-19T08:43:22.787Z","title":"HID: uclogic: fix use-after-free of inrange_timer on remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-80765","published":"2026-09-04T15:12:37.639Z","updated":"2026-10-19T08:43:21.769Z","title":"HID: hyperv: validate initial device info bounds","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-80764","published":"2026-09-04T15:12:36.599Z","updated":"2026-10-19T08:43:20.790Z","title":"Bluetooth: hci_event: fix LE list UAF on reset","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80763","published":"2026-09-04T15:12:35.652Z","updated":"2026-10-19T08:43:19.796Z","title":"Bluetooth: hci_event: validate LE Set CIG Parameters response","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80762","published":"2026-09-04T15:12:34.354Z","updated":"2026-10-19T08:43:18.848Z","title":"Bluetooth: hci_sync: Fix accept list UAF during suspend","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80761","published":"2026-09-04T15:12:33.345Z","updated":"2026-10-30T12:31:06.484Z","title":"Bluetooth: ISO: zero the sockaddr before returning it in getname","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-80760","published":"2026-09-04T15:12:32.306Z","updated":"2026-10-19T08:43:16.923Z","title":"Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-80759","published":"2026-09-04T15:12:28.900Z","updated":"2026-10-19T08:43:15.994Z","title":"Bluetooth: hci_aml: validate firmware segment lengths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80758","published":"2026-09-04T15:12:27.689Z","updated":"2026-10-19T08:43:14.380Z","title":"futex: Avoid private hash use-after-free on final put","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80757","published":"2026-09-03T08:26:35.005Z","updated":"2026-09-03T08:26:35.005Z","title":"selinux: reject a class permission count below its inherited common","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-80756","published":"2026-09-03T08:26:34.396Z","updated":"2026-09-03T08:26:34.396Z","title":"selinux: do not cancel a policy conversion that never started","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-80755","published":"2026-09-03T08:26:33.797Z","updated":"2026-10-30T12:31:05.421Z","title":"selinux: reject a permission value exceeding the class permission count","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-80754","published":"2026-09-03T08:26:33.180Z","updated":"2026-10-16T19:26:36.322Z","title":"Input: synaptics-rmi4 - fix F55 transmitter electrode count typo","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-80753","published":"2026-09-03T08:26:32.564Z","updated":"2026-09-07T15:45:09.288Z","title":"ovpn: run deferred work on a module-owned workqueue","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-80752","published":"2026-09-03T08:26:31.962Z","updated":"2026-09-04T04:58:32.588Z","title":"Input: psxpad-spi - set driver data before use","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-80751","published":"2026-09-03T08:26:31.347Z","updated":"2026-09-04T04:58:31.507Z","title":"pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-80750","published":"2026-09-03T08:26:30.751Z","updated":"2026-09-04T04:58:30.299Z","title":"pmdomain: mediatek: fix remaining %pOF after of_node_put()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-80749","published":"2026-09-03T08:26:30.140Z","updated":"2026-09-04T04:58:29.179Z","title":"drm/connector/hdmi: Fix out of bounds memory read","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-80748","published":"2026-09-03T08:26:29.532Z","updated":"2026-09-04T04:58:28.127Z","title":"mmc: loongson2: Fix sg iteration in data reorder functions","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80747","published":"2026-09-03T08:26:28.938Z","updated":"2026-10-30T12:31:04.327Z","title":"drm/amdkfd: Add bounds check for CRAT subtype length","severity":"HIGH","score":8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-80746","published":"2026-09-03T08:26:28.340Z","updated":"2026-09-03T08:26:28.340Z","title":"clk: qcom: dispcc-eliza: Fix disp_cc_mdss_mdp_clk_src RCG stall on Eliza EVK","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-80745","published":"2026-09-03T08:26:27.739Z","updated":"2026-09-04T04:58:25.988Z","title":"regulator: fp9931: Fix VPOS/VNEG voltage selector table","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-80744","published":"2026-09-03T08:26:27.137Z","updated":"2026-09-03T08:26:27.137Z","title":"netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-80743","published":"2026-09-03T08:26:26.524Z","updated":"2026-09-03T08:26:26.524Z","title":"ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-80742","published":"2026-09-03T08:26:25.920Z","updated":"2026-09-03T08:26:25.920Z","title":"af_packet: Don't send zero-byte data in tpacket_snd().","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-80741","published":"2026-09-03T08:26:25.322Z","updated":"2026-09-04T04:58:24.919Z","title":"drm/log: Fix out-of-bounds read on empty message length","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-80740","published":"2026-09-03T08:26:24.706Z","updated":"2026-09-03T08:26:24.706Z","title":"drm/log: Fix infinite loop when scale is too large for display","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80739","published":"2026-09-03T08:21:53.739Z","updated":"2026-10-30T12:31:03.271Z","title":"net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80738","published":"2026-09-03T08:21:53.143Z","updated":"2026-10-30T12:31:02.208Z","title":"bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-80737","published":"2026-09-03T08:21:52.539Z","updated":"2026-10-16T19:26:36.178Z","title":"serial: amba-pl011: synchronize DMA teardown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-80736","published":"2026-09-03T08:21:51.946Z","updated":"2026-09-04T04:58:21.747Z","title":"thunderbolt: Fix bandwidth group reservation indexing","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-80735","published":"2026-09-03T08:21:51.344Z","updated":"2026-09-04T04:58:20.684Z","title":"ovpn: ensure socket is owned by ovpn before deref sk_user_data","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-80734","published":"2026-09-03T08:21:50.734Z","updated":"2026-10-21T12:47:00.597Z","title":"btrfs: initialize inode mapping flags for cached inodes","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00601,"kevAdded":null},{"id":"CVE-2026-80733","published":"2026-09-03T08:21:50.136Z","updated":"2026-09-03T08:21:50.136Z","title":"net: remove WARN_ON_ONCE() from sk_mc_loop()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-80732","published":"2026-09-03T08:21:49.526Z","updated":"2026-09-04T04:58:18.567Z","title":"ata: pata_sl82c105: fix bridge revision use-after-free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-80731","published":"2026-09-03T08:21:48.924Z","updated":"2026-10-16T19:26:36.020Z","title":"net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-80730","published":"2026-09-03T08:21:48.325Z","updated":"2026-09-03T08:21:48.325Z","title":"ring-buffer: Fix crash passing ERR_PTR to kthread_stop()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80729","published":"2026-09-03T08:21:47.722Z","updated":"2026-10-11T13:47:11.562Z","title":"mm/huge_memory: initialise workingset state before folio split","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80728","published":"2026-09-03T08:21:47.126Z","updated":"2026-10-30T12:31:01.149Z","title":"Revert \"drm/amdgpu: fix aperture mapping leak\"","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80727","published":"2026-09-03T08:21:46.523Z","updated":"2026-09-03T08:21:46.523Z","title":"x86/mce: Set up the polling timer before CMCI discovery","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80725","published":"2026-08-29T06:39:35.212Z","updated":"2026-10-16T19:26:35.734Z","title":"net: gro: properly validate BIG TCP aggregation criteria","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00459,"kevAdded":null},{"id":"CVE-2026-80724","published":"2026-08-28T07:03:08.410Z","updated":"2026-10-19T08:43:13.410Z","title":"ptp: vmclock: prevent read-only mappings from becoming writable","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-80723","published":"2026-08-28T06:53:18.485Z","updated":"2026-10-16T19:26:35.582Z","title":"of: reserved_mem: prevent OOB when too many dynamic regions are defined","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-80722","published":"2026-08-28T06:53:17.886Z","updated":"2026-10-16T19:26:35.418Z","title":"wifi: mac80211: validate individual TWT params before driver setup","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-80721","published":"2026-08-28T06:53:17.278Z","updated":"2026-10-16T19:26:35.259Z","title":"Bluetooth: ISO: ensure no dangling hcon references in iso_conn","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-80720","published":"2026-08-28T06:53:16.683Z","updated":"2026-08-29T06:22:35.780Z","title":"iomap: add a separate bio_set for iomap_split_ioend","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-80719","published":"2026-08-28T06:53:16.087Z","updated":"2026-08-28T06:53:16.087Z","title":"mm: mglru: fix stale batch updates after memcg reparenting","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-80718","published":"2026-08-28T06:53:15.490Z","updated":"2026-08-29T06:22:34.556Z","title":"mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-80717","published":"2026-08-28T06:53:14.886Z","updated":"2026-10-16T19:26:35.092Z","title":"sctp: validate Adaptation Indication parameter length","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2026-80716","published":"2026-08-28T06:53:14.286Z","updated":"2026-10-16T19:26:34.951Z","title":"ALSA: pcm: wake linked drain waiters on unlink","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-80715","published":"2026-08-28T06:53:13.683Z","updated":"2026-08-28T06:53:13.683Z","title":"igc: remove napi_synchronize() in igc_down()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-80714","published":"2026-08-28T06:53:13.069Z","updated":"2026-10-16T19:26:34.808Z","title":"ipvs: do not propagate one-packet flag to synced conns","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-80713","published":"2026-08-28T06:53:12.438Z","updated":"2026-08-29T06:22:29.500Z","title":"io_uring: preserve task restrictions across exec","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-80712","published":"2026-08-28T06:53:11.243Z","updated":"2026-08-29T06:22:28.248Z","title":"spi: spi-qpic-snand: write the feature value before executing SET_FEATURE","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-80711","published":"2026-08-28T06:53:10.631Z","updated":"2026-08-28T06:53:10.631Z","title":"power: supply: max17040: handle missing status supplier","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-80710","published":"2026-08-28T06:53:10.028Z","updated":"2026-10-30T12:31:00.080Z","title":"s390/dasd: Fix undersized format-check buffer","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-80709","published":"2026-08-28T06:53:09.439Z","updated":"2026-10-16T19:26:34.515Z","title":"s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-80708","published":"2026-08-28T06:53:08.843Z","updated":"2026-08-28T06:53:08.843Z","title":"s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-80707","published":"2026-08-28T06:53:08.244Z","updated":"2026-10-16T19:26:34.357Z","title":"can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2026-80706","published":"2026-08-28T06:53:07.640Z","updated":"2026-10-16T19:26:34.192Z","title":"can: softing: fw_parse(): validate firmware record spans","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-80705","published":"2026-08-28T06:53:07.045Z","updated":"2026-10-21T12:46:59.474Z","title":"drm/amd/display: check if dml21_add_phantom_plane() is successful","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-80704","published":"2026-08-28T06:53:06.442Z","updated":"2026-10-21T12:46:58.375Z","title":"drm/amd/display: use proper context for logging","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-80703","published":"2026-08-28T06:53:05.851Z","updated":"2026-08-30T07:08:35.224Z","title":"drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-80702","published":"2026-08-28T06:53:05.253Z","updated":"2026-10-16T19:26:34.045Z","title":"drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-80701","published":"2026-08-28T06:53:04.652Z","updated":"2026-08-28T06:53:04.652Z","title":"drm/vmwgfx: enforce cursor size limits for MOB cursors","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80700","published":"2026-08-28T06:53:04.050Z","updated":"2026-10-16T19:26:33.894Z","title":"drm/vmwgfx: validate external BO copy bounds for both stride paths","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-80699","published":"2026-08-28T06:53:03.430Z","updated":"2026-08-28T06:53:03.430Z","title":"KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-80698","published":"2026-08-28T06:53:02.829Z","updated":"2026-10-30T12:30:59.012Z","title":"dmaengine: idxd: fix double free of wq, engine, and group structs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-80697","published":"2026-08-28T06:53:02.236Z","updated":"2026-08-28T12:08:17.218Z","title":"erofs: ensure valid f_path for page cache sharing","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-80696","published":"2026-08-28T06:53:01.632Z","updated":"2026-08-29T06:22:19.564Z","title":"hwmon: (ltc4282) Fix reading the minimum alarm voltage","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-80695","published":"2026-08-28T06:53:01.037Z","updated":"2026-10-30T12:30:57.945Z","title":"hwmon: (sht3x) Fix unaligned accesses","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80694","published":"2026-08-28T06:53:00.442Z","updated":"2026-10-30T12:30:56.887Z","title":"net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00491,"kevAdded":null},{"id":"CVE-2026-80693","published":"2026-08-28T06:52:56.131Z","updated":"2026-10-21T12:46:53.892Z","title":"idpf: bound interrupt-vector register fill to the allocated array","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-80692","published":"2026-08-28T06:52:55.529Z","updated":"2026-10-21T12:46:52.785Z","title":"Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2026-80691","published":"2026-08-28T06:52:54.933Z","updated":"2026-10-16T19:26:33.427Z","title":"scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00441,"kevAdded":null},{"id":"CVE-2026-80690","published":"2026-08-28T06:52:54.325Z","updated":"2026-08-28T06:52:54.325Z","title":"scsi: ufs: core: Initialize hba->rpmbs list in ufshcd","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-80689","published":"2026-08-28T06:52:53.724Z","updated":"2026-09-14T11:58:50.409Z","title":"tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-80688","published":"2026-08-28T06:52:53.126Z","updated":"2026-08-28T06:52:53.126Z","title":"riscv: drop __init from vec_check_unaligned_access_speed_all_cpus","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80687","published":"2026-08-28T06:52:52.512Z","updated":"2026-08-28T06:52:52.512Z","title":"iommufd/viommu: Release the igroup lock on the vdevice_size error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80686","published":"2026-08-28T06:52:51.924Z","updated":"2026-08-28T06:52:51.924Z","title":"mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80685","published":"2026-08-28T06:52:51.305Z","updated":"2026-09-21T13:14:10.006Z","title":"mm/util: don't read __page_2 for order-1 folios in snapshot_page()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-80684","published":"2026-08-28T06:52:50.703Z","updated":"2026-10-16T19:26:33.268Z","title":"KVM: s390: pci: Fix NULL dereference on AIBV allocation failure","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-80683","published":"2026-08-28T06:52:50.099Z","updated":"2026-10-16T19:26:33.090Z","title":"Bluetooth: SCO: give the socket its own sco_conn reference","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00365,"kevAdded":null},{"id":"CVE-2026-80682","published":"2026-08-28T06:52:49.498Z","updated":"2026-08-29T06:22:09.064Z","title":"riscv/mm: use physical alignment for vmemmap_start_pfn","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-80681","published":"2026-08-28T06:52:48.896Z","updated":"2026-10-16T19:26:32.921Z","title":"vxlan: re-fetch eth header after route_shortcircuit()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.005,"kevAdded":null},{"id":"CVE-2026-80680","published":"2026-08-28T06:52:48.300Z","updated":"2026-08-29T06:22:06.613Z","title":"i2c: amd-mp2: Unregister callback on adapter add failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-80679","published":"2026-08-28T06:52:47.682Z","updated":"2026-08-28T06:52:47.682Z","title":"s390/dasd: Fix potential NULL pointer dereference","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-80678","published":"2026-08-28T06:52:47.077Z","updated":"2026-10-16T19:26:32.757Z","title":"i2c: imx: Fix slave registration race and error handling","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-80677","published":"2026-08-28T06:49:15.507Z","updated":"2026-10-16T19:26:32.494Z","title":"driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-80676","published":"2026-08-28T06:49:14.747Z","updated":"2026-10-21T12:46:51.475Z","title":"Drivers: hv: vmbus: use generic driver_override infrastructure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-80675","published":"2026-08-28T06:49:14.148Z","updated":"2026-08-29T06:22:02.823Z","title":"libbpf: Reject non-exclusive metadata maps in the signed loader","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-80674","published":"2026-08-28T06:49:13.549Z","updated":"2026-08-29T06:22:01.603Z","title":"ntfs: validate resident attribute lists and harden the validator","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-80673","published":"2026-08-28T06:49:12.951Z","updated":"2026-08-29T06:22:00.387Z","title":"ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-80672","published":"2026-08-28T06:49:12.340Z","updated":"2026-08-29T06:21:59.169Z","title":"ntfs: fix u16 truncation of restart-area length check","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-80671","published":"2026-08-28T06:49:11.744Z","updated":"2026-09-14T11:58:49.345Z","title":"perf sched: Fix register_pid() overflow, strcpy, and BUG_ON","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-80670","published":"2026-08-28T06:49:11.120Z","updated":"2026-08-29T06:21:56.727Z","title":"perf tools: Use perf_env__get_cpu_topology() in machine__resolve()","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00671,"kevAdded":null},{"id":"CVE-2026-80669","published":"2026-08-28T06:49:10.511Z","updated":"2026-08-28T06:49:10.511Z","title":"bpf: Disable xfrm_decode_session hook attachment","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-80668","published":"2026-08-28T06:49:09.877Z","updated":"2026-10-30T12:30:55.328Z","title":"netfilter: nf_conntrack_expect: use conntrack GC to reap expectations","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00671,"kevAdded":null},{"id":"CVE-2026-80667","published":"2026-08-28T06:49:09.277Z","updated":"2026-08-28T06:49:09.277Z","title":"net/mlx5: LAG, MPESW, Fix missing complete() on devcom error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-80666","published":"2026-08-28T06:49:08.684Z","updated":"2026-08-28T06:49:08.684Z","title":"Bluetooth: sco: Fix a race condition in sco_sock_timeout()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80665","published":"2026-08-28T06:49:08.085Z","updated":"2026-08-29T06:21:53.024Z","title":"KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-80664","published":"2026-08-28T06:49:07.478Z","updated":"2026-10-16T19:26:32.191Z","title":"netfilter: xt_nat: reject unsupported target families","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-80663","published":"2026-08-28T06:49:06.882Z","updated":"2026-10-16T19:26:32.045Z","title":"tools/power/x86/intel-speed-select: Harden daemon pidfile open","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-80662","published":"2026-08-28T06:49:06.277Z","updated":"2026-10-21T12:46:49.254Z","title":"cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-80661","published":"2026-08-28T06:49:05.685Z","updated":"2026-08-29T06:21:46.376Z","title":"ufs: core: tracing: Do not dereference pointers in TP_printk()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80660","published":"2026-08-28T06:49:04.992Z","updated":"2026-08-28T06:49:04.992Z","title":"hwmon: (occ) unregister sysfs devices outside occ lock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-80659","published":"2026-08-28T06:49:04.389Z","updated":"2026-08-28T06:49:04.389Z","title":"mmc: vub300: defer reset until cmd_mutex is unlocked","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-80658","published":"2026-08-28T06:49:03.796Z","updated":"2026-08-28T06:49:03.796Z","title":"drm/rockchip: dw_dp: Fix null-ptr-deref in dw_dp_remove()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80657","published":"2026-08-28T06:49:03.200Z","updated":"2026-08-28T06:49:03.200Z","title":"accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-80656","published":"2026-08-28T06:49:02.596Z","updated":"2026-08-29T06:21:45.266Z","title":"hfsplus: Add a sanity check for btree node size","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-80655","published":"2026-08-28T06:49:01.988Z","updated":"2026-10-21T12:46:48.145Z","title":"soc: xilinx: Fix race condition in event registration","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-80654","published":"2026-08-28T06:49:01.311Z","updated":"2026-10-30T12:30:54.256Z","title":"soc: xilinx: Shutdown and free rx mailbox channel","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-80653","published":"2026-08-28T06:49:00.717Z","updated":"2026-10-30T12:30:53.201Z","title":"scsi: hisi_sas: Add slave_destroy interface for v3 hw","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-80652","published":"2026-08-28T06:49:00.093Z","updated":"2026-08-28T06:49:00.093Z","title":"crypto: ccp - Treat zero-length cert chain as query for blob lengths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-80651","published":"2026-08-28T06:48:59.460Z","updated":"2026-08-28T06:48:59.460Z","title":"crypto: ccp/sev-dev-tsm - bail out early when pdev->bus is NULL","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-80650","published":"2026-08-28T06:48:58.858Z","updated":"2026-10-30T12:30:52.133Z","title":"media: atomisp: gc2235: fix UAF and memory leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-80649","published":"2026-08-28T06:48:58.203Z","updated":"2026-08-29T06:21:42.793Z","title":"firmware: arm_scmi: Fix OOB in scmi_power_name_get()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-80648","published":"2026-08-28T06:48:57.479Z","updated":"2026-08-28T06:48:57.479Z","title":"pinctrl: spacemit: fix NULL check in spacemit_pin_set_config","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80647","published":"2026-08-28T06:48:56.879Z","updated":"2026-08-28T06:48:56.879Z","title":"RDMA/hns: Fix warning in poll cq direct mode","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-80646","published":"2026-08-28T06:48:56.277Z","updated":"2026-10-16T19:26:31.747Z","title":"ipv6: guard against possible NULL deref in __in6_dev_stats_get()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00716,"kevAdded":null},{"id":"CVE-2026-80645","published":"2026-08-28T06:48:55.678Z","updated":"2026-08-29T06:21:40.217Z","title":"rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00402,"kevAdded":null},{"id":"CVE-2026-80644","published":"2026-08-28T06:48:55.076Z","updated":"2026-08-28T06:48:55.076Z","title":"ocfs2: don't BUG_ON an invalid journal dinode","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-80643","published":"2026-08-28T06:48:54.439Z","updated":"2026-10-30T12:30:51.067Z","title":"EDAC/igen6: Fix call trace due to missing release()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-80642","published":"2026-08-28T06:48:53.841Z","updated":"2026-08-28T06:48:53.841Z","title":"liveupdate: Reference count incoming FLB data","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-80641","published":"2026-08-28T06:48:53.241Z","updated":"2026-08-28T06:48:53.241Z","title":"wifi: wlcore: enable the right set of ciphers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-80640","published":"2026-08-28T06:48:52.650Z","updated":"2026-08-28T06:48:52.650Z","title":"cxl/fwctl: Fix __fortify_panic","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2026-80639","published":"2026-08-28T06:48:52.045Z","updated":"2026-08-28T06:48:52.045Z","title":"cxl/test: Fix __fortify_panic","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-80638","published":"2026-08-28T06:48:51.439Z","updated":"2026-08-29T06:21:38.111Z","title":"ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00508,"kevAdded":null},{"id":"CVE-2026-80637","published":"2026-08-28T06:48:50.836Z","updated":"2026-10-30T12:30:49.999Z","title":"netfilter: synproxy: fix unaligned memory access in timestamp adjustment","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00684,"kevAdded":null},{"id":"CVE-2026-80636","published":"2026-08-28T06:48:50.241Z","updated":"2026-08-28T06:48:50.241Z","title":"netfilter: conntrack: revert ct extension genid infrastructure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-80635","published":"2026-08-28T06:48:49.637Z","updated":"2026-08-29T06:21:35.535Z","title":"wifi: wcn36xx: fix OOB read from short trigger BA firmware response","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2026-80634","published":"2026-08-28T06:48:49.022Z","updated":"2026-10-30T12:30:48.907Z","title":"netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00721,"kevAdded":null},{"id":"CVE-2026-80633","published":"2026-08-28T06:48:48.372Z","updated":"2026-08-29T06:21:32.731Z","title":"iommufd: Take dma_resv lock before dma_buf_unpin() in release path","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-80632","published":"2026-08-28T06:48:47.772Z","updated":"2026-08-28T06:48:47.772Z","title":"wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996_init_tx_queues()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-80631","published":"2026-08-28T06:48:47.166Z","updated":"2026-10-30T12:30:47.841Z","title":"btrfs: lzo: reject compressed segment that overflows the compressed input","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-80630","published":"2026-08-28T06:48:46.569Z","updated":"2026-10-16T19:26:31.257Z","title":"net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00755,"kevAdded":null},{"id":"CVE-2026-80629","published":"2026-08-28T06:48:45.976Z","updated":"2026-10-30T12:30:46.767Z","title":"octeontx2-af: npc: Fix size of entry2cntr_map","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-80628","published":"2026-08-28T06:48:45.377Z","updated":"2026-10-30T12:30:45.686Z","title":"ALSA: seq: oss: Serialize readq reset state with q->lock","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-80627","published":"2026-08-28T06:48:44.777Z","updated":"2026-08-28T06:48:44.777Z","title":"MIPS: mm: Fix out-of-bounds write in maar_res_walk()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-80626","published":"2026-08-28T06:48:44.182Z","updated":"2026-08-28T06:48:44.182Z","title":"powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-80625","published":"2026-08-28T06:48:43.583Z","updated":"2026-08-28T06:48:43.583Z","title":"RDMA/hns: Fix memory leak of bonding resources","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-80624","published":"2026-08-28T06:48:42.983Z","updated":"2026-08-28T06:48:42.983Z","title":"mfd: cs42l43: Sanity check firmware size","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-80623","published":"2026-08-28T06:48:42.371Z","updated":"2026-10-30T12:30:44.623Z","title":"coresight: ete: Always save state on power down","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-80622","published":"2026-08-28T06:48:41.744Z","updated":"2026-10-16T19:26:30.961Z","title":"char: tlclk: fix use-after-free in tlclk_cleanup()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-80621","published":"2026-08-28T06:48:41.081Z","updated":"2026-08-28T06:48:41.081Z","title":"PCI: dwc: Avoid dwc_pcie_rasdes_debugfs_deinit() NULL dereference when no RAS DES capability","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80620","published":"2026-08-28T06:48:40.340Z","updated":"2026-08-28T06:48:40.340Z","title":"Revert \"PCI/MSI: Unmap MSI-X region on error\"","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-80619","published":"2026-08-28T06:48:38.702Z","updated":"2026-08-29T06:21:26.537Z","title":"apparmor: fix potential UAF in aa_replace_profiles","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-80618","published":"2026-08-28T06:48:38.112Z","updated":"2026-08-28T06:48:38.112Z","title":"drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-80617","published":"2026-08-28T06:48:37.508Z","updated":"2026-08-29T06:21:25.270Z","title":"net: airoha: fix foe_check_time allocation size","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00702,"kevAdded":null},{"id":"CVE-2026-80616","published":"2026-08-28T06:48:36.911Z","updated":"2026-10-30T12:30:43.551Z","title":"ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-80615","published":"2026-08-28T06:48:36.315Z","updated":"2026-10-16T19:26:30.819Z","title":"net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00489,"kevAdded":null},{"id":"CVE-2026-80614","published":"2026-08-28T06:48:35.720Z","updated":"2026-10-21T12:46:34.944Z","title":"net: emac: Fix NULL pointer dereference in emac_probe","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0063,"kevAdded":null},{"id":"CVE-2026-80613","published":"2026-08-28T06:48:35.127Z","updated":"2026-10-16T19:26:30.677Z","title":"veth: fix NAPI leak in XDP enable error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-80612","published":"2026-08-28T06:48:34.527Z","updated":"2026-08-29T06:21:20.430Z","title":"net: lwtunnel: Drop skb metadata before LWT encapsulation","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-80611","published":"2026-08-28T06:48:33.934Z","updated":"2026-10-30T12:30:42.384Z","title":"ACPI: processor_idle: Mark LPI enter functions as __cpuidle","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-80610","published":"2026-08-28T06:48:33.340Z","updated":"2026-08-28T06:48:33.340Z","title":"net: enetc: fix potential divide-by-zero when num_vsi is zero","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-80609","published":"2026-08-28T06:48:32.751Z","updated":"2026-10-16T19:26:30.519Z","title":"qede: fix out-of-bounds check for cqe->len_list[]","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00738,"kevAdded":null},{"id":"CVE-2026-80608","published":"2026-08-28T06:48:32.152Z","updated":"2026-08-29T06:21:18.093Z","title":"accel/amdxdna: Fix iommu domain lifetime race during device removal","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-80607","published":"2026-08-28T06:48:31.556Z","updated":"2026-10-21T12:46:32.757Z","title":"tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-80606","published":"2026-08-28T06:48:30.960Z","updated":"2026-10-16T19:26:30.365Z","title":"drm/xe/userptr: Hold notifier_lock for write on inject test path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80605","published":"2026-08-28T06:48:30.362Z","updated":"2026-08-28T06:48:30.362Z","title":"HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-80604","published":"2026-08-28T06:48:29.755Z","updated":"2026-10-16T19:26:30.189Z","title":"HID: core: Fix OOB read in hid_get_report for numbered reports","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00412,"kevAdded":null},{"id":"CVE-2026-80603","published":"2026-08-28T06:48:29.158Z","updated":"2026-10-16T19:26:30.043Z","title":"netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00595,"kevAdded":null},{"id":"CVE-2026-80602","published":"2026-08-28T06:48:28.553Z","updated":"2026-10-30T12:30:41.331Z","title":"perf/x86/amd/lbr: Fix kernel address leakage","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-80601","published":"2026-08-28T06:48:27.948Z","updated":"2026-10-16T19:26:29.891Z","title":"batman-adv: gw: acquire ethernet header only after skb realloc","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-80600","published":"2026-08-28T06:48:27.351Z","updated":"2026-08-29T06:21:12.299Z","title":"batman-adv: dat: acquire ARP hw source only after skb realloc","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00734,"kevAdded":null},{"id":"CVE-2026-80599","published":"2026-08-28T06:48:26.709Z","updated":"2026-10-16T19:26:29.749Z","title":"batman-adv: dat: ensure accessible eth_hdr proto field","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-80598","published":"2026-08-28T06:48:24.097Z","updated":"2026-10-16T19:26:29.603Z","title":"ntfs3: fix out-of-bounds read in decompress_lznt","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-80597","published":"2026-08-28T06:48:23.499Z","updated":"2026-08-28T06:48:23.499Z","title":"mtd: maps: vmu-flash: fix NULL pointer dereference in initialization","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-80596","published":"2026-08-28T06:48:22.892Z","updated":"2026-08-29T06:21:08.760Z","title":"Input: ims-pcu - only expose sysfs attributes on control interface","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-80595","published":"2026-08-28T06:48:22.291Z","updated":"2026-08-28T06:48:22.291Z","title":"Input: ims-pcu - add response length checks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-80594","published":"2026-08-28T06:48:21.426Z","updated":"2026-08-28T06:48:21.426Z","title":"Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-80593","published":"2026-08-28T06:48:20.816Z","updated":"2026-10-16T19:26:29.448Z","title":"hwmon: (asus_atk0110) Check package count before accessing element","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-80592","published":"2026-08-28T06:48:20.218Z","updated":"2026-08-28T06:48:20.218Z","title":"samples/damon/mtier: fail early if address range parameters are invalid","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80591","published":"2026-08-28T06:48:19.617Z","updated":"2026-08-29T06:21:06.412Z","title":"f2fs: fix listxattr handling of corrupted xattr entries","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-80590","published":"2026-08-28T06:35:12.516Z","updated":"2026-10-19T08:43:12.426Z","title":"inet: frags: strip GSO state from fragments before reassembly","severity":"HIGH","score":8.6,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00578,"kevAdded":null},{"id":"CVE-2026-80589","published":"2026-08-26T14:37:43.293Z","updated":"2026-10-16T19:26:29.099Z","title":"block: stop the timeout timer when releasing a never added disk","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2026-80588","published":"2026-08-26T14:37:42.685Z","updated":"2026-10-16T19:26:28.920Z","title":"mptcp: reclaim forward-allocated memory on RX path errors","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-80587","published":"2026-08-26T14:37:42.093Z","updated":"2026-10-30T12:30:40.271Z","title":"mptcp: avoid combining some incoming suboptions","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00412,"kevAdded":null},{"id":"CVE-2026-80586","published":"2026-08-26T14:37:41.493Z","updated":"2026-10-16T19:26:28.632Z","title":"mptcp: options: reset DSS fields in case of unexpected size","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2026-80585","published":"2026-08-26T14:37:40.901Z","updated":"2026-10-16T19:26:28.485Z","title":"mptcp: fastopen: only mark MPTFO subflows with SYN data","severity":"CRITICAL","score":9.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-80584","published":"2026-08-26T14:37:40.302Z","updated":"2026-10-16T19:26:28.329Z","title":"s390/qeth: validate user buffer length in SNMP and ARP query ioctls","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-80583","published":"2026-08-26T14:37:39.704Z","updated":"2026-08-27T12:40:21.902Z","title":"ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-80582","published":"2026-08-26T14:37:39.113Z","updated":"2026-08-27T05:02:02.758Z","title":"drm/shmem_helper: Check VMA boundaries for PMD mappings","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-80581","published":"2026-08-26T14:37:38.510Z","updated":"2026-10-30T12:30:39.206Z","title":"ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-80580","published":"2026-08-26T14:37:37.917Z","updated":"2026-10-16T19:26:28.187Z","title":"fbdev: bound mode sysfs output to the sysfs buffer","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-80579","published":"2026-08-26T14:37:37.320Z","updated":"2026-10-16T19:26:28.024Z","title":"fbdev: clear fb_info->mode before deleting a videomode","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-80578","published":"2026-08-26T14:37:36.722Z","updated":"2026-10-16T19:26:27.851Z","title":"fbdev: core: Fix pointer desynchronization in fb_io_read()","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-80577","published":"2026-08-26T14:37:36.132Z","updated":"2026-08-26T14:37:36.132Z","title":"drm/panthor: skip zero-sized firmware sections","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-80576","published":"2026-08-26T14:37:35.538Z","updated":"2026-10-30T12:30:38.142Z","title":"drm/amdgpu: reject oversized IBs with per-ring packet limits","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-80575","published":"2026-08-26T14:37:34.942Z","updated":"2026-08-27T05:01:57.416Z","title":"Input: cs40l50-vibra - validate custom data from user space","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-80574","published":"2026-08-26T14:37:34.353Z","updated":"2026-10-16T19:26:27.544Z","title":"Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-80573","published":"2026-08-26T14:37:33.756Z","updated":"2026-08-27T04:58:55.441Z","title":"Input: iforce - validate input packet lengths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-80572","published":"2026-08-26T14:37:33.141Z","updated":"2026-10-30T12:30:37.072Z","title":"Input: byd - synchronize timer deletion before freeing private data","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-80571","published":"2026-08-26T14:37:32.541Z","updated":"2026-08-26T14:37:32.541Z","title":"powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80570","published":"2026-08-26T14:37:31.940Z","updated":"2026-08-27T05:01:54.209Z","title":"Input: synaptics-rmi4 - zero report size on F54 work error","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-80569","published":"2026-08-26T14:37:31.338Z","updated":"2026-08-27T05:01:53.135Z","title":"Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-80568","published":"2026-08-26T14:37:30.740Z","updated":"2026-08-27T05:01:52.050Z","title":"Input: synaptics-rmi4 - block s_input when F54 queue is busy","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-80567","published":"2026-08-26T14:37:30.152Z","updated":"2026-08-26T14:37:30.152Z","title":"Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-80566","published":"2026-08-26T14:37:29.552Z","updated":"2026-08-26T14:37:29.552Z","title":"Input: hynitron_cstxxx - validate touch count and finger IDs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-80565","published":"2026-08-26T14:37:28.953Z","updated":"2026-08-27T05:01:50.972Z","title":"crypto: qce - fix error path in devm_qce_register_algs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-80564","published":"2026-08-26T14:37:28.351Z","updated":"2026-08-26T14:37:28.351Z","title":"gve: fix NULL dereference due to missing ptp adjfine","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80563","published":"2026-08-26T14:37:27.759Z","updated":"2026-08-26T14:37:27.759Z","title":"gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-80562","published":"2026-08-26T14:37:27.171Z","updated":"2026-08-27T12:40:17.967Z","title":"gpio: ml-ioh: use raw_spinlock_t for the register lock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-80561","published":"2026-08-26T14:37:26.572Z","updated":"2026-10-16T19:26:27.238Z","title":"libceph: fix multiple unsafe decodes in decode_locker()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-80560","published":"2026-08-26T14:37:25.971Z","updated":"2026-08-27T05:01:48.838Z","title":"openrisc: signal: do not restore privileged SR bits on sigreturn","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-80559","published":"2026-08-26T14:37:25.371Z","updated":"2026-08-27T05:01:47.768Z","title":"Input: sur40 - fix input device registration ordering","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-80558","published":"2026-08-26T14:37:24.768Z","updated":"2026-10-16T19:26:27.095Z","title":"libceph: Avoid using invalid osd indices from primary_temp","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-80557","published":"2026-08-26T14:37:24.178Z","updated":"2026-10-16T19:26:26.946Z","title":"libceph: fix OOB read in decode_watchers() via missing bounds check","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00525,"kevAdded":null},{"id":"CVE-2026-80556","published":"2026-08-26T14:37:23.573Z","updated":"2026-08-27T05:01:44.585Z","title":"mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-80555","published":"2026-08-26T14:37:22.969Z","updated":"2026-08-27T12:40:15.211Z","title":"s390/vfio_ccw: Free all memory if cp_init() fails","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-80554","published":"2026-08-26T14:37:22.376Z","updated":"2026-10-30T12:30:35.998Z","title":"s390/vfio_ccw: Limit the number of channel program segments","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-80553","published":"2026-08-26T14:37:21.774Z","updated":"2026-10-16T19:26:26.626Z","title":"s390/vfio_ccw: Cancel existing workqueues","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-80552","published":"2026-08-26T14:37:21.178Z","updated":"2026-10-16T19:26:26.482Z","title":"s390/vfio_ccw: Ensure index for read/write regions are within range","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-80551","published":"2026-08-26T14:37:20.554Z","updated":"2026-10-30T12:30:34.924Z","title":"s390/vfio_ccw: Ensure first IDAW remains constant","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-80550","published":"2026-08-26T14:37:19.956Z","updated":"2026-10-16T19:26:26.153Z","title":"s390/vfio_ccw: Fix out of bounds check on CCW array","severity":"HIGH","score":7.9,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-80549","published":"2026-08-26T14:37:19.353Z","updated":"2026-10-16T19:26:25.990Z","title":"s390/vfio_ccw: Move cp cleanup out of not operational","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-80548","published":"2026-08-26T14:37:18.759Z","updated":"2026-10-16T19:26:25.857Z","title":"s390/vfio_ccw: Selectively expand io_mutex","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-80547","published":"2026-08-26T14:37:18.159Z","updated":"2026-10-16T19:26:25.722Z","title":"s390/vfio_ccw: Implement a crw lock","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-80546","published":"2026-08-26T14:37:17.550Z","updated":"2026-10-21T12:46:29.446Z","title":"s390/zcrypt: Improve CCA CPRB length and overflow checks","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2026-80545","published":"2026-08-26T14:37:16.956Z","updated":"2026-10-21T12:46:28.345Z","title":"s390/zcrypt: Improve EP11 CPRB length and overflow checks","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2026-80544","published":"2026-08-26T14:37:16.367Z","updated":"2026-10-21T12:46:27.170Z","title":"s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-80543","published":"2026-08-26T14:37:15.765Z","updated":"2026-10-21T12:46:26.051Z","title":"s390/zcrypt: Pad trailing CCA or EP11 message with zeros","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80542","published":"2026-08-26T14:37:15.168Z","updated":"2026-08-26T14:37:15.168Z","title":"drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80541","published":"2026-08-26T14:37:14.572Z","updated":"2026-10-16T19:26:25.405Z","title":"drm/amdgpu: validate GEM_CREATE domain combinations","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-80540","published":"2026-08-26T14:37:13.966Z","updated":"2026-10-16T19:26:25.254Z","title":"drm/amdgpu: Fix UVD decode image min size calculation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-80539","published":"2026-08-26T14:37:13.367Z","updated":"2026-08-27T12:40:05.835Z","title":"drm/amdgpu: disallow multiple FENCE chunks in one submit","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80538","published":"2026-08-26T14:37:12.767Z","updated":"2026-08-27T05:01:28.422Z","title":"xfs: propagate errors from xfs_rtginode_load","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-80537","published":"2026-08-26T14:37:12.180Z","updated":"2026-08-27T05:01:27.352Z","title":"xfs: fix off-by-one in rtrefcount btree root level validation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80536","published":"2026-08-26T14:37:11.584Z","updated":"2026-10-16T19:26:25.114Z","title":"xfs: bounds-check buffer log item's dirty bitmap","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-80535","published":"2026-08-26T14:37:10.985Z","updated":"2026-08-26T14:37:10.985Z","title":"xfs: don't double-lock when deleting a self-referential directory","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80534","published":"2026-08-26T14:37:10.378Z","updated":"2026-08-27T12:40:03.205Z","title":"xfs: fix ilock leak on error in xfs_dq_get_next_id","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-80533","published":"2026-08-26T14:37:09.785Z","updated":"2026-08-26T14:37:09.785Z","title":"xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80532","published":"2026-08-26T14:37:09.194Z","updated":"2026-08-26T14:37:09.194Z","title":"xfs: fix another iunlink infinite loop bug in online fsck","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80531","published":"2026-08-26T14:37:08.594Z","updated":"2026-08-27T05:01:25.229Z","title":"xfs: avoid UAF on sc->tempip in xrep_tempfile_create","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-80530","published":"2026-08-26T14:37:07.990Z","updated":"2026-10-16T19:26:24.966Z","title":"xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-80529","published":"2026-08-26T14:37:07.390Z","updated":"2026-08-26T14:37:07.390Z","title":"xfs: don't swallow dquot recovery verification errors","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-80528","published":"2026-08-26T14:37:06.781Z","updated":"2026-10-16T19:26:24.829Z","title":"ceph: avoid fs reclaim while using current->journal_info","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-80527","published":"2026-08-26T14:37:06.178Z","updated":"2026-10-16T19:26:24.678Z","title":"ceph: fix hanging __ceph_get_caps() with stale mds_wanted","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-80526","published":"2026-08-26T14:37:05.570Z","updated":"2026-10-30T12:30:33.861Z","title":"ASoC: tas2562: Validate values for volume writes","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-80525","published":"2026-08-26T14:37:04.973Z","updated":"2026-08-26T14:37:04.973Z","title":"ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-80524","published":"2026-08-26T14:37:04.373Z","updated":"2026-10-15T10:09:33.300Z","title":"optee: ffa: Add NULL check in optee_ffa_lend_protmem","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-80523","published":"2026-08-26T14:37:03.779Z","updated":"2026-08-27T05:01:19.881Z","title":"clk: spacemit: k3: set hdma clock as critical","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-80522","published":"2026-08-26T14:37:03.180Z","updated":"2026-10-16T19:26:24.520Z","title":"crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-80521","published":"2026-08-26T14:37:02.589Z","updated":"2026-10-03T10:56:06.656Z","title":"af_unix: Unlink scc_entry in unix_del_edge().","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-80520","published":"2026-08-26T14:37:01.983Z","updated":"2026-08-27T05:01:16.637Z","title":"ovpn: fix NULL dereference when killing missing key","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-80519","published":"2026-08-26T14:37:01.383Z","updated":"2026-08-27T05:01:15.137Z","title":"ovpn: finish crypto callback cleanup before peer release","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00649,"kevAdded":null},{"id":"CVE-2026-74754","published":"2026-08-26T14:37:00.766Z","updated":"2026-10-30T12:30:32.806Z","title":"scsi: core: pair EH runtime PM get and put","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-74753","published":"2026-08-26T14:37:00.168Z","updated":"2026-10-30T12:30:31.737Z","title":"perf: Reject exited events as group leaders","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74752","published":"2026-08-26T14:36:59.548Z","updated":"2026-10-21T12:46:23.915Z","title":"sctp: validate cookie AUTH state before use","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00524,"kevAdded":null},{"id":"CVE-2026-74751","published":"2026-08-26T14:36:58.954Z","updated":"2026-08-27T05:01:11.654Z","title":"riscv: lib: Fix ZBB strnlen reading past count boundary","severity":"CRITICAL","score":9.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00459,"kevAdded":null},{"id":"CVE-2026-74750","published":"2026-08-26T14:36:58.355Z","updated":"2026-10-15T10:09:31.165Z","title":"ovpn: defer key slot crypto freeing to workqueue","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-74749","published":"2026-08-26T14:36:57.763Z","updated":"2026-08-26T14:36:57.763Z","title":"rseq: Prevent hard lockup on granted time slice extension","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-74748","published":"2026-08-26T14:36:57.164Z","updated":"2026-10-16T19:26:24.058Z","title":"netfilter: ipset: fix refcount race between list:set GC and swap","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-74747","published":"2026-08-26T14:36:56.563Z","updated":"2026-10-30T12:30:30.657Z","title":"ipvs: revalidate ihl to prevent out-of-bounds access","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-74746","published":"2026-08-26T14:36:55.963Z","updated":"2026-10-16T19:26:23.781Z","title":"netfilter: flowtable: publish GC-visible tuple last","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00536,"kevAdded":null},{"id":"CVE-2026-74745","published":"2026-08-26T14:36:55.372Z","updated":"2026-10-16T19:26:23.647Z","title":"eth: bnxt: avoid deadlock when canceling IRQ affinity notifier","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00451,"kevAdded":null},{"id":"CVE-2026-74744","published":"2026-08-26T14:36:54.773Z","updated":"2026-10-16T19:26:23.512Z","title":"ipvlan: inherit needed_headroom and needed_tailroom from phy_dev","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00512,"kevAdded":null},{"id":"CVE-2026-74743","published":"2026-08-26T14:36:54.175Z","updated":"2026-10-16T19:16:13.009Z","title":"macvlan: inherit needed_headroom and needed_tailroom from lowerdev","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00536,"kevAdded":null},{"id":"CVE-2026-74742","published":"2026-08-26T14:36:53.580Z","updated":"2026-08-27T05:01:02.886Z","title":"veth: fix queue index used to wake the peer txq in veth_poll","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2026-74741","published":"2026-08-26T14:36:52.937Z","updated":"2026-08-27T05:01:01.751Z","title":"net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-74740","published":"2026-08-26T14:36:52.344Z","updated":"2026-10-30T12:30:29.380Z","title":"net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-74739","published":"2026-08-26T14:36:51.746Z","updated":"2026-10-30T12:30:28.148Z","title":"net/sched: cls_u32: skip hash tables in u32_bind_class()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-74738","published":"2026-08-26T14:36:51.136Z","updated":"2026-08-26T14:36:51.136Z","title":"regmap: sdw-mbq: don't call an unset readable_reg callback","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74737","published":"2026-08-26T14:36:50.544Z","updated":"2026-08-27T05:00:59.630Z","title":"net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00552,"kevAdded":null},{"id":"CVE-2026-74736","published":"2026-08-26T14:36:49.950Z","updated":"2026-10-16T19:16:12.701Z","title":"net/sched: cls_bpf: reject dev-bound programs bound to a different device","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-74735","published":"2026-08-26T14:36:49.352Z","updated":"2026-10-30T12:30:27.082Z","title":"l2tp: fix tunnel and session refcount leak on seq_file release","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-74734","published":"2026-08-26T14:36:48.753Z","updated":"2026-10-21T12:46:20.638Z","title":"firewire: ohci: fix NULL pointer dereference in ar_context_release","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-74733","published":"2026-08-22T15:33:21.579Z","updated":"2026-10-30T12:30:25.982Z","title":"gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-74731","published":"2026-08-22T15:33:20.294Z","updated":"2026-08-25T05:42:10.750Z","title":"sched_ext: Skip sub-disable teardown for never-linked sub-schedulers","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-74730","published":"2026-08-22T15:33:19.659Z","updated":"2026-10-16T19:16:12.405Z","title":"NFS: Pin the 'struct nfs_server' during a FREE_STATEID call","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0051,"kevAdded":null},{"id":"CVE-2026-74729","published":"2026-08-22T15:33:19.037Z","updated":"2026-10-30T12:30:24.911Z","title":"soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-74728","published":"2026-08-22T15:33:18.412Z","updated":"2026-10-21T12:46:17.289Z","title":"xfs: handle NULL b_addr in xfs_buf_free","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-74727","published":"2026-08-22T15:33:17.773Z","updated":"2026-08-25T05:42:08.380Z","title":"ovpn: skip rehash for peers already removed from by_id","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00649,"kevAdded":null},{"id":"CVE-2026-74726","published":"2026-08-22T15:33:17.128Z","updated":"2026-10-16T19:16:12.256Z","title":"bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74725","published":"2026-08-22T15:33:16.460Z","updated":"2026-10-16T19:16:12.099Z","title":"enic: fix tx_hang_reset use-after-free on device removal","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-74724","published":"2026-08-22T15:33:15.832Z","updated":"2026-10-16T19:16:11.956Z","title":"ipvs: avoid out-of-bounds write in ip_vs_nat_icmp","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-74723","published":"2026-08-22T15:33:15.196Z","updated":"2026-10-30T12:30:23.837Z","title":"btrfs: lzo: reject inline extents without valid headers","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00491,"kevAdded":null},{"id":"CVE-2026-74722","published":"2026-08-22T15:33:14.582Z","updated":"2026-08-22T15:33:14.582Z","title":"btrfs: fix memory leak in btrfs_do_encoded_write()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74721","published":"2026-08-22T15:33:13.960Z","updated":"2026-10-15T10:09:24.790Z","title":"accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74720","published":"2026-08-22T15:33:13.342Z","updated":"2026-10-16T19:16:11.811Z","title":"bpf: Preserve pointer state for commuted arithmetic","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74719","published":"2026-08-22T15:33:12.716Z","updated":"2026-08-22T15:33:12.716Z","title":"net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74718","published":"2026-08-22T15:33:12.106Z","updated":"2026-08-22T15:33:12.106Z","title":"devlink: fix net namespace reference leak in reload","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74717","published":"2026-08-22T15:33:11.488Z","updated":"2026-10-16T19:16:11.661Z","title":"net/mlx5: fw_tracer, return NULL on create error","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-74716","published":"2026-08-22T15:33:10.876Z","updated":"2026-10-15T10:09:23.729Z","title":"accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74715","published":"2026-08-22T15:33:10.262Z","updated":"2026-10-30T12:30:22.773Z","title":"bpf: Fix netns reference imbalance in conntrack kfuncs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74714","published":"2026-08-22T15:33:09.643Z","updated":"2026-10-16T19:16:11.358Z","title":"bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74713","published":"2026-08-22T15:33:09.028Z","updated":"2026-10-30T12:30:21.707Z","title":"vhost_iotlb: bound map allocation in add_range","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-74712","published":"2026-08-22T15:33:08.392Z","updated":"2026-08-25T05:41:54.897Z","title":"vdpa/mlx5: Fix buffer length in create_direct_keys()","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-74711","published":"2026-08-22T15:33:07.779Z","updated":"2026-10-21T12:46:12.854Z","title":"hwmon: (pmbus) Fix type confusion in notification logic","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-74710","published":"2026-08-22T15:33:07.172Z","updated":"2026-10-16T19:16:11.065Z","title":"xsk: require at least 16 bytes of TX metadata","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74709","published":"2026-08-22T15:33:06.558Z","updated":"2026-08-22T15:33:06.558Z","title":"xsk: clear metadata pointer when no timestamp is requested","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74708","published":"2026-08-22T15:33:05.956Z","updated":"2026-10-16T19:16:10.891Z","title":"xsk: validate launch-time metadata size","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74707","published":"2026-08-22T15:33:05.337Z","updated":"2026-10-16T19:16:10.746Z","title":"xsk: validate metadata when processing requests","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-74706","published":"2026-08-22T15:33:04.723Z","updated":"2026-08-22T15:33:04.723Z","title":"bnge: Fix NULL pointer dereference in aux device release","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-74705","published":"2026-08-22T15:33:04.110Z","updated":"2026-10-16T19:16:10.609Z","title":"udp: fix potential use-after-free in tunnel segmentation","severity":"CRITICAL","score":10,"vendor":"Linux","product":"Linux","kev":false,"epss":0.005,"kevAdded":null},{"id":"CVE-2026-74704","published":"2026-08-22T15:33:03.491Z","updated":"2026-10-16T19:16:10.461Z","title":"net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00443,"kevAdded":null},{"id":"CVE-2026-74703","published":"2026-08-22T15:33:02.872Z","updated":"2026-08-25T05:41:46.287Z","title":"vhost-scsi: Validate T10 PI scatterlist counts","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-74702","published":"2026-08-22T15:33:02.223Z","updated":"2026-08-25T05:41:45.057Z","title":"vhost-scsi: reject feature changes after endpoint","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74701","published":"2026-08-22T15:33:01.585Z","updated":"2026-10-16T19:16:10.294Z","title":"net/openvswitch: check Ethernet header length in key_extract()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-74700","published":"2026-08-22T15:33:00.933Z","updated":"2026-10-30T12:30:20.652Z","title":"net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74699","published":"2026-08-22T15:33:00.316Z","updated":"2026-08-22T15:33:00.316Z","title":"drm/xe: Fix memory leak in exec_queue_set_hang_replay_state()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-74698","published":"2026-08-22T15:32:59.703Z","updated":"2026-08-22T15:32:59.703Z","title":"net/mlx5e: fix BQL reset on SQ re-activation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74697","published":"2026-08-22T15:32:59.073Z","updated":"2026-10-21T12:46:11.741Z","title":"bnxt_en: Disable EOP for TPA on all chips to prevent data corruption","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0045,"kevAdded":null},{"id":"CVE-2026-74696","published":"2026-08-22T15:32:58.414Z","updated":"2026-10-16T19:16:09.811Z","title":"tcp: fix TFO max_qlen accounting across reuseport migration","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0049,"kevAdded":null},{"id":"CVE-2026-74695","published":"2026-08-22T15:32:57.756Z","updated":"2026-10-30T12:30:19.575Z","title":"netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-74694","published":"2026-08-22T15:32:57.113Z","updated":"2026-08-22T15:32:57.113Z","title":"net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74693","published":"2026-08-22T15:32:56.491Z","updated":"2026-08-22T15:32:56.491Z","title":"net: prestera: validate firmware header length","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-74692","published":"2026-08-22T15:32:55.873Z","updated":"2026-10-16T19:16:09.513Z","title":"net/smc: fix TOCTOU race between smc_listen_out() and listener close","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0049,"kevAdded":null},{"id":"CVE-2026-74691","published":"2026-08-22T15:32:55.258Z","updated":"2026-08-25T05:41:36.384Z","title":"net: thunderbolt: Tear down DMA paths before stopping the rings","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2026-74690","published":"2026-08-22T15:32:54.650Z","updated":"2026-10-30T12:30:18.492Z","title":"s390/ism: Fix UAF of sba and ieq during ism_dev_exit()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-74689","published":"2026-08-22T15:32:54.034Z","updated":"2026-10-16T19:16:09.361Z","title":"net/atm: fix slab-out-of-bounds read in vcc_setsockopt()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-74688","published":"2026-08-22T15:32:53.423Z","updated":"2026-10-16T19:16:09.209Z","title":"sctp: clear control chunk transport if it is being removed","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.005,"kevAdded":null},{"id":"CVE-2026-74687","published":"2026-08-22T15:32:52.792Z","updated":"2026-10-30T12:30:17.415Z","title":"watchdog: at91sam9_wdt: prevent timer rearm during teardown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-74686","published":"2026-08-22T15:32:52.178Z","updated":"2026-08-22T15:32:52.178Z","title":"rqspinlock: Reset tail when preserving queue on deadlock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-74685","published":"2026-08-22T15:32:51.493Z","updated":"2026-08-22T15:32:51.493Z","title":"hwmon: (ltc4282) Clamp negative current limits","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-74684","published":"2026-08-22T15:32:50.846Z","updated":"2026-10-30T12:30:16.355Z","title":"net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-74683","published":"2026-08-22T15:32:50.192Z","updated":"2026-08-25T05:23:19.336Z","title":"Input: evdev - sanitize event type index when fetching event masks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-74682","published":"2026-08-22T15:32:49.527Z","updated":"2026-08-22T15:32:49.527Z","title":"ALSA: usb-audio: fix OOB write on Type II inbound URBs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74681","published":"2026-08-22T15:32:48.873Z","updated":"2026-08-22T15:32:48.873Z","title":"usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74680","published":"2026-08-22T15:32:48.230Z","updated":"2026-08-22T15:32:48.230Z","title":"usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74679","published":"2026-08-22T15:32:47.499Z","updated":"2026-08-22T15:32:47.499Z","title":"usb: gadget: f_ncm: Use unsigned int for ndp_index","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-74678","published":"2026-08-22T15:32:46.765Z","updated":"2026-10-16T19:16:08.884Z","title":"net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-74677","published":"2026-08-22T15:32:46.001Z","updated":"2026-08-22T15:32:46.001Z","title":"net: usb: ipheth: fix carrier_work UAF on disconnect","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74676","published":"2026-08-22T15:32:45.256Z","updated":"2026-08-25T05:23:18.083Z","title":"vt: add permission check for KDSKBMETA ioctl","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74675","published":"2026-08-22T15:32:44.493Z","updated":"2026-10-16T19:16:08.728Z","title":"vt: stabilize tty reference in kbd_keycode with tty_port_tty_get","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74674","published":"2026-08-22T15:32:43.670Z","updated":"2026-08-25T05:41:26.569Z","title":"mm: fix incorrect flush address in direct page table reclaim","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-74673","published":"2026-08-22T15:32:42.941Z","updated":"2026-08-25T05:23:15.607Z","title":"Input: evdev - fix information leak in evdev_pass_values()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74672","published":"2026-08-22T15:32:42.210Z","updated":"2026-10-30T12:30:15.259Z","title":"mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74671","published":"2026-08-22T15:32:41.480Z","updated":"2026-08-22T15:32:41.480Z","title":"ima: fix out-of-bounds read in xattr_verify()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74670","published":"2026-08-22T15:32:40.850Z","updated":"2026-08-25T05:41:25.343Z","title":"ipvs: stop estimator after disabled calc phase","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74669","published":"2026-08-22T15:32:40.221Z","updated":"2026-10-16T19:16:08.572Z","title":"ipvs: clear IPv4 options after rebasing tunnel ICMP errors","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-74668","published":"2026-08-22T15:32:39.583Z","updated":"2026-10-16T19:16:08.423Z","title":"packet: use consistent hard_header_len in TX_RING send path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74667","published":"2026-08-22T15:32:38.862Z","updated":"2026-10-16T19:16:08.261Z","title":"net/packet: reset the MAC header on the packet-socket transmit path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-74666","published":"2026-08-22T15:32:38.098Z","updated":"2026-10-16T19:16:08.102Z","title":"packet: synchronize pressure clearing with ring reconfiguration","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74665","published":"2026-08-22T15:32:37.346Z","updated":"2026-08-25T05:41:19.196Z","title":"net: fix skb length accounting after generic XDP frag adjustment","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00373,"kevAdded":null},{"id":"CVE-2026-74664","published":"2026-08-22T15:32:36.616Z","updated":"2026-08-22T15:32:36.616Z","title":"net: openvswitch: reallocate update replies for mismatched IDs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74663","published":"2026-08-22T15:32:35.871Z","updated":"2026-10-16T19:16:07.950Z","title":"net/sched: reject overly deep qdisc hierarchies","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74662","published":"2026-08-22T15:32:35.151Z","updated":"2026-10-16T19:16:07.802Z","title":"inet: frags: publish queues before arming timer","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-74661","published":"2026-08-22T15:32:34.414Z","updated":"2026-08-25T05:41:15.528Z","title":"mac802154: fix netdev use-after-free in beacon worker","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-74660","published":"2026-08-22T15:32:33.677Z","updated":"2026-10-16T19:16:07.659Z","title":"netfilter: ebt_nflog: pin the NFLOG backend","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74659","published":"2026-08-22T15:32:32.926Z","updated":"2026-08-22T15:32:32.926Z","title":"net: bridge: mrp: fix uninitialised bytes on the wire","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74658","published":"2026-08-22T15:32:32.190Z","updated":"2026-08-22T15:32:32.190Z","title":"futex: Prevent robust futex exit race some more","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74657","published":"2026-08-22T15:32:31.458Z","updated":"2026-08-27T12:39:57.259Z","title":"ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74656","published":"2026-08-22T15:32:30.729Z","updated":"2026-10-16T19:16:07.512Z","title":"ipv4: fix use-after-free in fib_nhc_update_mtu()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74655","published":"2026-08-22T15:32:29.993Z","updated":"2026-08-27T12:39:56.189Z","title":"serial: qcom-geni: fix TX DMA buffer flush","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-74654","published":"2026-08-22T15:32:29.263Z","updated":"2026-08-22T15:32:29.263Z","title":"serial: 8250_dma: Clear stale RX state on shutdown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74653","published":"2026-08-22T15:32:28.521Z","updated":"2026-10-21T12:46:06.161Z","title":"serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74652","published":"2026-08-22T15:32:27.799Z","updated":"2026-08-25T05:41:10.525Z","title":"serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74651","published":"2026-08-22T15:32:27.073Z","updated":"2026-10-16T19:16:07.351Z","title":"staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-74650","published":"2026-08-22T15:32:26.333Z","updated":"2026-08-27T12:39:54.006Z","title":"staging: rtl8723bs: fix OOB read in WMM_param_handler()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74649","published":"2026-08-22T15:32:25.601Z","updated":"2026-10-16T19:16:07.198Z","title":"staging: rtl8723bs: fix missing shared-key auth challenge length check","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2026-74648","published":"2026-08-22T15:32:24.858Z","updated":"2026-10-16T19:16:07.049Z","title":"staging: rtl8723bs: validate monitor transmit frame lengths","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74647","published":"2026-08-22T15:32:24.127Z","updated":"2026-08-27T12:39:52.927Z","title":"misc: fastrpc: Remove buffer from list prior to unmap operation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-74646","published":"2026-08-22T15:32:23.378Z","updated":"2026-08-25T05:41:04.331Z","title":"misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-74645","published":"2026-08-22T15:32:22.645Z","updated":"2026-08-22T15:32:22.645Z","title":"mm/damon/lru_sort: error out for >10000 active_mem_bp","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-74644","published":"2026-08-22T15:32:21.899Z","updated":"2026-08-23T12:47:57.298Z","title":"mm/damon/ops-common: putback folios on invalid migrate nid","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74643","published":"2026-08-22T15:32:21.140Z","updated":"2026-08-22T15:32:21.140Z","title":"samples/damon/mtier: error out for zero quota goal target values","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74642","published":"2026-08-22T15:32:20.418Z","updated":"2026-08-22T15:32:20.418Z","title":"ALSA: usb: Fix UAF at delayed release of MIDI2 EPs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74641","published":"2026-08-22T15:32:19.696Z","updated":"2026-10-16T19:06:04.565Z","title":"ALSA: usx2y: bound the hwdep mmap fault offset","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74640","published":"2026-08-22T15:32:18.957Z","updated":"2026-10-16T19:06:04.418Z","title":"ALSA: FCP: fix OOB write in fcp_meter_ctl_get()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74639","published":"2026-08-22T15:32:18.236Z","updated":"2026-08-22T15:32:18.236Z","title":"ALSA: us144mkii: re-anchor capture URBs on resubmission","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74638","published":"2026-08-22T15:32:17.509Z","updated":"2026-08-25T05:23:13.123Z","title":"drm/v3d: Serialize the scheduler timeout handlers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-74637","published":"2026-08-22T15:32:16.755Z","updated":"2026-10-16T19:06:04.262Z","title":"perf/core: Fix group leader use-after-free after sibling detach","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74636","published":"2026-08-22T15:32:16.026Z","updated":"2026-08-22T15:32:16.026Z","title":"tracing: Fix race between update_event_fields and, event_define_fields","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74635","published":"2026-08-22T15:32:15.280Z","updated":"2026-10-16T19:06:04.057Z","title":"fbdev: bitblit: bound-check glyph index in bit_cursor()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74634","published":"2026-08-22T15:32:14.547Z","updated":"2026-08-25T05:40:58.185Z","title":"ring-buffer: Prevent subbuf order change when resizing is disabled","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-74633","published":"2026-08-22T15:32:13.808Z","updated":"2026-08-22T15:32:13.808Z","title":"tracing: Fix NULL pointer dereference in module event cache removal","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74632","published":"2026-08-22T15:32:13.078Z","updated":"2026-10-16T19:06:03.913Z","title":"mm/huge_memory: fix huge_zero_pfn race","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74631","published":"2026-08-22T15:32:12.334Z","updated":"2026-10-16T19:06:03.774Z","title":"net: smc: fix splice entry lifetime imbalance in smc_rx_splice","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-74630","published":"2026-08-22T15:32:11.596Z","updated":"2026-10-16T19:06:03.622Z","title":"ipv6: prevent in6_dev_get() from resurrecting inet6_dev","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-74629","published":"2026-08-22T15:32:10.861Z","updated":"2026-10-16T19:06:03.413Z","title":"net/dibs: Correct freeing of dmb_clientid_arr","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-74628","published":"2026-08-22T15:32:10.135Z","updated":"2026-08-27T12:39:49.703Z","title":"net/x25: fix use-after-free of the socket by its timers","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.005,"kevAdded":null},{"id":"CVE-2026-74627","published":"2026-08-22T15:32:09.405Z","updated":"2026-08-25T05:40:50.784Z","title":"net: devmem: prevent net-iov / page mixing","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74626","published":"2026-08-22T15:32:08.687Z","updated":"2026-10-16T19:06:03.263Z","title":"NTB: ntb_netdev: Preserve RX queue depth on allocation failure","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-74625","published":"2026-08-22T15:32:07.929Z","updated":"2026-10-16T19:06:03.037Z","title":"netfilter: bridge: release template ct on non-IP path","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-74624","published":"2026-08-22T15:32:07.193Z","updated":"2026-10-16T19:06:02.842Z","title":"netfilter: nf_conntrack: defer invalid log until after unlock","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-74623","published":"2026-08-22T15:32:06.467Z","updated":"2026-08-23T12:47:48.573Z","title":"net: atlantic: free stranded TX buffers on ring deinit","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74622","published":"2026-08-22T15:32:05.719Z","updated":"2026-08-22T15:32:05.719Z","title":"net: atlantic: free RX pages of consumed but not refilled buffers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74621","published":"2026-08-22T15:32:04.990Z","updated":"2026-10-16T19:06:02.607Z","title":"net/sched: act_ct: fix sk_buff leak when the header checks reject a packet","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0049,"kevAdded":null},{"id":"CVE-2026-74620","published":"2026-08-22T15:32:04.254Z","updated":"2026-08-23T12:47:46.379Z","title":"net/sched: act_gact, act_police: range check the fallback control action","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74619","published":"2026-08-22T15:32:03.511Z","updated":"2026-08-22T15:32:03.511Z","title":"ovl: don't warn when the mount is completed from another user namespace","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74618","published":"2026-08-22T15:32:02.778Z","updated":"2026-08-22T15:32:02.778Z","title":"binfmt_misc: don't warn when the mount is completed from another user namespace","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74617","published":"2026-08-22T15:32:02.049Z","updated":"2026-10-16T19:06:02.395Z","title":"dibs: initialise dibs->lock in dibs_dev_alloc()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00649,"kevAdded":null},{"id":"CVE-2026-74616","published":"2026-08-22T15:32:01.313Z","updated":"2026-10-16T19:06:02.219Z","title":"xdp: reject clones that overrun skb_shared_info tailroom","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00513,"kevAdded":null},{"id":"CVE-2026-74615","published":"2026-08-22T15:32:00.588Z","updated":"2026-10-16T19:06:02.032Z","title":"vxlan: do not arm the ageing timer on a device that is down","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74614","published":"2026-08-22T15:31:59.800Z","updated":"2026-10-16T19:06:01.847Z","title":"vsock/virtio: read virtqueues under worker locks","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-74613","published":"2026-08-22T15:31:59.062Z","updated":"2026-10-16T19:06:01.547Z","title":"vsock/virtio: avoid refilling the RX queue after teardown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74612","published":"2026-08-22T15:31:58.295Z","updated":"2026-10-16T19:06:01.379Z","title":"veth: fix skb length accounting after XDP frag adjustment","severity":"CRITICAL","score":10,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00491,"kevAdded":null},{"id":"CVE-2026-74611","published":"2026-08-22T15:31:57.534Z","updated":"2026-10-30T12:30:14.199Z","title":"tls: rx: restore msg_iter before TLS 1.3 optimistic retry","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00491,"kevAdded":null},{"id":"CVE-2026-74610","published":"2026-08-22T15:31:56.813Z","updated":"2026-08-25T05:40:36.026Z","title":"tls: don't leave a full plaintext sk_msg ring unpushed","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74609","published":"2026-08-22T15:31:56.054Z","updated":"2026-10-16T19:06:01.059Z","title":"tipc: read le->link under the node lock in tipc_node_link_down()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74608","published":"2026-08-22T15:31:55.298Z","updated":"2026-10-16T19:06:00.915Z","title":"smb: client: Fix use-after-free in cifs_try_adding_channels()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00477,"kevAdded":null},{"id":"CVE-2026-74607","published":"2026-08-22T15:31:54.554Z","updated":"2026-10-16T19:06:00.756Z","title":"KVM: SVM: Serialize accesses to the owner and mirror list with separate lock","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74606","published":"2026-08-22T15:31:53.819Z","updated":"2026-08-25T05:40:31.060Z","title":"eventfs: Fix use-after-free in eventfs_remove_rec()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-74605","published":"2026-08-22T15:31:53.063Z","updated":"2026-10-21T12:46:03.903Z","title":"eventfs: Use children field for rcu head and add memory barriers","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74604","published":"2026-08-22T15:31:52.295Z","updated":"2026-10-16T19:06:00.603Z","title":"Revert \"thermal/drivers/hwmon: Cleanup coding style a bit\"","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-74603","published":"2026-08-22T15:31:51.544Z","updated":"2026-08-25T05:40:27.399Z","title":"ptp: ocp: Fix board ID over-read","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74602","published":"2026-08-22T15:31:50.811Z","updated":"2026-08-23T12:47:43.108Z","title":"ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74601","published":"2026-08-22T15:31:50.092Z","updated":"2026-10-16T19:06:00.447Z","title":"ring-buffer: Use current_context for safe per-CPU buffer swap","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-74600","published":"2026-08-22T15:31:49.334Z","updated":"2026-10-30T12:30:13.139Z","title":"mm/page_table_check: skip special zero mappings","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74599","published":"2026-08-22T15:31:48.604Z","updated":"2026-10-30T12:30:12.084Z","title":"mm/ptdump: always stabilise against page table freeing using init_mm","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74598","published":"2026-08-22T15:31:47.859Z","updated":"2026-10-16T19:06:00.288Z","title":"ipv6: fix Route Information option length validation","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00425,"kevAdded":null},{"id":"CVE-2026-74597","published":"2026-08-22T15:31:47.120Z","updated":"2026-10-16T19:06:00.036Z","title":"ip6_tunnel: clear skb2->cb[] in ip6ip6_err()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00543,"kevAdded":null},{"id":"CVE-2026-74596","published":"2026-08-22T15:31:46.383Z","updated":"2026-10-21T12:46:01.695Z","title":"fs,fsverity: remove check for fsverity being enabled in setattr_prepare()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-74595","published":"2026-08-22T15:31:45.649Z","updated":"2026-10-16T19:05:59.849Z","title":"fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00092,"kevAdded":null},{"id":"CVE-2026-74594","published":"2026-08-22T15:31:44.894Z","updated":"2026-10-16T19:05:59.691Z","title":"sched/psi: Shut down rtpoll_timer in psi_cgroup_free()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74593","published":"2026-08-22T15:31:44.160Z","updated":"2026-08-23T12:47:36.437Z","title":"sched_ext: Take cgroup_lock() first in scx_cgroup_lock()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74592","published":"2026-08-22T15:31:43.419Z","updated":"2026-10-16T19:05:59.525Z","title":"ima: Instantiate file_truncate and path_truncate hooks","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00341,"kevAdded":null},{"id":"CVE-2026-74591","published":"2026-08-22T15:31:42.661Z","updated":"2026-08-25T05:40:18.794Z","title":"mm/filemap: __filemap_add_folio() restore index before retrying","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00649,"kevAdded":null},{"id":"CVE-2026-74590","published":"2026-08-22T15:31:41.929Z","updated":"2026-10-16T19:05:59.372Z","title":"fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74589","published":"2026-08-22T15:31:41.177Z","updated":"2026-10-16T19:05:59.193Z","title":"bpf, sockmap: Fix sk_redir use-after-free in send verdict","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-74588","published":"2026-08-22T15:31:40.466Z","updated":"2026-10-16T19:05:59.010Z","title":"sctp: keep chunk->transport in step with the list it is queued on","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.005,"kevAdded":null},{"id":"CVE-2026-74587","published":"2026-08-22T15:31:39.810Z","updated":"2026-10-16T19:05:58.841Z","title":"sctp: fix use-after-free of cached ASCONF chunk","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.005,"kevAdded":null},{"id":"CVE-2026-74586","published":"2026-08-22T15:31:39.094Z","updated":"2026-10-16T19:05:58.687Z","title":"sctp: clear new_transport when removing a peer","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.005,"kevAdded":null},{"id":"CVE-2026-74585","published":"2026-08-22T15:31:38.339Z","updated":"2026-08-22T15:31:38.339Z","title":"thunderbolt: Bound the DROM dual link port number before indexing sw->ports","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74584","published":"2026-08-22T14:28:07.988Z","updated":"2026-10-16T19:05:58.544Z","title":"RDMA/bnxt_re: zero shared page before exposing to userspace","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-74583","published":"2026-08-21T16:31:55.886Z","updated":"2026-10-16T19:05:58.388Z","title":"net/sched: cls_route: fix fastmap use-after-free on filter","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-74582","published":"2026-08-21T16:31:55.283Z","updated":"2026-10-16T19:05:58.230Z","title":"packet: use consistent hard_header_len in non-ring send paths","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-74581","published":"2026-08-21T16:31:54.683Z","updated":"2026-10-16T19:05:58.061Z","title":"net: ipv6: clear suppressed fib6 rule result","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00421,"kevAdded":null},{"id":"CVE-2026-74580","published":"2026-08-21T16:31:54.076Z","updated":"2026-10-29T03:57:01.255Z","title":"vhost: reset the vring metadata cache on vring reconfiguration","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00409,"kevAdded":null},{"id":"CVE-2026-74579","published":"2026-08-17T05:28:27.768Z","updated":"2026-10-16T19:05:57.728Z","title":"netfilter: nft_payload: fix mask build for partial field offload","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-74578","published":"2026-08-16T08:20:32.055Z","updated":"2026-10-16T19:05:57.566Z","title":"crypto: algif_skcipher - force synchronous processing on trees without ctx->state","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-74577","published":"2026-08-15T12:28:14.408Z","updated":"2026-08-19T16:39:14.107Z","title":"net: mpls: initialize rtm_tos in mpls_getroute()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-74576","published":"2026-08-15T12:28:13.798Z","updated":"2026-10-16T19:05:57.423Z","title":"mm/slab: prevent unbounded recursion in free path with new kmalloc type","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0067,"kevAdded":null},{"id":"CVE-2026-74575","published":"2026-08-15T12:28:13.187Z","updated":"2026-10-16T19:05:57.276Z","title":"thunderbolt: Prevent XDomain delayed work use-after-free on disconnect","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2026-74574","published":"2026-08-15T12:28:12.558Z","updated":"2026-10-16T19:05:57.115Z","title":"dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-74573","published":"2026-08-15T12:28:11.935Z","updated":"2026-10-16T19:05:56.969Z","title":"iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-74572","published":"2026-08-15T12:28:11.328Z","updated":"2026-10-16T19:05:56.826Z","title":"btrfs: zoned: fix deadlock between metadata writeback and transaction commit","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-74571","published":"2026-08-15T12:28:10.711Z","updated":"2026-10-30T12:30:11.015Z","title":"btrfs: skip global block reserve accounting for rescue mounts","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-74570","published":"2026-08-15T12:28:10.107Z","updated":"2026-08-17T05:48:49.705Z","title":"ntfs: harden runlist realloc size calculations","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-74569","published":"2026-08-15T12:28:09.476Z","updated":"2026-10-16T19:05:56.675Z","title":"netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00388,"kevAdded":null},{"id":"CVE-2026-74568","published":"2026-08-15T12:28:08.859Z","updated":"2026-10-16T19:05:56.525Z","title":"KVM: arm64: vgic: Fix race between LPI release and re-registration","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2026-74567","published":"2026-08-15T12:28:08.240Z","updated":"2026-10-16T19:05:56.377Z","title":"keys: fix out-of-bounds read in keyring_get_key_chunk()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-74566","published":"2026-08-15T12:28:07.628Z","updated":"2026-08-19T16:39:06.890Z","title":"keys: make keyring key-chunk byte order agree with keyring_diff_objects()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-74565","published":"2026-08-15T12:28:07.015Z","updated":"2026-10-21T12:45:59.495Z","title":"netfilter: nf_tables: make nft_object rhltable per table","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-74564","published":"2026-08-15T12:28:06.392Z","updated":"2026-10-16T19:05:56.067Z","title":"netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2026-74563","published":"2026-08-15T12:28:05.768Z","updated":"2026-10-16T19:05:55.886Z","title":"rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-74562","published":"2026-08-15T12:28:05.154Z","updated":"2026-10-15T10:09:16.149Z","title":"nexthop: take nh->lock for f6i_list walks in replace check and notify","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74561","published":"2026-08-15T12:28:04.525Z","updated":"2026-10-15T10:09:15.073Z","title":"nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74560","published":"2026-08-15T12:28:03.912Z","updated":"2026-10-21T12:45:58.392Z","title":"xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-74559","published":"2026-08-15T12:28:03.279Z","updated":"2026-10-21T12:45:57.288Z","title":"xsk: drain continuation descs after overflow in xsk_build_skb()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-74558","published":"2026-08-15T12:28:02.628Z","updated":"2026-10-21T12:45:56.189Z","title":"xsk: reclaim invalid Tx descriptors in ZC batch path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-74557","published":"2026-08-15T12:28:01.988Z","updated":"2026-10-16T19:05:55.724Z","title":"scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2026-74556","published":"2026-08-15T12:28:01.359Z","updated":"2026-10-16T19:05:55.568Z","title":"scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2026-74555","published":"2026-08-15T12:28:00.729Z","updated":"2026-08-19T16:38:54.912Z","title":"scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-74554","published":"2026-08-15T12:28:00.097Z","updated":"2026-10-16T19:05:55.415Z","title":"wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2026-74553","published":"2026-08-15T12:27:59.472Z","updated":"2026-08-19T16:38:52.272Z","title":"hwmon: (nct6775-core) Fix number of temperature registers for NCT6116","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-74552","published":"2026-08-15T12:27:58.829Z","updated":"2026-08-19T16:38:49.811Z","title":"hwmon: (lm90) Only report alarms if driver is ready","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74551","published":"2026-08-15T12:27:58.237Z","updated":"2026-08-19T16:38:47.362Z","title":"hwmon: (nzxt-smart2) DMA-align output buffer","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74550","published":"2026-08-15T12:27:57.615Z","updated":"2026-10-16T19:05:55.243Z","title":"net: do not send ICMP/NDISC Redirects when peer allocation fails","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-74549","published":"2026-08-15T12:27:56.993Z","updated":"2026-08-19T16:38:42.442Z","title":"hwmon: (nct6775-core) Prevent access to unsupported weight registers","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-74548","published":"2026-08-15T12:27:56.387Z","updated":"2026-10-16T19:05:55.094Z","title":"forcedeth: fix UAF of txrx_stats in nv_remove","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74547","published":"2026-08-15T12:27:55.777Z","updated":"2026-08-19T16:38:37.219Z","title":"hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74546","published":"2026-08-15T12:27:55.147Z","updated":"2026-08-19T16:38:34.886Z","title":"hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74545","published":"2026-08-15T12:27:54.536Z","updated":"2026-08-17T05:48:32.121Z","title":"rtase: fix double free of multi-frag skb on DMA map failure","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00671,"kevAdded":null},{"id":"CVE-2026-74544","published":"2026-08-15T12:27:53.941Z","updated":"2026-10-30T12:30:09.940Z","title":"net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-74543","published":"2026-08-15T12:27:53.336Z","updated":"2026-10-30T12:30:08.864Z","title":"net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-74542","published":"2026-08-15T12:27:52.741Z","updated":"2026-10-21T12:45:52.776Z","title":"netfs: Fix folio_queue ENOMEM in writeback by adding a mempool","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-74541","published":"2026-08-15T12:27:52.120Z","updated":"2026-10-16T19:05:54.748Z","title":"Bluetooth: ISO: clear iso_data always when detaching conn from hcon","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2026-74540","published":"2026-08-15T12:27:51.522Z","updated":"2026-10-16T19:05:54.604Z","title":"Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2026-74539","published":"2026-08-15T12:27:50.902Z","updated":"2026-10-16T19:05:54.465Z","title":"Bluetooth: ISO: lock sk in iso_sock_getname","severity":"HIGH","score":8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2026-74538","published":"2026-08-15T12:27:50.271Z","updated":"2026-10-21T12:45:51.636Z","title":"Bluetooth: ISO: lock sk in iso_connect_ind","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2026-74537","published":"2026-08-15T12:27:49.668Z","updated":"2026-10-30T12:30:07.803Z","title":"Bluetooth: ISO: hold sk properly in iso_conn_ready","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2026-74536","published":"2026-08-15T12:27:49.054Z","updated":"2026-08-17T05:21:20.361Z","title":"Bluetooth: ISO: fix leaking sk after socket release","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74535","published":"2026-08-15T12:27:48.449Z","updated":"2026-10-16T19:05:53.982Z","title":"Bluetooth: ISO: avoid deadlocks in iso_sock_timeout","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2026-74534","published":"2026-08-15T12:27:47.831Z","updated":"2026-10-23T08:20:16.546Z","title":"Bluetooth: ISO: fix refcounting of iso_conn","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2026-74533","published":"2026-08-15T12:27:47.219Z","updated":"2026-10-21T12:45:49.462Z","title":"Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-74532","published":"2026-08-15T12:27:46.597Z","updated":"2026-08-17T05:21:15.978Z","title":"Bluetooth: btintel: Validate length before parsing diagnostics TLV","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74531","published":"2026-08-15T12:27:45.988Z","updated":"2026-10-16T19:05:53.525Z","title":"Bluetooth: hci_conn: hold conn reference in abort_conn_sync()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-74530","published":"2026-08-15T12:27:45.381Z","updated":"2026-10-21T12:45:48.364Z","title":"Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00379,"kevAdded":null},{"id":"CVE-2026-74529","published":"2026-08-15T12:27:44.783Z","updated":"2026-10-21T12:45:47.259Z","title":"Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-74528","published":"2026-08-15T12:27:44.181Z","updated":"2026-08-17T05:48:17.804Z","title":"Bluetooth: hci_sync: hold conn in hci_past_sync() callback","severity":"HIGH","score":8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2026-74527","published":"2026-08-15T12:27:43.568Z","updated":"2026-10-30T12:30:06.747Z","title":"octeontx2-af: Block VFs from clobbering special CGX PKIND state","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-74526","published":"2026-08-15T12:27:42.965Z","updated":"2026-08-17T05:21:09.281Z","title":"scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-74525","published":"2026-08-15T12:27:42.344Z","updated":"2026-08-19T16:38:29.844Z","title":"net: sxgbe: free TX rings on RX allocation failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-74524","published":"2026-08-15T12:27:41.735Z","updated":"2026-08-17T05:21:07.108Z","title":"riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-74523","published":"2026-08-15T12:27:40.575Z","updated":"2026-10-16T19:05:52.869Z","title":"qede: sync udp_tunnel ports outside qede_lock in the recovery path","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-74522","published":"2026-08-15T12:27:39.945Z","updated":"2026-08-19T16:38:25.036Z","title":"ksmbd: fix use-after-free in __close_file_table_ids()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0063,"kevAdded":null},{"id":"CVE-2026-74521","published":"2026-08-15T12:27:39.330Z","updated":"2026-10-03T10:56:04.438Z","title":"ksmbd: use memcmp() to compare ClientGUIDs","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00406,"kevAdded":null},{"id":"CVE-2026-74520","published":"2026-08-15T12:27:38.712Z","updated":"2026-10-21T12:45:45.054Z","title":"iommu/iommufd: Fix IOPF group ownership UAF","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-74519","published":"2026-08-15T12:27:38.101Z","updated":"2026-10-16T19:05:52.543Z","title":"pinctrl: devicetree: don't free uninitialized dev_name on error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-74518","published":"2026-08-15T12:27:37.480Z","updated":"2026-10-16T19:05:52.396Z","title":"mm/hugetlb: fix list corruption in allocate_file_region_entries()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74517","published":"2026-08-15T12:27:36.842Z","updated":"2026-10-16T19:05:52.238Z","title":"KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-74516","published":"2026-08-15T12:27:36.200Z","updated":"2026-10-16T19:05:52.090Z","title":"KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-74515","published":"2026-08-15T12:27:35.567Z","updated":"2026-10-16T19:05:51.934Z","title":"KVM: s390: pci: Reject adapter interrupt forwarding if already enabled","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74514","published":"2026-08-15T12:27:34.947Z","updated":"2026-08-23T12:47:32.122Z","title":"KVM: s390: pci: Fix memory accounting for pinned/unpinned pages","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-74513","published":"2026-08-15T12:27:34.329Z","updated":"2026-10-21T12:45:43.905Z","title":"dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-74512","published":"2026-08-15T12:27:33.736Z","updated":"2026-10-16T19:05:51.743Z","title":"audit: fix potential use-after-free in audit_del_rule()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74510","published":"2026-08-15T12:27:32.503Z","updated":"2026-10-16T19:05:51.530Z","title":"Bluetooth: mgmt: fix UAF in pair command cancellation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-74509","published":"2026-08-15T12:27:31.896Z","updated":"2026-10-16T19:05:51.377Z","title":"Bluetooth: hci_sync: Fix advertising data UAFs","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2026-74508","published":"2026-08-15T12:27:31.288Z","updated":"2026-10-16T19:05:51.205Z","title":"Bluetooth: HIDP: reject frames without a transaction header","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2026-74507","published":"2026-08-15T12:27:30.683Z","updated":"2026-10-16T19:05:51.043Z","title":"Bluetooth: HIDP: validate numbered report payloads","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2026-74506","published":"2026-08-15T12:27:30.057Z","updated":"2026-10-21T12:45:42.783Z","title":"afs: Fix UAF when sending a message","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-74505","published":"2026-08-15T12:27:29.436Z","updated":"2026-08-19T16:38:02.508Z","title":"ALSA: 6fire: Fix UAF at error handling during probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74504","published":"2026-08-15T12:27:28.829Z","updated":"2026-08-17T05:20:43.047Z","title":"ALSA: seq: Fix division by zero in initialize_timer()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74503","published":"2026-08-15T12:27:28.208Z","updated":"2026-10-16T19:05:50.728Z","title":"ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-74502","published":"2026-08-15T12:27:27.586Z","updated":"2026-08-17T05:20:40.831Z","title":"ALSA: ump: fix double free of out_cvts on rawmidi error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74501","published":"2026-08-15T12:27:26.957Z","updated":"2026-08-17T05:20:39.729Z","title":"ALSA: usb-audio: fix use-after-free in ump_to_endpoint()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74500","published":"2026-08-15T12:27:26.359Z","updated":"2026-08-17T05:20:38.636Z","title":"ALSA: usb-audio: fix stack info leak in RME Digiface status","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74499","published":"2026-08-15T12:27:25.728Z","updated":"2026-08-19T16:38:00.351Z","title":"ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74498","published":"2026-08-15T12:27:25.123Z","updated":"2026-08-19T16:37:57.897Z","title":"ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74497","published":"2026-08-15T12:27:24.494Z","updated":"2026-10-16T19:05:50.570Z","title":"ALSA: usb-audio: Clamp frame size in implicit-feedback mode","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-74496","published":"2026-08-15T12:27:23.854Z","updated":"2026-10-16T19:05:50.395Z","title":"fou: Fix use-after-free in fou_create()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74495","published":"2026-08-15T12:27:23.229Z","updated":"2026-10-16T19:05:50.237Z","title":"igbvf: Fix leak in TX DMA error cleanup","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-74494","published":"2026-08-15T12:27:22.609Z","updated":"2026-08-23T12:47:27.752Z","title":"ksmbd: reject repeated SMB2 NEGOTIATE requests","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-74493","published":"2026-08-15T12:27:21.980Z","updated":"2026-10-16T19:05:50.062Z","title":"net/smc: fix socket use-after-free during link group termination","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.005,"kevAdded":null},{"id":"CVE-2026-74492","published":"2026-08-15T12:27:21.365Z","updated":"2026-10-16T19:05:49.918Z","title":"netfilter: ipset: do not update comments from kernel-side hash adds","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-74491","published":"2026-08-15T12:27:20.759Z","updated":"2026-08-17T05:20:26.733Z","title":"of/address: Fix NULL bus dereference in of_pci_range_parser_one()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74490","published":"2026-08-15T12:27:20.107Z","updated":"2026-10-16T19:05:49.765Z","title":"tipc: avoid use-after-free in poll trace queue dumps","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2026-74489","published":"2026-08-15T12:27:19.505Z","updated":"2026-10-16T19:05:49.622Z","title":"wifi: mac80211: fix tid_tx use-after-free on BA session stop","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2026-74488","published":"2026-08-15T12:27:18.867Z","updated":"2026-10-16T19:05:49.470Z","title":"wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2026-74487","published":"2026-08-15T12:27:18.236Z","updated":"2026-08-23T12:47:26.657Z","title":"binfmt_misc: restore write access when removing an entry","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74486","published":"2026-08-15T12:27:17.609Z","updated":"2026-08-23T12:47:25.566Z","title":"binfmt_misc: use exe_file_deny_write_access() for the interpreter clone","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74485","published":"2026-08-15T12:27:16.980Z","updated":"2026-10-16T19:05:49.285Z","title":"binfmt_misc: reject a flag character as the field delimiter","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74484","published":"2026-08-15T12:27:16.346Z","updated":"2026-08-19T06:52:35.407Z","title":"binfmt_misc: don't let an 'F' entry pin its own instance","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74483","published":"2026-08-15T12:27:15.709Z","updated":"2026-08-23T12:47:24.496Z","title":"binfmt_misc: don't leak the user namespace when the mount fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74482","published":"2026-08-15T12:27:15.083Z","updated":"2026-10-16T19:05:49.129Z","title":"mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74481","published":"2026-08-15T12:27:14.441Z","updated":"2026-10-16T19:05:48.983Z","title":"mm/page_reporting: use system_freezable_wq to fix UAF during suspend","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-74480","published":"2026-08-15T12:27:13.803Z","updated":"2026-10-16T19:05:48.808Z","title":"net: bridge: stop fast-leave after deleting a port group","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00579,"kevAdded":null},{"id":"CVE-2026-74479","published":"2026-08-15T12:27:13.172Z","updated":"2026-10-16T19:05:48.651Z","title":"net: pktgen: fix proc entry use-after-free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74478","published":"2026-08-15T12:27:12.549Z","updated":"2026-08-19T16:37:30.555Z","title":"um: vector: fix use-after-free in vector_mmsg_rx()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00864,"kevAdded":null},{"id":"CVE-2026-74477","published":"2026-08-15T12:27:11.938Z","updated":"2026-08-17T05:20:09.952Z","title":"uprobes: Fix NULL pointer dereference in hprobe_expire()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74476","published":"2026-08-15T12:27:11.309Z","updated":"2026-10-16T19:05:48.477Z","title":"veth: convert frag_list skbs before running XDP","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00491,"kevAdded":null},{"id":"CVE-2026-74475","published":"2026-08-15T12:27:10.685Z","updated":"2026-10-16T19:05:48.322Z","title":"vxlan: use neigh_ha_snapshot() in route_shortcircuit()","severity":"CRITICAL","score":10,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00454,"kevAdded":null},{"id":"CVE-2026-74474","published":"2026-08-15T12:27:10.037Z","updated":"2026-10-16T19:05:48.132Z","title":"vxlan: use pskb_network_may_pull() for transmit path header pulls","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00491,"kevAdded":null},{"id":"CVE-2026-74473","published":"2026-08-15T12:27:09.382Z","updated":"2026-10-16T19:05:47.966Z","title":"vxlan: use pskb_network_may_pull() in route_shortcircuit()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00525,"kevAdded":null},{"id":"CVE-2026-74472","published":"2026-08-15T12:27:08.759Z","updated":"2026-08-19T16:37:23.182Z","title":"ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74471","published":"2026-08-15T12:27:08.128Z","updated":"2026-10-16T19:05:47.824Z","title":"tracing: Check return value of __register_event() in trace_module_add_events()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74470","published":"2026-08-15T12:27:07.504Z","updated":"2026-10-16T19:05:47.666Z","title":"scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74469","published":"2026-08-15T12:27:06.873Z","updated":"2026-10-16T19:05:47.493Z","title":"sctp: prevent peer transport count overflow","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.01467,"kevAdded":null},{"id":"CVE-2026-74468","published":"2026-08-15T12:27:06.250Z","updated":"2026-08-19T16:37:12.926Z","title":"gpio: pch: use raw_spinlock_t for the register lock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-74467","published":"2026-08-15T12:27:05.635Z","updated":"2026-10-16T19:05:47.339Z","title":"s390/qeth: Check CAP_NET_ADMIN for private ioctls","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74466","published":"2026-08-15T12:27:05.020Z","updated":"2026-10-30T12:30:05.677Z","title":"s390/zcrypt: Close speculative mem read possibility","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-74465","published":"2026-08-15T12:27:04.403Z","updated":"2026-10-16T19:05:47.189Z","title":"net: openvswitch: fix potential UAF on meter attach failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2026-74464","published":"2026-08-15T12:27:03.786Z","updated":"2026-08-19T16:37:05.367Z","title":"net: openvswitch: fix skb leak on flow key update failure during ct","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74463","published":"2026-08-15T12:27:03.176Z","updated":"2026-08-19T16:37:02.602Z","title":"i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-74462","published":"2026-08-15T12:27:02.548Z","updated":"2026-08-17T05:19:51.284Z","title":"i2c: imx: mark I2C adapter when hardware is powered down","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74461","published":"2026-08-15T12:27:01.924Z","updated":"2026-10-16T19:05:47.029Z","title":"i2c: imx: Cancel hrtimer before clearing slave pointer","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-74460","published":"2026-08-15T12:27:01.274Z","updated":"2026-10-03T10:56:02.281Z","title":"can: ems_usb: validate CPC message lengths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74459","published":"2026-08-15T12:27:00.653Z","updated":"2026-08-19T16:36:55.813Z","title":"can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-74458","published":"2026-08-15T12:27:00.053Z","updated":"2026-08-19T16:36:54.341Z","title":"can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74457","published":"2026-08-15T12:26:59.411Z","updated":"2026-08-19T16:36:52.931Z","title":"can: peak_usb: add bounds check for USB channel index","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74456","published":"2026-08-15T12:26:58.808Z","updated":"2026-10-16T19:05:46.867Z","title":"can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74455","published":"2026-08-15T12:26:58.175Z","updated":"2026-08-19T16:36:48.775Z","title":"can: peak_usb: validate uCAN receive record lengths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74454","published":"2026-08-15T12:26:57.565Z","updated":"2026-08-19T16:36:46.319Z","title":"drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74453","published":"2026-08-15T12:26:56.949Z","updated":"2026-10-16T19:05:46.727Z","title":"drm/vc4: Zero the tile state data array before each BIN job","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74452","published":"2026-08-15T12:26:56.331Z","updated":"2026-08-17T05:47:23.139Z","title":"drm/panthor: reject firmware sections with oversized data","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-74451","published":"2026-08-15T12:26:55.722Z","updated":"2026-08-17T05:47:22.050Z","title":"drm/panthor: validate firmware interface structure sizes","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-74450","published":"2026-08-15T12:26:55.127Z","updated":"2026-10-16T19:05:46.575Z","title":"drm/amd/pm: fix pptable use-after-free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74449","published":"2026-08-15T12:26:54.519Z","updated":"2026-10-21T12:45:40.556Z","title":"drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74448","published":"2026-08-15T12:26:53.915Z","updated":"2026-08-18T06:56:34.583Z","title":"drm/amdkfd: fix QID bit leak in pqm_create_queue()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74447","published":"2026-08-15T12:26:53.305Z","updated":"2026-10-16T19:05:46.230Z","title":"drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74446","published":"2026-08-15T12:26:52.677Z","updated":"2026-10-16T19:05:46.048Z","title":"drm/amdkfd: hold event_mutex while checkpointing CRIU events","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74445","published":"2026-08-15T12:26:52.063Z","updated":"2026-10-30T12:30:04.210Z","title":"drm/vmwgfx: reject DX_BIND_QUERY without a DX context","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74444","published":"2026-08-15T12:26:51.443Z","updated":"2026-10-16T19:05:45.890Z","title":"drm/vmwgfx: validate DRAW_PRIMITIVES header size before division","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74443","published":"2026-08-15T12:26:50.826Z","updated":"2026-10-16T19:05:45.672Z","title":"drm/vmwgfx: bound DMA command body size against suffix pointer","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74442","published":"2026-08-15T12:26:50.102Z","updated":"2026-08-17T05:19:29.387Z","title":"drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74441","published":"2026-08-15T12:26:49.359Z","updated":"2026-08-23T12:47:17.900Z","title":"usb: typec: ucsi: Fix race condition and ordering in port unregistration","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74440","published":"2026-08-15T12:26:48.483Z","updated":"2026-10-16T19:05:45.489Z","title":"drm/xe: Wait on external BO kernel fences in exec IOCTL","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74439","published":"2026-08-15T05:59:36.655Z","updated":"2026-10-16T19:05:45.325Z","title":"iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-74438","published":"2026-08-15T05:59:36.044Z","updated":"2026-08-17T05:47:12.124Z","title":"crypto: sun4i-ss - Remove insecure and unused rng_alg","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-74437","published":"2026-08-15T05:59:35.297Z","updated":"2026-08-17T05:19:23.869Z","title":"media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74436","published":"2026-08-15T05:59:34.687Z","updated":"2026-10-16T19:05:45.032Z","title":"rxrpc: serialize kernel accept preallocation with socket teardown","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2026-74435","published":"2026-08-15T05:59:34.073Z","updated":"2026-08-17T05:47:09.898Z","title":"rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0063,"kevAdded":null},{"id":"CVE-2026-74434","published":"2026-08-15T05:59:33.438Z","updated":"2026-08-17T05:47:08.797Z","title":"rxrpc: Don't move a peeked OOB message onto the pending queue","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00631,"kevAdded":null},{"id":"CVE-2026-74433","published":"2026-08-15T05:59:32.823Z","updated":"2026-08-17T05:47:07.711Z","title":"rxrpc: Fix UAF in rxgk_issue_challenge()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00649,"kevAdded":null},{"id":"CVE-2026-74432","published":"2026-08-15T05:59:32.207Z","updated":"2026-10-30T12:30:02.873Z","title":"rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-74431","published":"2026-08-15T05:59:31.586Z","updated":"2026-08-17T05:47:06.624Z","title":"rxrpc: Fix potential infinite loop in rxrpc_recvmsg()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-74430","published":"2026-08-15T05:59:30.965Z","updated":"2026-08-17T05:47:05.522Z","title":"rxrpc: Fix ACKALL packet handling","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-74429","published":"2026-08-15T05:59:30.286Z","updated":"2026-08-17T05:47:04.412Z","title":"rxrpc: Fix the reception of a reply packet before data transmission","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-74428","published":"2026-08-15T05:59:29.668Z","updated":"2026-08-17T05:47:03.327Z","title":"rxrpc: Fix double unlock in rxrpc_recvmsg()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00649,"kevAdded":null},{"id":"CVE-2026-74427","published":"2026-08-15T05:59:29.053Z","updated":"2026-10-16T19:05:44.869Z","title":"afs: Fix netns teardown to cancel the preallocation charger","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00755,"kevAdded":null},{"id":"CVE-2026-74426","published":"2026-08-15T05:59:28.427Z","updated":"2026-08-17T05:19:11.836Z","title":"afs: fix NULL pointer dereference in afs_get_tree()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-74425","published":"2026-08-15T05:59:27.806Z","updated":"2026-08-17T05:47:00.844Z","title":"afs: handle CB.InitCallBackState3 requests without a server record","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-74424","published":"2026-08-15T05:59:27.179Z","updated":"2026-08-18T06:56:33.340Z","title":"fbcon: fix NULL pointer dereference for a console without vc_data","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-74423","published":"2026-08-15T05:59:26.568Z","updated":"2026-08-17T05:19:08.522Z","title":"accel/amdxdna: Fix leak when pinning ubuf pages","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74422","published":"2026-08-15T05:59:25.955Z","updated":"2026-08-17T05:19:07.404Z","title":"drm/rockchip: inno-hdmi: Switch to drmm_kzalloc()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-74421","published":"2026-08-15T05:59:25.328Z","updated":"2026-08-17T05:19:06.310Z","title":"drm/rockchip: dw_dp: Switch to drmm_kzalloc()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74420","published":"2026-08-15T05:59:24.704Z","updated":"2026-08-17T05:19:04.353Z","title":"drm/gpusvm: Reject VMAs with VM_IO or VM_PFNMAP when creating SVM ranges","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74419","published":"2026-08-15T05:59:24.079Z","updated":"2026-08-17T05:46:59.744Z","title":"accel/amdxdna: Adjust size for copy_to_user()","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-74418","published":"2026-08-15T05:59:23.440Z","updated":"2026-08-17T05:19:01.013Z","title":"dma-fence: Fix potential tracepoint null pointer dereferences","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-74417","published":"2026-08-15T05:59:22.731Z","updated":"2026-10-30T12:30:01.801Z","title":"drm/radeon: fix integer overflow in radeon_align_pitch()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-74416","published":"2026-08-15T05:59:22.077Z","updated":"2026-08-17T05:18:58.660Z","title":"drm/radeon: fix memory leak in radeon_ring_restore() on lock failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-74415","published":"2026-08-15T05:59:21.378Z","updated":"2026-08-17T05:18:57.554Z","title":"spi: atcspi200: fix use-after-free when driver unbind","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-74414","published":"2026-08-15T05:59:20.699Z","updated":"2026-08-17T05:18:56.466Z","title":"hfsplus: Remove the duplicate attr inode dirty marking action","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-74413","published":"2026-08-15T05:59:20.021Z","updated":"2026-10-16T19:05:44.523Z","title":"wifi: rtw89: fix wrong pci_get_drvdata type in AER handlers","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-74412","published":"2026-08-15T05:59:19.354Z","updated":"2026-10-16T19:05:44.326Z","title":"wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-74411","published":"2026-08-15T05:59:18.696Z","updated":"2026-10-16T19:05:44.122Z","title":"wifi: rtw89: Correct data type for scan index to avoid infinite loop","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2026-74410","published":"2026-08-15T05:59:18.039Z","updated":"2026-10-16T19:05:43.968Z","title":"wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-74409","published":"2026-08-15T05:59:17.361Z","updated":"2026-10-16T19:05:43.801Z","title":"wifi: rtw89: add bounds check on firmware mac_id in link lookup","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-74408","published":"2026-08-15T05:59:16.701Z","updated":"2026-10-16T19:05:43.633Z","title":"wifi: ath9k: fix OOB access from firmware tx status queue ID","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00412,"kevAdded":null},{"id":"CVE-2026-74407","published":"2026-08-15T05:59:16.044Z","updated":"2026-10-30T12:30:00.729Z","title":"wifi: ath11k: cancel SSR work items during PCI shutdown","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2026-74406","published":"2026-08-15T05:59:15.385Z","updated":"2026-10-30T12:29:59.646Z","title":"vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-74405","published":"2026-08-15T05:59:14.719Z","updated":"2026-10-30T12:29:58.561Z","title":"OPP: Fix race between OPP addition and lookup","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-74404","published":"2026-08-15T05:59:14.073Z","updated":"2026-10-16T19:05:43.034Z","title":"crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-74403","published":"2026-08-15T05:59:13.399Z","updated":"2026-08-17T05:46:45.328Z","title":"crypto: ccp - Check for page allocation failure correctly in TIO","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-74402","published":"2026-08-15T05:59:12.747Z","updated":"2026-08-17T05:18:42.284Z","title":"crypto: atmel-sha204a - fix blocking and non-blocking rng logic","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-74401","published":"2026-08-15T05:59:12.099Z","updated":"2026-10-30T12:29:57.496Z","title":"dlm: fix add msg handle in send_queue ordered","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00701,"kevAdded":null},{"id":"CVE-2026-74400","published":"2026-08-15T05:59:11.450Z","updated":"2026-08-17T05:18:40.094Z","title":"bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74399","published":"2026-08-15T05:59:10.791Z","updated":"2026-08-17T05:18:39.008Z","title":"evm: terminate and bound the evm_xattrs read buffer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-74398","published":"2026-08-15T05:59:10.113Z","updated":"2026-10-16T19:05:41.331Z","title":"ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-74397","published":"2026-08-15T05:59:09.329Z","updated":"2026-10-30T12:29:56.424Z","title":"IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-74396","published":"2026-08-15T05:59:08.694Z","updated":"2026-10-16T19:05:41.026Z","title":"RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00732,"kevAdded":null},{"id":"CVE-2026-74395","published":"2026-08-15T05:59:07.798Z","updated":"2026-08-17T05:18:34.634Z","title":"RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-74394","published":"2026-08-15T05:59:07.144Z","updated":"2026-10-16T19:05:40.869Z","title":"RDMA/srpt: fix integer overflow in immediate data length check","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0054,"kevAdded":null},{"id":"CVE-2026-74393","published":"2026-08-15T05:59:06.470Z","updated":"2026-08-17T05:18:32.271Z","title":"drm/syncobj: Fix memory leak in drm_syncobj_find_fence()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-74392","published":"2026-08-15T05:59:05.787Z","updated":"2026-08-17T05:18:31.175Z","title":"dm: limit target bio polling to one shot","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-74391","published":"2026-08-15T05:59:05.127Z","updated":"2026-10-30T12:29:55.331Z","title":"tracing: Bound synthetic-field strings with seq_buf","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74390","published":"2026-08-15T05:59:04.479Z","updated":"2026-10-16T19:05:40.715Z","title":"RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-74389","published":"2026-08-15T05:59:03.786Z","updated":"2026-10-30T12:29:54.266Z","title":"RDMA/hns: Fix log flood after cmd_mbox failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74388","published":"2026-08-15T05:59:03.147Z","updated":"2026-10-30T12:29:53.196Z","title":"ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74387","published":"2026-08-15T05:59:02.457Z","updated":"2026-10-16T18:55:36.992Z","title":"ALSA: seq: midi: Serialize output teardown with event_input","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-74386","published":"2026-08-15T05:59:01.786Z","updated":"2026-10-30T12:29:52.129Z","title":"nvmet-tcp: fix page fragment cache leak in error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-74385","published":"2026-08-15T05:59:01.113Z","updated":"2026-10-21T12:45:33.852Z","title":"nvmet-tcp: check return value of nvmet_tcp_set_queue_sock","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00441,"kevAdded":null},{"id":"CVE-2026-74384","published":"2026-08-15T05:59:00.445Z","updated":"2026-10-16T18:55:36.724Z","title":"nvme-multipath: fix flex array size in struct nvme_ns_head","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-74383","published":"2026-08-15T05:58:59.767Z","updated":"2026-08-17T05:46:33.114Z","title":"nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-74382","published":"2026-08-15T05:58:59.106Z","updated":"2026-08-17T05:18:20.179Z","title":"net/sched: cls_bpf: prevent unbounded recursion in offload rollback","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-74381","published":"2026-08-15T05:58:58.354Z","updated":"2026-08-17T05:18:19.071Z","title":"gpu: host1x: Allow entries in BO caches to be freed","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-74380","published":"2026-08-15T05:58:57.706Z","updated":"2026-10-16T18:55:36.594Z","title":"gpu: host1x: Fix iommu_map_sgtable() return value check","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-74379","published":"2026-08-15T05:58:57.024Z","updated":"2026-08-17T05:18:16.387Z","title":"dax/kmem: account for partial discontiguous resource upon removal","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74378","published":"2026-08-15T05:58:56.381Z","updated":"2026-10-16T18:55:36.455Z","title":"RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-74377","published":"2026-08-15T05:58:55.704Z","updated":"2026-10-16T18:55:36.323Z","title":"RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74376","published":"2026-08-15T05:58:55.023Z","updated":"2026-10-16T18:55:36.173Z","title":"md/raid10: reset read_slot when reusing r10bio for discard","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00502,"kevAdded":null},{"id":"CVE-2026-74375","published":"2026-08-15T05:58:54.335Z","updated":"2026-10-21T12:45:32.765Z","title":"md/raid1,raid10: fix deadlock in read error recovery path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74374","published":"2026-08-15T05:58:53.659Z","updated":"2026-10-21T12:45:31.666Z","title":"md/raid1,raid10: fix error-path detection with md_cloned_bio()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0063,"kevAdded":null},{"id":"CVE-2026-74373","published":"2026-08-15T05:58:52.990Z","updated":"2026-10-21T12:45:30.565Z","title":"md/raid1,raid10: fix bio accounting for split md cloned bios","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-74372","published":"2026-08-15T05:58:52.306Z","updated":"2026-08-17T05:18:07.752Z","title":"raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74371","published":"2026-08-15T05:58:51.610Z","updated":"2026-09-14T11:58:45.047Z","title":"bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-74370","published":"2026-08-15T05:58:50.933Z","updated":"2026-08-17T05:18:05.573Z","title":"liveupdate: fix TOCTOU race in luo_session_retrieve()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-74369","published":"2026-08-15T05:58:50.280Z","updated":"2026-08-17T05:18:04.480Z","title":"liveupdate: fix u-a-f in luo_file_unpreserve_files() and luo_file_finish()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-74368","published":"2026-08-15T05:58:49.619Z","updated":"2026-10-21T12:45:29.473Z","title":"wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74367","published":"2026-08-15T05:58:48.938Z","updated":"2026-10-16T18:55:35.898Z","title":"wifi: ath12k: fix inconsistent arvif state in vdev_create error paths","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74366","published":"2026-08-15T05:58:48.264Z","updated":"2026-08-17T05:18:01.222Z","title":"wifi: ath12k: fix NULL deref in change_sta_links for unready link","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74365","published":"2026-08-15T05:58:47.594Z","updated":"2026-10-16T18:55:35.765Z","title":"nvdimm/btt: Handle preemption in BTT lane acquisition","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-74364","published":"2026-08-15T05:58:46.926Z","updated":"2026-08-17T05:46:23.107Z","title":"bpf: Reject exclusive maps as inner maps in map-in-map","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-74363","published":"2026-08-15T05:58:46.220Z","updated":"2026-10-16T18:55:35.622Z","title":"bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74362","published":"2026-08-15T05:58:45.553Z","updated":"2026-08-17T05:17:56.829Z","title":"ext2: fix ignored return value of generic_write_sync()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-74361","published":"2026-08-15T05:58:44.857Z","updated":"2026-10-16T18:55:35.477Z","title":"nvme: fix FDP fdpcidx bounds check","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00649,"kevAdded":null},{"id":"CVE-2026-74360","published":"2026-08-15T05:58:44.158Z","updated":"2026-08-17T05:17:54.663Z","title":"bpf: Reject exclusive maps for bpf_map_elem iterators","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74359","published":"2026-08-15T05:58:43.456Z","updated":"2026-10-16T18:55:35.328Z","title":"configfs_lookup(): don't leave ->s_dentry dangling on failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74358","published":"2026-08-15T05:58:42.789Z","updated":"2026-08-17T05:17:52.469Z","title":"ext4: fix fast commit wait/wake bit mapping on 64-bit","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74357","published":"2026-08-15T05:58:42.116Z","updated":"2026-08-17T05:46:18.298Z","title":"drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpu_coredump ring dump","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-74356","published":"2026-08-15T05:58:41.445Z","updated":"2026-10-30T12:29:51.074Z","title":"vhost: fix vhost_get_avail_idx for a non empty ring","severity":"HIGH","score":7.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2026-74355","published":"2026-08-15T05:58:40.766Z","updated":"2026-10-16T18:55:35.014Z","title":"iommu/vt-d: Fix RB-tree corruption in probe error path","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-74354","published":"2026-08-15T05:58:40.067Z","updated":"2026-10-16T18:55:34.866Z","title":"bpf: Take mmap_lock in zap_pages()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-74353","published":"2026-08-15T05:58:39.376Z","updated":"2026-08-17T05:17:46.959Z","title":"drm/amdkfd: always resume_all after suspend_all","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-74352","published":"2026-08-15T05:58:38.710Z","updated":"2026-08-17T05:17:45.878Z","title":"of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74351","published":"2026-08-15T05:58:37.967Z","updated":"2026-08-17T05:17:44.780Z","title":"ocfs2: rebase copied fsdlm LVB pointers in locking_state","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-74350","published":"2026-08-15T05:58:37.298Z","updated":"2026-10-30T12:29:50.024Z","title":"ocfs2: validate fast symlink target during inode read","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00701,"kevAdded":null},{"id":"CVE-2026-74349","published":"2026-08-15T05:58:36.630Z","updated":"2026-10-16T18:55:34.720Z","title":"ocfs2: reject FITRIM ranges shorter than a cluster","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74348","published":"2026-08-15T05:58:35.977Z","updated":"2026-08-17T05:17:41.148Z","title":"ocfs2/dlm: require a ref for locking_state debugfs open","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-74347","published":"2026-08-15T05:58:35.287Z","updated":"2026-10-30T12:29:48.957Z","title":"netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74346","published":"2026-08-15T05:58:34.606Z","updated":"2026-08-17T05:17:38.929Z","title":"RDMA/irdma: Fix OOB read during CQ MR registration","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74345","published":"2026-08-15T05:58:33.906Z","updated":"2026-10-30T12:29:47.902Z","title":"RDMA/siw: Fix endpoint/socket association handling","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00477,"kevAdded":null},{"id":"CVE-2026-74344","published":"2026-08-15T05:58:33.231Z","updated":"2026-10-21T12:45:23.651Z","title":"bpf: Clear rb node linkage when freeing bpf_rb_root","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-74343","published":"2026-08-15T05:58:32.577Z","updated":"2026-08-17T05:46:08.382Z","title":"kernfs: fix xattr race condition with multiple superblocks","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-74342","published":"2026-08-15T05:58:31.924Z","updated":"2026-08-17T05:17:34.554Z","title":"kernfs: link kn to its parent before the LSM init hook","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-74341","published":"2026-08-15T05:58:31.238Z","updated":"2026-10-30T12:29:46.830Z","title":"wifi: wcn36xx: fix heap overflow from oversized firmware HAL response","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00532,"kevAdded":null},{"id":"CVE-2026-74340","published":"2026-08-15T05:58:30.558Z","updated":"2026-10-16T18:55:34.097Z","title":"wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-74339","published":"2026-08-15T05:58:29.888Z","updated":"2026-10-30T12:29:45.739Z","title":"ALSA: seq: Clear variable event pointer on read","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-74338","published":"2026-08-15T05:58:29.222Z","updated":"2026-10-30T12:29:44.566Z","title":"bpf: Reject sleepable BPF_LSM_CGROUP programs at load time","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-74337","published":"2026-08-15T05:58:28.518Z","updated":"2026-08-17T05:17:29.070Z","title":"bpf: Fix NMI/tracepoint re-entry deadlock on lru locks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74336","published":"2026-08-15T05:58:27.799Z","updated":"2026-10-15T10:08:55.597Z","title":"wifi: mac80211: bound S1G TIM PVB walk to the TIM element","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74335","published":"2026-08-15T05:58:27.148Z","updated":"2026-08-17T05:17:26.885Z","title":"bpf: Fix NULL pointer dereference in bpf_task_from_vpid()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74334","published":"2026-08-15T05:58:26.455Z","updated":"2026-10-16T18:55:33.821Z","title":"RDMA/nldev: Fix locking when accessing mr->pd","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74333","published":"2026-08-15T05:58:25.781Z","updated":"2026-10-16T18:55:33.681Z","title":"ASoC: amd: acp-sdw-legacy: Bound DAI link iteration","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-74332","published":"2026-08-15T05:58:25.112Z","updated":"2026-10-16T18:55:33.526Z","title":"ASoC: amd: acp-sdw-sof: Bound DAI link iteration","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-74331","published":"2026-08-15T05:58:24.420Z","updated":"2026-08-17T05:17:22.413Z","title":"firmware_loader: Fix recursive lock in device_cache_fw_images()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2026-74330","published":"2026-08-15T05:58:23.722Z","updated":"2026-10-16T18:55:33.381Z","title":"configfs: fix lockless traversals of ->s_children","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74329","published":"2026-08-15T05:58:23.059Z","updated":"2026-08-17T05:17:20.223Z","title":"watchdog: unregister PM notifier on watchdog unregister","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-74328","published":"2026-08-15T05:58:22.371Z","updated":"2026-08-17T05:45:55.733Z","title":"iommufd: Destroy the pages content after detaching from dmabuf","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-74327","published":"2026-08-15T05:58:21.665Z","updated":"2026-08-17T05:17:17.979Z","title":"vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-74326","published":"2026-08-15T05:58:20.933Z","updated":"2026-08-17T05:17:16.898Z","title":"wifi: mt76: mt7921: fix resource leak in probe error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-74325","published":"2026-08-15T05:58:20.236Z","updated":"2026-10-16T18:55:33.235Z","title":"wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74324","published":"2026-08-15T05:58:19.518Z","updated":"2026-08-17T05:17:14.721Z","title":"wifi: mt76: mt7925: validate skb length in testmode query","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74323","published":"2026-08-15T05:58:18.857Z","updated":"2026-10-16T18:55:33.088Z","title":"wifi: mt76: mt7996: Fix possible token leak in mt7996_tx_prepare_skb()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-74322","published":"2026-08-15T05:58:18.167Z","updated":"2026-08-17T05:17:12.538Z","title":"wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996_mac_write_txwi_80211()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74321","published":"2026-08-15T05:58:17.485Z","updated":"2026-10-16T18:55:32.917Z","title":"btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00716,"kevAdded":null},{"id":"CVE-2026-74320","published":"2026-08-15T05:58:16.805Z","updated":"2026-08-17T05:17:10.332Z","title":"fbdev: sm501fb: Fix buffer errors in OF binding code","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-74319","published":"2026-08-15T05:58:16.142Z","updated":"2026-08-17T05:17:09.243Z","title":"btrfs: zoned: fix deadlock waiting for ticket during data relocation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-74318","published":"2026-08-15T05:58:15.499Z","updated":"2026-10-30T12:29:43.511Z","title":"btrfs: fix deadlock cloning inline extent when using flushoncommit","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-74317","published":"2026-08-15T05:58:14.832Z","updated":"2026-10-30T12:29:42.265Z","title":"ixgbe: do not configure xps for XDP queues","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74316","published":"2026-08-15T05:58:14.165Z","updated":"2026-10-16T18:55:32.624Z","title":"NFSD: Handle layout stid in nfsd4_drop_revoked_stid()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0063,"kevAdded":null},{"id":"CVE-2026-74315","published":"2026-08-15T05:58:13.504Z","updated":"2026-08-17T05:45:48.282Z","title":"lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-74314","published":"2026-08-15T05:58:12.766Z","updated":"2026-10-16T18:55:32.490Z","title":"bpf: Cancel special fields on map value recycle","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74313","published":"2026-08-15T05:58:12.058Z","updated":"2026-10-16T18:55:32.347Z","title":"vduse: hold vduse_lock across IDR lookup in open path","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74312","published":"2026-08-15T05:58:11.395Z","updated":"2026-10-16T18:55:32.188Z","title":"vhost/vdpa: validate virtqueue index in mmap and fault paths","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74311","published":"2026-08-15T05:58:10.711Z","updated":"2026-08-17T05:45:43.827Z","title":"virtio: rtc: tear down old virtqueues before restore","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74310","published":"2026-08-15T05:58:10.043Z","updated":"2026-10-16T18:55:32.036Z","title":"vhost/net: complete zerocopy ubufs only once","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-74309","published":"2026-08-15T05:58:09.366Z","updated":"2026-08-17T05:45:41.596Z","title":"vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler","severity":"CRITICAL","score":10,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00649,"kevAdded":null},{"id":"CVE-2026-74308","published":"2026-08-15T05:58:08.682Z","updated":"2026-10-30T12:29:41.200Z","title":"ext4: fix kernel BUG in ext4_write_inline_data_end","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74307","published":"2026-08-15T05:58:07.969Z","updated":"2026-10-30T12:29:40.141Z","title":"ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74306","published":"2026-08-15T05:58:07.313Z","updated":"2026-08-17T05:45:40.501Z","title":"vfio/qat: fix f_pos race in qat_vf_resume_write()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74305","published":"2026-08-15T05:58:06.654Z","updated":"2026-10-16T18:55:31.883Z","title":"bpf: Tighten cgroup storage cookie checks for prog arrays","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-74304","published":"2026-08-15T05:58:05.981Z","updated":"2026-09-25T14:44:24.813Z","title":"Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev device","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74303","published":"2026-08-15T05:58:05.321Z","updated":"2026-08-17T05:16:50.701Z","title":"Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-74302","published":"2026-08-15T05:58:04.638Z","updated":"2026-10-30T12:29:39.077Z","title":"Bluetooth: hci_core: Fix UAF in hci_unregister_dev()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74301","published":"2026-08-15T05:58:03.991Z","updated":"2026-08-17T05:16:48.515Z","title":"Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-74300","published":"2026-08-15T05:58:03.348Z","updated":"2026-10-16T18:55:31.589Z","title":"Bluetooth: hci: validate codec capability element length","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2026-74299","published":"2026-08-15T05:58:02.688Z","updated":"2026-08-17T05:16:46.307Z","title":"RDMA/core: Fix FRMR aging push to queue error flow","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-74298","published":"2026-08-15T05:58:02.051Z","updated":"2026-08-17T05:16:45.222Z","title":"RDMA/core: Fix FRMR set pinned push error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-74297","published":"2026-08-15T05:58:01.414Z","updated":"2026-10-16T18:55:31.425Z","title":"RDMA/mlx5: Fix undefined shift of user RQ WQE size","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-74296","published":"2026-08-15T05:58:00.758Z","updated":"2026-10-16T18:55:31.271Z","title":"RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-74295","published":"2026-08-15T05:58:00.123Z","updated":"2026-10-16T18:55:31.120Z","title":"ASoC: codecs: hdac_hdmi: Validate written enum value","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-74294","published":"2026-08-15T05:57:59.508Z","updated":"2026-10-16T18:55:30.979Z","title":"ASoC: meson: aiu: Validate written enum values","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74293","published":"2026-08-15T05:57:58.889Z","updated":"2026-10-16T18:55:30.824Z","title":"ASoC: fsl: fsl_audmix: Validate written enum values","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-74292","published":"2026-08-15T05:57:58.250Z","updated":"2026-10-16T18:55:30.680Z","title":"ASoC: tegra: tegra210_ahub: Validate written enum value","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-74291","published":"2026-08-15T05:57:57.631Z","updated":"2026-10-30T12:29:38.001Z","title":"ASoC: topology: Check PCM and DAI name strings before use","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74290","published":"2026-08-15T05:57:57.004Z","updated":"2026-08-17T05:16:36.420Z","title":"net/sched: cls_flow: Dont expose folded kernel pointers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74289","published":"2026-08-15T05:57:56.383Z","updated":"2026-10-16T18:55:30.522Z","title":"ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74288","published":"2026-08-15T05:57:55.760Z","updated":"2026-10-16T18:55:30.358Z","title":"net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74287","published":"2026-08-15T05:57:55.151Z","updated":"2026-10-16T18:55:30.206Z","title":"sctp: validate embedded address parameter length","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00735,"kevAdded":null},{"id":"CVE-2026-74286","published":"2026-08-15T05:57:54.529Z","updated":"2026-08-17T05:16:32.000Z","title":"net: pfcp: allocate per-cpu tstats for PFCP netdevs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74285","published":"2026-08-15T05:57:53.907Z","updated":"2026-08-17T05:45:25.616Z","title":"net: Stop leased rxq before uninstalling its memory provider","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-74284","published":"2026-08-15T05:57:53.290Z","updated":"2026-08-17T05:16:29.785Z","title":"net/sched: sch_hfsc: Don't make class passive twice","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-74283","published":"2026-08-15T05:57:52.667Z","updated":"2026-10-16T18:55:30.055Z","title":"tipc: require net admin for TIPCv2 netlink mutators","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-74282","published":"2026-08-15T05:57:52.048Z","updated":"2026-10-16T18:55:29.895Z","title":"tipc: prevent snt_unacked underflow on CONN_ACK","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00696,"kevAdded":null},{"id":"CVE-2026-74281","published":"2026-08-15T05:57:51.423Z","updated":"2026-10-16T18:55:29.746Z","title":"tipc: reject inverted service ranges from peer bindings","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0068,"kevAdded":null},{"id":"CVE-2026-74280","published":"2026-08-15T05:57:50.809Z","updated":"2026-08-17T05:45:21.184Z","title":"crypto: marvell/octeontx - fix DMA cleanup using wrong loop index","severity":"CRITICAL","score":10,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00755,"kevAdded":null},{"id":"CVE-2026-74279","published":"2026-08-15T05:57:50.131Z","updated":"2026-10-16T18:55:29.607Z","title":"crypto: cavium/cpt - fix DMA cleanup using wrong loop index","severity":"CRITICAL","score":10,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00755,"kevAdded":null},{"id":"CVE-2026-74278","published":"2026-08-15T05:57:49.475Z","updated":"2026-10-30T12:29:36.939Z","title":"ALSA: seq: Fix kernel heap address leak in bounce_error_event()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74277","published":"2026-08-15T05:57:48.814Z","updated":"2026-10-16T18:55:29.456Z","title":"iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74276","published":"2026-08-15T05:57:48.115Z","updated":"2026-08-17T05:16:20.426Z","title":"spi: xilinx: use FIFO occupancy register to determine buffer size","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-74275","published":"2026-08-15T05:57:47.455Z","updated":"2026-08-17T05:45:17.863Z","title":"cxl/region: Fix out-of-bounds access in cxl_cancel_auto_attach()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-74274","published":"2026-08-15T05:57:46.798Z","updated":"2026-08-17T05:16:18.253Z","title":"cxl/region: Fill first free targets[] slot during auto-discovery","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-74273","published":"2026-08-15T05:57:46.134Z","updated":"2026-10-21T12:45:15.193Z","title":"cxl/region: Block region delete during region creation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-74272","published":"2026-08-15T05:57:45.494Z","updated":"2026-10-21T12:45:14.105Z","title":"cxl/region: Resolve region deletion races","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-74271","published":"2026-08-15T05:57:44.853Z","updated":"2026-08-17T05:16:14.971Z","title":"power: supply: core: fix supplied_from allocations","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-74270","published":"2026-08-15T05:57:44.195Z","updated":"2026-10-16T18:55:29.298Z","title":"handshake: Require admin permission for DONE command","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-74269","published":"2026-08-15T05:57:43.559Z","updated":"2026-10-30T12:29:35.875Z","title":"bnxt: fix head underflow on XDP head-grow","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00721,"kevAdded":null},{"id":"CVE-2026-74268","published":"2026-08-15T05:57:42.920Z","updated":"2026-10-16T18:55:28.993Z","title":"tcp: clear sock_ops cb flags before force-closing a child socket","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-74267","published":"2026-08-15T05:57:42.263Z","updated":"2026-10-16T18:55:28.845Z","title":"net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-74266","published":"2026-08-15T05:57:41.611Z","updated":"2026-08-17T05:16:08.881Z","title":"net/sched: sch_dualpi2: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-74265","published":"2026-08-15T05:57:40.976Z","updated":"2026-08-17T05:16:07.784Z","title":"net: mana: initialize gdma queue id to INVALID_QUEUE_ID","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-74264","published":"2026-08-15T05:57:40.314Z","updated":"2026-10-30T12:29:34.809Z","title":"net: watchdog: fix refcount tracking races","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-74263","published":"2026-08-15T05:57:39.660Z","updated":"2026-08-17T05:16:05.593Z","title":"net: wwan: t7xx: check skb_clone in control TX","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-74262","published":"2026-08-15T05:57:38.990Z","updated":"2026-10-16T18:55:28.552Z","title":"kcm: use WRITE_ONCE() when changing lower socket callbacks","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-74261","published":"2026-08-15T05:57:38.311Z","updated":"2026-10-30T12:29:33.748Z","title":"ALSA: seq: avoid stale FIFO cells during resize","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-74260","published":"2026-08-15T05:57:37.579Z","updated":"2026-10-15T10:08:50.087Z","title":"netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-74258","published":"2026-08-15T05:57:36.257Z","updated":"2026-10-16T18:55:28.406Z","title":"bpf: Guard __get_user acesss with access_ok for uprobe_multi data","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-74257","published":"2026-08-15T05:57:35.604Z","updated":"2026-10-30T12:29:32.689Z","title":"sockmap: Fix use-after-free in udp_bpf_recvmsg()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-74256","published":"2026-08-15T05:57:34.956Z","updated":"2026-10-16T18:55:28.085Z","title":"bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-74255","published":"2026-08-15T05:57:34.293Z","updated":"2026-10-16T18:55:27.929Z","title":"tipc: fix UAF in tipc_l2_send_msg()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.005,"kevAdded":null},{"id":"CVE-2026-72502","published":"2026-08-15T05:57:33.647Z","updated":"2026-10-16T18:55:27.761Z","title":"tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00716,"kevAdded":null},{"id":"CVE-2026-72501","published":"2026-08-15T05:57:32.990Z","updated":"2026-10-21T12:45:08.545Z","title":"RDMA/bnxt_re: Initialize dpi variable to zero","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72500","published":"2026-08-15T05:57:32.341Z","updated":"2026-10-21T12:45:07.452Z","title":"RDMA/bnxt_re: Free SRQ toggle page after firmware teardown","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-72499","published":"2026-08-15T05:57:31.696Z","updated":"2026-10-21T12:45:06.350Z","title":"RDMA/bnxt_re: Free CQ toggle page after firmware teardown","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-72498","published":"2026-08-15T05:57:31.037Z","updated":"2026-08-17T05:15:51.400Z","title":"RDMA/bnxt_re: Avoid displaying the kernel pointer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-72497","published":"2026-08-15T05:57:30.386Z","updated":"2026-10-21T12:45:05.370Z","title":"RDMA/bnxt_re: Add a max slot check for SQ","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-72496","published":"2026-08-15T05:57:29.723Z","updated":"2026-10-16T18:55:27.134Z","title":"RDMA/bnxt_re: Proper rollback if the ioremap fails","severity":"CRITICAL","score":9.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2026-72495","published":"2026-08-15T05:57:28.920Z","updated":"2026-10-21T12:45:04.330Z","title":"RDMA/bnxt_re: Avoid repeated requests to allocate WC pages","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-72494","published":"2026-08-15T05:57:28.280Z","updated":"2026-10-30T12:29:31.628Z","title":"RDMA/irdma: Replace waitqueue and flag with completion","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00721,"kevAdded":null},{"id":"CVE-2026-72493","published":"2026-08-15T05:57:27.642Z","updated":"2026-10-21T12:45:02.169Z","title":"net: serialize netif_running() check in enqueue_to_backlog()","severity":"CRITICAL","score":9.9,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2026-72492","published":"2026-08-15T05:57:26.967Z","updated":"2026-08-17T05:44:53.329Z","title":"ksmbd: fix use-after-free in same_client_has_lease()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00644,"kevAdded":null},{"id":"CVE-2026-72491","published":"2026-08-15T05:57:26.281Z","updated":"2026-10-16T18:55:26.515Z","title":"net/9p: fix race condition on rdma->state in trans_rdma.c","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00724,"kevAdded":null},{"id":"CVE-2026-72490","published":"2026-08-15T05:57:25.610Z","updated":"2026-08-17T05:15:41.415Z","title":"staging: rtl8723bs: fix stainfo check in rtw_aes_decrypt","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72489","published":"2026-08-15T05:57:24.948Z","updated":"2026-08-17T05:44:51.131Z","title":"staging: nvec: fix use-after-free in nvec_rx_completed()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-72488","published":"2026-08-15T05:57:24.146Z","updated":"2026-10-30T12:29:30.561Z","title":"soundwire: fix bug in sdw_add_element_group_count found by syzkaller","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72487","published":"2026-08-15T05:57:23.490Z","updated":"2026-10-16T18:55:26.195Z","title":"PCI: Check ROM header and data structure addr before accessing","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-72486","published":"2026-08-15T05:57:22.821Z","updated":"2026-08-17T05:15:36.888Z","title":"mailbox: mtk-adsp: fix UAF during device teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72485","published":"2026-08-15T05:57:22.170Z","updated":"2026-10-03T10:55:54.492Z","title":"coresight: platform: defer connection counter increment until alloc succeeds","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-72484","published":"2026-08-15T05:57:21.528Z","updated":"2026-08-17T05:15:34.687Z","title":"staging: most: video: avoid double free on video register failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72483","published":"2026-08-15T05:57:20.914Z","updated":"2026-08-17T05:44:46.745Z","title":"usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-72482","published":"2026-08-15T05:57:20.247Z","updated":"2026-08-17T05:44:45.643Z","title":"gpib: fix double decrement of descriptor_busy in command_ioctl()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-72481","published":"2026-08-15T05:57:19.613Z","updated":"2026-08-17T05:15:31.386Z","title":"iio: magnetometer: ak8975: fix potential kernel stack memory leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72480","published":"2026-08-15T05:57:18.975Z","updated":"2026-08-17T05:44:43.931Z","title":"iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-72479","published":"2026-08-15T05:57:18.324Z","updated":"2026-08-17T05:15:29.198Z","title":"iio: accel: mma8452: handle I2C read error(s) in mma8452_read()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72478","published":"2026-08-15T05:57:17.679Z","updated":"2026-10-16T18:55:26.034Z","title":"fs/ntfs3: add bounds check to run_get_highest_vcn()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-72477","published":"2026-08-15T05:57:17.035Z","updated":"2026-10-15T10:08:45.810Z","title":"fs/ntfs3: call _ntfs_bad_inode() when failing to rename","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00649,"kevAdded":null},{"id":"CVE-2026-72476","published":"2026-08-15T05:57:16.396Z","updated":"2026-10-16T18:55:25.895Z","title":"dmaengine: Fix possible use after free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-72475","published":"2026-08-15T05:57:15.734Z","updated":"2026-08-17T05:15:24.817Z","title":"dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72474","published":"2026-08-15T05:57:15.073Z","updated":"2026-08-17T05:15:23.275Z","title":"dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72473","published":"2026-08-15T05:57:14.412Z","updated":"2026-10-16T18:55:25.751Z","title":"xprtrdma: Decouple req recycling from RPC completion","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00721,"kevAdded":null},{"id":"CVE-2026-72472","published":"2026-08-15T05:57:13.752Z","updated":"2026-10-30T12:29:29.497Z","title":"nfs: use nfsi->rwsem to protect traversal of the file lock list","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00652,"kevAdded":null},{"id":"CVE-2026-72471","published":"2026-08-15T05:57:13.117Z","updated":"2026-08-17T05:44:36.197Z","title":"fs/ntfs3: prevent potential lcn remains uninitialized","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2026-72470","published":"2026-08-15T05:57:12.472Z","updated":"2026-10-30T12:29:28.441Z","title":"fs/ntfs3: resize log->one_page_buf when adopting on-disk page size","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-72469","published":"2026-08-15T05:57:11.829Z","updated":"2026-10-21T12:44:59.460Z","title":"xprtrdma: Fix ep kref imbalance on ADDR_CHANGE","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2026-72468","published":"2026-08-15T05:57:11.171Z","updated":"2026-08-17T05:15:13.672Z","title":"xprtrdma: Initialize re_id before removal registration","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72467","published":"2026-08-15T05:57:10.499Z","updated":"2026-08-17T05:15:12.570Z","title":"xprtrdma: Check frwr_wp_create() during connect","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72466","published":"2026-08-15T05:57:09.847Z","updated":"2026-10-16T18:55:25.296Z","title":"xprtrdma: Fix bcall rep leak and unbounded peek","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00738,"kevAdded":null},{"id":"CVE-2026-72465","published":"2026-08-15T05:57:08.767Z","updated":"2026-08-17T05:44:31.793Z","title":"xprtrdma: Sanitize the reply credit grant after parsing","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00684,"kevAdded":null},{"id":"CVE-2026-72464","published":"2026-08-15T05:57:08.080Z","updated":"2026-10-16T18:55:25.140Z","title":"xprtrdma: Repost Receive buffers for malformed replies","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00675,"kevAdded":null},{"id":"CVE-2026-72463","published":"2026-08-15T05:57:07.413Z","updated":"2026-10-30T12:29:27.386Z","title":"xfrm: Fix dev use-after-free in xfrm async resumption","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00444,"kevAdded":null},{"id":"CVE-2026-72462","published":"2026-08-15T05:57:06.705Z","updated":"2026-08-17T05:44:28.507Z","title":"apparmor: fix race in unix socket mediation when peer_path is used","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-72461","published":"2026-08-15T05:57:06.042Z","updated":"2026-08-17T05:44:27.397Z","title":"apparmor: fix refcount leak when updating the sk_ctx","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-72460","published":"2026-08-15T05:57:05.404Z","updated":"2026-08-17T05:44:26.306Z","title":"apparmor: check label build before no_new_privs test","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-72459","published":"2026-08-15T05:57:04.794Z","updated":"2026-08-17T05:44:25.217Z","title":"apparmor: aa_label_alloc use aa_label_free on alloc failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-72458","published":"2026-08-15T05:57:04.179Z","updated":"2026-08-17T05:15:02.544Z","title":"apparmor: fix NULL pointer dereference in unpack_pdb","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-72457","published":"2026-08-15T05:57:03.536Z","updated":"2026-08-17T05:15:01.418Z","title":"apparmor: fail policy unpack on accept2 allocation failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-72456","published":"2026-08-15T05:57:02.864Z","updated":"2026-08-17T05:15:00.310Z","title":"apparmor: release exe file resources on path failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72455","published":"2026-08-15T05:57:02.234Z","updated":"2026-08-17T05:44:24.111Z","title":"apparmor: fix uninitialised pointer passed to audit_log_untrustedstring()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-72454","published":"2026-08-15T05:57:01.558Z","updated":"2026-10-15T10:08:44.758Z","title":"i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-72453","published":"2026-08-15T05:57:00.921Z","updated":"2026-10-30T12:29:26.327Z","title":"regcache: Do not overwrite error code when finalizing cache after error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72452","published":"2026-08-15T05:57:00.234Z","updated":"2026-10-16T18:55:24.968Z","title":"drm/i915: clear CRTC color blob pointers after dropping refs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-72451","published":"2026-08-15T05:56:59.561Z","updated":"2026-08-17T05:44:20.831Z","title":"xfrm: Fix xfrm state cache insertion race","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00671,"kevAdded":null},{"id":"CVE-2026-72450","published":"2026-08-15T05:56:58.939Z","updated":"2026-10-16T18:55:24.828Z","title":"xfrm: validate selector family and prefixlen during match","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72449","published":"2026-08-15T05:56:58.313Z","updated":"2026-10-16T18:55:24.681Z","title":"drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-72448","published":"2026-08-15T05:56:57.701Z","updated":"2026-08-17T05:14:50.660Z","title":"octeontx2-pf: Fix leak of SQ timestamp buffer on teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-72447","published":"2026-08-15T05:56:57.089Z","updated":"2026-08-17T05:14:49.557Z","title":"sctp: hold socket lock when dumping endpoints in sctp_diag","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72446","published":"2026-08-15T05:56:56.470Z","updated":"2026-08-17T05:44:17.542Z","title":"ALSA: usb-audio: qcom: reject stream disable with no active interface","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-72445","published":"2026-08-15T05:56:55.855Z","updated":"2026-08-17T05:14:46.557Z","title":"ALSA: usb-audio: qcom: clear opened when stream enable fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-72444","published":"2026-08-15T05:56:55.229Z","updated":"2026-10-16T18:55:24.524Z","title":"flow_dissector: check device type before reading ETH_ADDRS","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-72443","published":"2026-08-15T05:56:54.601Z","updated":"2026-08-17T05:14:44.380Z","title":"ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72442","published":"2026-08-15T05:56:53.941Z","updated":"2026-08-17T05:44:15.340Z","title":"netfilter: flowtable: fix and simplify IP6IP6 tunnel handling","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-72441","published":"2026-08-15T05:56:53.305Z","updated":"2026-08-17T05:14:42.172Z","title":"ieee802154: fix kernel-infoleak in dgram_recvmsg()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2026-72440","published":"2026-08-15T05:56:52.662Z","updated":"2026-10-30T12:29:25.252Z","title":"md/raid1: fix writes_pending and barrier reference leaks on write failures","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00498,"kevAdded":null},{"id":"CVE-2026-72439","published":"2026-08-15T05:56:52.023Z","updated":"2026-10-30T12:29:24.199Z","title":"md/raid10: fix writes_pending leak on write request failures","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-72438","published":"2026-08-15T05:56:51.384Z","updated":"2026-10-30T12:29:23.144Z","title":"md/raid10: fix writes_pending and barrier reference leaks on discard failures","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.005,"kevAdded":null},{"id":"CVE-2026-72437","published":"2026-08-15T05:56:50.732Z","updated":"2026-08-17T05:14:37.742Z","title":"md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72436","published":"2026-08-15T05:56:50.051Z","updated":"2026-10-16T18:55:24.058Z","title":"netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00712,"kevAdded":null},{"id":"CVE-2026-72435","published":"2026-08-15T05:56:49.402Z","updated":"2026-10-16T18:55:23.893Z","title":"netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72434","published":"2026-08-15T05:56:48.756Z","updated":"2026-10-16T18:55:23.726Z","title":"netfilter: ipset: make sure gc is properly stopped","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-72433","published":"2026-08-15T05:56:48.117Z","updated":"2026-08-17T05:14:33.263Z","title":"netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-72432","published":"2026-08-15T05:56:47.478Z","updated":"2026-08-17T05:14:32.158Z","title":"tpm_crb: Check ACPI_COMPANION() against NULL during probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72431","published":"2026-08-15T05:56:46.821Z","updated":"2026-08-17T05:14:31.058Z","title":"alloc_tag: fix use-after-free in /proc/allocinfo after module unload","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-72430","published":"2026-08-15T05:56:46.178Z","updated":"2026-08-17T05:14:29.962Z","title":"net/sched: act_ct: fix nf_connlabels leak on two error paths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72429","published":"2026-08-15T05:56:45.530Z","updated":"2026-08-17T05:44:08.737Z","title":"ipv6: ioam: fix type confusion of dst_entry","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00649,"kevAdded":null},{"id":"CVE-2026-72428","published":"2026-08-15T05:56:44.831Z","updated":"2026-08-17T05:14:27.751Z","title":"bpf: Fix stack slot index in nospec checks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72427","published":"2026-08-15T05:56:44.197Z","updated":"2026-10-16T18:55:23.555Z","title":"bpf: Fix effective prog array index with BPF_F_PREORDER","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-72426","published":"2026-08-15T05:56:43.575Z","updated":"2026-08-17T05:44:06.105Z","title":"bpf: Preserve pointer spill metadata during half-slot cleanup","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-72425","published":"2026-08-15T05:56:42.959Z","updated":"2026-10-16T18:55:23.412Z","title":"ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-72424","published":"2026-08-15T05:56:42.335Z","updated":"2026-08-17T05:14:23.414Z","title":"rtc: msc313: fix NULL deref in shared IRQ handler at probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72423","published":"2026-08-15T05:56:41.711Z","updated":"2026-10-30T12:29:22.084Z","title":"bpf: Guard conntrack opts error writes","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-72422","published":"2026-08-15T05:56:41.090Z","updated":"2026-08-17T05:44:02.758Z","title":"ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00717,"kevAdded":null},{"id":"CVE-2026-72421","published":"2026-08-15T05:56:40.466Z","updated":"2026-10-16T18:55:23.102Z","title":"ipv4: fib: Don't ignore error route in local/main tables.","severity":"CRITICAL","score":10,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00571,"kevAdded":null},{"id":"CVE-2026-72420","published":"2026-08-15T05:56:39.802Z","updated":"2026-10-30T12:29:21.031Z","title":"md/raid5: avoid R5_Overlap races while breaking stripe batches","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00648,"kevAdded":null},{"id":"CVE-2026-72419","published":"2026-08-15T05:56:39.126Z","updated":"2026-10-16T18:55:22.803Z","title":"netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-72418","published":"2026-08-15T05:56:38.374Z","updated":"2026-10-16T18:55:22.660Z","title":"netfilter: nf_conncount: prevent connlimit drops for early confirmed ct","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00716,"kevAdded":null},{"id":"CVE-2026-72417","published":"2026-08-15T05:56:37.547Z","updated":"2026-08-17T05:43:57.257Z","title":"netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-72416","published":"2026-08-15T05:56:36.886Z","updated":"2026-10-30T12:29:19.961Z","title":"netfilter: nft_compat: ebtables emulation must reject non-bridge targets","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-72415","published":"2026-08-15T05:56:36.210Z","updated":"2026-10-16T18:55:22.361Z","title":"ASoC: SDCA: Validate written enum value in ge_put_enum_double()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-72414","published":"2026-08-15T05:56:35.548Z","updated":"2026-08-17T05:14:12.457Z","title":"net: dsa: sja1105: round up PTP perout pin duration","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72413","published":"2026-08-15T05:56:34.857Z","updated":"2026-10-03T10:55:52.258Z","title":"sctp: fix err_chunk memory leaks in INIT handling","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-72412","published":"2026-08-15T05:56:34.165Z","updated":"2026-08-17T05:43:53.927Z","title":"s390/mm: Fix handling of _PAGE_UNUSED pte bit","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-72411","published":"2026-08-15T05:56:33.508Z","updated":"2026-08-17T05:43:51.843Z","title":"net: dsa: mxl862xx: fix use-after-free of DSA ports in crc_err_work","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-72410","published":"2026-08-15T05:56:32.843Z","updated":"2026-08-17T05:43:50.739Z","title":"octeontx2-af: Validate NIX maximum LFs correctly","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-72409","published":"2026-08-15T05:56:32.152Z","updated":"2026-10-16T18:55:22.213Z","title":"net: mvneta: re-enable percpu interrupt on resume","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00716,"kevAdded":null},{"id":"CVE-2026-72408","published":"2026-08-15T05:56:31.477Z","updated":"2026-08-17T05:43:48.541Z","title":"geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint","severity":"CRITICAL","score":10,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-72407","published":"2026-08-15T05:56:30.847Z","updated":"2026-08-17T05:43:47.398Z","title":"geneve: validate inner network offset in geneve_gro_complete()","severity":"CRITICAL","score":10,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-72406","published":"2026-08-15T05:56:30.225Z","updated":"2026-10-16T18:55:22.076Z","title":"net: sungem: fix probe error cleanup","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72405","published":"2026-08-15T05:56:29.466Z","updated":"2026-10-30T12:29:18.903Z","title":"net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-72404","published":"2026-08-15T05:56:28.124Z","updated":"2026-10-30T12:29:17.840Z","title":"tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-72403","published":"2026-08-15T05:56:27.464Z","updated":"2026-08-17T05:14:00.240Z","title":"ALSA: FCP: Fix NULL pointer dereference in interface lookup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-72402","published":"2026-08-15T05:56:26.816Z","updated":"2026-10-03T10:55:51.170Z","title":"bpf: Mask pseudo pointer values in verifier logs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-72401","published":"2026-08-15T05:56:26.197Z","updated":"2026-08-17T05:13:58.017Z","title":"bpf: Fix insn_aux_data leak on verifier err_free_env path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-72400","published":"2026-08-15T05:56:25.572Z","updated":"2026-10-16T18:55:21.670Z","title":"seg6: validate SRH length before reading fixed fields","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-72399","published":"2026-08-15T05:56:24.926Z","updated":"2026-08-17T05:43:41.891Z","title":"net: enetc: check the number of BDs needed for xdp_frame","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00682,"kevAdded":null},{"id":"CVE-2026-72398","published":"2026-08-15T05:56:24.306Z","updated":"2026-10-30T12:29:16.761Z","title":"sctp: add INIT verification after cookie unpacking","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00803,"kevAdded":null},{"id":"CVE-2026-72397","published":"2026-08-15T05:56:23.675Z","updated":"2026-10-21T12:44:48.405Z","title":"hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-72396","published":"2026-08-15T05:56:23.067Z","updated":"2026-08-17T05:13:52.535Z","title":"hwmon: adm1275: Prevent reading uninitialized stack","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72395","published":"2026-08-15T05:56:22.400Z","updated":"2026-10-30T12:29:15.667Z","title":"hwmon: (pmbus) Fix passing events to regulator core","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-72394","published":"2026-08-15T05:56:21.707Z","updated":"2026-08-17T05:13:48.410Z","title":"hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72393","published":"2026-08-15T05:56:21.081Z","updated":"2026-08-17T05:43:37.508Z","title":"eth: fbnic: don't cache shinfo across skb realloc","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00631,"kevAdded":null},{"id":"CVE-2026-72392","published":"2026-08-15T05:56:20.463Z","updated":"2026-08-19T16:36:33.417Z","title":"ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-72391","published":"2026-08-15T05:56:19.842Z","updated":"2026-08-17T05:13:45.125Z","title":"net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72390","published":"2026-08-15T05:56:19.186Z","updated":"2026-10-16T18:55:21.250Z","title":"net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-72389","published":"2026-08-15T05:56:18.553Z","updated":"2026-10-16T18:55:21.113Z","title":"bridge: stp: Fix a potential use-after-free when deleting a bridge","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-72388","published":"2026-08-15T05:56:17.918Z","updated":"2026-10-21T12:44:47.279Z","title":"drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72387","published":"2026-08-15T05:56:17.303Z","updated":"2026-08-17T05:13:40.696Z","title":"drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72386","published":"2026-08-15T05:56:16.665Z","updated":"2026-08-17T05:13:39.606Z","title":"drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72385","published":"2026-08-15T05:56:16.050Z","updated":"2026-08-17T05:13:38.517Z","title":"tracing/fprobe: Fix NULL pointer dereference in fprobe_fgraph_entry()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-72384","published":"2026-08-15T05:56:15.410Z","updated":"2026-08-17T05:13:37.396Z","title":"irqchip/ts4800: Fix missing chained handler cleanup on remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72383","published":"2026-08-15T05:56:14.755Z","updated":"2026-10-30T12:29:14.606Z","title":"sctp: fix addr_wq_timer race in sctp_free_addr_wq()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-72382","published":"2026-08-15T05:56:14.103Z","updated":"2026-10-30T12:29:13.532Z","title":"ksmbd: reject undersized DACLs before parsing ACEs","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0068,"kevAdded":null},{"id":"CVE-2026-72381","published":"2026-08-15T05:56:13.477Z","updated":"2026-08-17T05:43:32.020Z","title":"ksmbd: fix use-after-free of fp->owner.name in durable handle owner check","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00652,"kevAdded":null},{"id":"CVE-2026-72380","published":"2026-08-15T05:56:12.866Z","updated":"2026-10-30T12:29:12.462Z","title":"xen/pvcalls: bound backend response req_id before indexing rsp[]","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2026-72379","published":"2026-08-15T05:56:12.251Z","updated":"2026-10-30T12:29:11.407Z","title":"fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72378","published":"2026-08-15T05:56:11.641Z","updated":"2026-08-17T05:43:29.813Z","title":"afs: Fix error code in afs_extract_vl_addrs()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00716,"kevAdded":null},{"id":"CVE-2026-72377","published":"2026-08-15T05:56:11.017Z","updated":"2026-08-17T05:13:29.683Z","title":"afs: Remove setting of AS_RELEASE_ALWAYS for symlinks and mountpoints","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72376","published":"2026-08-15T05:56:10.401Z","updated":"2026-08-17T05:13:28.597Z","title":"afs: Fix misplaced inc of net->cells_outstanding","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72375","published":"2026-08-15T05:56:09.790Z","updated":"2026-10-30T12:29:10.338Z","title":"afs: Fix reinitialisation of the inode, in particular ->lock_work","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-72374","published":"2026-08-15T05:56:09.182Z","updated":"2026-10-16T18:55:20.697Z","title":"afs: Fix callback service message parsers to pass through -EAGAIN","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00716,"kevAdded":null},{"id":"CVE-2026-72373","published":"2026-08-15T05:56:08.564Z","updated":"2026-10-16T18:55:20.560Z","title":"afs: Fix missing NULL pointer check in afs_break_some_callbacks()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0063,"kevAdded":null},{"id":"CVE-2026-72372","published":"2026-08-15T05:56:07.916Z","updated":"2026-08-17T05:43:25.401Z","title":"afs: Fix lack of locking around modifications of net->cells_dyn_ino","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-72371","published":"2026-08-15T05:56:07.299Z","updated":"2026-10-16T18:55:20.416Z","title":"afs: Fix the volume AFS_VOLUME_RM_TREE is set on","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-72370","published":"2026-08-15T05:56:06.648Z","updated":"2026-10-15T10:08:37.321Z","title":"iomap: release pages on atomic dio size mismatch","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-72369","published":"2026-08-15T05:56:05.995Z","updated":"2026-08-17T05:43:23.188Z","title":"minix: avoid overflow in bitmap block count calculation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-72368","published":"2026-08-15T05:56:05.329Z","updated":"2026-08-17T05:43:22.072Z","title":"cachefiles: Fix double unlock in nomem_d_alloc error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-72367","published":"2026-08-15T05:56:04.669Z","updated":"2026-10-21T12:44:42.934Z","title":"iomap: guard io_size EOF trim against concurrent truncate underflow","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00601,"kevAdded":null},{"id":"CVE-2026-72366","published":"2026-08-15T05:56:04.016Z","updated":"2026-10-21T12:44:41.841Z","title":"netfs: Fix netfs_create_write_req() to handle async cache object creation","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00671,"kevAdded":null},{"id":"CVE-2026-72365","published":"2026-08-15T05:56:03.366Z","updated":"2026-08-17T05:13:16.473Z","title":"netfs: Fix writethrough to use collection offload","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-72364","published":"2026-08-15T05:56:02.722Z","updated":"2026-08-17T05:43:18.766Z","title":"netfs: Fix writeback error handling","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-72363","published":"2026-08-15T05:56:02.071Z","updated":"2026-10-21T12:44:40.702Z","title":"netfs: Fix folio state after ENOMEM whilst under writeback iteration","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72362","published":"2026-08-15T05:56:01.414Z","updated":"2026-08-17T05:13:13.207Z","title":"drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72361","published":"2026-08-15T05:56:00.759Z","updated":"2026-08-17T05:13:12.118Z","title":"drm/xe/hw_engine: Fix double-free of managed BO in error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72360","published":"2026-08-15T05:56:00.076Z","updated":"2026-10-16T18:55:20.266Z","title":"drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-72359","published":"2026-08-15T05:55:59.424Z","updated":"2026-08-17T05:13:09.946Z","title":"drm/xe: fix NPD in bo_meminfo()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72358","published":"2026-08-15T05:55:58.783Z","updated":"2026-08-17T05:43:16.546Z","title":"drm/xe/pt: prevent invalid cursor access for purged BOs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-72357","published":"2026-08-15T05:55:58.124Z","updated":"2026-08-17T05:43:15.438Z","title":"uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-72356","published":"2026-08-15T05:55:57.464Z","updated":"2026-08-17T05:43:14.352Z","title":"cifs: Fix missing credit release on failure in cifs_issue_read()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0063,"kevAdded":null},{"id":"CVE-2026-72355","published":"2026-08-15T05:55:56.812Z","updated":"2026-09-21T13:13:45.795Z","title":"netfs: Fix barriering when walking subrequest list","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00641,"kevAdded":null},{"id":"CVE-2026-72354","published":"2026-08-15T05:55:56.163Z","updated":"2026-08-17T05:43:12.145Z","title":"ntfs: avoid stale runlist element dereference in MFT writeback","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00508,"kevAdded":null},{"id":"CVE-2026-72353","published":"2026-08-15T05:55:55.480Z","updated":"2026-08-17T05:43:11.052Z","title":"ntfs: avoid stale runlist element dereference in fallocate","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00508,"kevAdded":null},{"id":"CVE-2026-72352","published":"2026-08-15T05:55:54.809Z","updated":"2026-10-21T12:44:39.607Z","title":"HID: bpf: Fix hid_bpf_get_data() range check","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-72351","published":"2026-08-15T05:55:54.150Z","updated":"2026-10-16T18:55:19.979Z","title":"gue: validate REMCSUM private option length","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00745,"kevAdded":null},{"id":"CVE-2026-72350","published":"2026-08-15T05:55:53.532Z","updated":"2026-10-16T18:55:19.841Z","title":"netfilter: xt_u32: reject invalid shift counts","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-72349","published":"2026-08-15T05:55:52.916Z","updated":"2026-08-17T05:12:58.965Z","title":"netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72348","published":"2026-08-15T05:55:52.295Z","updated":"2026-10-16T18:55:19.696Z","title":"netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00626,"kevAdded":null},{"id":"CVE-2026-72347","published":"2026-08-15T05:55:51.665Z","updated":"2026-10-16T18:55:19.565Z","title":"netfilter: xt_connmark: reject invalid shift parameters","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-72346","published":"2026-08-15T05:55:51.054Z","updated":"2026-08-17T05:12:55.582Z","title":"platform/x86: bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72345","published":"2026-08-15T05:55:50.427Z","updated":"2026-10-16T18:55:19.426Z","title":"net/mlx5: LAG, Fix off-by-one in single-FDB error rollback","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-72344","published":"2026-08-15T05:55:49.751Z","updated":"2026-08-17T05:43:03.143Z","title":"net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-72343","published":"2026-08-15T05:55:49.067Z","updated":"2026-10-16T18:55:19.281Z","title":"net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-72342","published":"2026-08-15T05:55:48.412Z","updated":"2026-10-16T18:55:19.106Z","title":"net/mlx5e: Fix HV VHCA stats agent registration race","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-72341","published":"2026-08-15T05:55:47.764Z","updated":"2026-10-30T12:29:09.273Z","title":"net/mlx5e: Fix publication race for priv->channel_stats[]","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72340","published":"2026-08-15T05:55:47.119Z","updated":"2026-08-17T05:42:59.028Z","title":"net: microchip: vcap: fix races on the shared Super VCAP block","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-72339","published":"2026-08-15T05:55:46.480Z","updated":"2026-10-16T18:55:18.961Z","title":"qede: fix off-by-one in BD ring consumption on build_skb failure","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00745,"kevAdded":null},{"id":"CVE-2026-72338","published":"2026-08-15T05:55:45.823Z","updated":"2026-10-30T12:29:08.215Z","title":"net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-72337","published":"2026-08-15T05:55:45.160Z","updated":"2026-10-30T12:29:07.154Z","title":"Bluetooth: 6lowpan: avoid untracked enable work","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72336","published":"2026-08-15T05:55:44.487Z","updated":"2026-10-30T12:29:06.091Z","title":"Bluetooth: 6lowpan: hold L2CAP conn across debugfs control","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72335","published":"2026-08-15T05:55:43.847Z","updated":"2026-10-16T18:55:18.546Z","title":"Bluetooth: MGMT: Fix adv monitor add failure cleanup","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-72334","published":"2026-08-15T05:55:43.160Z","updated":"2026-10-16T18:55:18.395Z","title":"Bluetooth: ISO: fix malformed ISO_END/CONT handling","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00397,"kevAdded":null},{"id":"CVE-2026-72333","published":"2026-08-15T05:55:42.523Z","updated":"2026-08-17T05:12:40.473Z","title":"Bluetooth: L2CAP: fix tx ident leak for commands without a response","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72332","published":"2026-08-15T05:55:41.878Z","updated":"2026-08-17T05:12:39.373Z","title":"accel/amdxdna: Prevent PM resume deadlock in hwctx_sync_debug_bo()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72331","published":"2026-08-15T05:55:41.196Z","updated":"2026-10-15T10:08:34.107Z","title":"accel/amdxdna: Fix VMA access race","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-72330","published":"2026-08-15T05:55:40.555Z","updated":"2026-10-16T18:55:18.242Z","title":"net/tls: Consume empty data records in tls_sw_read_sock()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00622,"kevAdded":null},{"id":"CVE-2026-72329","published":"2026-08-15T05:55:39.931Z","updated":"2026-10-30T12:29:05.019Z","title":"net/liquidio: drop cached VF pci_dev LUT","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2026-72328","published":"2026-08-15T05:55:39.296Z","updated":"2026-08-17T05:42:50.096Z","title":"accel/amdxdna: Fix potential amdxdna_umap lifetime race","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-72327","published":"2026-08-15T05:55:37.435Z","updated":"2026-08-17T05:12:33.922Z","title":"drm/v3d: Reject invalid indirect BO handle in indirect CSD setup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72326","published":"2026-08-15T05:55:36.811Z","updated":"2026-08-17T05:12:32.814Z","title":"net/sched: cake: reject overhead values that underflow length","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72325","published":"2026-08-15T05:55:36.148Z","updated":"2026-10-30T12:29:03.961Z","title":"perf/x86/amd/core: Avoid enabling BRS from the SVM reload path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72324","published":"2026-08-15T05:55:35.475Z","updated":"2026-10-21T12:44:34.047Z","title":"gpio: mvebu: free generic chips on unbind","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72323","published":"2026-08-15T05:55:34.828Z","updated":"2026-10-16T18:55:17.940Z","title":"ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00724,"kevAdded":null},{"id":"CVE-2026-72322","published":"2026-08-15T05:55:34.171Z","updated":"2026-10-16T18:55:17.786Z","title":"ipv6: mcast: Fix potential UAF in MLD delayed work","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00724,"kevAdded":null},{"id":"CVE-2026-72321","published":"2026-08-15T05:55:33.547Z","updated":"2026-10-30T12:29:02.891Z","title":"ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72320","published":"2026-08-15T05:55:32.939Z","updated":"2026-10-30T12:29:01.843Z","title":"netfilter: nft_lookup: fix catchall element handling with inverted lookups","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00569,"kevAdded":null},{"id":"CVE-2026-72319","published":"2026-08-15T05:55:32.313Z","updated":"2026-10-16T18:55:17.469Z","title":"ipvs: ensure inner headers in ICMP errors are in headroom","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00745,"kevAdded":null},{"id":"CVE-2026-72318","published":"2026-08-15T05:55:31.682Z","updated":"2026-10-16T18:55:17.318Z","title":"cifs: validate DFS referral string offsets","severity":"CRITICAL","score":9.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00586,"kevAdded":null},{"id":"CVE-2026-72317","published":"2026-08-15T05:55:31.022Z","updated":"2026-10-16T18:55:17.145Z","title":"SUNRPC: pin upper rpc_clnt across the TLS connect_worker","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00644,"kevAdded":null},{"id":"CVE-2026-72316","published":"2026-08-15T05:55:30.399Z","updated":"2026-08-17T05:12:21.813Z","title":"dm era: fix NULL pointer dereference in metadata_open()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72315","published":"2026-08-15T05:55:29.761Z","updated":"2026-10-03T10:55:48.520Z","title":"smb: client: fix busy dentry warning on unmount after DIO","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-72314","published":"2026-08-15T05:55:29.118Z","updated":"2026-10-16T18:55:16.999Z","title":"regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-72313","published":"2026-08-15T05:55:28.455Z","updated":"2026-08-17T05:12:18.468Z","title":"drm/fb-helper: Only consider active CRTCs for vblank sync","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72312","published":"2026-08-15T05:55:27.817Z","updated":"2026-10-16T18:55:16.851Z","title":"octeontx2-af: fix VF bringup affecting PF promiscuous state","severity":"HIGH","score":7.9,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-72311","published":"2026-08-15T05:55:27.164Z","updated":"2026-08-17T05:12:16.211Z","title":"drm/xe: free madvise VMA array on L2 flush failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72310","published":"2026-08-15T05:55:26.539Z","updated":"2026-10-16T18:55:16.690Z","title":"smb: client: fix overflow in passthrough ioctl bounds check","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00643,"kevAdded":null},{"id":"CVE-2026-72309","published":"2026-08-15T05:55:25.914Z","updated":"2026-08-17T05:12:13.994Z","title":"tracing/remotes: Fix leak in trace_remote_alloc_buffer() error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72308","published":"2026-08-15T05:55:25.260Z","updated":"2026-08-23T12:47:14.564Z","title":"mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72307","published":"2026-08-15T05:55:24.622Z","updated":"2026-08-17T05:12:11.806Z","title":"mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72306","published":"2026-08-15T05:55:23.532Z","updated":"2026-08-17T05:12:10.666Z","title":"vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72305","published":"2026-08-15T05:55:22.914Z","updated":"2026-08-23T12:47:13.473Z","title":"VDUSE: avoid leaking information to userspace","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-72304","published":"2026-08-15T05:55:22.290Z","updated":"2026-10-16T18:55:16.536Z","title":"ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-72303","published":"2026-08-15T05:55:21.667Z","updated":"2026-10-16T18:55:16.397Z","title":"ASoC: SOF: ipc4-control: Validate notification payload size","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-72302","published":"2026-08-15T05:55:21.049Z","updated":"2026-10-16T18:55:16.199Z","title":"ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-72301","published":"2026-08-15T05:55:20.430Z","updated":"2026-10-16T18:55:16.018Z","title":"ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72300","published":"2026-08-15T05:55:19.786Z","updated":"2026-08-17T05:12:03.913Z","title":"ASoC: SOF: topology: validate vendor array size before parsing","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72299","published":"2026-08-15T05:55:19.147Z","updated":"2026-10-16T18:55:15.859Z","title":"tipc: restrict socket queue dumps in enqueue tracepoints","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00745,"kevAdded":null},{"id":"CVE-2026-72298","published":"2026-08-15T05:55:18.529Z","updated":"2026-10-16T18:55:15.699Z","title":"net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-72297","published":"2026-08-15T05:55:17.877Z","updated":"2026-10-16T18:55:15.534Z","title":"net: atm: reject out-of-range traffic classes in QoS validation","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-72296","published":"2026-08-15T05:55:17.250Z","updated":"2026-10-16T18:55:15.361Z","title":"net: ife: require ETH_HLEN to be pullable in ife_decode()","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00735,"kevAdded":null},{"id":"CVE-2026-72295","published":"2026-08-15T05:55:16.590Z","updated":"2026-08-17T05:42:28.074Z","title":"LoongArch: KVM: Validate irqchip index in irqfd routing","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-72294","published":"2026-08-15T05:55:14.553Z","updated":"2026-08-17T05:42:26.951Z","title":"LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-72293","published":"2026-08-15T05:55:13.910Z","updated":"2026-08-17T05:11:56.042Z","title":"KVM: s390: vsie: Add missing radix_tree_preload() in _gaccess_shadow_fault()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72292","published":"2026-08-15T05:55:13.248Z","updated":"2026-08-17T05:11:54.937Z","title":"KVM: s390: Initialize KVM_S390_GET_CMMA_BITS memory","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72291","published":"2026-08-15T05:55:12.597Z","updated":"2026-08-17T05:42:25.857Z","title":"KVM: s390: Fix unlikely race in try_get_locked_pte()","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-72290","published":"2026-08-15T05:55:11.543Z","updated":"2026-08-17T05:11:52.778Z","title":"KVM: s390: pci: Fix GISC refcount leak on AIF enable failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72289","published":"2026-08-15T05:55:10.870Z","updated":"2026-10-16T18:55:15.201Z","title":"KVM: arm64: vgic: Check the interrupt is still ours before migrating it","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-72288","published":"2026-08-15T05:55:10.256Z","updated":"2026-10-30T12:29:00.768Z","title":"KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-72287","published":"2026-08-15T05:55:09.624Z","updated":"2026-08-17T05:42:22.571Z","title":"KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into \"normal\" checks","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2026-72286","published":"2026-08-15T05:55:09.004Z","updated":"2026-10-16T18:55:14.819Z","title":"KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-72285","published":"2026-08-15T05:55:08.385Z","updated":"2026-08-17T05:42:20.367Z","title":"KVM: TDX: Reject concurrent change to CPUID entry count","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-72284","published":"2026-08-15T05:55:07.765Z","updated":"2026-10-16T18:55:14.664Z","title":"KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2026-72283","published":"2026-08-15T05:55:06.959Z","updated":"2026-08-17T05:42:18.185Z","title":"KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-72282","published":"2026-08-15T05:55:06.307Z","updated":"2026-10-16T18:55:14.491Z","title":"KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-72281","published":"2026-08-15T05:55:05.652Z","updated":"2026-08-17T05:11:42.129Z","title":"KVM: arm64: account pKVM reclaim against the VM mm","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72280","published":"2026-08-15T05:55:04.969Z","updated":"2026-10-16T18:55:14.328Z","title":"KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-72279","published":"2026-08-15T05:55:04.313Z","updated":"2026-08-17T05:42:14.902Z","title":"KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR","severity":"CRITICAL","score":9,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-72278","published":"2026-08-15T05:54:59.698Z","updated":"2026-08-17T05:42:13.824Z","title":"KVM: arm64: nv: Re-translate VNCR before injecting abort","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-72277","published":"2026-08-15T05:54:59.022Z","updated":"2026-08-17T05:42:12.724Z","title":"KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-72276","published":"2026-08-15T05:54:58.358Z","updated":"2026-08-17T05:11:36.665Z","title":"fbdev: metronomefb: fix potential memory leak in metronomefb_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72275","published":"2026-08-15T05:54:57.685Z","updated":"2026-08-17T05:11:35.583Z","title":"fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72274","published":"2026-08-15T05:54:57.070Z","updated":"2026-08-17T05:11:34.481Z","title":"fbdev: hecubafb: fix potential memory leak in hecubafb_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72273","published":"2026-08-15T05:54:56.440Z","updated":"2026-08-17T05:11:33.384Z","title":"fbdev: efifb: fix memory leak in efifb_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72272","published":"2026-08-15T05:54:55.825Z","updated":"2026-08-17T05:11:32.271Z","title":"fbdev: radeon: fix potential memory leak in radeonfb_pci_register()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72271","published":"2026-08-15T05:54:55.203Z","updated":"2026-08-17T05:11:31.179Z","title":"fbdev: i740fb: fix potential memory leak in i740fb_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72270","published":"2026-08-15T05:54:54.589Z","updated":"2026-08-17T05:11:30.077Z","title":"fbdev: s3fb: fix potential memory leak in s3_pci_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72269","published":"2026-08-15T05:54:53.973Z","updated":"2026-08-17T05:11:28.961Z","title":"fbdev: uvesafb: fix potential memory leak in uvesafb_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72268","published":"2026-08-15T05:54:53.357Z","updated":"2026-08-17T05:11:27.859Z","title":"fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72267","published":"2026-08-15T05:54:52.735Z","updated":"2026-08-17T05:11:26.769Z","title":"fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72266","published":"2026-08-15T05:54:52.121Z","updated":"2026-08-17T05:11:25.613Z","title":"fbdev: vesafb: fix memory leak in vesafb_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72265","published":"2026-08-15T05:54:51.506Z","updated":"2026-08-17T05:11:24.514Z","title":"fbdev: nvidia: fix potential memory leak in nvidiafb_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72264","published":"2026-08-15T05:54:50.886Z","updated":"2026-08-17T05:11:23.399Z","title":"fbdev: tridentfb: fix potential memory leak in trident_pci_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72263","published":"2026-08-15T05:54:50.265Z","updated":"2026-08-17T05:11:22.312Z","title":"ASoC: SOF: topology: fix memory leak in snd_sof_load_topology","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72262","published":"2026-08-15T05:54:49.635Z","updated":"2026-10-16T18:55:14.172Z","title":"ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-72261","published":"2026-08-15T05:54:49.022Z","updated":"2026-10-16T18:55:13.974Z","title":"ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72260","published":"2026-08-15T05:54:48.409Z","updated":"2026-08-23T12:47:10.221Z","title":"ASoC: mediatek: mt8192: Check runtime resume during probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-72259","published":"2026-08-15T05:54:47.788Z","updated":"2026-08-17T05:11:17.946Z","title":"ASoC: mediatek: mt8192: Release reserved memory on cleanup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72258","published":"2026-08-15T05:54:45.181Z","updated":"2026-08-17T05:11:16.853Z","title":"ASoC: mediatek: mt8183: Release reserved memory on cleanup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72257","published":"2026-08-15T05:54:44.448Z","updated":"2026-08-17T05:11:15.758Z","title":"ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72256","published":"2026-08-15T05:54:43.706Z","updated":"2026-08-17T05:11:14.683Z","title":"netfilter: xt_cluster: reject template conntracks in hash match","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-72255","published":"2026-08-15T05:54:42.972Z","updated":"2026-10-16T18:55:13.836Z","title":"netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-72254","published":"2026-08-15T05:54:42.239Z","updated":"2026-10-30T12:28:58.734Z","title":"netfilter: nft_fib: reject fib expression on the netdev egress hook","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00665,"kevAdded":null},{"id":"CVE-2026-72253","published":"2026-08-15T05:54:41.490Z","updated":"2026-10-16T18:55:13.536Z","title":"netfilter: nf_conntrack_sip: validate skb_dst() before accessing it","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00696,"kevAdded":null},{"id":"CVE-2026-72252","published":"2026-08-15T05:54:40.740Z","updated":"2026-10-16T18:55:13.379Z","title":"netfilter: nft_set_pipapo: don't leak bad clone into future transaction","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72251","published":"2026-08-15T05:54:39.983Z","updated":"2026-10-16T18:55:13.187Z","title":"netfilter: nf_nat_sip: reload possible stale data pointer","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-72250","published":"2026-08-15T05:54:39.134Z","updated":"2026-10-16T18:55:13.023Z","title":"netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72249","published":"2026-08-15T05:54:37.914Z","updated":"2026-08-17T05:42:01.084Z","title":"netfilter: flowtable: use dst in this direction when pushing IPIP header","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-72248","published":"2026-08-15T05:54:36.535Z","updated":"2026-08-17T05:41:59.975Z","title":"netfilter: flowtable: support IPIP tunnel with direct xmit","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-72247","published":"2026-08-15T05:54:35.201Z","updated":"2026-10-16T18:55:12.850Z","title":"netfilter: nf_conncount: fix zone comparison in tuple dedup","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00696,"kevAdded":null},{"id":"CVE-2026-72245","published":"2026-08-15T05:54:32.611Z","updated":"2026-08-17T05:11:03.666Z","title":"gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-72244","published":"2026-08-15T05:54:31.866Z","updated":"2026-10-16T18:55:12.711Z","title":"gpu/buddy: bail out of try_harder when alignment cannot be honoured","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-72243","published":"2026-08-15T05:54:31.117Z","updated":"2026-10-16T18:45:04.616Z","title":"selinux: check connect-related permissions on TCP Fast Open","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-72242","published":"2026-08-15T05:54:30.378Z","updated":"2026-10-16T18:45:04.443Z","title":"selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00696,"kevAdded":null},{"id":"CVE-2026-72241","published":"2026-08-15T05:54:29.640Z","updated":"2026-08-17T05:10:59.303Z","title":"leds: uleds: Fix potential buffer overread","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72240","published":"2026-08-15T05:54:28.905Z","updated":"2026-08-17T05:10:58.219Z","title":"mfd: sm501: Fix reference leak on failed device registration","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72239","published":"2026-08-15T05:54:28.166Z","updated":"2026-08-17T05:41:54.072Z","title":"x86/virt/sev: Revert \"Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN\"","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-72238","published":"2026-08-15T05:54:27.424Z","updated":"2026-08-17T05:10:56.018Z","title":"x86/boot: Validate console=uart8250 baud rate to fix early boot hang","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72237","published":"2026-08-15T05:54:26.685Z","updated":"2026-08-19T16:36:31.271Z","title":"perf/x86/amd/brs: Fix kernel address leakage","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-72236","published":"2026-08-15T05:54:25.891Z","updated":"2026-08-23T12:47:04.750Z","title":"s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-72235","published":"2026-08-15T05:54:25.136Z","updated":"2026-10-16T18:45:04.206Z","title":"batman-adv: retrieve ethhdr after potential skb realloc on RX","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2026-72234","published":"2026-08-15T05:54:24.395Z","updated":"2026-10-16T18:45:03.804Z","title":"batman-adv: access unicast_ttvn skb->data only after skb realloc","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00734,"kevAdded":null},{"id":"CVE-2026-72233","published":"2026-08-15T05:54:23.663Z","updated":"2026-10-16T18:45:03.576Z","title":"batman-adv: bla: reacquire gw address after skb realloc","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2026-72232","published":"2026-08-15T05:54:22.864Z","updated":"2026-10-16T18:45:03.394Z","title":"batman-adv: ensure minimal ethernet header on TX","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-72231","published":"2026-08-15T05:54:22.076Z","updated":"2026-10-16T18:45:03.082Z","title":"batman-adv: tt: avoid request storms during pending request","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00677,"kevAdded":null},{"id":"CVE-2026-72230","published":"2026-08-15T05:54:21.256Z","updated":"2026-08-17T05:10:46.396Z","title":"batman-adv: frag: free unfragmentable packet","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72229","published":"2026-08-15T05:54:20.512Z","updated":"2026-08-17T05:10:45.285Z","title":"batman-adv: clean untagged VLAN on netdev registration failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72228","published":"2026-08-15T05:54:19.775Z","updated":"2026-08-17T05:10:44.186Z","title":"batman-adv: frag: fix primary_if leak on failed linearization","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72227","published":"2026-08-15T05:54:19.020Z","updated":"2026-08-17T05:41:47.496Z","title":"batman-adv: mcast: avoid OOB read of num_dests header","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2026-72226","published":"2026-08-15T05:54:18.285Z","updated":"2026-10-16T18:45:02.826Z","title":"batman-adv: tt: prevent TVLV OOB check overflow","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00755,"kevAdded":null},{"id":"CVE-2026-72225","published":"2026-08-15T05:54:17.541Z","updated":"2026-10-16T18:45:02.597Z","title":"jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-72224","published":"2026-08-15T05:54:16.781Z","updated":"2026-08-17T05:10:39.755Z","title":"nvdimm/btt: Free arenas on btt_init() error paths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72223","published":"2026-08-15T05:54:16.019Z","updated":"2026-08-17T05:10:38.658Z","title":"nvdimm/btt: Free arena sub-allocations on discover_arenas() error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72222","published":"2026-08-15T05:54:15.277Z","updated":"2026-10-16T18:45:02.369Z","title":"sunrpc: pin svc_xprt across the asynchronous TLS handshake callback","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00635,"kevAdded":null},{"id":"CVE-2026-72221","published":"2026-08-15T05:54:14.539Z","updated":"2026-10-16T18:45:02.148Z","title":"sunrpc: wait for in-flight TLS handshake callback when cancel loses race","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00635,"kevAdded":null},{"id":"CVE-2026-72220","published":"2026-08-15T05:54:13.800Z","updated":"2026-08-17T05:41:41.598Z","title":"sunrpc: harden rq_procinfo lifecycle to prevent double-free","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00631,"kevAdded":null},{"id":"CVE-2026-72219","published":"2026-08-15T05:54:13.067Z","updated":"2026-08-17T05:10:34.296Z","title":"lockd: Plug nlm_file leak when nlm_do_fopen() fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-72218","published":"2026-08-15T05:54:11.672Z","updated":"2026-08-17T05:10:33.204Z","title":"lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-72217","published":"2026-08-15T05:54:10.888Z","updated":"2026-08-17T05:41:40.504Z","title":"SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00635,"kevAdded":null},{"id":"CVE-2026-72216","published":"2026-08-15T05:54:10.106Z","updated":"2026-08-23T12:47:02.553Z","title":"remoteproc: qcom: Fix leak when custom dump_segments addition fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72215","published":"2026-08-15T05:54:09.352Z","updated":"2026-08-17T05:10:29.923Z","title":"MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72214","published":"2026-08-15T05:54:08.602Z","updated":"2026-08-17T05:10:28.814Z","title":"power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72213","published":"2026-08-15T05:54:07.854Z","updated":"2026-10-30T12:28:57.670Z","title":"mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-72212","published":"2026-08-15T05:54:07.077Z","updated":"2026-08-17T05:10:26.630Z","title":"mm/memory_hotplug: fix incorrect altmap passing in error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-72211","published":"2026-08-15T05:54:06.292Z","updated":"2026-08-18T06:56:30.876Z","title":"ntfs: grow index root value before reparent header update","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-72210","published":"2026-08-15T05:54:05.527Z","updated":"2026-08-19T10:49:39.287Z","title":"ntfs: fix off-by-one in mapping pairs decoding bounds checks","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-72209","published":"2026-08-15T05:54:04.772Z","updated":"2026-08-17T05:41:36.117Z","title":"ntfs: validate attribute values on lookup","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-72208","published":"2026-08-15T05:54:04.022Z","updated":"2026-08-18T06:56:28.443Z","title":"ntfs: add bounds check before accessing EA entries","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-72207","published":"2026-08-15T05:54:03.281Z","updated":"2026-08-18T06:56:27.219Z","title":"ntfs: not change 0-byte $DATA attribute to non-resident","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-72206","published":"2026-08-15T05:54:02.534Z","updated":"2026-08-18T06:56:26.018Z","title":"ntfs: validate index block header more strictly","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-72205","published":"2026-08-15T05:54:01.803Z","updated":"2026-08-18T06:56:24.809Z","title":"ntfs: free volume-wide resources on fill_super failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72204","published":"2026-08-15T05:54:01.070Z","updated":"2026-08-18T06:56:23.160Z","title":"ntfs: centalize $INDEX_ROOT header validation","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-72203","published":"2026-08-15T05:54:00.321Z","updated":"2026-10-30T12:28:56.581Z","title":"ntfs: skip extent mft records in writeback to prevent deadlock","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0063,"kevAdded":null},{"id":"CVE-2026-72202","published":"2026-08-15T05:53:59.587Z","updated":"2026-08-18T06:56:20.164Z","title":"ntfs: avoid heap allocation for free-cluster readahead state","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-72201","published":"2026-08-15T05:53:58.854Z","updated":"2026-08-18T06:56:18.944Z","title":"ntfs: validate index entries on reading","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-72200","published":"2026-08-15T05:53:58.100Z","updated":"2026-10-30T12:28:55.485Z","title":"ntfs: detect mapping-pairs LCN accumulator overflow","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00671,"kevAdded":null},{"id":"CVE-2026-72199","published":"2026-08-15T05:53:57.414Z","updated":"2026-08-18T06:56:16.523Z","title":"ntfs: validate resident index root values on lookup","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-72198","published":"2026-08-15T05:53:56.782Z","updated":"2026-10-30T12:28:54.419Z","title":"ntfs: reject non-resident records for resident-only attributes","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-72197","published":"2026-08-15T05:53:56.149Z","updated":"2026-10-16T18:45:01.720Z","title":"fs/ntfs3: bound DeleteIndexEntryAllocation memmove length","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-72196","published":"2026-08-15T05:53:55.509Z","updated":"2026-10-16T18:45:01.462Z","title":"fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-72195","published":"2026-08-15T05:53:54.869Z","updated":"2026-10-16T18:45:01.278Z","title":"fs/ntfs3: bound attr_off in UpdateResidentValue against data_off","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72194","published":"2026-08-15T05:53:54.125Z","updated":"2026-10-16T18:45:01.099Z","title":"fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00798,"kevAdded":null},{"id":"CVE-2026-72193","published":"2026-08-15T05:53:53.381Z","updated":"2026-08-17T05:10:01.666Z","title":"ntfs3: cap RESTART_TABLE free-chain walker at rt->used","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72192","published":"2026-08-15T05:53:52.634Z","updated":"2026-10-16T18:45:00.935Z","title":"ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00738,"kevAdded":null},{"id":"CVE-2026-72191","published":"2026-08-15T05:53:51.893Z","updated":"2026-10-16T18:45:00.783Z","title":"ntfs3: validate split-point offset in indx_insert_into_buffer","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00697,"kevAdded":null},{"id":"CVE-2026-72190","published":"2026-08-15T05:53:51.143Z","updated":"2026-08-17T05:09:55.301Z","title":"ntfs: fix mrec_lock ABBA deadlock in rename","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72189","published":"2026-08-15T05:53:50.373Z","updated":"2026-08-17T05:09:53.903Z","title":"ntfs: fail attrlist updates when the superblock is inactive","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72188","published":"2026-08-15T05:53:49.593Z","updated":"2026-08-17T05:41:17.414Z","title":"ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-72187","published":"2026-08-15T05:53:48.866Z","updated":"2026-08-17T05:09:51.703Z","title":"ntfs: avoid self-deadlock during inode eviction","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72186","published":"2026-08-15T05:53:48.127Z","updated":"2026-08-17T05:41:16.318Z","title":"ntfs: make system files immutable to prevent corruption","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-72185","published":"2026-08-15T05:53:47.388Z","updated":"2026-08-17T05:41:15.234Z","title":"ntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00671,"kevAdded":null},{"id":"CVE-2026-72184","published":"2026-08-15T05:53:46.650Z","updated":"2026-08-17T05:09:48.392Z","title":"ntfs: fix hole runlist memory leak in insert range error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72183","published":"2026-08-15T05:53:45.922Z","updated":"2026-10-16T18:45:00.631Z","title":"landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-72182","published":"2026-08-15T05:53:45.189Z","updated":"2026-08-17T05:09:46.199Z","title":"power: supply: charger-manager: fix refcount leak in is_full_charged()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72181","published":"2026-08-15T05:53:44.453Z","updated":"2026-08-19T16:36:28.810Z","title":"mips: sched: Fix CPUMASK_OFFSTACK memory corruption","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-72180","published":"2026-08-15T05:53:43.718Z","updated":"2026-08-17T05:09:43.031Z","title":"mm/huge_memory: preserve pmd_swp_uffd_wp on device-private PMD downgrade","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-72179","published":"2026-08-15T05:53:42.980Z","updated":"2026-08-17T05:09:41.910Z","title":"riscv: cacheinfo: Fix node reference leak in populate_cache_leaves","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72178","published":"2026-08-15T05:53:42.238Z","updated":"2026-08-17T05:09:40.842Z","title":"mm/damon/core: always put unsuccessfully committed target pids","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72177","published":"2026-08-15T05:53:41.496Z","updated":"2026-08-17T05:09:39.737Z","title":"mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72176","published":"2026-08-15T05:53:40.759Z","updated":"2026-08-17T05:09:38.651Z","title":"mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72175","published":"2026-08-15T05:53:40.011Z","updated":"2026-10-16T18:45:00.474Z","title":"fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-72174","published":"2026-08-15T05:53:39.276Z","updated":"2026-08-17T05:09:36.416Z","title":"fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-72173","published":"2026-08-15T05:53:38.543Z","updated":"2026-08-17T05:09:35.315Z","title":"fs/proc/task_mmu: do not warn on seeing non-migration pmd entry","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72172","published":"2026-08-15T05:53:37.795Z","updated":"2026-10-16T18:45:00.307Z","title":"mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72171","published":"2026-08-15T05:53:37.070Z","updated":"2026-08-17T05:41:09.326Z","title":"mtd: slram: remove failed entries from the device list","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-72170","published":"2026-08-15T05:53:36.332Z","updated":"2026-10-16T18:45:00.097Z","title":"9p: skip nlink update in cacheless mode to fix WARN_ON","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72169","published":"2026-08-15T05:53:35.599Z","updated":"2026-08-17T05:09:30.900Z","title":"kho: make sure scratch size is always aligned by CMA_MIN_ALIGNMENT_BYTES","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-72168","published":"2026-08-15T05:53:34.868Z","updated":"2026-10-30T12:28:53.356Z","title":"mtd: maps: vmu-flash: fix fault in unaligned fixup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72167","published":"2026-08-15T05:53:34.123Z","updated":"2026-08-17T05:09:28.688Z","title":"mtd: rawnand: pl353: fix probe resource allocation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72166","published":"2026-08-15T05:53:33.383Z","updated":"2026-08-23T12:46:57.100Z","title":"net/9p: fix infinite loop in p9_client_rpc on fatal signal","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-72165","published":"2026-08-15T05:53:32.649Z","updated":"2026-10-16T18:44:59.914Z","title":"mtd: rawnand: fix condition in 'nand_select_target()'","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-72164","published":"2026-08-15T05:53:31.901Z","updated":"2026-10-16T18:44:59.778Z","title":"ocfs2: avoid moving extents to occupied clusters","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72163","published":"2026-08-15T05:53:31.157Z","updated":"2026-08-17T05:09:24.274Z","title":"ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-72162","published":"2026-08-15T05:53:30.420Z","updated":"2026-10-30T12:28:52.281Z","title":"ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-72161","published":"2026-08-15T05:53:29.670Z","updated":"2026-08-17T05:09:21.902Z","title":"ocfs2: add journal NULL check in ocfs2_checkpoint_inode()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-72160","published":"2026-08-15T05:53:28.943Z","updated":"2026-10-16T18:44:59.633Z","title":"ocfs2: reject dinodes with non-canonical i_mode type","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0065,"kevAdded":null},{"id":"CVE-2026-72159","published":"2026-08-15T05:53:28.205Z","updated":"2026-08-17T05:09:19.690Z","title":"ocfs2: reject non-inline dinodes with i_size and zero i_clusters","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72158","published":"2026-08-15T05:53:27.454Z","updated":"2026-08-17T05:09:18.602Z","title":"fpga: dfl: add bounds check in dfh_get_param_size()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72157","published":"2026-08-15T05:53:26.718Z","updated":"2026-10-16T18:44:59.473Z","title":"net: thunderbolt: Fix frags[] overflow by bounding frame_count","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00354,"kevAdded":null},{"id":"CVE-2026-72156","published":"2026-08-15T05:53:25.979Z","updated":"2026-08-17T05:09:16.408Z","title":"fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72155","published":"2026-08-15T05:53:25.236Z","updated":"2026-08-23T12:46:54.916Z","title":"mtd: spi-nor: swp: Improve locking user experience","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-72154","published":"2026-08-15T05:53:24.474Z","updated":"2026-08-17T05:41:01.606Z","title":"openrisc: Fix jump_label smp syncing","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-72153","published":"2026-08-15T05:53:23.699Z","updated":"2026-08-17T05:09:13.069Z","title":"irqchip/crossbar: Use correct index in crossbar_domain_free()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72152","published":"2026-08-15T05:53:22.951Z","updated":"2026-08-23T12:46:53.842Z","title":"tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-72151","published":"2026-08-15T05:53:22.196Z","updated":"2026-08-17T05:41:00.459Z","title":"tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-72150","published":"2026-08-15T05:53:21.440Z","updated":"2026-08-18T06:56:12.877Z","title":"sunrpc: fix uninitialized xprt_create_args structure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-72149","published":"2026-08-15T05:53:20.695Z","updated":"2026-10-16T18:44:59.313Z","title":"dmaengine: tegra: Fix burst size calculation","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00647,"kevAdded":null},{"id":"CVE-2026-72148","published":"2026-08-15T05:53:19.921Z","updated":"2026-08-23T12:46:52.752Z","title":"dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2026-72147","published":"2026-08-15T05:53:19.170Z","updated":"2026-10-30T12:28:51.216Z","title":"dmaengine: dw-edma-pcie: Reject devices without driver data","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-72146","published":"2026-08-15T05:53:18.431Z","updated":"2026-08-19T16:36:26.048Z","title":"dmaengine: sh: rz-dmac: Move interrupt request after everything is set up","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-72145","published":"2026-08-15T05:53:17.703Z","updated":"2026-08-17T05:09:03.889Z","title":"platform/x86/intel/tpmi: use cleanup helpers in mem_write()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72144","published":"2026-08-15T05:53:16.974Z","updated":"2026-10-30T12:28:50.165Z","title":"platform/x86: dell-laptop: fix missing cleanups in init error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-72143","published":"2026-08-15T05:53:16.241Z","updated":"2026-10-16T18:44:58.966Z","title":"platform/x86: ISST: Restore SST-PP control to all domains","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72142","published":"2026-08-15T05:53:15.489Z","updated":"2026-08-23T12:46:51.665Z","title":"i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-72141","published":"2026-08-15T05:53:14.754Z","updated":"2026-08-17T05:40:49.962Z","title":"i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ)","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-72140","published":"2026-08-15T05:53:14.015Z","updated":"2026-08-17T05:08:58.385Z","title":"i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72139","published":"2026-08-15T05:53:13.279Z","updated":"2026-08-17T05:40:48.870Z","title":"tcp: defer md5sig_info kfree past RCU grace period in tcp_connect","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00631,"kevAdded":null},{"id":"CVE-2026-72138","published":"2026-08-15T05:53:12.549Z","updated":"2026-08-17T05:08:56.108Z","title":"xen/gntdev: fix error handling in ioctl","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-72137","published":"2026-08-15T05:53:11.812Z","updated":"2026-08-17T05:40:47.767Z","title":"xfrm: nat_keepalive: avoid double free on send error","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0071,"kevAdded":null},{"id":"CVE-2026-72136","published":"2026-08-15T05:53:11.072Z","updated":"2026-10-16T18:44:58.796Z","title":"xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72135","published":"2026-08-15T05:53:10.315Z","updated":"2026-10-16T18:44:58.643Z","title":"tpm: Make the TPM character devices non-seekable","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72134","published":"2026-08-15T05:53:09.573Z","updated":"2026-08-17T05:40:44.407Z","title":"spi: imx: reconfigure for PIO when DMA cannot be started","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-72133","published":"2026-08-15T05:53:08.833Z","updated":"2026-08-17T05:40:43.316Z","title":"spi: uniphier: Fix completion initialization order before devm_request_irq()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-72132","published":"2026-08-15T05:53:08.096Z","updated":"2026-08-17T05:08:49.516Z","title":"NFS: Charge unstable writes by request size, not folio size","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72131","published":"2026-08-15T05:53:07.349Z","updated":"2026-10-03T10:55:47.352Z","title":"nvme-apple: Prevent shared tags across queues on Apple A11","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72130","published":"2026-08-15T05:53:06.604Z","updated":"2026-10-30T12:28:49.087Z","title":"nvmet-auth: reject short AUTH_RECEIVE buffers","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00803,"kevAdded":null},{"id":"CVE-2026-72129","published":"2026-08-15T05:53:05.874Z","updated":"2026-10-16T18:44:58.318Z","title":"nvmet-rdma: handle inline data with a nonzero offset","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-72128","published":"2026-08-15T05:53:05.141Z","updated":"2026-08-17T05:08:44.496Z","title":"nvmet: fix refcount leak in nvmet_sq_create()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72127","published":"2026-08-15T05:53:04.405Z","updated":"2026-08-17T05:08:42.273Z","title":"netdev-genl: report NAPI thread PID in the caller's pid namespace","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72126","published":"2026-08-15T05:53:03.642Z","updated":"2026-10-16T18:44:58.135Z","title":"can: isotp: use unconditional synchronize_rcu() in isotp_release()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-72125","published":"2026-08-15T05:53:02.905Z","updated":"2026-10-16T18:44:57.938Z","title":"can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-72124","published":"2026-08-15T05:53:02.172Z","updated":"2026-10-16T18:44:57.766Z","title":"can: isotp: serialize TX state transitions under so->rx_lock","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00354,"kevAdded":null},{"id":"CVE-2026-72123","published":"2026-08-15T05:53:01.433Z","updated":"2026-10-16T18:44:57.598Z","title":"can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72122","published":"2026-08-15T05:53:00.704Z","updated":"2026-10-16T18:44:57.450Z","title":"can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-72121","published":"2026-08-15T05:52:59.959Z","updated":"2026-10-16T18:44:57.290Z","title":"can: bcm: add locking when updating filter and timer values","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00354,"kevAdded":null},{"id":"CVE-2026-72120","published":"2026-08-15T05:52:59.226Z","updated":"2026-10-16T18:44:57.136Z","title":"can: bcm: add missing rcu list annotations and operations","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72119","published":"2026-08-15T05:52:58.479Z","updated":"2026-10-16T18:44:56.991Z","title":"can: bcm: extend bcm_tx_lock usage for data and timer updates","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72118","published":"2026-08-15T05:52:57.734Z","updated":"2026-08-19T16:36:11.603Z","title":"can: bcm: fix CAN frame rx/tx statistics","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-72117","published":"2026-08-15T05:52:56.991Z","updated":"2026-08-19T16:36:08.847Z","title":"can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-72116","published":"2026-08-15T05:52:56.260Z","updated":"2026-10-16T18:44:56.837Z","title":"can: bcm: fix stale rx/tx ops after device removal","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-72115","published":"2026-08-15T05:52:55.524Z","updated":"2026-10-16T18:44:56.703Z","title":"can: bcm: track a single source interface for ANYDEV timeout/throttle ops","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-72114","published":"2026-08-15T05:52:54.750Z","updated":"2026-10-16T18:44:56.572Z","title":"can: bcm: validate frame length in bcm_rx_setup() for RTR replies","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72113","published":"2026-08-15T05:52:54.001Z","updated":"2026-10-16T18:44:56.440Z","title":"can: bcm: add missing device refcount for CAN filter removal","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72112","published":"2026-08-15T05:52:53.275Z","updated":"2026-08-17T05:40:26.740Z","title":"io_uring/bpf-ops: reject re-registration of an already-bound ops","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-72111","published":"2026-08-15T05:52:52.538Z","updated":"2026-10-16T18:44:56.296Z","title":"bpf: Reset register bounds before narrowing retval range in check_mem_access()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-72110","published":"2026-08-15T05:52:51.805Z","updated":"2026-10-16T18:44:56.143Z","title":"bpf,fork: wipe ->bpf_storage before bailouts that access it","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72109","published":"2026-08-15T05:52:51.067Z","updated":"2026-08-17T05:40:22.667Z","title":"net: sparx5: unregister blocking notifier on init failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-72108","published":"2026-08-15T05:52:50.321Z","updated":"2026-10-19T21:19:28.563Z","title":"dm thin metadata: fix metadata snapshot consistency on commit failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2026-72107","published":"2026-08-15T05:52:49.581Z","updated":"2026-10-19T21:19:28.417Z","title":"dm era: fix out-of-bounds memory access for non-zero start sector","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0065,"kevAdded":null},{"id":"CVE-2026-72106","published":"2026-08-15T05:52:48.845Z","updated":"2026-10-30T12:28:48.016Z","title":"dm-ioctl: fix a possible overflow in list_version_get_info","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-72105","published":"2026-08-15T05:52:48.099Z","updated":"2026-10-19T21:19:28.267Z","title":"dm-log: fix a bitset_size overflow on 32bit machines","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72104","published":"2026-08-15T05:52:47.458Z","updated":"2026-08-17T05:08:16.915Z","title":"dm-pcache: reject option groups without values","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-72103","published":"2026-08-15T05:52:46.824Z","updated":"2026-10-19T21:19:28.124Z","title":"dm: avoid leaking the caller's thread keyring via the table device file","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-72102","published":"2026-08-15T05:52:46.200Z","updated":"2026-10-19T21:19:27.969Z","title":"dm_early_create: fix freeing used table on dm_resume failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72101","published":"2026-08-15T05:52:45.548Z","updated":"2026-08-17T05:08:13.573Z","title":"dm-integrity: fix leaking uninitialized kernel memory","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-72100","published":"2026-08-15T05:52:44.923Z","updated":"2026-10-19T21:19:27.814Z","title":"dm-integrity: fix a bug if the bio is out of limits","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00464,"kevAdded":null},{"id":"CVE-2026-72099","published":"2026-08-15T05:52:44.292Z","updated":"2026-10-19T21:19:27.671Z","title":"dm-integrity: don't increment hash_offset twice","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00546,"kevAdded":null},{"id":"CVE-2026-72098","published":"2026-08-15T05:52:43.666Z","updated":"2026-10-30T12:28:46.939Z","title":"dm-verity: fix buffer overflow in FEC calculation","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00737,"kevAdded":null},{"id":"CVE-2026-72097","published":"2026-08-15T05:52:42.941Z","updated":"2026-08-17T05:08:08.851Z","title":"dm-verity: fix a possible NULL pointer dereference","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72096","published":"2026-08-15T05:52:42.208Z","updated":"2026-08-23T12:46:48.390Z","title":"dm-verity: make error counter atomic","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-72095","published":"2026-08-15T05:52:41.470Z","updated":"2026-10-19T21:19:27.366Z","title":"dma-fence: Make dma_fence_dedup_array() robust against 0-count input","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-72094","published":"2026-08-15T05:52:40.632Z","updated":"2026-08-17T05:08:05.562Z","title":"dma-buf: dma-fence: Fix potential NULL pointer dereference","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72093","published":"2026-08-15T05:52:39.865Z","updated":"2026-08-17T05:40:11.291Z","title":"accel/amdxdna: Fix use-after-free in amdxdna_gem_dmabuf_mmap()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-72092","published":"2026-08-15T05:52:39.120Z","updated":"2026-08-17T05:08:03.359Z","title":"accel/amdxdna: reject command submission on devices without a submit op","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-72091","published":"2026-08-15T05:52:38.366Z","updated":"2026-10-15T10:08:31.946Z","title":"accel/amdxdna: reject user command submission without a command BO","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-72090","published":"2026-08-15T05:52:37.524Z","updated":"2026-08-17T05:40:10.207Z","title":"accel/amdxdna: Use caller client for debug BO sync","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-72089","published":"2026-08-15T05:52:36.800Z","updated":"2026-08-17T05:40:09.108Z","title":"accel/ivpu: Reject firmware log with size smaller than header","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-72088","published":"2026-08-15T05:52:36.155Z","updated":"2026-08-17T05:07:59.011Z","title":"scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72087","published":"2026-08-15T05:52:35.513Z","updated":"2026-08-23T12:46:47.317Z","title":"scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72086","published":"2026-08-15T05:52:34.822Z","updated":"2026-08-17T05:07:56.806Z","title":"scsi: xen: scsiback: Free the command tag on the TMR submit-failure path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-72085","published":"2026-08-15T05:52:33.521Z","updated":"2026-10-19T21:19:27.216Z","title":"scsi: xen: scsiback: Free unsubmitted command instead of double-putting it","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-72084","published":"2026-08-15T05:52:32.789Z","updated":"2026-10-19T21:19:27.063Z","title":"scsi: target: Bound PR-OUT TransportID parsing to the received buffer","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00745,"kevAdded":null},{"id":"CVE-2026-72083","published":"2026-08-15T05:52:32.045Z","updated":"2026-10-19T21:19:26.910Z","title":"scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00724,"kevAdded":null},{"id":"CVE-2026-72082","published":"2026-08-15T05:52:31.291Z","updated":"2026-08-17T05:07:52.350Z","title":"scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72081","published":"2026-08-15T05:52:30.545Z","updated":"2026-08-17T05:07:51.232Z","title":"scsi: elx: efct: Fix I/O leak on unsupported additional CDB","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72080","published":"2026-08-15T05:52:29.827Z","updated":"2026-10-19T21:19:26.766Z","title":"fs/resctrl: Fix use-after-free during unmount","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-72079","published":"2026-08-15T05:52:29.096Z","updated":"2026-08-17T05:07:48.078Z","title":"Input: ims-pcu - fix use-after-free and double-free in disconnect","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72078","published":"2026-08-15T05:52:28.353Z","updated":"2026-08-17T05:07:46.949Z","title":"Input: ims-pcu - validate control endpoint type","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72077","published":"2026-08-15T05:52:27.612Z","updated":"2026-08-23T12:46:45.145Z","title":"Input: ims-pcu - fix firmware leak in async update","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72076","published":"2026-08-15T05:52:26.884Z","updated":"2026-08-17T05:07:44.723Z","title":"Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72075","published":"2026-08-15T05:52:26.147Z","updated":"2026-08-27T12:39:45.329Z","title":"Input: ims-pcu - fix race condition in reset_device sysfs callback","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72074","published":"2026-08-15T05:52:25.418Z","updated":"2026-08-17T05:07:42.538Z","title":"Input: ims-pcu - fix type confusion in CDC union descriptor parsing","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72073","published":"2026-08-15T05:52:24.676Z","updated":"2026-10-21T12:44:20.898Z","title":"mmc: vub300: fix use-after-free on probe failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-72072","published":"2026-08-15T05:52:23.946Z","updated":"2026-10-19T21:19:26.618Z","title":"net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-72071","published":"2026-08-15T05:52:23.215Z","updated":"2026-08-17T05:40:01.974Z","title":"tracing/user_events: Fix use-after-free in user_event_mm_dup()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-72070","published":"2026-08-15T05:52:22.486Z","updated":"2026-08-23T12:46:42.921Z","title":"wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72069","published":"2026-08-15T05:52:21.752Z","updated":"2026-10-19T21:19:26.463Z","title":"locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00728,"kevAdded":null},{"id":"CVE-2026-72068","published":"2026-08-15T05:52:21.007Z","updated":"2026-08-17T05:07:35.943Z","title":"posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72067","published":"2026-08-15T05:52:20.268Z","updated":"2026-10-19T21:19:26.303Z","title":"cpu: hotplug: Preserve per instance callback errors","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-72066","published":"2026-08-15T05:52:19.527Z","updated":"2026-10-19T21:19:26.150Z","title":"cpu: hotplug: Bound hotplug states sysfs output","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-72065","published":"2026-08-15T05:52:18.801Z","updated":"2026-10-19T21:19:25.989Z","title":"net: mana: Validate the packet length reported by the NIC","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00728,"kevAdded":null},{"id":"CVE-2026-72064","published":"2026-08-15T05:52:18.069Z","updated":"2026-10-19T21:19:25.844Z","title":"net: mana: Sync page pool RX frags for CPU","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00502,"kevAdded":null},{"id":"CVE-2026-72063","published":"2026-08-15T05:52:17.315Z","updated":"2026-08-23T12:46:39.651Z","title":"gpio: tegra: do not call pinctrl for GPIO direction","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72062","published":"2026-08-15T05:52:16.564Z","updated":"2026-08-23T12:46:38.586Z","title":"gpio: mt7621: avoid corruption of shared interrupt trigger state","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72061","published":"2026-08-15T05:52:15.823Z","updated":"2026-10-19T21:19:25.695Z","title":"net: sit: require CAP_NET_ADMIN in the device netns for changelink","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2026-72060","published":"2026-08-15T05:52:15.099Z","updated":"2026-08-17T05:07:27.219Z","title":"net: ethernet: ti: icssg: guard PA stat lookups","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-72059","published":"2026-08-15T05:52:14.350Z","updated":"2026-08-17T05:07:26.131Z","title":"net: wwan: t7xx: destroy DMA pool on CLDMA late init failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72058","published":"2026-08-15T05:52:13.616Z","updated":"2026-08-23T12:46:37.509Z","title":"net: ixp4xx_hss: fix duplicate HDLC netdev allocation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72057","published":"2026-08-15T05:52:12.873Z","updated":"2026-10-19T21:19:25.539Z","title":"net/sched: act_ct: preserve tc_skb_cb across defragmentation","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00585,"kevAdded":null},{"id":"CVE-2026-72056","published":"2026-08-15T05:52:12.136Z","updated":"2026-08-17T05:07:22.862Z","title":"net: ena: clean up XDP TX queues when regular TX setup fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72055","published":"2026-08-15T05:52:11.413Z","updated":"2026-10-19T21:19:25.382Z","title":"net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2026-72054","published":"2026-08-15T05:52:10.679Z","updated":"2026-10-19T21:19:25.227Z","title":"net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2026-72053","published":"2026-08-15T05:52:09.924Z","updated":"2026-10-19T21:19:25.074Z","title":"net: ipip: require CAP_NET_ADMIN in the device netns for changelink","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2026-72052","published":"2026-08-15T05:52:09.194Z","updated":"2026-10-19T21:19:24.924Z","title":"net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2026-72051","published":"2026-08-15T05:52:08.445Z","updated":"2026-10-19T21:19:24.769Z","title":"net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2026-72050","published":"2026-08-15T05:52:07.709Z","updated":"2026-08-17T05:07:16.287Z","title":"octeontx2-af: Free BPID bitmap on setup failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72049","published":"2026-08-15T05:52:06.989Z","updated":"2026-10-19T21:19:24.612Z","title":"ieee802154: admin-gate legacy LLSEC dump operations","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2026-72048","published":"2026-08-15T05:52:06.253Z","updated":"2026-08-17T05:07:14.096Z","title":"ieee802154: ca8210: fix cas_ctl leak on spi_async failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72047","published":"2026-08-15T05:52:05.510Z","updated":"2026-08-17T05:07:12.985Z","title":"ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72046","published":"2026-08-15T05:52:04.769Z","updated":"2026-08-17T05:39:45.577Z","title":"gve: fix header buffer corruption with header-split and HW-GRO","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00635,"kevAdded":null},{"id":"CVE-2026-72045","published":"2026-08-15T05:52:04.038Z","updated":"2026-10-19T21:19:24.462Z","title":"octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2026-72043","published":"2026-08-15T05:52:02.505Z","updated":"2026-08-17T05:39:42.678Z","title":"LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-72042","published":"2026-08-15T05:52:01.454Z","updated":"2026-08-17T05:39:41.572Z","title":"ipmi: Fix user refcount underflow in event delivery","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-72041","published":"2026-08-15T05:52:00.721Z","updated":"2026-10-19T21:19:24.315Z","title":"espintcp: use sk_msg_free_partial to fix partial send","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-72040","published":"2026-08-15T05:51:59.975Z","updated":"2026-08-23T12:46:30.954Z","title":"ipmi: fix refcount leak in i_ipmi_request()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-72039","published":"2026-08-15T05:51:59.216Z","updated":"2026-08-17T05:07:05.117Z","title":"bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72038","published":"2026-08-15T05:51:58.487Z","updated":"2026-08-17T05:07:04.031Z","title":"net: liquidio: fix BAR resource leak on PF number failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72037","published":"2026-08-15T05:51:57.745Z","updated":"2026-08-17T05:07:02.911Z","title":"net: lan743x: Initialize eth_syslock spinlock before use","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72036","published":"2026-08-15T05:51:57.012Z","updated":"2026-10-19T21:19:24.167Z","title":"net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-72035","published":"2026-08-15T05:51:56.374Z","updated":"2026-10-19T21:19:23.999Z","title":"net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00589,"kevAdded":null},{"id":"CVE-2026-72034","published":"2026-08-15T05:51:55.739Z","updated":"2026-10-19T21:19:23.840Z","title":"fhandle: reject detached mounts in capable_wrt_mount()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-72033","published":"2026-08-15T05:51:55.102Z","updated":"2026-08-17T05:39:36.089Z","title":"orangefs: keep the readdir entry size 64-bit in fill_from_part()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00793,"kevAdded":null},{"id":"CVE-2026-72032","published":"2026-08-15T05:51:54.461Z","updated":"2026-08-17T05:06:57.395Z","title":"net/mlx5: HWS, fix matcher leak on resize target setup failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-72031","published":"2026-08-15T05:51:53.824Z","updated":"2026-10-21T12:44:19.607Z","title":"ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-72030","published":"2026-08-15T05:51:53.189Z","updated":"2026-08-23T12:46:28.762Z","title":"ata: libata-core: Reject an invalid concurrent positioning ranges count","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-72029","published":"2026-08-15T05:51:52.533Z","updated":"2026-10-19T21:19:23.693Z","title":"net: wwan: iosm: bound device offsets in the MUX downlink decoder","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2026-72028","published":"2026-08-15T05:51:51.868Z","updated":"2026-10-30T12:28:45.873Z","title":"riscv: probes: save original sp in rethook trampoline","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72027","published":"2026-08-15T05:51:51.219Z","updated":"2026-08-17T05:39:33.783Z","title":"mm/compaction: handle free_pages_prepare() properly in compaction_free()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-72026","published":"2026-08-15T05:51:50.581Z","updated":"2026-08-17T05:06:49.893Z","title":"irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-72025","published":"2026-08-15T05:51:49.928Z","updated":"2026-08-18T06:56:09.214Z","title":"s390/monwriter: Reject buffer reuse with different data length","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-72024","published":"2026-08-15T05:51:49.270Z","updated":"2026-10-19T21:19:23.535Z","title":"mac802154: remove interfaces with RCU list deletion","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-72023","published":"2026-08-15T05:51:48.629Z","updated":"2026-08-23T12:46:27.683Z","title":"octeontx2-pf: fix SQB pointer leak on init failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-72022","published":"2026-08-15T05:51:47.978Z","updated":"2026-08-17T05:06:45.278Z","title":"llc: fix SAP refcount leak in llc_ui_autobind()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72021","published":"2026-08-15T05:51:47.324Z","updated":"2026-10-19T21:19:23.393Z","title":"ipvs: use parsed transport offset in SCTP state lookup","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00589,"kevAdded":null},{"id":"CVE-2026-72020","published":"2026-08-15T05:51:46.675Z","updated":"2026-10-19T21:19:23.243Z","title":"ipvs: reset full ip_vs_seq structs in ip_vs_conn_new","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-72019","published":"2026-08-15T05:51:46.014Z","updated":"2026-10-19T21:19:23.088Z","title":"macsec: don't read an unset MAC header in macsec_encrypt()","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-72018","published":"2026-08-15T05:51:45.360Z","updated":"2026-10-16T18:42:39.883Z","title":"dibs: loopback: validate offset and size in move_data()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-72017","published":"2026-08-15T05:51:44.698Z","updated":"2026-08-23T12:46:26.593Z","title":"net: macb: drop in-flight Tx SKBs on close","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-72016","published":"2026-08-15T05:51:44.050Z","updated":"2026-08-17T05:06:38.684Z","title":"cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-72015","published":"2026-08-15T05:51:43.390Z","updated":"2026-08-23T12:46:25.496Z","title":"fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-72014","published":"2026-08-15T05:51:42.741Z","updated":"2026-10-19T21:09:12.925Z","title":"drbd: reject data replies with an out-of-range payload size","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00723,"kevAdded":null},{"id":"CVE-2026-72013","published":"2026-08-15T05:51:41.982Z","updated":"2026-08-17T05:06:35.378Z","title":"riscv: Prevent NULL pointer dereference in machine_kexec_prepare()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72012","published":"2026-08-15T05:51:41.222Z","updated":"2026-10-19T21:09:12.782Z","title":"tracing/osnoise: Call synchronize_rcu() when unregistering","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-72011","published":"2026-08-15T05:51:40.489Z","updated":"2026-08-17T05:06:33.180Z","title":"s390/diag: Add missing array_index_nospec() call to memtop_get_page_count()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2026-72010","published":"2026-08-15T05:51:39.755Z","updated":"2026-08-17T05:06:32.084Z","title":"cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72009","published":"2026-08-15T05:51:39.019Z","updated":"2026-10-30T12:28:44.807Z","title":"pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-72008","published":"2026-08-15T05:51:38.102Z","updated":"2026-08-17T05:06:29.895Z","title":"pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-72007","published":"2026-08-15T05:51:37.352Z","updated":"2026-10-30T12:28:43.725Z","title":"pmdomain: imx: Fix i.MX8MP VC8000E power up sequence","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-72006","published":"2026-08-15T05:51:36.635Z","updated":"2026-08-17T05:06:27.714Z","title":"net/mlx5: free mlx5_st_idx_data on final dealloc","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-72005","published":"2026-08-15T05:51:36.005Z","updated":"2026-10-19T21:09:12.477Z","title":"wifi: rt2x00: avoid full teardown before work setup in probe","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-72004","published":"2026-08-15T05:51:35.363Z","updated":"2026-08-17T05:06:25.480Z","title":"wifi: mac80211: fix memory leak in ieee80211_register_hw()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-72003","published":"2026-08-15T05:51:34.730Z","updated":"2026-10-19T21:09:12.330Z","title":"wifi: brcmfmac: cyw: fix heap overflow on a short auth frame","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0035,"kevAdded":null},{"id":"CVE-2026-68479","published":"2026-08-15T05:51:34.106Z","updated":"2026-10-19T21:09:12.177Z","title":"Bluetooth: btrtl: validate firmware patch bounds","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-68478","published":"2026-08-15T05:51:33.441Z","updated":"2026-08-17T05:06:21.136Z","title":"memstick: ms_block: reject a card that reports too many blocks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-68477","published":"2026-08-15T05:51:32.820Z","updated":"2026-10-19T21:09:12.031Z","title":"ipvs: fix more places with wrong ipv6 transport offsets","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-68476","published":"2026-08-15T05:51:32.170Z","updated":"2026-09-02T12:49:42.932Z","title":"ipvs: reload ip header after head reallocation","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-68475","published":"2026-08-15T05:51:31.551Z","updated":"2026-08-17T05:06:17.875Z","title":"reset: sunxi: fix memory region leak on ioremap failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-68474","published":"2026-08-15T05:51:30.918Z","updated":"2026-08-17T05:39:17.306Z","title":"powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-68473","published":"2026-08-15T05:51:30.274Z","updated":"2026-08-17T05:39:16.211Z","title":"powerpc/uaccess: correct check for CONFIG_PPC_E500 in mask_user_address()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-68472","published":"2026-08-15T05:51:29.634Z","updated":"2026-10-19T21:09:11.873Z","title":"wifi: cfg80211: validate EHT MLE before MLD ID read","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-68471","published":"2026-08-15T05:51:29.001Z","updated":"2026-10-30T12:28:42.675Z","title":"wifi: ieee80211: validate MLE common info length","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-68470","published":"2026-08-15T05:51:28.211Z","updated":"2026-10-21T12:44:15.262Z","title":"wifi: mac80211: validate extension-frame layout before RX","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00356,"kevAdded":null},{"id":"CVE-2026-68469","published":"2026-08-15T05:51:27.429Z","updated":"2026-08-17T05:06:11.253Z","title":"wifi: mwifiex: fix permanently busy scans after multiple roam iterations","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2026-68468","published":"2026-08-15T05:51:26.686Z","updated":"2026-08-17T05:06:10.123Z","title":"mtd: virt-concat: free duplicate generated name","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-68467","published":"2026-08-15T05:51:25.949Z","updated":"2026-08-17T05:39:11.779Z","title":"mtd: mchp23k256: use SPI match data for chip caps","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-68466","published":"2026-08-15T05:51:25.212Z","updated":"2026-08-17T05:39:10.682Z","title":"mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-68465","published":"2026-08-15T05:51:24.332Z","updated":"2026-08-17T05:06:06.761Z","title":"mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-68464","published":"2026-08-15T05:51:23.578Z","updated":"2026-08-17T05:06:05.597Z","title":"mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-68463","published":"2026-08-15T05:51:22.807Z","updated":"2026-08-17T05:06:04.488Z","title":"mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-68462","published":"2026-08-15T05:51:21.948Z","updated":"2026-08-17T05:39:09.532Z","title":"bpf: Reject negative const offsets for buffer pointers","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-68461","published":"2026-08-15T05:51:21.219Z","updated":"2026-10-19T21:09:11.556Z","title":"device property: initialize the remaining fields of fwnode_handle in fwnode_init()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-68460","published":"2026-08-15T05:51:20.463Z","updated":"2026-08-18T06:56:06.773Z","title":"f2fs: fix potential deadlock in f2fs_balance_fs()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-68459","published":"2026-08-15T05:51:19.713Z","updated":"2026-08-17T05:06:00.080Z","title":"f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-68458","published":"2026-08-15T05:51:18.975Z","updated":"2026-08-17T05:39:07.025Z","title":"binder: cache secctx size before release zeroes it","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-68457","published":"2026-08-15T05:51:18.233Z","updated":"2026-08-18T06:56:05.565Z","title":"ksmbd: use opener credentials for FSCTL mutations","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00703,"kevAdded":null},{"id":"CVE-2026-68456","published":"2026-08-15T05:51:17.487Z","updated":"2026-08-17T05:05:56.711Z","title":"usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-68455","published":"2026-08-15T05:51:16.745Z","updated":"2026-08-17T05:05:55.589Z","title":"liveupdate: validate session type before performing operation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-68454","published":"2026-08-13T13:59:57.209Z","updated":"2026-10-19T21:09:11.404Z","title":"KVM: s390: pci: Fix handling of AIF enable without AISB","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-68453","published":"2026-08-13T13:59:56.036Z","updated":"2026-10-30T12:28:41.617Z","title":"s390/zcrypt: Fix buffer over-read in cca_cipher2protkey","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-68452","published":"2026-08-13T13:59:54.840Z","updated":"2026-10-19T21:09:11.097Z","title":"s390/zcrypt: Validate length for CCA AES cipher key requests","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-68451","published":"2026-08-13T13:59:53.674Z","updated":"2026-10-19T21:09:10.945Z","title":"s390/zcrypt: Validate length for CCA ECC private key requests","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-68450","published":"2026-08-12T00:51:48.970Z","updated":"2026-08-19T16:35:45.490Z","title":"btrfs: free mapping node on duplicate reloc root insert","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-68449","published":"2026-08-12T00:51:47.140Z","updated":"2026-10-30T12:28:40.534Z","title":"ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-68448","published":"2026-08-12T00:51:44.866Z","updated":"2026-10-30T12:28:39.471Z","title":"ovl: check access to copy_file_range source with src mounter creds","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-68447","published":"2026-08-12T00:51:42.433Z","updated":"2026-10-21T12:44:11.622Z","title":"drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2026-68446","published":"2026-08-12T00:07:37.385Z","updated":"2026-10-19T21:09:10.643Z","title":"drm/vmwgfx: Validate vmw_surface_metadata::array_size","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-68445","published":"2026-08-12T00:07:36.230Z","updated":"2026-10-30T12:28:38.418Z","title":"drm/vc4: Prevent shader BO mappings from becoming writable","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-68444","published":"2026-08-12T00:07:34.609Z","updated":"2026-08-19T16:35:38.125Z","title":"firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68443","published":"2026-08-12T00:07:33.319Z","updated":"2026-08-17T05:05:40.768Z","title":"hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-68442","published":"2026-08-12T00:07:31.981Z","updated":"2026-10-19T21:09:10.486Z","title":"btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-68441","published":"2026-08-12T00:07:30.669Z","updated":"2026-10-30T12:28:37.360Z","title":"net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-68440","published":"2026-08-12T00:07:29.605Z","updated":"2026-08-17T05:05:37.444Z","title":"net: txgbe: fix heap overflow when reading module EEPROM","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-68439","published":"2026-08-12T00:07:28.625Z","updated":"2026-08-17T05:05:36.346Z","title":"wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-68438","published":"2026-08-12T00:07:27.105Z","updated":"2026-08-17T05:05:35.262Z","title":"smp: Make CSD lock acquisition atomic for debug mode","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-68437","published":"2026-08-12T00:07:25.745Z","updated":"2026-08-17T05:05:34.181Z","title":"drm/imagination: Fit paired fragment job in the correct CCCB","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-68436","published":"2026-08-12T00:07:24.698Z","updated":"2026-10-21T12:44:09.408Z","title":"drm/amd/display: use kvzalloc to allocate struct dc","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-68435","published":"2026-08-12T00:07:23.359Z","updated":"2026-10-30T12:28:36.302Z","title":"LoongArch: Fix address space mismatch in kexec command line lookup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-68434","published":"2026-08-12T00:07:21.897Z","updated":"2026-08-23T12:46:23.299Z","title":"serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-68433","published":"2026-08-12T00:07:20.455Z","updated":"2026-10-19T21:09:10.325Z","title":"libceph: bound get_version reply decode to front len","severity":"HIGH","score":8.6,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00364,"kevAdded":null},{"id":"CVE-2026-68432","published":"2026-08-12T00:07:18.806Z","updated":"2026-10-19T21:09:10.150Z","title":"vxlan: require CAP_NET_ADMIN in the device netns for changelink","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-68431","published":"2026-08-12T00:07:17.216Z","updated":"2026-08-23T12:46:22.134Z","title":"ksmbd: validate minimum PDU size for transform requests","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2026-68430","published":"2026-08-12T00:07:15.927Z","updated":"2026-08-19T16:35:27.984Z","title":"drm/amdgpu/gfx8: drop unecessary BUG_ON()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-68429","published":"2026-08-12T00:07:14.640Z","updated":"2026-08-17T05:05:25.387Z","title":"drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-68428","published":"2026-08-10T12:04:48.905Z","updated":"2026-08-19T16:35:25.214Z","title":"KVM: x86/mmu: Fix use-after-free on vendor module reload","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-68427","published":"2026-08-10T12:04:47.915Z","updated":"2026-10-19T21:09:09.990Z","title":"gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-68426","published":"2026-08-10T12:04:46.945Z","updated":"2026-10-30T12:28:35.226Z","title":"xfrm: fix stale skb->prev after async crypto steals a GSO segment","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00498,"kevAdded":null},{"id":"CVE-2026-68425","published":"2026-08-10T12:04:45.947Z","updated":"2026-10-19T21:09:09.668Z","title":"IB/mad: Drop unmatched RMPP responses before reassembly","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-68424","published":"2026-08-10T12:04:44.975Z","updated":"2026-08-17T05:05:19.862Z","title":"mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-68423","published":"2026-08-10T12:04:43.942Z","updated":"2026-08-17T05:05:18.750Z","title":"mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-68422","published":"2026-08-10T12:04:42.949Z","updated":"2026-08-19T16:35:17.540Z","title":"btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-68421","published":"2026-08-10T12:04:41.946Z","updated":"2026-10-21T12:44:06.128Z","title":"sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-68420","published":"2026-08-10T12:04:40.933Z","updated":"2026-08-17T05:05:15.432Z","title":"xfrm: reject optional IPTFS templates in outbound policies","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2026-68419","published":"2026-08-10T12:04:39.912Z","updated":"2026-10-19T21:09:09.507Z","title":"RDMA/irdma: Prevent rereg_mr for non-mem regions","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-68418","published":"2026-08-10T12:04:38.930Z","updated":"2026-10-30T12:28:34.156Z","title":"RDMA/irdma: Prevent user-triggered null deref on QP create","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-68417","published":"2026-08-10T12:04:37.936Z","updated":"2026-10-19T21:09:09.356Z","title":"RDMA/siw: publish QP after initialization","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00096,"kevAdded":null},{"id":"CVE-2026-68416","published":"2026-08-10T12:04:36.582Z","updated":"2026-10-30T12:28:33.091Z","title":"mtd: fix double free and WARN_ON in add_mtd_device() error paths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-68415","published":"2026-08-10T12:04:35.425Z","updated":"2026-08-17T05:05:09.173Z","title":"xfrm: clear mode callbacks after failed mode setup","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-68414","published":"2026-08-10T12:04:34.459Z","updated":"2026-10-19T21:09:09.201Z","title":"wifi: cfg80211: cancel sched scan results work on unregister","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-68413","published":"2026-08-10T12:04:33.525Z","updated":"2026-08-19T16:35:10.167Z","title":"wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-68412","published":"2026-08-10T12:04:32.486Z","updated":"2026-10-21T12:44:04.216Z","title":"wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-68411","published":"2026-08-10T12:04:31.532Z","updated":"2026-08-19T16:35:07.403Z","title":"wifi: mac80211_hwsim: clamp virtio RX length before skb_put","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-68410","published":"2026-08-10T12:04:30.194Z","updated":"2026-08-19T16:35:04.634Z","title":"wifi: libertas: fix memory leak in helper_firmware_cb()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-68409","published":"2026-08-10T12:04:29.238Z","updated":"2026-10-30T12:28:32.032Z","title":"wifi: mac80211: defer link RX stats percpu free to RCU","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2026-68408","published":"2026-08-10T12:04:28.172Z","updated":"2026-10-30T12:28:30.974Z","title":"wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68407","published":"2026-08-10T12:04:27.252Z","updated":"2026-08-19T16:35:02.178Z","title":"wifi: nl80211: free RNR data on MBSSID mismatch","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-68406","published":"2026-08-10T12:04:26.251Z","updated":"2026-08-19T16:34:59.823Z","title":"wifi: cfg80211: validate PMSR FTM preamble range","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-68405","published":"2026-08-10T12:04:25.241Z","updated":"2026-08-19T16:34:57.265Z","title":"wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-68404","published":"2026-08-10T12:04:24.241Z","updated":"2026-10-30T12:28:29.915Z","title":"wifi: cfg80211: use wiphy work for socket owner autodisconnect","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-68403","published":"2026-08-10T12:04:23.150Z","updated":"2026-08-19T16:34:54.805Z","title":"wifi: brcmfmac: initialize SDIO data work before cleanup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-68402","published":"2026-08-10T12:04:22.113Z","updated":"2026-10-19T21:09:08.740Z","title":"wifi: cfg80211: bound element ID read when checking non-inheritance","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-68401","published":"2026-08-10T12:04:21.020Z","updated":"2026-10-30T12:28:28.852Z","title":"firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-68400","published":"2026-08-10T12:04:19.952Z","updated":"2026-10-21T12:43:58.807Z","title":"firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-68399","published":"2026-08-10T12:04:18.837Z","updated":"2026-10-30T12:28:27.786Z","title":"bpf: Fix UAF in sock clone early bailouts","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-68398","published":"2026-08-10T12:04:17.771Z","updated":"2026-10-19T21:09:08.443Z","title":"ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2026-68397","published":"2026-08-10T12:04:16.772Z","updated":"2026-10-19T21:09:08.287Z","title":"net/iucv: take a reference on the socket found in afiucv_hs_rcv()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2026-68396","published":"2026-08-10T12:04:15.607Z","updated":"2026-10-30T12:28:26.719Z","title":"scsi: core: wake eh reliably when using scsi_schedule_eh","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-68395","published":"2026-08-10T12:04:14.545Z","updated":"2026-08-19T16:34:45.284Z","title":"ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-68394","published":"2026-08-10T12:04:13.562Z","updated":"2026-10-19T21:09:08.131Z","title":"Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-68393","published":"2026-08-10T12:04:12.564Z","updated":"2026-10-21T12:43:55.492Z","title":"Bluetooth: hci_sync: extend conn_hash lookup critical sections","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2026-68392","published":"2026-08-10T12:04:11.543Z","updated":"2026-08-23T12:46:21.017Z","title":"Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-68391","published":"2026-08-10T12:04:10.564Z","updated":"2026-10-19T21:09:07.828Z","title":"Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-68390","published":"2026-08-10T12:04:09.373Z","updated":"2026-08-17T05:04:37.940Z","title":"Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2026-68389","published":"2026-08-10T12:04:08.306Z","updated":"2026-08-17T05:04:36.839Z","title":"Bluetooth: hci_qca: Clear memdump state on invalid dump size","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-68388","published":"2026-08-10T12:04:07.304Z","updated":"2026-10-19T21:09:07.685Z","title":"smb/client: handle overlapping allocated ranges in fallocate","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-68387","published":"2026-08-10T12:04:06.326Z","updated":"2026-08-17T05:04:34.632Z","title":"can: raw: add locking for raw flags bitfield","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68386","published":"2026-08-10T12:04:05.306Z","updated":"2026-08-19T16:34:40.363Z","title":"bpf, sockmap: Reject unhashed UDP sockets on sockmap update","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-68385","published":"2026-08-10T12:04:04.281Z","updated":"2026-10-19T21:09:07.531Z","title":"s390/checksum: Fix csum_partial() without vector facility","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00491,"kevAdded":null},{"id":"CVE-2026-68384","published":"2026-08-10T12:04:03.240Z","updated":"2026-10-19T21:09:07.386Z","title":"drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00104,"kevAdded":null},{"id":"CVE-2026-68383","published":"2026-08-10T12:04:02.230Z","updated":"2026-10-21T12:43:54.357Z","title":"drm/xe/guc: Keep scheduler timeline name alive","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-68382","published":"2026-08-10T12:04:01.187Z","updated":"2026-10-19T21:09:07.083Z","title":"drm/xe/guc: Hold device ref until queue teardown completes","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00106,"kevAdded":null},{"id":"CVE-2026-68381","published":"2026-08-10T12:03:59.849Z","updated":"2026-10-30T12:28:25.660Z","title":"ksmbd: pin conn during async oplock break notification","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00491,"kevAdded":null},{"id":"CVE-2026-68380","published":"2026-08-10T12:03:58.536Z","updated":"2026-08-17T05:04:26.414Z","title":"accel/amdxdna: Fix use-after-free of mm_struct in job scheduler","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-68379","published":"2026-08-10T12:03:57.537Z","updated":"2026-08-17T05:04:25.324Z","title":"tcp: fix TIME_WAIT socket reference leak on PSP policy failure","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00601,"kevAdded":null},{"id":"CVE-2026-68378","published":"2026-08-10T12:03:56.590Z","updated":"2026-08-17T05:04:24.219Z","title":"dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-68377","published":"2026-08-10T12:03:55.643Z","updated":"2026-10-19T21:09:06.777Z","title":"net/sched: act_tunnel_key: Defer dst_release to RCU callback","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-68376","published":"2026-08-10T12:03:54.666Z","updated":"2026-10-19T21:09:06.621Z","title":"sctp: fix auth_hmacs array size in struct sctp_cookie","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00605,"kevAdded":null},{"id":"CVE-2026-68375","published":"2026-08-10T12:03:53.659Z","updated":"2026-10-21T12:43:53.285Z","title":"bnxt_en: Handle partially initialized auxiliary devices","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-68374","published":"2026-08-10T12:03:52.701Z","updated":"2026-10-19T21:09:06.470Z","title":"usb: core: sysfs: add lock to bos_descriptors_read()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-68373","published":"2026-08-10T12:03:51.663Z","updated":"2026-10-19T21:09:06.316Z","title":"wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2026-68372","published":"2026-08-10T12:03:50.292Z","updated":"2026-08-17T05:04:17.570Z","title":"usb: core: port: Deattach Type-C connector on component unbind","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-68371","published":"2026-08-10T12:03:49.287Z","updated":"2026-08-23T12:46:19.885Z","title":"usb: musb: omap2430: Do not put borrowed of_node in probe","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-68370","published":"2026-08-10T12:03:48.320Z","updated":"2026-08-19T16:34:31.156Z","title":"usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-68369","published":"2026-08-10T12:03:46.845Z","updated":"2026-08-19T16:34:28.812Z","title":"usb: gadget: printer: fix infinite loop in printer_read()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-68368","published":"2026-08-10T12:03:45.579Z","updated":"2026-08-19T16:34:26.235Z","title":"usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-68367","published":"2026-08-10T12:03:44.600Z","updated":"2026-08-23T12:46:18.779Z","title":"usb: gadget: f_tcm: synchronize delayed set_alt with teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-68366","published":"2026-08-10T12:03:43.304Z","updated":"2026-08-19T16:34:23.776Z","title":"usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-68365","published":"2026-08-10T12:03:42.358Z","updated":"2026-08-19T16:34:21.018Z","title":"USB: serial: io_edgeport: cap received transmit credits","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-68364","published":"2026-08-10T12:03:41.385Z","updated":"2026-08-18T06:55:58.239Z","title":"drm/amd/display: Fix ISM dc_lock deadlock during suspend","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-68363","published":"2026-08-10T12:03:40.355Z","updated":"2026-08-19T16:34:18.694Z","title":"wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-68362","published":"2026-08-10T12:03:39.363Z","updated":"2026-08-19T16:34:15.793Z","title":"wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68361","published":"2026-08-10T12:03:38.332Z","updated":"2026-08-19T16:34:13.231Z","title":"hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-68360","published":"2026-08-10T12:03:37.298Z","updated":"2026-08-19T16:34:10.569Z","title":"hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2026-68359","published":"2026-08-10T12:03:36.254Z","updated":"2026-08-19T16:34:08.117Z","title":"hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-68358","published":"2026-08-10T12:03:35.247Z","updated":"2026-08-17T05:04:01.579Z","title":"hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-68357","published":"2026-08-10T12:03:34.241Z","updated":"2026-08-19T16:34:05.347Z","title":"watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-68356","published":"2026-08-10T12:03:33.280Z","updated":"2026-08-17T05:03:59.392Z","title":"watchdog: airoha: Prevent division by zero when clock frequency is zero","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-68355","published":"2026-08-10T12:03:32.321Z","updated":"2026-08-19T16:34:03.197Z","title":"wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-68354","published":"2026-08-10T12:03:31.348Z","updated":"2026-10-19T21:09:06.151Z","title":"firewire: net: Fix fragmented datagram reassembly","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2026-68353","published":"2026-08-10T12:03:30.330Z","updated":"2026-10-19T21:09:06.001Z","title":"wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-68352","published":"2026-08-10T12:03:29.304Z","updated":"2026-10-19T21:09:05.860Z","title":"wifi: ath6kl: fix OOB read from firmware IE lengths in connect event","severity":"HIGH","score":8.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00415,"kevAdded":null},{"id":"CVE-2026-68351","published":"2026-08-10T12:03:28.312Z","updated":"2026-08-19T16:33:53.098Z","title":"wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-68350","published":"2026-08-10T12:03:27.314Z","updated":"2026-08-19T16:33:50.606Z","title":"wifi: carl9170: fix OOB read from off-by-two in TX status handler","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-68349","published":"2026-08-10T12:03:26.166Z","updated":"2026-08-19T16:33:47.832Z","title":"wifi: carl9170: fix buffer overflow in rx_stream failover path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2026-68348","published":"2026-08-10T12:03:25.193Z","updated":"2026-10-19T21:09:05.718Z","title":"ASoC: tas2781: bound firmware description string parsing","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-68347","published":"2026-08-10T12:03:24.020Z","updated":"2026-08-17T05:03:47.926Z","title":"iommu/amd: Fix IRQ unsafe locking in gdom allocation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-68346","published":"2026-08-10T12:03:23.079Z","updated":"2026-08-17T05:03:46.731Z","title":"ALSA: hda: cs35l41: validate and free ACPI mute object","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-68345","published":"2026-08-10T12:03:22.098Z","updated":"2026-08-17T05:03:45.634Z","title":"arm_mpam: guard MBWU state before adding it to garbage","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-68344","published":"2026-08-10T12:03:20.917Z","updated":"2026-08-19T16:33:45.376Z","title":"usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-68343","published":"2026-08-10T12:03:19.939Z","updated":"2026-10-19T21:09:05.575Z","title":"smb: client: validate DFS referral PathConsumed","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00513,"kevAdded":null},{"id":"CVE-2026-68342","published":"2026-08-10T12:03:18.852Z","updated":"2026-08-17T05:03:42.312Z","title":"ovpn: avoid putting unrelated P2P peer on socket release","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-68341","published":"2026-08-10T12:03:17.821Z","updated":"2026-08-17T05:03:41.213Z","title":"ovpn: fix use after free in unlock_ovpn()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00566,"kevAdded":null},{"id":"CVE-2026-68340","published":"2026-08-10T12:03:16.552Z","updated":"2026-08-19T16:33:40.900Z","title":"hwmon: occ: validate poll response sensor blocks","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2026-68339","published":"2026-08-10T12:03:15.551Z","updated":"2026-08-17T05:03:38.589Z","title":"Bluetooth: btusb: validate Realtek vendor event length","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-68338","published":"2026-08-10T12:03:14.549Z","updated":"2026-10-19T21:09:05.428Z","title":"net/packet: avoid fanout hook re-registration after unregister","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-68337","published":"2026-08-10T12:03:13.583Z","updated":"2026-09-21T13:13:42.530Z","title":"bpf: Reject redirect helpers without a bpf_net_context","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-68336","published":"2026-08-10T12:03:12.592Z","updated":"2026-08-19T16:33:35.547Z","title":"bonding: fix devconf_all NULL dereference when IPv6 is disabled","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-68335","published":"2026-08-10T12:03:11.547Z","updated":"2026-10-19T21:09:05.269Z","title":"rds: drop incoming messages that cross network namespace boundaries","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-68334","published":"2026-08-10T12:03:10.538Z","updated":"2026-08-17T05:03:33.108Z","title":"rxrpc: fix io_thread race in rxrpc_wake_up_io_thread()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68333","published":"2026-08-10T12:03:09.524Z","updated":"2026-08-19T16:33:30.627Z","title":"dpaa2-switch: put MAC endpoint device on disconnect","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-68332","published":"2026-08-10T12:03:08.525Z","updated":"2026-08-17T05:03:30.927Z","title":"net: airoha: Fix potential use-after-free in airoha_ppe_deinit()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68331","published":"2026-08-10T12:03:07.529Z","updated":"2026-08-19T16:33:28.174Z","title":"dpaa2-eth: put MAC endpoint device on disconnect","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68330","published":"2026-08-10T12:03:06.542Z","updated":"2026-08-17T05:03:28.769Z","title":"net: airoha: Fix DMA direction for NPU mailbox buffer","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-68329","published":"2026-08-10T12:03:05.526Z","updated":"2026-10-30T12:28:24.585Z","title":"iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-68328","published":"2026-08-10T12:03:04.560Z","updated":"2026-08-19T16:33:25.716Z","title":"nfp: Check resource mutex allocation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-68327","published":"2026-08-10T12:03:03.398Z","updated":"2026-08-19T16:33:23.256Z","title":"wan: wanxl: Only reset hardware after BAR mapping","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-68326","published":"2026-08-10T12:03:02.372Z","updated":"2026-10-19T21:09:04.965Z","title":"wifi: mwifiex: bound uAP association event IEs to the event buffer","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2026-68325","published":"2026-08-10T12:03:01.384Z","updated":"2026-08-19T16:33:18.080Z","title":"iommu/amd: Bound the early ACPI HID map","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-68324","published":"2026-08-10T12:03:00.073Z","updated":"2026-08-19T16:33:15.575Z","title":"iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68323","published":"2026-08-10T12:02:59.034Z","updated":"2026-10-30T12:28:23.482Z","title":"tipc: serialize udp bearer replicast list updates","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-68322","published":"2026-08-10T12:02:57.499Z","updated":"2026-08-19T16:33:12.816Z","title":"rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-68321","published":"2026-08-10T12:02:56.166Z","updated":"2026-08-17T05:03:18.882Z","title":"net: txgbe: fix FDIR filter leak on remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-68320","published":"2026-08-10T12:02:55.144Z","updated":"2026-10-19T21:09:04.674Z","title":"sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-68319","published":"2026-08-10T12:02:54.173Z","updated":"2026-08-17T05:03:16.659Z","title":"pds_core: fix deadlock between reset thread and remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-68318","published":"2026-08-10T12:02:53.197Z","updated":"2026-10-21T12:43:51.063Z","title":"pds_core: fix use-after-free on workqueue during remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-68317","published":"2026-08-10T12:02:52.185Z","updated":"2026-08-17T05:03:14.295Z","title":"pds_core: fix auxiliary device add/del races","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-68316","published":"2026-08-10T12:02:51.141Z","updated":"2026-08-17T05:03:13.193Z","title":"accel: ethosu: Fix element size accounting for cmd stream validation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-68315","published":"2026-08-10T12:02:50.156Z","updated":"2026-10-19T21:09:04.525Z","title":"sctp: validate stream count in sctp_process_strreset_inreq()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00512,"kevAdded":null},{"id":"CVE-2026-68314","published":"2026-08-10T12:02:49.124Z","updated":"2026-08-17T05:03:10.989Z","title":"net: mctp i3c: clean up notifier and buses if driver register fails","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-68313","published":"2026-08-10T12:02:48.120Z","updated":"2026-08-19T16:33:05.750Z","title":"tipc: fix infinite loop in __tipc_nl_compat_dumpit","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-68312","published":"2026-08-10T12:02:46.907Z","updated":"2026-10-30T12:28:22.322Z","title":"cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-68311","published":"2026-08-10T12:02:45.919Z","updated":"2026-08-17T05:03:07.684Z","title":"wifi: mt76: mt7925: guard link STA in decap offload","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-68310","published":"2026-08-10T12:02:44.917Z","updated":"2026-08-19T16:33:03.090Z","title":"wifi: mt76: mt7915: guard HE capability lookups","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68309","published":"2026-08-10T12:02:43.950Z","updated":"2026-08-19T16:33:00.744Z","title":"wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68308","published":"2026-08-10T12:02:42.934Z","updated":"2026-08-17T05:03:00.803Z","title":"wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-68307","published":"2026-08-10T12:02:41.904Z","updated":"2026-08-17T05:02:59.698Z","title":"wifi: mt76: mt7925: fix crash in reset link replay","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-68306","published":"2026-08-10T12:02:40.907Z","updated":"2026-08-17T05:02:58.582Z","title":"wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-68305","published":"2026-08-10T12:02:39.911Z","updated":"2026-10-19T21:09:04.378Z","title":"drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68304","published":"2026-08-10T12:02:38.515Z","updated":"2026-08-19T16:32:58.379Z","title":"wifi: brcmfmac: fix 802.1X-SHA256 call trace warning","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-68303","published":"2026-08-10T12:02:37.512Z","updated":"2026-10-30T12:28:21.255Z","title":"drm/vc4: hvs/v3d: Fix null dereference in unbind","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-68302","published":"2026-08-10T12:02:36.313Z","updated":"2026-08-19T16:32:55.916Z","title":"amt: re-read skb header pointers after every pull","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00477,"kevAdded":null},{"id":"CVE-2026-68301","published":"2026-08-10T12:02:35.155Z","updated":"2026-08-19T16:32:53.463Z","title":"net: hsr: fix memory leak on slave unregistration by removing synced VLANs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68300","published":"2026-08-10T12:02:34.168Z","updated":"2026-10-19T21:09:04.214Z","title":"sctp: auth: verify auth requirement when auth_chunk is NULL","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0058,"kevAdded":null},{"id":"CVE-2026-68299","published":"2026-08-10T12:02:33.213Z","updated":"2026-10-19T21:09:04.053Z","title":"vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-68298","published":"2026-08-10T12:02:32.194Z","updated":"2026-10-19T21:09:03.900Z","title":"drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-68297","published":"2026-08-10T12:02:30.721Z","updated":"2026-10-19T21:09:03.754Z","title":"tipc: fix u16 MTU truncation in media and bearer MTU validation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-68296","published":"2026-08-10T12:02:29.464Z","updated":"2026-08-17T05:02:32.404Z","title":"net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-68295","published":"2026-08-10T12:02:28.412Z","updated":"2026-10-21T12:43:47.769Z","title":"LoongArch: BPF: Zero-extend signed ALU32 div/mod results","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-68294","published":"2026-08-10T12:02:27.423Z","updated":"2026-10-19T21:09:03.595Z","title":"net: qrtr: restrict socket creation to the initial network namespace","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2026-68293","published":"2026-08-10T12:02:26.414Z","updated":"2026-10-30T12:28:20.185Z","title":"net/mlx5: Fix MCIA register buffer overflow on 32 dword reads","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-68292","published":"2026-08-10T12:02:25.414Z","updated":"2026-08-17T05:02:28.011Z","title":"ice: prevent tstamp ring allocation for non-PF VSI types","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-68291","published":"2026-08-10T12:02:24.402Z","updated":"2026-10-21T12:43:45.336Z","title":"idpf: fix max_vport related crash on allocation error during init","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-68290","published":"2026-08-10T12:02:23.425Z","updated":"2026-10-30T12:28:19.129Z","title":"rds: tcp: unregister sysctl before tearing down listen socket","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-68289","published":"2026-08-10T12:02:22.101Z","updated":"2026-10-03T10:55:45.132Z","title":"tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-68288","published":"2026-08-10T12:02:21.097Z","updated":"2026-10-03T10:55:44.026Z","title":"net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-68287","published":"2026-08-10T12:02:20.110Z","updated":"2026-10-19T20:58:59.639Z","title":"drop_monitor: fix size calculations for 64-bit attributes","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00675,"kevAdded":null},{"id":"CVE-2026-68286","published":"2026-08-10T12:02:19.077Z","updated":"2026-10-03T10:55:41.847Z","title":"drop_monitor: perform u64_stats updates under IRQ-disabled section","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-68285","published":"2026-08-10T12:02:18.074Z","updated":"2026-08-17T05:02:20.327Z","title":"LoongArch: BPF: Fix memory leak in bpf_jit_free()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-68284","published":"2026-08-10T12:02:16.572Z","updated":"2026-10-19T20:58:59.373Z","title":"bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-68283","published":"2026-08-10T12:02:15.088Z","updated":"2026-08-17T05:02:18.147Z","title":"tracing: Fix use-after-free freeing trigger private data","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2026-68282","published":"2026-08-10T12:02:14.138Z","updated":"2026-08-17T05:02:17.047Z","title":"drm/rockchip: analogix_dp: Add missing error check for platform_get_resource()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68281","published":"2026-08-10T12:02:13.103Z","updated":"2026-08-17T05:02:15.934Z","title":"drm/imagination: Count paired job fence as dependency in prepare_job()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-68280","published":"2026-08-10T12:02:11.434Z","updated":"2026-08-23T12:46:17.699Z","title":"drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-68279","published":"2026-08-10T12:02:09.423Z","updated":"2026-08-23T12:46:16.563Z","title":"drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-68278","published":"2026-08-10T12:01:54.285Z","updated":"2026-08-23T12:46:15.450Z","title":"drm/dp/mst: fix buffer overflows in sideband chunk accumulation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2026-68277","published":"2026-08-10T12:01:53.085Z","updated":"2026-08-23T12:46:14.372Z","title":"drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-68276","published":"2026-08-10T12:01:51.789Z","updated":"2026-08-17T05:02:10.194Z","title":"drm/amdgpu/gfx: fix cleaner shader IB buffer overflow","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-68275","published":"2026-08-10T12:01:50.777Z","updated":"2026-08-17T05:02:09.102Z","title":"drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68274","published":"2026-08-10T12:01:49.762Z","updated":"2026-10-19T20:58:59.226Z","title":"drm/xe/guc: Fix buffer overflow in steered register list allocation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2026-68273","published":"2026-08-10T12:01:48.734Z","updated":"2026-10-30T12:28:18.032Z","title":"drm/amdgpu: Fix context pstate override handling","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-68272","published":"2026-08-10T12:01:47.708Z","updated":"2026-08-17T05:02:05.775Z","title":"drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-68271","published":"2026-08-10T12:01:46.534Z","updated":"2026-08-17T05:02:04.681Z","title":"drm/nouveau: fix reversed error cleanup order in ucopy functions","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-68270","published":"2026-08-10T12:01:45.569Z","updated":"2026-08-17T05:02:03.584Z","title":"drm/sysfb: Avoid possible truncation with calculating visible size","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-68269","published":"2026-08-10T12:01:44.575Z","updated":"2026-08-19T16:32:30.915Z","title":"drm/i915/gem: Add missing nospec on parallel submit slot","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-68268","published":"2026-08-10T12:01:43.573Z","updated":"2026-08-17T05:02:01.400Z","title":"drm/xe: Return error on non-migratable faults requiring devmem","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-68267","published":"2026-08-10T12:01:42.551Z","updated":"2026-08-17T05:02:00.297Z","title":"drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-68266","published":"2026-08-10T12:01:41.280Z","updated":"2026-10-19T20:58:58.924Z","title":"drm/xe: Hold a dma-buf reference for imported BOs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-68265","published":"2026-08-10T12:01:40.271Z","updated":"2026-10-19T20:58:58.789Z","title":"drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-68264","published":"2026-08-10T12:01:38.686Z","updated":"2026-10-19T20:58:58.651Z","title":"drm/xe/pt: Reset current_op in xe_pt_update_ops_init()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-68263","published":"2026-08-10T12:01:37.571Z","updated":"2026-08-17T05:01:55.726Z","title":"drm/imagination: Fix double call to drm_sched_entity_fini()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-68262","published":"2026-08-10T12:01:36.582Z","updated":"2026-08-17T05:01:54.563Z","title":"drm/imagination: Fix user array stride in pvr_set_uobj_array()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-68261","published":"2026-08-10T12:01:35.600Z","updated":"2026-08-17T05:01:53.453Z","title":"drm/imagination: fix error checking of pvr_vm_context_lookup()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-68260","published":"2026-08-10T12:01:34.414Z","updated":"2026-08-17T05:01:52.352Z","title":"drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-68259","published":"2026-08-10T12:01:33.110Z","updated":"2026-08-19T16:32:28.586Z","title":"drm/amdkfd: Check bounds in allocate_event_notification_slot","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68258","published":"2026-08-10T12:01:32.149Z","updated":"2026-10-30T12:28:16.935Z","title":"drm/amdkfd: Check bounds on CRIU restore queue type and mqd size","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-68257","published":"2026-08-10T12:01:30.547Z","updated":"2026-10-19T20:58:58.377Z","title":"drm/amdkfd: fix 32-bit overflow in CWSR total size calculation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-68256","published":"2026-08-10T12:01:26.406Z","updated":"2026-08-17T05:01:47.968Z","title":"drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-68255","published":"2026-08-10T12:01:24.835Z","updated":"2026-10-19T20:58:58.229Z","title":"drm/virtio: bound EDID block reads to the response buffer","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-68254","published":"2026-08-10T12:01:20.400Z","updated":"2026-08-23T12:46:12.167Z","title":"drm/i915/vrr: require valid min/max vfreq for VRR","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68253","published":"2026-08-10T12:01:19.402Z","updated":"2026-10-19T20:58:58.090Z","title":"drm/i915/hdcp: check streams[] bounds before overflow","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-68252","published":"2026-08-10T12:01:18.379Z","updated":"2026-08-18T06:55:52.977Z","title":"drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-68251","published":"2026-08-10T12:01:17.402Z","updated":"2026-08-19T16:32:23.355Z","title":"drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-68250","published":"2026-08-10T12:01:16.435Z","updated":"2026-08-19T16:32:21.015Z","title":"drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-68249","published":"2026-08-10T12:01:15.453Z","updated":"2026-08-19T16:32:18.750Z","title":"drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-68248","published":"2026-08-10T12:01:14.485Z","updated":"2026-08-19T16:32:15.977Z","title":"drm/i915: Return NULL on error in active_instance","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68247","published":"2026-08-10T12:01:13.466Z","updated":"2026-10-30T12:28:15.845Z","title":"drm/i915/bios: range check LFP Data Block panel_type2","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68246","published":"2026-08-10T12:01:12.489Z","updated":"2026-08-19T16:32:13.526Z","title":"drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68245","published":"2026-08-10T12:01:11.501Z","updated":"2026-10-30T12:28:14.789Z","title":"drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-68244","published":"2026-08-10T12:01:10.469Z","updated":"2026-08-19T16:32:11.063Z","title":"drm/i915/gem: Do not leak siblings[] on proto context error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68243","published":"2026-08-10T12:01:09.484Z","updated":"2026-08-19T16:32:08.740Z","title":"drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68242","published":"2026-08-10T12:01:08.447Z","updated":"2026-10-30T12:28:13.711Z","title":"drm/i915/gt: Fix NULL deref on sched_engine alloc failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-68241","published":"2026-08-10T12:01:07.103Z","updated":"2026-10-30T12:28:12.656Z","title":"drm/i915/mst: limit DP MST ESI service loop","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-68240","published":"2026-08-10T12:01:05.810Z","updated":"2026-10-19T20:58:57.805Z","title":"drm/gpusvm: publish dpagemap early to avoid device mapping leak on error","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-68239","published":"2026-08-10T12:01:04.297Z","updated":"2026-08-17T05:01:28.470Z","title":"drm/ttm: Account for NULL and handle pages in ttm_pool_backup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-68238","published":"2026-08-10T12:01:03.277Z","updated":"2026-10-30T12:28:10.657Z","title":"drm/amdgpu: Release VFCT ACPI table reference","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68237","published":"2026-08-10T12:01:02.144Z","updated":"2026-08-17T05:01:26.271Z","title":"drm/amdgpu/userq: fix indefinite fence wait during GPU reset","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-68236","published":"2026-08-10T12:01:01.114Z","updated":"2026-10-19T20:58:57.661Z","title":"drm/amd/display: set new_stream to NULL after release","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-68235","published":"2026-08-10T12:01:00.099Z","updated":"2026-08-18T06:55:45.652Z","title":"drm/amd/display: dce100: skip non-DP stream encoders for DP MST","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-68234","published":"2026-08-10T12:00:59.074Z","updated":"2026-08-19T16:32:06.457Z","title":"drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-68233","published":"2026-08-10T12:00:57.580Z","updated":"2026-10-30T12:28:09.594Z","title":"drm/vc4: Shut down BO cache timer before teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68232","published":"2026-08-10T12:00:56.256Z","updated":"2026-08-17T05:01:20.774Z","title":"drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-68231","published":"2026-08-10T12:00:54.801Z","updated":"2026-08-19T16:32:04.017Z","title":"media: airspy: Return queued buffers on start_streaming() failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-68230","published":"2026-08-10T12:00:53.425Z","updated":"2026-08-17T05:01:18.566Z","title":"media: amlogic-c3: Add validations for ae and awb config","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-68229","published":"2026-08-10T12:00:51.935Z","updated":"2026-08-19T16:32:01.546Z","title":"media: cedrus: skip invalid H.264 reference list entries","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-68228","published":"2026-08-10T12:00:50.892Z","updated":"2026-08-17T05:01:16.349Z","title":"media: chips-media: wave5: Move src_buf Removal to finish_encode","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-68227","published":"2026-08-10T12:00:49.821Z","updated":"2026-08-19T16:31:59.091Z","title":"media: cx231xx: fix devres lifetime","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-68226","published":"2026-08-10T12:00:48.349Z","updated":"2026-08-19T16:31:56.630Z","title":"media: cx23885: add ioremap return check and cleanup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-68225","published":"2026-08-10T12:00:47.085Z","updated":"2026-08-17T05:01:13.016Z","title":"media: i2c: alvium: fix critical pointer access in alvium_ctrl_init","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-68224","published":"2026-08-10T12:00:45.474Z","updated":"2026-08-17T05:01:11.903Z","title":"media: mali-c55: Fix possible ERR_PTR in enable_streams","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-68223","published":"2026-08-10T12:00:44.123Z","updated":"2026-08-19T16:31:54.081Z","title":"media: meson: vdec: Fix memory leak in error path of vdec_open","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-68222","published":"2026-08-10T12:00:42.687Z","updated":"2026-08-19T16:31:51.745Z","title":"media: msi2500: Return queued buffers on start_streaming() failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-68221","published":"2026-08-10T12:00:41.392Z","updated":"2026-08-17T05:01:07.985Z","title":"media: nuvoton: npcm-video: fix memory leaks in probe and remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-68220","published":"2026-08-10T12:00:40.434Z","updated":"2026-08-17T05:01:06.897Z","title":"media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-68219","published":"2026-08-10T12:00:39.405Z","updated":"2026-08-17T05:01:05.813Z","title":"media: nxp: imx8-isi: Fix potential out-of-bounds issues","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-68218","published":"2026-08-10T12:00:38.175Z","updated":"2026-08-19T16:31:50.280Z","title":"media: pci: dm1105: Free allocated workqueue","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-68217","published":"2026-08-10T12:00:36.773Z","updated":"2026-08-19T16:31:48.858Z","title":"media: pwc: Drain fill_buf on start_streaming() failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-68216","published":"2026-08-10T12:00:35.592Z","updated":"2026-10-19T20:58:57.523Z","title":"media: pwc: Return queued buffers on start_streaming() failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-68215","published":"2026-08-10T12:00:34.560Z","updated":"2026-08-19T16:31:44.648Z","title":"media: radio-si476x: Unregister v4l2_device on probe failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-68214","published":"2026-08-10T12:00:33.539Z","updated":"2026-08-19T16:31:42.193Z","title":"media: rtl2832: fix use-after-free in rtl2832_remove()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-68213","published":"2026-08-10T12:00:32.514Z","updated":"2026-10-19T20:58:57.387Z","title":"media: rtl2832_sdr: Return queued buffers on start_streaming() failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-68212","published":"2026-08-10T12:00:31.498Z","updated":"2026-08-19T16:31:37.074Z","title":"media: saa7134: Fix a possible memory leak in saa7134_video_init1","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-68211","published":"2026-08-10T12:00:30.502Z","updated":"2026-10-21T12:43:33.155Z","title":"media: stm32-dcmipp: Return queued buffers on start_streaming() failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-68210","published":"2026-08-10T12:00:29.515Z","updated":"2026-08-19T16:31:34.517Z","title":"media: stm32: dcmi: unregister notifier on probe failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-68209","published":"2026-08-10T12:00:28.245Z","updated":"2026-08-19T16:31:31.902Z","title":"media: sun4i-csi: Return queued buffers on start_streaming() failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-68208","published":"2026-08-10T12:00:27.277Z","updated":"2026-08-17T05:00:52.557Z","title":"media: ti: vpe: Fix the error code of devm_kzalloc() in vip_probe_slice()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-68207","published":"2026-08-10T12:00:26.322Z","updated":"2026-08-19T16:31:29.282Z","title":"media: ti: vpe: unwind v4l2 device registration on probe error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-68206","published":"2026-08-10T12:00:25.309Z","updated":"2026-10-19T20:58:57.229Z","title":"media: v4l2-ctrls: validate HEVC active reference counts","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-68205","published":"2026-08-10T12:00:24.265Z","updated":"2026-08-23T12:46:09.673Z","title":"media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-68204","published":"2026-08-10T12:00:23.311Z","updated":"2026-08-19T16:31:23.943Z","title":"media: vivid: check for vb2_is_busy() when toggling caps","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-68203","published":"2026-08-10T12:00:22.319Z","updated":"2026-10-30T12:28:08.541Z","title":"media: vivid: fix cleanup bugs in vivid_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-68202","published":"2026-08-10T12:00:21.279Z","updated":"2026-10-19T20:58:57.086Z","title":"ALSA: seq: close a re-opened queue timer in the destructor","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-68201","published":"2026-08-10T12:00:20.280Z","updated":"2026-10-19T20:58:56.946Z","title":"ALSA: timer: drain a slave's callback before its master detaches it","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-68200","published":"2026-08-10T12:00:19.253Z","updated":"2026-10-19T20:58:56.806Z","title":"ALSA: timer: don't re-enter an instance callback that is still running","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-68199","published":"2026-08-10T12:00:18.278Z","updated":"2026-10-19T20:58:56.656Z","title":"wifi: ath6kl: fix OOB access from firmware ADDBA window size","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-68198","published":"2026-08-10T12:00:16.718Z","updated":"2026-10-19T18:00:24.933Z","title":"wifi: ath6kl: fix use-after-free in aggr_reset_state()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2026-68197","published":"2026-08-10T12:00:15.750Z","updated":"2026-08-19T16:31:16.085Z","title":"wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-68196","published":"2026-08-10T12:00:14.686Z","updated":"2026-08-19T16:31:13.791Z","title":"wifi: wilc1000: validate assoc response length before subtracting header","severity":"HIGH","score":8.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00413,"kevAdded":null},{"id":"CVE-2026-68195","published":"2026-08-10T12:00:13.627Z","updated":"2026-08-19T16:31:11.475Z","title":"wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-68194","published":"2026-08-10T12:00:12.245Z","updated":"2026-08-19T16:31:09.017Z","title":"wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-68193","published":"2026-08-10T12:00:11.110Z","updated":"2026-08-17T05:00:36.015Z","title":"wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-68192","published":"2026-08-10T12:00:10.041Z","updated":"2026-10-19T20:58:56.511Z","title":"wifi: brcmfmac: make release_scratchbuffers idempotent","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00408,"kevAdded":null},{"id":"CVE-2026-68191","published":"2026-08-10T12:00:09.069Z","updated":"2026-08-17T05:00:33.856Z","title":"wifi: ath12k: fix NULL pointer dereference in rhash table destroy","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-68190","published":"2026-08-10T12:00:07.764Z","updated":"2026-08-19T16:31:04.402Z","title":"staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-68189","published":"2026-08-10T12:00:01.711Z","updated":"2026-10-19T20:58:56.269Z","title":"Bluetooth: hci_sync: Protect UUID list traversal","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-68188","published":"2026-08-10T12:00:00.521Z","updated":"2026-08-19T16:30:59.491Z","title":"Bluetooth: RFCOMM: Fix session UAF in set_termios","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-68187","published":"2026-08-10T11:59:59.303Z","updated":"2026-08-19T16:30:56.724Z","title":"exec: fix unsigned loop counter wrap in transfer_args_to_stack()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-68186","published":"2026-08-10T11:59:58.299Z","updated":"2026-08-19T16:30:54.269Z","title":"binfmt_misc: set have_execfd only once the interpreter is opened","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-68185","published":"2026-08-10T11:59:57.327Z","updated":"2026-10-30T12:28:07.474Z","title":"LoongArch: Move jump_label_init() before parse_early_param()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-68184","published":"2026-08-10T11:59:56.319Z","updated":"2026-08-19T16:30:51.908Z","title":"cdrom: fix stack out-of-bounds read in CDROMVOLCTRL","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-68183","published":"2026-08-10T11:59:54.836Z","updated":"2026-08-19T16:30:49.896Z","title":"firmware: stratix10-svc: fix memory leaks and list corruption bugs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-68182","published":"2026-08-10T11:59:53.793Z","updated":"2026-08-19T16:30:47.491Z","title":"comedi: comedi_parport: deal with premature interrupt","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-68181","published":"2026-08-10T11:59:52.724Z","updated":"2026-08-23T12:46:04.934Z","title":"mei: bus: access mei_device under device_lock on cleanup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-68180","published":"2026-08-10T11:59:51.694Z","updated":"2026-08-19T16:30:44.755Z","title":"intel_th: fix MSC output device reference leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-68179","published":"2026-08-10T11:59:50.667Z","updated":"2026-10-19T20:58:56.123Z","title":"misc: nsm: only unlock nsm_dev on post-lock error paths","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-68178","published":"2026-08-10T11:59:49.344Z","updated":"2026-10-19T20:58:55.830Z","title":"misc: nsm: pin the module while the device is open","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-68177","published":"2026-08-10T11:59:48.318Z","updated":"2026-08-17T05:00:18.452Z","title":"tracing: Delay module ref count for \"enable_event\" trigger","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-68176","published":"2026-08-10T11:59:47.298Z","updated":"2026-08-19T16:30:41.982Z","title":"tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-68175","published":"2026-08-10T11:59:45.965Z","updated":"2026-08-19T16:30:39.826Z","title":"tracing: Fix resource leak on mmiotrace trace_pipe close","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-68174","published":"2026-08-10T11:59:44.417Z","updated":"2026-08-17T05:00:15.155Z","title":"tracing: Fix union collision of module and refcnt for dynamic events","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-68173","published":"2026-08-10T11:59:42.889Z","updated":"2026-08-17T05:00:14.047Z","title":"ublk: wait on ublk_dev_ready() instead of ub->completion","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-68172","published":"2026-08-10T11:59:41.893Z","updated":"2026-08-17T05:00:12.926Z","title":"arm64: make huge_ptep_get handled unaligned addresses","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-68170","published":"2026-08-10T11:59:39.174Z","updated":"2026-08-17T05:00:11.808Z","title":"mptcp: fix stale skb->sk reference on subflow close","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00516,"kevAdded":null},{"id":"CVE-2026-68169","published":"2026-08-10T11:59:38.177Z","updated":"2026-08-23T12:46:03.401Z","title":"mptcp: pm: userspace: fix use-after-free in get_local_id","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-68168","published":"2026-08-10T11:59:36.633Z","updated":"2026-08-17T05:00:08.675Z","title":"afs: Fix afs_edit_dir_remove() to get, not find, block 0","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-68167","published":"2026-08-10T11:59:35.630Z","updated":"2026-08-17T05:00:07.591Z","title":"btrfs: do not try compression for data reloc inodes","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-68166","published":"2026-08-10T11:59:34.576Z","updated":"2026-08-23T12:46:02.309Z","title":"userfaultfd: prevent registration of special VMAs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-68165","published":"2026-08-10T11:59:33.152Z","updated":"2026-08-19T16:30:37.581Z","title":"mm/damon/core: validate ranges in damon_set_regions()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-68164","published":"2026-08-10T11:59:31.670Z","updated":"2026-08-19T16:30:34.916Z","title":"mm/damon/core: disallow overlapping input ranges for damon_set_regions()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-68163","published":"2026-08-10T11:59:30.633Z","updated":"2026-08-17T05:00:02.619Z","title":"mm/page_vma_mapped: fix device-private PMD handling","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-68162","published":"2026-08-10T11:59:29.099Z","updated":"2026-10-19T20:58:55.689Z","title":"sctp: avoid auth_enable sysctl UAF during netns teardown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-68161","published":"2026-08-10T11:59:28.072Z","updated":"2026-10-19T20:58:55.541Z","title":"sctp: close UDP tunnel sockets during netns teardown","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00682,"kevAdded":null},{"id":"CVE-2026-68160","published":"2026-08-10T11:59:26.741Z","updated":"2026-10-19T20:58:55.403Z","title":"ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00772,"kevAdded":null},{"id":"CVE-2026-68159","published":"2026-08-10T11:59:25.697Z","updated":"2026-10-19T20:58:55.255Z","title":"libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00745,"kevAdded":null},{"id":"CVE-2026-68158","published":"2026-08-10T11:59:24.675Z","updated":"2026-10-19T20:58:55.112Z","title":"libceph: Fix multiplication overflow in decode_new_up_state_weight()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-68157","published":"2026-08-10T11:59:23.692Z","updated":"2026-10-19T20:58:54.933Z","title":"libceph: guard missing CRUSH type name lookup","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00696,"kevAdded":null},{"id":"CVE-2026-68156","published":"2026-08-10T11:59:22.514Z","updated":"2026-10-19T20:58:54.796Z","title":"libceph: refresh auth->authorizer_buf{,_len} after authorizer update","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00694,"kevAdded":null},{"id":"CVE-2026-68155","published":"2026-08-10T11:59:21.200Z","updated":"2026-10-19T20:58:54.643Z","title":"libceph: Reject monmaps advertising zero monitors","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00696,"kevAdded":null},{"id":"CVE-2026-68154","published":"2026-08-10T11:59:20.250Z","updated":"2026-10-19T20:58:54.485Z","title":"libceph: reject zero bucket types in crush_decode","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-68153","published":"2026-08-10T11:59:19.302Z","updated":"2026-10-19T20:58:54.326Z","title":"libceph: remove debugfs files before client teardown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-68152","published":"2026-08-10T11:59:18.270Z","updated":"2026-08-17T04:59:47.614Z","title":"amt: fix use-after-free in AMT delayed works","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-68151","published":"2026-08-10T11:59:16.878Z","updated":"2026-08-19T16:30:15.558Z","title":"binfmt_elf_fdpic: only honour the first PT_INTERP","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-68150","published":"2026-08-10T11:59:15.647Z","updated":"2026-08-23T12:45:59.037Z","title":"fs/super: fix emergency thaw double-unlock of s_umount","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-68149","published":"2026-08-10T11:59:14.645Z","updated":"2026-10-19T20:58:54.165Z","title":"fs: preserve ACL_DONT_CACHE state in forget_cached_acl()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-68148","published":"2026-08-10T11:59:13.413Z","updated":"2026-10-19T20:58:54.031Z","title":"fscrypt: Add missing superblock check in find_or_insert_direct_key()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00092,"kevAdded":null},{"id":"CVE-2026-68147","published":"2026-08-10T11:59:12.308Z","updated":"2026-08-19T16:30:11.166Z","title":"fscrypt: Avoid dynamic allocation in fscrypt_get_devices()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-68146","published":"2026-08-10T11:59:11.273Z","updated":"2026-08-23T12:45:57.951Z","title":"ftrace: Add global mutex to serialize trace_parser access","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-68145","published":"2026-08-10T11:59:09.721Z","updated":"2026-10-19T20:58:53.891Z","title":"iomap: fix out-of-bounds bitmap_set() with zero-length range","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-68144","published":"2026-08-10T11:59:08.437Z","updated":"2026-10-19T20:58:53.730Z","title":"phonet: pep: fix use-after-free in pep_get_sb()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00536,"kevAdded":null},{"id":"CVE-2026-68143","published":"2026-08-10T11:59:07.354Z","updated":"2026-10-19T20:58:53.572Z","title":"net: slip: serialize receive against buffer reallocation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-68142","published":"2026-08-10T11:59:06.048Z","updated":"2026-10-19T20:58:53.417Z","title":"geneve: require CAP_NET_ADMIN in the device netns for changelink","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-68141","published":"2026-08-10T11:59:05.051Z","updated":"2026-10-19T20:58:53.262Z","title":"net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00523,"kevAdded":null},{"id":"CVE-2026-68140","published":"2026-08-10T11:59:03.761Z","updated":"2026-10-19T20:58:53.121Z","title":"net/iucv: fix use-after-free of a severed iucv_path","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2026-68139","published":"2026-08-10T11:59:02.768Z","updated":"2026-08-17T04:59:32.634Z","title":"net/mlx5e: Use sender devcom for MPV master-up","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-68138","published":"2026-08-10T11:59:01.744Z","updated":"2026-10-19T20:58:52.975Z","title":"net/sched: serialize qdisc_rtab_list against concurrent get/put","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2026-68137","published":"2026-08-10T11:59:00.740Z","updated":"2026-08-19T16:29:54.672Z","title":"net/x25: fix use-after-free in x25_kill_by_neigh()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00536,"kevAdded":null},{"id":"CVE-2026-68136","published":"2026-08-10T11:58:59.450Z","updated":"2026-10-19T20:58:52.839Z","title":"net: gro: fix double aggregation of flush-marked skbs","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00539,"kevAdded":null},{"id":"CVE-2026-68135","published":"2026-08-10T11:58:58.463Z","updated":"2026-08-19T16:29:52.114Z","title":"net: hip04: fix RX buffer leak on build_skb failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-68134","published":"2026-08-10T11:58:57.504Z","updated":"2026-08-17T04:59:26.371Z","title":"ptp: ptp_s390: Add missing facility check","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-68133","published":"2026-08-10T11:58:56.223Z","updated":"2026-08-17T04:59:25.287Z","title":"ice: fix PTP Call Trace during PTP release","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-68132","published":"2026-08-10T11:58:55.196Z","updated":"2026-08-23T12:45:53.613Z","title":"super: fix emergency thaw deadlock on frozen block devices","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-68131","published":"2026-08-10T11:58:54.155Z","updated":"2026-10-19T20:58:52.688Z","title":"rbd: Reset positive result codes to zero in object map update path","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00523,"kevAdded":null},{"id":"CVE-2026-68130","published":"2026-08-10T11:58:52.653Z","updated":"2026-08-23T12:45:52.403Z","title":"ksmbd: defer destroy_previous_session() until after NTLM authentication","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-68129","published":"2026-08-10T11:58:51.406Z","updated":"2026-10-19T20:58:52.534Z","title":"gve: fix Rx queue stall on alloc failure","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-68128","published":"2026-08-10T11:58:50.013Z","updated":"2026-10-19T20:58:52.382Z","title":"ice: reject out-of-range ptype in ice_parser_profile_init","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-68127","published":"2026-08-10T11:58:48.489Z","updated":"2026-10-19T20:58:52.243Z","title":"ila: reload IPv6 header after pskb_may_pull in checksum adjust","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00536,"kevAdded":null},{"id":"CVE-2026-68126","published":"2026-08-10T11:58:47.478Z","updated":"2026-08-17T04:59:17.559Z","title":"mac802154: hold an interface reference across the scan worker","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-68125","published":"2026-08-10T11:58:46.198Z","updated":"2026-10-19T20:58:52.090Z","title":"mac802154: llsec: reject frames shorter than the authentication tag","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2026-68124","published":"2026-08-10T11:58:44.997Z","updated":"2026-08-19T16:29:36.851Z","title":"mctp: serial: handle zero-length frames to prevent rx buffer overflow","severity":"CRITICAL","score":9.6,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00343,"kevAdded":null},{"id":"CVE-2026-68123","published":"2026-08-10T11:58:43.727Z","updated":"2026-10-19T20:58:51.936Z","title":"openvswitch: fix GSO userspace truncation underflow","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00552,"kevAdded":null},{"id":"CVE-2026-68122","published":"2026-08-10T11:58:42.477Z","updated":"2026-08-17T04:59:13.088Z","title":"ovpn: fix peer refcount leak in TCP error paths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68121","published":"2026-08-10T11:58:41.489Z","updated":"2026-10-19T20:58:51.778Z","title":"pppoe: reload header pointer after dev_hard_header()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00367,"kevAdded":null},{"id":"CVE-2026-68120","published":"2026-08-10T11:58:40.224Z","updated":"2026-08-17T04:59:10.871Z","title":"rtase: Workaround for TX hang caused by hardware packet parsing","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00441,"kevAdded":null},{"id":"CVE-2026-68119","published":"2026-08-10T11:58:39.026Z","updated":"2026-08-17T04:59:09.650Z","title":"tcp: initialize standalone TCP-AO response padding","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00373,"kevAdded":null},{"id":"CVE-2026-68118","published":"2026-08-10T11:58:38.000Z","updated":"2026-10-30T12:28:06.412Z","title":"tcp: challenge ACK for non-exact RST in SYN-RECEIVED","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-68117","published":"2026-08-10T11:58:36.675Z","updated":"2026-10-19T20:58:51.459Z","title":"tipc: clear sock->sk on the failed-insert path in tipc_sk_create()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00525,"kevAdded":null},{"id":"CVE-2026-68116","published":"2026-08-10T11:58:34.612Z","updated":"2026-10-19T20:58:51.286Z","title":"vxlan: mdb: Fix source list corruption on a failed replace","severity":"HIGH","score":7.9,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-68115","published":"2026-08-10T11:58:33.594Z","updated":"2026-08-19T16:29:26.881Z","title":"drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-68114","published":"2026-08-10T11:58:32.559Z","updated":"2026-08-18T06:55:39.489Z","title":"drm/amdgpu/gfx12.1: replace BUG_ON() with WARN_ON()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-68113","published":"2026-08-10T11:58:31.059Z","updated":"2026-08-18T06:55:38.263Z","title":"drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-68112","published":"2026-08-10T11:58:29.670Z","updated":"2026-08-18T06:55:36.971Z","title":"drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-68111","published":"2026-08-10T11:58:28.489Z","updated":"2026-08-19T16:29:24.565Z","title":"drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-68110","published":"2026-08-10T11:58:27.478Z","updated":"2026-08-17T04:58:59.664Z","title":"drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-68109","published":"2026-08-10T11:58:26.461Z","updated":"2026-08-17T04:58:58.564Z","title":"drm/amdgpu/sdma7.1: replace BUG_ON() with WARN_ON()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-68108","published":"2026-08-10T11:58:25.241Z","updated":"2026-10-19T20:58:51.134Z","title":"drm/amdgpu/vce: fix integer overflow in image size","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-68107","published":"2026-08-10T11:58:24.135Z","updated":"2026-10-30T12:28:05.347Z","title":"drm/amdgpu/vcn4: avoid rereading IB param length","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-68106","published":"2026-08-10T11:58:23.108Z","updated":"2026-10-19T20:58:50.821Z","title":"drm/amdgpu: fix division by zero with invalid uvd dimensions","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-68105","published":"2026-08-10T11:58:22.101Z","updated":"2026-10-21T12:43:29.891Z","title":"drm/amdgpu: Fix kernel panic during driver load failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-68104","published":"2026-08-10T11:58:20.614Z","updated":"2026-10-19T20:58:50.663Z","title":"drm/amdgpu: invoke pm_genpd_remove() before freeing genpd","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-68103","published":"2026-08-10T11:58:19.317Z","updated":"2026-10-19T20:58:50.510Z","title":"drm/amdgpu: reject mapping a reserved doorbell to a new queue","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2026-68102","published":"2026-08-10T11:58:18.093Z","updated":"2026-10-30T12:28:04.267Z","title":"drm/amdgpu: fix aperture mapping leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-68100","published":"2026-08-10T11:58:15.233Z","updated":"2026-10-19T20:58:50.348Z","title":"ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2026-68099","published":"2026-08-10T11:58:13.940Z","updated":"2026-08-23T12:45:49.075Z","title":"ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-68098","published":"2026-08-10T11:58:12.768Z","updated":"2026-10-30T12:28:03.210Z","title":"ksmbd: bound DACL dedup walk to copied ACEs","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00447,"kevAdded":null},{"id":"CVE-2026-68097","published":"2026-08-10T11:58:11.289Z","updated":"2026-10-03T10:55:37.291Z","title":"ksmbd: validate ACE size against SID sub-authorities","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00447,"kevAdded":null},{"id":"CVE-2026-68096","published":"2026-08-10T11:58:09.951Z","updated":"2026-10-19T20:48:44.598Z","title":"audit: fix recursive locking deadlock in audit_dupe_exe()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00533,"kevAdded":null},{"id":"CVE-2026-68095","published":"2026-08-10T11:58:08.590Z","updated":"2026-08-17T04:58:43.670Z","title":"fuse-uring: fix race between registration and connection abortion","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-68094","published":"2026-08-10T11:58:07.086Z","updated":"2026-08-17T04:58:42.583Z","title":"sched_ext: Preserve rq tracking across local DSQ dispatch","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-68093","published":"2026-08-10T11:58:05.933Z","updated":"2026-08-19T16:29:15.060Z","title":"KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-68092","published":"2026-08-10T11:51:47.895Z","updated":"2026-08-17T04:58:40.365Z","title":"time/jiffies: Register jiffies clocksource before usage","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-68091","published":"2026-08-10T11:51:46.683Z","updated":"2026-10-19T20:48:44.455Z","title":"HID: wacom: stop hardware after post-start probe failures","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2026-68090","published":"2026-08-10T11:51:45.149Z","updated":"2026-08-17T04:58:38.177Z","title":"debugobjects: Plug race against a concurrent OOM disable","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-68089","published":"2026-08-10T11:51:43.963Z","updated":"2026-08-17T04:58:37.083Z","title":"iio: core: fix uninitialized data in debugfs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-68088","published":"2026-08-10T11:51:42.647Z","updated":"2026-08-17T04:58:35.975Z","title":"usb: gadget: function: rndis: add length check to response query","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-68087","published":"2026-08-10T11:51:41.348Z","updated":"2026-08-17T04:58:34.892Z","title":"HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-68086","published":"2026-08-10T11:51:40.304Z","updated":"2026-08-10T11:51:40.304Z","title":"mm/khugepaged: write all dirty file folios when collapsing","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2026-68085","published":"2026-08-10T11:51:39.079Z","updated":"2026-10-19T20:48:44.294Z","title":"Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled","severity":"HIGH","score":8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-68084","published":"2026-08-10T11:51:37.255Z","updated":"2026-08-17T04:58:31.918Z","title":"staging: vme_user: fix location monitor leak in tsi148 bridge","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-68083","published":"2026-08-10T11:41:47.153Z","updated":"2026-10-30T12:28:02.157Z","title":"ksmbd: fix path resolution in ksmbd_vfs_kern_path_create","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-68082","published":"2026-08-08T09:17:45.394Z","updated":"2026-10-19T20:48:44.160Z","title":"libceph: fix two unsafe bare decodes in decode_lockers()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2026-68081","published":"2026-08-08T09:17:44.795Z","updated":"2026-10-30T12:28:01.095Z","title":"KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-68480","published":"2026-08-06T17:36:43.654Z","updated":"2026-08-18T06:56:07.999Z","title":"x86/bugs: Make Safe-RET robust against interrupt injection","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-64604","published":"2026-08-06T07:13:55.718Z","updated":"2026-08-17T04:58:27.506Z","title":"KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-64603","published":"2026-08-06T07:13:55.114Z","updated":"2026-08-17T04:58:26.397Z","title":"platform/x86: intel-hid: Protect ACPI notify handler against recursion","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-64602","published":"2026-08-06T07:13:54.519Z","updated":"2026-08-17T04:58:25.306Z","title":"iio: adc: spear: Initialize completion before requesting IRQ","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-64601","published":"2026-08-06T07:13:53.926Z","updated":"2026-08-17T04:58:24.207Z","title":"ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-64599","published":"2026-08-06T07:13:53.328Z","updated":"2026-10-19T20:48:43.746Z","title":"crypto: amlogic - avoid double cleanup in meson_crypto_probe()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-64598","published":"2026-08-06T07:13:52.716Z","updated":"2026-10-19T20:48:43.611Z","title":"smb/client: Fix error code in smb2_aead_req_alloc()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-64597","published":"2026-08-06T07:13:52.117Z","updated":"2026-10-19T20:48:43.468Z","title":"smb: client: fix double-free in SMB2_close() replay","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2026-64596","published":"2026-08-06T07:13:51.523Z","updated":"2026-08-17T04:58:18.647Z","title":"libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-64595","published":"2026-08-06T07:13:50.918Z","updated":"2026-08-17T04:58:17.545Z","title":"HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-64594","published":"2026-08-06T07:13:50.309Z","updated":"2026-08-17T04:58:16.410Z","title":"usb: gadget: f_fs: initialize reset_work at allocation time","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-64593","published":"2026-08-06T07:13:49.700Z","updated":"2026-08-17T04:58:15.319Z","title":"btrfs: do not trim a device which is not writeable","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-64592","published":"2026-08-06T07:13:49.098Z","updated":"2026-08-17T04:58:14.158Z","title":"riscv: mm: Unconditionally sfence.vma for spurious fault","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-64591","published":"2026-08-06T07:13:48.490Z","updated":"2026-08-17T04:58:12.761Z","title":"iommu/vt-d: Avoid WARNING in sva unbind path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-64590","published":"2026-08-06T07:13:47.888Z","updated":"2026-08-23T12:45:45.786Z","title":"dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-64589","published":"2026-08-06T07:13:47.291Z","updated":"2026-08-17T04:58:10.524Z","title":"i2c: core: fix NULL-deref on adapter registration failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-64588","published":"2026-08-06T07:13:46.688Z","updated":"2026-08-17T04:58:09.400Z","title":"fuse-uring: fix data races on ring->ready","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-64587","published":"2026-08-06T07:06:27.765Z","updated":"2026-08-08T15:13:24.903Z","title":"net: ethernet: arc: emac: quiesce interrupts before requesting IRQ","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-64586","published":"2026-08-06T07:06:27.158Z","updated":"2026-10-19T20:48:43.327Z","title":"wifi: brcmfmac: drain bus_reset work on device removal","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2026-64585","published":"2026-08-06T07:06:26.556Z","updated":"2026-08-23T12:45:43.597Z","title":"can: esd_usb: kill anchored URBs before freeing netdevs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-64584","published":"2026-08-06T07:06:25.953Z","updated":"2026-08-19T16:29:12.890Z","title":"usb: gadget: f_midi: cancel pending IN work before freeing the midi object","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-64583","published":"2026-08-06T07:06:25.335Z","updated":"2026-08-23T12:45:42.500Z","title":"usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-64582","published":"2026-08-05T11:25:29.082Z","updated":"2026-10-19T20:48:43.186Z","title":"RDMA/rxe: Fix a use-after-free problem in rxe_mmap","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-64581","published":"2026-08-05T08:09:35.556Z","updated":"2026-10-19T20:48:43.050Z","title":"xfrm: fix sk_dst_cache double-free in xfrm_user_policy()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-64580","published":"2026-08-05T08:09:34.946Z","updated":"2026-10-19T20:48:42.908Z","title":"xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-64579","published":"2026-08-05T08:09:34.346Z","updated":"2026-08-19T16:29:04.594Z","title":"xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-64578","published":"2026-08-05T08:09:33.740Z","updated":"2026-08-19T16:29:02.136Z","title":"ksmbd: validate compound request size before reading StructureSize2","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00336,"kevAdded":null},{"id":"CVE-2026-64577","published":"2026-08-05T08:09:33.135Z","updated":"2026-08-19T16:28:59.684Z","title":"gtp: check skb_pull_data() return in gtp1u_send_echo_resp()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00576,"kevAdded":null},{"id":"CVE-2026-64576","published":"2026-08-05T08:09:32.529Z","updated":"2026-10-19T20:48:42.772Z","title":"nexthop: initialize extack in nh_res_bucket_migrate()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-64575","published":"2026-08-05T08:09:31.923Z","updated":"2026-10-19T20:48:42.635Z","title":"bpf: tcp: fix double sock release on batch realloc","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-64574","published":"2026-08-05T08:08:10.272Z","updated":"2026-10-19T20:48:42.499Z","title":"wifi: mac80211: tear down new links on vif update error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-64573","published":"2026-08-05T08:08:09.669Z","updated":"2026-08-19T16:28:52.002Z","title":"Bluetooth: qca: fix NVM tag length underflow in TLV parser","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-64572","published":"2026-08-05T08:08:09.068Z","updated":"2026-08-19T16:28:49.541Z","title":"ipv4: fib: free fib_alias with kfree_rcu() on insert error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-64571","published":"2026-08-05T08:08:08.466Z","updated":"2026-08-19T16:28:46.775Z","title":"wifi: p54: validate RX frame length in p54_rx_eeprom_readback()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-64570","published":"2026-08-05T08:08:07.855Z","updated":"2026-10-19T20:48:42.361Z","title":"wifi: mac80211: fix fils_discovery double free on alloc failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-64569","published":"2026-08-05T08:08:07.233Z","updated":"2026-08-19T16:28:44.216Z","title":"mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-64568","published":"2026-08-05T08:08:06.625Z","updated":"2026-08-17T04:57:46.839Z","title":"wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-64567","published":"2026-08-05T08:08:06.015Z","updated":"2026-10-19T20:48:42.223Z","title":"btrfs: reject free space cache with more entries than pages","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-64566","published":"2026-08-05T08:06:18.645Z","updated":"2026-08-17T04:57:44.387Z","title":"xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2026-64565","published":"2026-08-04T06:23:24.089Z","updated":"2026-08-19T16:28:39.404Z","title":"Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-64564","published":"2026-08-04T06:23:23.339Z","updated":"2026-10-19T20:48:42.076Z","title":"sctp: don't free the ASCONF's own transport in DEL-IP processing","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.01432,"kevAdded":null},{"id":"CVE-2026-64563","published":"2026-08-04T06:23:22.601Z","updated":"2026-10-19T20:48:41.938Z","title":"rhashtable: clear stale iter->p on table restart","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-64562","published":"2026-08-04T06:23:21.855Z","updated":"2026-10-19T20:48:41.796Z","title":"KVM: nVMX: Hide shadow VMCS right after VMCLEAR","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-64561","published":"2026-08-04T06:23:21.094Z","updated":"2026-10-19T20:48:41.652Z","title":"KVM: x86: Check for invalid/obsolete root *after* making MMU pages available","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2022-4994","published":"2026-07-30T09:18:06.591Z","updated":"2026-07-30T09:18:06.591Z","title":"KVM: x86: wean fast IN from emulator_pio_in","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-64560","published":"2026-07-29T16:47:17.602Z","updated":"2026-10-19T20:48:41.511Z","title":"posix-cpu-timers: Prevent UAF caused by non-leader exec() race","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00503,"kevAdded":null},{"id":"CVE-2026-64559","published":"2026-07-29T16:31:22.195Z","updated":"2026-10-19T20:48:41.365Z","title":"s390/pkey: Check length in PKEY_VERIFYPROTK ioctl","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-64558","published":"2026-07-29T16:31:21.591Z","updated":"2026-10-19T20:48:41.175Z","title":"s390/pkey: Check length in pkey_pckmo handler implementation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-64557","published":"2026-07-29T08:01:47.462Z","updated":"2026-10-19T20:48:41.023Z","title":"Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-64556","published":"2026-07-29T08:01:46.864Z","updated":"2026-10-30T12:28:00.037Z","title":"perf/core: Detach event groups during remove_on_exec","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-64555","published":"2026-07-27T20:10:42.259Z","updated":"2026-08-17T04:57:33.289Z","title":"KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64554","published":"2026-07-27T20:10:41.726Z","updated":"2026-10-19T20:48:40.742Z","title":"netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2026-64553","published":"2026-07-27T20:10:41.159Z","updated":"2026-08-17T04:57:30.953Z","title":"net: psample: fix info leak in PSAMPLE_ATTR_DATA","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-64552","published":"2026-07-27T20:10:40.570Z","updated":"2026-10-19T20:48:40.599Z","title":"virtio-net: fix len check in receive_big()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-64551","published":"2026-07-27T20:10:40.012Z","updated":"2026-10-19T20:48:40.456Z","title":"sctp: validate STALE_COOKIE cause length before reading staleness","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-64550","published":"2026-07-27T20:10:39.459Z","updated":"2026-08-17T04:57:27.672Z","title":"net: qualcomm: rmnet: validate MAP frame length before ingress parsing","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-64549","published":"2026-07-27T20:10:38.894Z","updated":"2026-08-17T04:57:26.570Z","title":"Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-64548","published":"2026-07-27T20:10:38.355Z","updated":"2026-10-19T20:48:40.311Z","title":"bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-64547","published":"2026-07-27T20:10:37.786Z","updated":"2026-10-19T20:48:40.168Z","title":"net: usb: net1080: validate packet_len before pad-byte access in rx_fixup","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2026-64546","published":"2026-07-27T20:10:37.217Z","updated":"2026-10-19T20:48:40.025Z","title":"drm/edid: fix OOB read in drm_parse_tiled_block()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-64545","published":"2026-07-27T20:10:36.659Z","updated":"2026-10-19T20:48:39.877Z","title":"net, bpf: check master for NULL in xdp_master_redirect()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00578,"kevAdded":null},{"id":"CVE-2026-64544","published":"2026-07-27T20:10:36.101Z","updated":"2026-08-17T04:57:21.054Z","title":"crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-64543","published":"2026-07-27T20:10:35.565Z","updated":"2026-10-19T20:48:39.735Z","title":"tipc: fix use-after-free of the discoverer in tipc_disc_rcv()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-64542","published":"2026-07-27T20:10:34.994Z","updated":"2026-08-19T16:28:25.885Z","title":"ipv6: ndisc: fix NULL deref in accept_untracked_na()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-64541","published":"2026-07-27T20:10:34.439Z","updated":"2026-10-19T20:48:39.587Z","title":"net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00565,"kevAdded":null},{"id":"CVE-2026-64540","published":"2026-07-27T20:10:33.905Z","updated":"2026-10-19T20:48:39.446Z","title":"usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2026-64539","published":"2026-07-27T20:10:33.363Z","updated":"2026-10-21T12:43:26.591Z","title":"Bluetooth: eir: Fix stack OOB write when prepending the Flags AD","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-64538","published":"2026-07-27T20:10:32.779Z","updated":"2026-10-15T01:23:51.777Z","title":"ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-64537","published":"2026-07-27T20:10:32.210Z","updated":"2026-08-17T04:57:13.368Z","title":"bridge: cfm: reject invalid CCM interval at configuration time","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-64536","published":"2026-07-27T06:36:04.736Z","updated":"2026-10-19T20:48:39.153Z","title":"staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2026-64535","published":"2026-07-27T06:32:34.859Z","updated":"2026-10-19T20:48:39.004Z","title":"nvmet-tcp: Fix potential UAF when ddgst mismatch","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00547,"kevAdded":null},{"id":"CVE-2026-64534","published":"2026-07-27T06:32:34.301Z","updated":"2026-10-19T20:48:38.863Z","title":"nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2026-64533","published":"2026-07-27T06:32:33.740Z","updated":"2026-10-19T20:48:38.720Z","title":"fs/ntfs3: validate lcns_follow in log_replay conversion","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2026-64532","published":"2026-07-27T06:32:33.159Z","updated":"2026-10-19T20:48:38.580Z","title":"fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-64531","published":"2026-07-27T06:32:32.596Z","updated":"2026-10-19T20:48:38.436Z","title":"net: openvswitch: reject oversized nested action attrs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0038,"kevAdded":null},{"id":"CVE-2024-14040","published":"2026-07-26T06:30:17.607Z","updated":"2026-10-30T12:17:41.141Z","title":"net: nexthop: Increase weight to u16","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-64530","published":"2026-07-26T06:28:42.970Z","updated":"2026-10-19T20:48:38.296Z","title":"net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00655,"kevAdded":null},{"id":"CVE-2026-64529","published":"2026-07-25T09:24:18.750Z","updated":"2026-10-19T20:48:38.158Z","title":"crypto: qat - remove unused character device and IOCTLs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-64528","published":"2026-07-25T09:20:51.774Z","updated":"2026-07-25T09:20:51.774Z","title":"tty: serial: samsung: Remove redundant port lock acquisition in rx helpers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-64527","published":"2026-07-25T09:20:51.078Z","updated":"2026-07-25T09:20:51.078Z","title":"drm/hyperv: validate VMBus packet size in receive callback","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-64526","published":"2026-07-25T09:20:50.394Z","updated":"2026-07-25T09:20:50.394Z","title":"ethtool: tsconfig: fix missing ethnl_ops_complete()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-64525","published":"2026-07-25T09:20:49.256Z","updated":"2026-10-30T12:27:58.969Z","title":"xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-64524","published":"2026-07-25T09:20:48.193Z","updated":"2026-10-19T20:48:38.013Z","title":"drm/hyperv: validate resolution_count and fix WIN8 fallback","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-64523","published":"2026-07-25T09:20:47.606Z","updated":"2026-10-21T12:43:25.473Z","title":"net/handshake: Take a long-lived file reference at submit","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0045,"kevAdded":null},{"id":"CVE-2026-64522","published":"2026-07-25T09:14:47.404Z","updated":"2026-10-19T20:48:37.735Z","title":"net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00512,"kevAdded":null},{"id":"CVE-2026-64521","published":"2026-07-25T09:14:46.709Z","updated":"2026-07-25T09:14:46.709Z","title":"pinctrl: meson: amlogic-a4: fix deadlock issue","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-64520","published":"2026-07-25T09:14:46.005Z","updated":"2026-08-05T12:42:34.515Z","title":"firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-64519","published":"2026-07-25T09:14:45.322Z","updated":"2026-07-25T09:14:45.322Z","title":"NFSD: Fix infinite loop in layout state revocation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-64518","published":"2026-07-25T09:14:44.603Z","updated":"2026-07-25T09:14:44.603Z","title":"tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-64517","published":"2026-07-25T09:14:43.863Z","updated":"2026-07-25T09:14:43.863Z","title":"drm/xe/gsc: Fix double-free of managed BO in error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-64516","published":"2026-07-25T09:14:43.142Z","updated":"2026-08-05T12:42:33.445Z","title":"drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-64515","published":"2026-07-25T09:14:42.418Z","updated":"2026-10-19T20:48:37.591Z","title":"wifi: mac80211: fix MLE defragmentation","severity":"HIGH","score":8.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2026-64514","published":"2026-07-25T08:52:05.878Z","updated":"2026-08-17T04:57:05.592Z","title":"userfaultfd: gate must_wait writability check on pte_present()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-64513","published":"2026-07-25T08:52:05.119Z","updated":"2026-10-21T12:43:24.391Z","title":"KVM: x86: Unconditionally recompute CR8 intercept on PPR update","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-64512","published":"2026-07-25T08:52:04.423Z","updated":"2026-08-17T04:57:03.207Z","title":"ACPI: CPPC: Suppress UBSAN warning caused by field misuse","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-64511","published":"2026-07-25T08:52:03.818Z","updated":"2026-08-17T04:57:02.104Z","title":"ACPI: NFIT: core: Fix possible NULL pointer dereference","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-64510","published":"2026-07-25T08:52:03.208Z","updated":"2026-10-19T20:48:37.449Z","title":"ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2026-64509","published":"2026-07-25T08:52:02.486Z","updated":"2026-08-17T04:56:59.904Z","title":"rust: block: fix GenDisk cleanup paths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-64508","published":"2026-07-25T08:52:01.732Z","updated":"2026-08-19T16:28:20.972Z","title":"bpf: Support for hardening against JIT spraying","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-64507","published":"2026-07-25T08:52:01.008Z","updated":"2026-08-19T16:28:18.513Z","title":"x86/bugs: Enable IBPB flush on BPF JIT allocation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-64506","published":"2026-07-25T08:52:00.322Z","updated":"2026-08-17T04:56:56.610Z","title":"wifi: rtw89: correct drop logic for malformed AMPDU frames","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-64505","published":"2026-07-25T08:51:59.618Z","updated":"2026-08-17T04:56:55.519Z","title":"usb: gadget: function: rndis: add length check for header","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-64504","published":"2026-07-25T08:51:58.887Z","updated":"2026-08-17T04:56:54.396Z","title":"iio: accel: bmc150: clamp the device-reported FIFO frame count","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-64503","published":"2026-07-25T08:51:58.186Z","updated":"2026-08-17T04:56:53.290Z","title":"iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-64502","published":"2026-07-25T08:51:57.477Z","updated":"2026-08-17T04:56:52.172Z","title":"iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-64501","published":"2026-07-25T08:51:56.768Z","updated":"2026-08-17T04:56:51.067Z","title":"iio: adc: ad_sigma_delta: fix CS held asserted and state leaks","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-64500","published":"2026-07-25T08:51:56.053Z","updated":"2026-08-17T04:56:49.966Z","title":"iio: adc: lpc32xx: Initialize completion before requesting IRQ","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-64499","published":"2026-07-25T08:51:55.336Z","updated":"2026-08-17T04:56:48.117Z","title":"iio: adc: ti-ads1119: fix PM reference leak in buffer preenable","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-64498","published":"2026-07-25T08:51:54.625Z","updated":"2026-08-17T04:56:47.022Z","title":"iio: buffer: hw-consumer: free scan_mask on buffer release","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-64497","published":"2026-07-25T08:51:53.917Z","updated":"2026-08-17T04:56:45.940Z","title":"iio: chemical: scd30: Cleanup initializations and fix sign-extension bug","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-64496","published":"2026-07-25T08:51:53.194Z","updated":"2026-10-19T20:48:37.305Z","title":"iio: event: Fix event FIFO reset race","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64495","published":"2026-07-25T08:51:52.468Z","updated":"2026-08-17T04:56:43.712Z","title":"iio: gyro: bmg160: bail out when bandwidth/filter is not in table","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-64494","published":"2026-07-25T08:51:51.747Z","updated":"2026-08-17T04:56:42.612Z","title":"iio: light: gp2ap002: fix runtime PM leak on read error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-64493","published":"2026-07-25T08:51:51.036Z","updated":"2026-08-17T04:56:41.512Z","title":"iio: pressure: mpl115: fix runtime PM leak on read error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-64492","published":"2026-07-25T08:51:50.313Z","updated":"2026-08-17T04:56:40.394Z","title":"iio: temperature: tmp006: use devm_iio_trigger_register","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-64491","published":"2026-07-25T08:51:49.601Z","updated":"2026-08-17T04:56:39.296Z","title":"ALSA: usx2y: us144mkii: fix work UAF on disconnect","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-64490","published":"2026-07-25T08:51:48.877Z","updated":"2026-10-19T20:48:37.167Z","title":"ALSA: virtio: Validate control metadata from the device","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2026-64489","published":"2026-07-25T08:51:48.161Z","updated":"2026-08-17T04:56:37.102Z","title":"ALSA: ymfpci: check snd_ctl_new1() return value","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-64488","published":"2026-07-25T08:51:47.436Z","updated":"2026-08-17T04:56:35.958Z","title":"ALSA: aoa: check snd_ctl_new1() return value","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-64487","published":"2026-07-25T08:51:46.711Z","updated":"2026-08-17T04:56:34.866Z","title":"ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-64486","published":"2026-07-25T08:51:45.982Z","updated":"2026-08-17T04:56:33.629Z","title":"ALSA: cmipci: check snd_ctl_new1() return value","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-64485","published":"2026-07-25T08:51:45.301Z","updated":"2026-10-19T20:48:37.025Z","title":"ALSA: compress: Fix task creation error unwind","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-64484","published":"2026-07-25T08:51:44.591Z","updated":"2026-08-17T04:56:31.383Z","title":"ALSA: es1938: check snd_ctl_new1() return value","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-64483","published":"2026-07-25T08:51:43.851Z","updated":"2026-08-17T04:56:30.281Z","title":"ALSA: firewire: isight: bound the sample count to the packet payload","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-64482","published":"2026-07-25T08:51:43.128Z","updated":"2026-08-17T04:56:29.187Z","title":"ALSA: gus: check snd_ctl_new1() return value","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-64481","published":"2026-07-25T08:51:42.430Z","updated":"2026-10-30T12:27:57.910Z","title":"ALSA: hda/cs35l41: Fix firmware load work teardown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-64480","published":"2026-07-25T08:51:41.691Z","updated":"2026-08-17T04:56:26.964Z","title":"ALSA: ice1712: check snd_ctl_new1() return value","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-64479","published":"2026-07-25T08:51:41.006Z","updated":"2026-08-17T04:56:25.868Z","title":"ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-64478","published":"2026-07-25T08:51:40.299Z","updated":"2026-08-17T04:56:24.788Z","title":"ALSA: usb-audio: avoid kobject path lookup in DualSense match","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-64477","published":"2026-07-25T08:51:39.558Z","updated":"2026-08-17T04:56:23.686Z","title":"x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-64476","published":"2026-07-25T08:51:38.865Z","updated":"2026-08-17T04:56:22.585Z","title":"vfio/pci: Latch disable_idle_d3 per device","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-64475","published":"2026-07-25T08:51:38.154Z","updated":"2026-10-19T20:48:36.746Z","title":"vfio/pci: Release the VGA arbiter client on register_device() failure","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-64474","published":"2026-07-25T08:51:37.405Z","updated":"2026-08-17T04:56:20.392Z","title":"vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-64473","published":"2026-07-25T08:51:36.702Z","updated":"2026-08-17T04:56:19.303Z","title":"vfio: Remove device debugfs before releasing devres","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-64472","published":"2026-07-25T08:51:35.978Z","updated":"2026-08-17T04:56:18.199Z","title":"vfio/mlx5: Fix racy bitfields and tighten struct layout","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-64471","published":"2026-07-25T08:51:35.245Z","updated":"2026-08-17T04:56:17.111Z","title":"Bluetooth: btusb: fix use-after-free on registration failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-64470","published":"2026-07-25T08:51:34.673Z","updated":"2026-08-17T04:56:16.023Z","title":"Bluetooth: btusb: fix use-after-free on marvell probe failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-64469","published":"2026-07-25T08:51:34.025Z","updated":"2026-08-17T04:56:14.927Z","title":"binder: fix UAF in binder_thread_release()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-64468","published":"2026-07-25T08:51:33.364Z","updated":"2026-08-17T04:56:13.826Z","title":"binder: fix UAF in binder_free_transaction()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-64467","published":"2026-07-25T08:51:32.626Z","updated":"2026-08-17T04:56:12.747Z","title":"rust_binder: use a u64 stride when cleaning up the offsets array","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-64466","published":"2026-07-25T08:51:31.887Z","updated":"2026-08-17T04:56:11.640Z","title":"rust_binder: clear freeze listener on node removal","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-64465","published":"2026-07-25T08:51:31.160Z","updated":"2026-08-17T04:56:10.537Z","title":"usb: xhci: Fix sleep in atomic context in xhci_free_streams()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-64464","published":"2026-07-25T08:51:30.443Z","updated":"2026-08-17T04:56:09.419Z","title":"xhci: sideband: fix ring sg table pages leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-64463","published":"2026-07-25T08:51:29.720Z","updated":"2026-10-30T12:27:56.849Z","title":"usb: typec: tcpci_rt1711h: unregister TCPCI port with devres","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-64462","published":"2026-07-25T08:51:29.013Z","updated":"2026-08-17T04:56:07.206Z","title":"PCI: altera: Fix resource leaks on probe failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-64461","published":"2026-07-25T08:51:28.309Z","updated":"2026-08-17T04:56:06.127Z","title":"PCI: mediatek: Fix IRQ domain leak when port fails to enable","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-64460","published":"2026-07-25T08:51:27.568Z","updated":"2026-10-19T20:38:30.737Z","title":"PCI/IOV: Skip VF Resizable BAR restore on read error","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2026-64459","published":"2026-07-25T08:51:26.879Z","updated":"2026-08-17T04:56:03.943Z","title":"tcp: restore RCU grace period in tcp_ao_destroy_sock","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00649,"kevAdded":null},{"id":"CVE-2026-64458","published":"2026-07-25T08:51:26.072Z","updated":"2026-08-17T04:56:02.857Z","title":"mm/damon/ops-common: handle extreme intervals in damon_hot_score()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-64457","published":"2026-07-25T08:51:25.364Z","updated":"2026-08-17T04:56:01.747Z","title":"virtio_pci: fix vq info pointer lookup via wrong index","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-64456","published":"2026-07-25T08:51:24.659Z","updated":"2026-10-19T20:38:30.595Z","title":"hwrng: virtio: clamp device-reported used.len at copy_data()","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2026-64455","published":"2026-07-25T08:51:23.952Z","updated":"2026-08-17T04:55:59.518Z","title":"USB: chaoskey: Fix slab-use-after-free in chaoskey_release()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-64454","published":"2026-07-25T08:51:23.212Z","updated":"2026-08-17T04:55:58.408Z","title":"usb: dwc3: run gadget disconnect from sleepable suspend context","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-64453","published":"2026-07-25T08:51:22.478Z","updated":"2026-08-17T04:55:57.317Z","title":"usb: misc: usbio: fix disconnect UAF in client teardown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-64452","published":"2026-07-25T08:51:21.754Z","updated":"2026-10-19T20:38:30.450Z","title":"6lowpan: fix NHC entry use-after-free on error path","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-64451","published":"2026-07-25T08:51:21.020Z","updated":"2026-08-17T04:55:55.128Z","title":"tracing: Fix NULL pointer dereference in func_set_flag()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-64450","published":"2026-07-25T08:51:20.319Z","updated":"2026-10-19T20:38:30.286Z","title":"tipc: fix out-of-bounds read in broadcast Gap ACK blocks","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00537,"kevAdded":null},{"id":"CVE-2026-64449","published":"2026-07-25T08:51:19.537Z","updated":"2026-08-17T04:55:52.942Z","title":"staging: vme_user: bound slave read/write to the kern_buf size","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-64448","published":"2026-07-25T08:51:18.796Z","updated":"2026-10-19T20:38:30.137Z","title":"smb: client: restrict implied bcc[0] exemption to responses without data area","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00463,"kevAdded":null},{"id":"CVE-2026-64447","published":"2026-07-25T08:51:18.096Z","updated":"2026-08-17T04:55:50.059Z","title":"staging: media: ipu7: fix double-free and use-after-free in error paths","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-64446","published":"2026-07-25T08:51:17.402Z","updated":"2026-08-17T04:55:48.878Z","title":"staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-64445","published":"2026-07-25T08:51:16.670Z","updated":"2026-10-19T20:38:29.983Z","title":"staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2026-64444","published":"2026-07-25T08:51:15.968Z","updated":"2026-10-30T12:27:55.777Z","title":"staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-64443","published":"2026-07-25T08:51:15.234Z","updated":"2026-10-19T20:38:29.673Z","title":"staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2026-64442","published":"2026-07-25T08:51:14.535Z","updated":"2026-10-19T20:38:29.506Z","title":"staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-64441","published":"2026-07-25T08:51:13.834Z","updated":"2026-10-19T20:38:29.338Z","title":"staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2026-64440","published":"2026-07-25T08:51:13.138Z","updated":"2026-10-19T20:38:29.179Z","title":"staging: rtl8723bs: fix OOB write in HT_caps_handler()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2026-64439","published":"2026-07-25T08:51:12.422Z","updated":"2026-08-17T04:55:40.947Z","title":"crypto: krb5 - filter out async aead implementations at alloc","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2026-64438","published":"2026-07-25T08:51:11.740Z","updated":"2026-10-19T20:38:29.035Z","title":"crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-64437","published":"2026-07-25T08:51:11.072Z","updated":"2026-08-17T04:55:38.646Z","title":"ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2026-64436","published":"2026-07-25T08:51:10.370Z","updated":"2026-10-19T20:38:28.893Z","title":"net: af_key: initialize alg_key_len for IPComp states","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-64435","published":"2026-07-25T08:51:09.688Z","updated":"2026-10-19T20:38:28.743Z","title":"audit: Fix data races of skb_queue_len() readers on audit_queue","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2026-64434","published":"2026-07-25T08:51:09.066Z","updated":"2026-10-19T20:38:28.580Z","title":"Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2026-64433","published":"2026-07-25T08:51:08.432Z","updated":"2026-08-17T04:55:34.241Z","title":"Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-64432","published":"2026-07-25T08:51:07.791Z","updated":"2026-10-19T20:38:28.427Z","title":"fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-64431","published":"2026-07-25T08:51:07.194Z","updated":"2026-08-17T04:55:32.047Z","title":"ntfs: avoid calling post_write_mst_fixup() for invalid index_block","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-64430","published":"2026-07-25T08:51:06.612Z","updated":"2026-08-17T04:55:30.939Z","title":"NTB: epf: Avoid calling pci_irq_vector() from hardirq context","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0049,"kevAdded":null},{"id":"CVE-2026-64429","published":"2026-07-25T08:51:06.016Z","updated":"2026-08-17T04:55:29.849Z","title":"gpio: eic-sprd: use raw_spinlock_t in the irq startup path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-64428","published":"2026-07-25T08:51:05.460Z","updated":"2026-08-17T04:55:28.748Z","title":"gpio: sch: use raw_spinlock_t in the irq startup path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64427","published":"2026-07-25T08:51:04.686Z","updated":"2026-08-19T16:28:13.596Z","title":"HID: logitech-dj: Fix maxfield check in DJ short report validation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64426","published":"2026-07-25T08:51:03.867Z","updated":"2026-08-17T04:55:26.542Z","title":"io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64425","published":"2026-07-25T08:51:03.036Z","updated":"2026-10-15T01:23:50.155Z","title":"io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64424","published":"2026-07-25T08:51:02.276Z","updated":"2026-10-30T12:27:54.711Z","title":"netpoll: fix a use-after-free on shutdown path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-64423","published":"2026-07-25T08:51:01.485Z","updated":"2026-10-19T20:38:28.280Z","title":"ipv4: igmp: remove multicast group from hash table on device destruction","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-64422","published":"2026-07-25T08:51:00.671Z","updated":"2026-10-19T20:38:28.132Z","title":"net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-64421","published":"2026-07-25T08:50:59.926Z","updated":"2026-08-17T04:55:21.058Z","title":"media: nxp: imx8-isi: Fix use-after-free on remove","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-64420","published":"2026-07-25T08:50:59.115Z","updated":"2026-10-19T20:38:27.984Z","title":"mfd: cros_ec: Delay dev_set_drvdata() until probe success","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-64419","published":"2026-07-25T08:50:58.342Z","updated":"2026-08-17T04:55:18.870Z","title":"mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64418","published":"2026-07-25T08:50:57.594Z","updated":"2026-08-17T04:55:17.788Z","title":"mm: shrinker: fix shrinker_info teardown race with expansion","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00097,"kevAdded":null},{"id":"CVE-2026-64417","published":"2026-07-25T08:50:56.800Z","updated":"2026-08-17T04:55:16.708Z","title":"mm: shrinker: fix NULL pointer dereference in debugfs","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64416","published":"2026-07-25T08:50:55.997Z","updated":"2026-08-17T04:55:15.618Z","title":"mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-64415","published":"2026-07-25T08:50:55.226Z","updated":"2026-08-17T04:55:14.532Z","title":"mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00094,"kevAdded":null},{"id":"CVE-2026-64414","published":"2026-07-25T08:50:54.495Z","updated":"2026-08-17T04:55:13.439Z","title":"netfilter: handle unreadable frags","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00441,"kevAdded":null},{"id":"CVE-2026-64413","published":"2026-07-25T08:50:53.759Z","updated":"2026-10-19T20:38:27.843Z","title":"netfilter: ebtables: zero chainstack array","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-64412","published":"2026-07-25T08:50:52.946Z","updated":"2026-10-19T20:38:27.704Z","title":"netfilter: ebtables: module names must be null-terminated","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-64411","published":"2026-07-25T08:50:52.143Z","updated":"2026-10-19T20:38:27.565Z","title":"netfilter: ebtables: terminate table name before find_table_lock()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-64410","published":"2026-07-25T08:50:51.377Z","updated":"2026-08-17T04:55:08.961Z","title":"netfilter: flowtable: IPIP tunnel hardware offload is not yet support","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-64409","published":"2026-07-25T08:50:50.604Z","updated":"2026-08-17T04:55:07.875Z","title":"Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64408","published":"2026-07-25T08:50:49.807Z","updated":"2026-10-19T20:38:27.425Z","title":"Bluetooth: bnep: pin L2CAP connection during netdev registration","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2026-64407","published":"2026-07-25T08:50:48.912Z","updated":"2026-08-17T04:55:05.687Z","title":"Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-64406","published":"2026-07-25T08:50:47.978Z","updated":"2026-10-19T20:38:27.281Z","title":"Bluetooth: fix UAF in bt_accept_dequeue()","severity":"HIGH","score":8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2026-64405","published":"2026-07-25T08:50:47.262Z","updated":"2026-08-17T04:55:03.466Z","title":"Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-64404","published":"2026-07-25T08:50:46.523Z","updated":"2026-08-17T04:55:02.350Z","title":"Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-64403","published":"2026-07-25T08:50:45.796Z","updated":"2026-10-19T20:38:27.125Z","title":"Bluetooth: L2CAP: validate option length before reading conf opt value","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-64402","published":"2026-07-25T08:50:45.075Z","updated":"2026-08-17T04:55:00.113Z","title":"coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64401","published":"2026-07-25T08:50:44.361Z","updated":"2026-10-19T20:38:26.985Z","title":"smb: client: resolve SWN tcon from live registrations","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-64400","published":"2026-07-25T08:50:43.655Z","updated":"2026-10-30T12:27:53.511Z","title":"ksmbd: prevent path traversal bypass by restricting caseless retry","severity":"HIGH","score":8.6,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00639,"kevAdded":null},{"id":"CVE-2026-64399","published":"2026-07-25T08:50:42.925Z","updated":"2026-08-17T04:54:56.640Z","title":"ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00491,"kevAdded":null},{"id":"CVE-2026-64398","published":"2026-07-25T08:50:42.221Z","updated":"2026-08-17T04:54:54.292Z","title":"ksmbd: add a permission check for FSCTL_SET_ZERO_DATA","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00464,"kevAdded":null},{"id":"CVE-2026-64397","published":"2026-07-25T08:50:41.620Z","updated":"2026-08-17T04:54:51.854Z","title":"ksmbd: serialize QUERY_DIRECTORY requests per file","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00477,"kevAdded":null},{"id":"CVE-2026-64396","published":"2026-07-25T08:50:40.993Z","updated":"2026-08-17T04:54:50.101Z","title":"ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2026-64395","published":"2026-07-25T08:50:40.393Z","updated":"2026-08-17T04:54:49.007Z","title":"ksmbd: require source read access for duplicate extents","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00406,"kevAdded":null},{"id":"CVE-2026-64394","published":"2026-07-25T08:50:39.797Z","updated":"2026-08-17T04:54:47.889Z","title":"ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0047,"kevAdded":null},{"id":"CVE-2026-64393","published":"2026-07-25T08:50:39.239Z","updated":"2026-08-17T04:54:46.744Z","title":"ksmbd: run set info with opener credentials","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-64392","published":"2026-07-25T08:50:38.634Z","updated":"2026-10-30T12:27:52.436Z","title":"ksmbd: use opener credentials for delete-on-close","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00509,"kevAdded":null},{"id":"CVE-2026-64391","published":"2026-07-25T08:50:38.013Z","updated":"2026-10-30T12:27:51.381Z","title":"ksmbd: use opener credentials for ADS I/O","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00491,"kevAdded":null},{"id":"CVE-2026-64390","published":"2026-07-25T08:50:37.406Z","updated":"2026-08-17T04:54:42.740Z","title":"ksmbd: track the connection owning a byte-range lock","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-64389","published":"2026-07-25T08:50:36.817Z","updated":"2026-10-30T12:27:50.295Z","title":"ksmbd: validate NTLMv2 response before updating session key","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00485,"kevAdded":null},{"id":"CVE-2026-64388","published":"2026-07-25T08:50:36.202Z","updated":"2026-10-30T12:27:49.236Z","title":"smb/client: fix chown/chgrp with SMB3 POSIX Extensions","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-64387","published":"2026-07-25T08:50:35.543Z","updated":"2026-10-19T20:38:26.713Z","title":"smb: client: fix query directory replay double-free","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00457,"kevAdded":null},{"id":"CVE-2026-64386","published":"2026-07-25T08:50:34.729Z","updated":"2026-10-19T20:38:26.574Z","title":"smb: client: fix query_info() replay double-free","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00457,"kevAdded":null},{"id":"CVE-2026-64385","published":"2026-07-25T08:50:33.997Z","updated":"2026-10-19T20:38:26.437Z","title":"smb: client: fix double-free in SMB2_ioctl() replay","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00457,"kevAdded":null},{"id":"CVE-2026-64384","published":"2026-07-25T08:50:33.306Z","updated":"2026-10-19T20:38:26.294Z","title":"smb: client: fix change notify replay double-free","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00457,"kevAdded":null},{"id":"CVE-2026-64383","published":"2026-07-25T08:50:32.634Z","updated":"2026-10-19T20:38:26.139Z","title":"smb: client: fix double-free in SMB2_flush() replay","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00457,"kevAdded":null},{"id":"CVE-2026-64382","published":"2026-07-25T08:50:31.937Z","updated":"2026-10-19T20:38:25.998Z","title":"smb: client: fix double-free in SMB2_open() replay","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00354,"kevAdded":null},{"id":"CVE-2026-64381","published":"2026-07-25T08:50:31.209Z","updated":"2026-08-17T04:54:32.853Z","title":"smb: client: Fix next buffer leak in receive_encrypted_standard()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64380","published":"2026-07-25T08:50:30.476Z","updated":"2026-10-19T20:38:25.851Z","title":"smb: client: harden POSIX SID length parsing","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00443,"kevAdded":null},{"id":"CVE-2026-64379","published":"2026-07-25T08:50:29.717Z","updated":"2026-10-19T20:38:25.713Z","title":"smb: client: mask server-provided mode to 07777 in modefromsid","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00309,"kevAdded":null},{"id":"CVE-2026-64378","published":"2026-07-25T08:50:29.006Z","updated":"2026-10-19T20:38:25.561Z","title":"writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-64377","published":"2026-07-25T08:50:28.299Z","updated":"2026-10-21T12:43:17.811Z","title":"cpufreq: qcom-cpufreq-hw: Fix possible double free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64376","published":"2026-07-25T08:50:27.577Z","updated":"2026-08-17T04:54:27.297Z","title":"firmware_loader: fix device reference leak in firmware_upload_register()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64375","published":"2026-07-25T08:50:26.869Z","updated":"2026-10-19T20:38:25.420Z","title":"proc: protect ptrace_may_access() with exec_update_lock (FD links)","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00105,"kevAdded":null},{"id":"CVE-2026-64374","published":"2026-07-25T08:50:26.130Z","updated":"2026-10-19T20:38:25.279Z","title":"sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00387,"kevAdded":null},{"id":"CVE-2026-64373","published":"2026-07-25T08:50:25.427Z","updated":"2026-08-17T04:54:23.307Z","title":"cpufreq: Fix hotplug-suspend race during reboot","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00089,"kevAdded":null},{"id":"CVE-2026-64372","published":"2026-07-25T08:50:24.733Z","updated":"2026-10-19T20:38:25.140Z","title":"cpufreq: pcc: fix use-after-free and double free in _OSC evaluation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-64371","published":"2026-07-25T08:50:23.981Z","updated":"2026-10-15T01:23:38.736Z","title":"proc: protect ptrace_may_access() with exec_update_lock (part 1)","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64370","published":"2026-07-25T08:50:23.257Z","updated":"2026-10-15T01:23:37.127Z","title":"posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64369","published":"2026-07-25T08:50:22.543Z","updated":"2026-08-17T04:54:18.866Z","title":"s390: Revert support for DCACHE_WORD_ACCESS","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-64368","published":"2026-07-25T08:50:21.831Z","updated":"2026-10-19T20:38:24.997Z","title":"mm/slab: do not limit zeroing to orig_size when only red zoning is enabled","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-64367","published":"2026-07-25T08:50:21.214Z","updated":"2026-08-17T04:54:16.646Z","title":"HID: hid-goodix-spi: validate report size to prevent stack buffer overflow","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-64366","published":"2026-07-25T08:50:20.612Z","updated":"2026-10-19T20:38:24.864Z","title":"HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2026-64365","published":"2026-07-25T08:50:20.039Z","updated":"2026-08-17T04:54:13.108Z","title":"HID: letsketch: fix UAF on inrange_timer at driver unbind","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64364","published":"2026-07-25T08:50:19.441Z","updated":"2026-10-19T20:38:24.727Z","title":"HID: multitouch: fix out-of-bounds bit access on mt_io_flags","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00355,"kevAdded":null},{"id":"CVE-2026-64363","published":"2026-07-25T08:50:18.824Z","updated":"2026-08-17T04:54:10.084Z","title":"HID: appleir: fix UAF on pending key_up_timer in remove()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-64362","published":"2026-07-25T08:50:18.008Z","updated":"2026-08-17T04:54:08.962Z","title":"HID: lg-g15: cancel pending work on remove to fix a use-after-free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-64361","published":"2026-07-25T08:50:17.345Z","updated":"2026-08-17T04:54:07.849Z","title":"hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64360","published":"2026-07-25T08:50:16.573Z","updated":"2026-08-17T04:54:06.743Z","title":"hfs/hfsplus: zero-initialize buffer in hfs_bnode_read","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64359","published":"2026-07-25T08:50:15.947Z","updated":"2026-08-17T04:54:05.599Z","title":"nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64358","published":"2026-07-25T08:50:15.303Z","updated":"2026-08-17T04:54:04.458Z","title":"media: mtk-jpeg: cancel workqueue on release for supported platforms only","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-64357","published":"2026-07-25T08:50:14.676Z","updated":"2026-08-17T04:54:03.348Z","title":"xfs: fix exchmaps reservation limit check","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-64356","published":"2026-07-25T08:50:14.049Z","updated":"2026-08-17T04:54:02.246Z","title":"xfs: fix memory leak in xfs_dqinode_metadir_create()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-64355","published":"2026-07-25T08:50:13.410Z","updated":"2026-10-19T20:38:24.590Z","title":"bpf: Reject fragmented frames in devmap","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00513,"kevAdded":null},{"id":"CVE-2026-64354","published":"2026-07-25T08:50:12.752Z","updated":"2026-10-19T20:38:24.454Z","title":"bpf: Validate BTF repeated field counts before expansion","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64353","published":"2026-07-25T08:50:12.120Z","updated":"2026-08-17T04:53:58.950Z","title":"bpf: Keep dynamic inner array lookups nullable","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64352","published":"2026-07-25T08:50:11.522Z","updated":"2026-08-17T04:53:57.862Z","title":"bpf: Allow LPM map access from sleepable BPF programs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64351","published":"2026-07-25T08:50:10.882Z","updated":"2026-08-17T04:53:56.750Z","title":"net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-64350","published":"2026-07-25T08:50:10.270Z","updated":"2026-08-17T04:53:55.657Z","title":"usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64349","published":"2026-07-25T08:50:09.647Z","updated":"2026-08-17T04:53:54.541Z","title":"usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-64348","published":"2026-07-25T08:50:08.983Z","updated":"2026-10-30T12:27:48.179Z","title":"usb: free iso schedules on failed submit","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64347","published":"2026-07-25T08:50:08.338Z","updated":"2026-08-17T04:53:52.339Z","title":"usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-64346","published":"2026-07-25T08:50:07.680Z","updated":"2026-08-17T04:53:51.249Z","title":"usb: gadget: udc: Fix use-after-free in gadget_match_driver","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-64345","published":"2026-07-25T08:50:07.069Z","updated":"2026-10-30T12:27:47.119Z","title":"usb: gadget: f_printer: take kref only for successful open","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64344","published":"2026-07-25T08:50:06.461Z","updated":"2026-08-17T04:53:48.283Z","title":"USB: idmouse: fix use-after-free on disconnect race","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-64343","published":"2026-07-25T08:50:05.828Z","updated":"2026-08-17T04:53:47.172Z","title":"USB: ldusb: fix use-after-free on disconnect race","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-64342","published":"2026-07-25T08:50:05.169Z","updated":"2026-08-17T04:53:46.066Z","title":"USB: iowarrior: fix use-after-free on disconnect","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-64341","published":"2026-07-25T08:50:04.512Z","updated":"2026-10-30T12:27:46.059Z","title":"USB: iowarrior: fix use-after-free on disconnect race","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-64340","published":"2026-07-25T08:50:03.896Z","updated":"2026-08-17T04:53:43.875Z","title":"USB: legousbtower: fix use-after-free on disconnect race","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-64339","published":"2026-07-25T08:50:03.272Z","updated":"2026-08-17T04:53:42.778Z","title":"usb: misc: usbio: bound bulk IN response length to the received transfer","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-64338","published":"2026-07-25T08:50:02.673Z","updated":"2026-08-17T04:53:41.636Z","title":"USB: misc: uss720: unregister parport on probe failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64337","published":"2026-07-25T08:50:02.066Z","updated":"2026-08-17T04:53:40.517Z","title":"usb: mtu3: unmap request DMA on queue failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64336","published":"2026-07-25T08:50:01.444Z","updated":"2026-09-14T11:58:39.667Z","title":"USB: serial: keyspan_pda: fix information leak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64335","published":"2026-07-25T08:50:00.835Z","updated":"2026-08-17T04:53:38.295Z","title":"USB: serial: digi_acceleport: fix broken rx after throttle","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64334","published":"2026-07-25T08:50:00.229Z","updated":"2026-08-17T04:53:37.202Z","title":"USB: serial: digi_acceleport: fix hard lockup on disconnect","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-64333","published":"2026-07-25T08:49:59.616Z","updated":"2026-10-19T20:38:24.312Z","title":"USB: serial: digi_acceleport: fix write buffer corruption","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-64332","published":"2026-07-25T08:49:59.005Z","updated":"2026-08-17T04:53:35.002Z","title":"USB: ulpi: fix memory leak on registration failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64331","published":"2026-07-25T08:49:58.370Z","updated":"2026-08-17T04:53:33.891Z","title":"usbip: vudc: fix NULL deref in vep_dequeue()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64330","published":"2026-07-25T08:49:57.734Z","updated":"2026-08-17T04:53:32.777Z","title":"usb: typec: tcpm: Validate SVID index in svdm_consume_modes()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64329","published":"2026-07-25T08:49:57.098Z","updated":"2026-08-17T04:53:31.661Z","title":"usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-64328","published":"2026-07-25T08:49:56.340Z","updated":"2026-08-17T04:53:30.558Z","title":"usb: gadget: f_fs: Fix DMA fence leak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-64327","published":"2026-07-25T08:49:55.426Z","updated":"2026-08-17T04:53:29.409Z","title":"usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-64326","published":"2026-07-25T08:49:54.327Z","updated":"2026-08-17T04:53:28.310Z","title":"block: skip sync_blockdev() on surprise removal in bdev_mark_dead()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-64325","published":"2026-07-25T08:49:53.238Z","updated":"2026-10-15T10:08:09.458Z","title":"wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64324","published":"2026-07-25T08:49:52.063Z","updated":"2026-10-19T20:38:24.164Z","title":"udf: validate free block extents against the partition length","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-64323","published":"2026-07-25T08:49:51.097Z","updated":"2026-10-19T20:38:24.010Z","title":"udf: validate VAT header length against the VAT inode size","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-64322","published":"2026-07-25T08:49:50.180Z","updated":"2026-10-19T20:38:23.865Z","title":"udf: validate sparing table length as an entry count, not a byte count","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-64321","published":"2026-07-25T08:49:49.541Z","updated":"2026-09-14T11:58:38.599Z","title":"nvme: target: rdma: fix ndev refcount leak on queue connect","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64320","published":"2026-07-25T08:49:48.908Z","updated":"2026-10-30T12:27:44.977Z","title":"nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00803,"kevAdded":null},{"id":"CVE-2026-64319","published":"2026-07-25T08:49:48.291Z","updated":"2026-10-30T12:27:43.881Z","title":"nvmet-auth: validate reply message payload bounds against transfer length","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00563,"kevAdded":null},{"id":"CVE-2026-64318","published":"2026-07-25T08:49:47.690Z","updated":"2026-08-17T04:53:18.783Z","title":"partitions: aix: bound the pp_count scan to the ppe array","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-64317","published":"2026-07-25T08:49:47.067Z","updated":"2026-10-19T20:38:23.435Z","title":"isofs: bound Rock Ridge symlink components to the SL record","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-64316","published":"2026-07-25T08:49:46.415Z","updated":"2026-08-17T04:53:16.580Z","title":"crypto: caam - use print_hex_dump_devel to guard key hex dumps","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64315","published":"2026-07-25T08:49:45.787Z","updated":"2026-08-17T04:53:15.471Z","title":"crypto: caam - use print_hex_dump_devel to guard key hex dumps","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2026-64314","published":"2026-07-25T08:49:45.170Z","updated":"2026-08-17T04:53:14.370Z","title":"crypto: chacha20poly1305 - validate poly1305 template argument","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64313","published":"2026-07-25T08:49:44.546Z","updated":"2026-10-19T20:38:23.266Z","title":"crypto: ecc - Fix carry overflow in vli multiplication","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00355,"kevAdded":null},{"id":"CVE-2026-64312","published":"2026-07-25T08:49:43.940Z","updated":"2026-10-19T20:38:23.127Z","title":"crypto: pcrypt - restore callback for non-parallel fallback","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-64311","published":"2026-07-25T08:49:43.318Z","updated":"2026-08-17T04:53:10.994Z","title":"crypto: loongson - Remove broken and unused loongson-rng","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-64310","published":"2026-07-25T08:49:42.683Z","updated":"2026-08-17T04:53:09.879Z","title":"crypto: ccp - Do not initialize SNP for SEV ioctls","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-64309","published":"2026-07-25T08:49:42.035Z","updated":"2026-08-17T04:53:08.770Z","title":"crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-64308","published":"2026-07-25T08:49:41.411Z","updated":"2026-08-17T04:53:07.657Z","title":"crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-64307","published":"2026-07-25T08:49:40.782Z","updated":"2026-08-17T04:53:06.569Z","title":"crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-64306","published":"2026-07-25T08:49:40.153Z","updated":"2026-08-17T04:53:05.476Z","title":"crypto: drbg - Fix returning success on failure in CTR_DRBG","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64305","published":"2026-07-25T08:49:39.536Z","updated":"2026-10-30T12:27:42.624Z","title":"crypto: qat - protect service table iterations with service_lock","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-64304","published":"2026-07-25T08:49:38.873Z","updated":"2026-10-19T20:38:22.981Z","title":"crypto: qat - validate RSA CRT component lengths","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-64303","published":"2026-07-25T08:49:38.223Z","updated":"2026-10-19T20:38:22.841Z","title":"spi: fsl-lpspi: terminate the RX channel on TX prepare failure path","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00694,"kevAdded":null},{"id":"CVE-2026-64302","published":"2026-07-25T08:49:37.621Z","updated":"2026-08-17T04:53:00.389Z","title":"x86/mm: Fix freeing of PMD-sized vmemmap pages","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64301","published":"2026-07-25T08:49:36.999Z","updated":"2026-08-17T04:52:59.288Z","title":"regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64300","published":"2026-07-25T08:49:36.372Z","updated":"2026-08-17T04:52:58.194Z","title":"perf/aux: Fix page UAF in map_range()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-64299","published":"2026-07-25T08:49:35.742Z","updated":"2026-10-19T20:38:22.703Z","title":"tracing: Prevent out-of-bounds read in glob matching","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-64298","published":"2026-07-25T08:49:35.101Z","updated":"2026-10-19T20:38:22.558Z","title":"NFSv4: include MAY_WRITE in open permission mask for O_TRUNC","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-64297","published":"2026-07-25T08:49:34.486Z","updated":"2026-08-17T04:52:54.883Z","title":"module: decompress: check return value of module_extend_max_pages()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64296","published":"2026-07-25T08:49:33.847Z","updated":"2026-10-19T20:38:22.402Z","title":"exfat: bound uniname advance in exfat_find_dir_entry()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-64295","published":"2026-07-25T08:49:33.194Z","updated":"2026-08-17T04:52:52.693Z","title":"mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64294","published":"2026-07-25T08:49:32.570Z","updated":"2026-08-23T12:45:40.258Z","title":"mm: do file ownership checks with the proper mount idmap","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64293","published":"2026-07-25T08:49:31.945Z","updated":"2026-10-19T20:38:22.244Z","title":"iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-64292","published":"2026-07-25T08:49:31.325Z","updated":"2026-08-17T04:52:49.390Z","title":"iommufd: Move vevent memory allocation outside spinlock","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64291","published":"2026-07-25T08:49:30.686Z","updated":"2026-08-17T04:52:48.275Z","title":"iommufd: Set veventq_depth upper bound","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64290","published":"2026-07-25T08:49:30.049Z","updated":"2026-08-17T04:52:47.176Z","title":"iommufd: Break the loop on failure in iommufd_fault_fops_read()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-64289","published":"2026-07-25T08:49:29.434Z","updated":"2026-08-17T04:52:45.289Z","title":"iommufd: Set upper bounds on cache invalidation entry_num and entry_len","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-64288","published":"2026-07-25T08:49:28.789Z","updated":"2026-08-17T04:52:44.195Z","title":"KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64287","published":"2026-07-25T08:49:28.168Z","updated":"2026-10-19T20:38:22.088Z","title":"KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-64286","published":"2026-07-25T08:49:27.542Z","updated":"2026-10-19T20:38:21.930Z","title":"KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-64285","published":"2026-07-25T08:49:26.898Z","updated":"2026-08-17T04:52:40.907Z","title":"KVM: SEV: Pin source page for write when adding CPUID data for SNP guest","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-64284","published":"2026-07-25T08:49:26.270Z","updated":"2026-10-19T20:38:21.777Z","title":"KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-64283","published":"2026-07-25T08:49:25.642Z","updated":"2026-10-21T12:43:13.426Z","title":"KVM: guest_memfd: Treat memslot binding offset+size as unsigned values","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2026-64282","published":"2026-07-25T08:49:25.011Z","updated":"2026-08-17T04:52:37.632Z","title":"KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00109,"kevAdded":null},{"id":"CVE-2026-64281","published":"2026-07-25T08:49:24.399Z","updated":"2026-08-17T04:52:36.535Z","title":"svcrdma: wake sq waiters when the transport closes","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-64280","published":"2026-07-25T08:49:23.753Z","updated":"2026-08-23T12:45:39.157Z","title":"fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-64279","published":"2026-07-25T08:49:23.145Z","updated":"2026-10-19T20:28:17.398Z","title":"i2c: core: fix adapter deregistration race","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-64278","published":"2026-07-25T08:49:22.535Z","updated":"2026-08-17T04:52:33.233Z","title":"i2c: imx-lpi2c: mark I2C adapter when hardware is powered down","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64277","published":"2026-07-25T08:49:21.936Z","updated":"2026-10-19T20:28:17.252Z","title":"Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-64276","published":"2026-07-25T08:49:21.300Z","updated":"2026-10-19T20:28:17.083Z","title":"Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-64275","published":"2026-07-25T08:49:20.669Z","updated":"2026-08-17T04:52:29.928Z","title":"Input: elan_i2c - prevent division by zero and arithmetic underflow","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64274","published":"2026-07-25T08:49:20.040Z","updated":"2026-08-17T04:52:28.842Z","title":"Input: goodix - clamp the device-reported contact count","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-64273","published":"2026-07-25T08:49:19.416Z","updated":"2026-08-17T04:52:27.750Z","title":"Input: iforce - bound the device-reported force-feedback effect index","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-64272","published":"2026-07-25T08:49:18.766Z","updated":"2026-08-23T12:45:38.059Z","title":"Input: mms114 - fix touch indexing for MMS134S and MMS136","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-64271","published":"2026-07-25T08:49:18.160Z","updated":"2026-08-17T04:52:25.592Z","title":"Input: touchwin - reset the packet index on every complete packet","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-64270","published":"2026-07-25T08:49:17.541Z","updated":"2026-08-23T12:45:36.926Z","title":"Input: mms114 - reject an oversized device packet size","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-64269","published":"2026-07-25T08:49:16.946Z","updated":"2026-08-23T12:45:35.835Z","title":"RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-64268","published":"2026-07-25T08:49:16.336Z","updated":"2026-10-19T20:28:16.936Z","title":"RDMA/siw: bound Read Response placement to the RREAD length","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-64267","published":"2026-07-25T08:49:15.720Z","updated":"2026-08-17T04:52:21.187Z","title":"fuse: avoid 32-bit prune notification count wrap","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64266","published":"2026-07-25T08:49:15.142Z","updated":"2026-10-19T20:28:16.797Z","title":"fuse: re-lock request before returning from fuse_ref_folio()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-64265","published":"2026-07-25T08:49:14.548Z","updated":"2026-08-17T04:52:19.015Z","title":"fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-64264","published":"2026-07-25T08:49:13.891Z","updated":"2026-08-17T04:52:17.918Z","title":"fuse-uring: fix EFAULT clobber in fuse_uring_commit","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64263","published":"2026-07-25T08:49:13.217Z","updated":"2026-08-17T04:52:16.831Z","title":"fuse-uring: fix moving cancelled entry to ent_in_userspace list","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64262","published":"2026-07-25T08:49:12.599Z","updated":"2026-08-17T04:52:15.740Z","title":"fuse-uring: end fuse_req on io-uring cancel task work","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64261","published":"2026-07-25T08:49:11.999Z","updated":"2026-08-17T04:52:14.647Z","title":"fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-64260","published":"2026-07-25T08:49:11.395Z","updated":"2026-08-17T04:52:13.575Z","title":"fuse-uring: Avoid queue->stopped races and set/read that value under lock","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-64259","published":"2026-07-25T08:49:10.756Z","updated":"2026-08-17T04:52:12.445Z","title":"fuse-uring: make a fuse_req on SQE commit only findable after memcpy","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-64258","published":"2026-07-25T08:49:10.093Z","updated":"2026-08-17T04:52:11.332Z","title":"fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64257","published":"2026-07-25T08:49:09.345Z","updated":"2026-08-17T04:52:09.787Z","title":"smb: client: reject overlapping data areas in SMB2 responses","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00702,"kevAdded":null},{"id":"CVE-2026-64256","published":"2026-07-25T08:49:08.676Z","updated":"2026-08-17T04:52:08.656Z","title":"xfs: don't wrap around quota ids in dqiterate","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-64255","published":"2026-07-24T15:31:22.870Z","updated":"2026-10-19T20:28:16.644Z","title":"wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2026-64254","published":"2026-07-24T15:31:22.293Z","updated":"2026-08-17T04:52:06.227Z","title":"NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-64253","published":"2026-07-24T15:31:21.378Z","updated":"2026-08-17T04:52:05.134Z","title":"kernel/fork: clear PF_BLOCK_TS in copy_process()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-64252","published":"2026-07-24T15:31:19.344Z","updated":"2026-08-17T04:52:04.034Z","title":"MIPS: DEC: Prevent initial console buffer from landing in XKPHYS","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-64251","published":"2026-07-24T15:31:17.601Z","updated":"2026-08-17T04:52:02.919Z","title":"pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-64250","published":"2026-07-24T15:31:17.021Z","updated":"2026-08-17T04:52:01.823Z","title":"LoongArch: Report dying CPU to RCU in stop_this_cpu()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2026-64249","published":"2026-07-24T15:31:16.458Z","updated":"2026-08-17T04:52:00.712Z","title":"fpga: region: fix use-after-free in child_regions_with_firmware()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-64248","published":"2026-07-24T15:31:15.892Z","updated":"2026-08-17T04:51:59.618Z","title":"MIPS: smp: report dying CPU to RCU in stop_this_cpu()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2026-64247","published":"2026-07-24T15:31:15.304Z","updated":"2026-10-19T20:28:16.498Z","title":"KVM: x86: hyper-v: Bound the bank index when querying sparse banks","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-64246","published":"2026-07-24T15:31:14.709Z","updated":"2026-08-17T04:51:57.403Z","title":"power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-64245","published":"2026-07-24T15:31:14.142Z","updated":"2026-08-17T04:51:56.311Z","title":"fbdev: modedb: fix a possible UAF in fb_find_mode()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-64244","published":"2026-07-24T15:29:59.891Z","updated":"2026-08-17T04:51:55.230Z","title":"drivers/base/memory: set mem->altmap after successful device registration","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2026-64243","published":"2026-07-24T15:27:45.311Z","updated":"2026-10-19T20:28:16.341Z","title":"ASoC: codecs: simple-mux: Fix enum control bounds check","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64242","published":"2026-07-24T15:27:44.730Z","updated":"2026-07-24T15:27:44.730Z","title":"usb: gadget: net2280: Fix double free in probe error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-64241","published":"2026-07-24T15:27:44.144Z","updated":"2026-10-21T12:43:12.330Z","title":"gpio: rockchip: teardown bugs and resource leaks","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-64240","published":"2026-07-24T15:27:43.590Z","updated":"2026-07-24T15:27:43.590Z","title":"media: rc: igorplugusb: fix control request setup packet","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2026-64239","published":"2026-07-24T15:27:43.057Z","updated":"2026-07-24T15:27:43.057Z","title":"mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2026-64238","published":"2026-07-24T15:27:42.482Z","updated":"2026-07-24T15:27:42.482Z","title":"gpio: shared: fix deadlock on shared proxy's parent removal","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00111,"kevAdded":null},{"id":"CVE-2026-64237","published":"2026-07-24T15:27:41.937Z","updated":"2026-07-27T04:37:26.944Z","title":"Input: elan_i2c - validate firmware size before use","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-64236","published":"2026-07-24T15:27:41.371Z","updated":"2026-07-24T15:27:41.371Z","title":"i2c: davinci: fix division by zero on missing clock-frequency","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64235","published":"2026-07-24T15:27:40.814Z","updated":"2026-10-19T20:28:16.189Z","title":"x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2026-64234","published":"2026-07-24T15:27:40.263Z","updated":"2026-07-24T15:27:40.263Z","title":"tty: serial: pch_uart: add check for dma_alloc_coherent()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2026-64233","published":"2026-07-24T15:27:39.710Z","updated":"2026-07-24T15:27:39.710Z","title":"usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-64232","published":"2026-07-24T15:23:13.729Z","updated":"2026-10-19T20:28:16.033Z","title":"block: recompute nr_integrity_segments in blk_insert_cloned_request","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00431,"kevAdded":null},{"id":"CVE-2026-64231","published":"2026-07-24T15:23:13.175Z","updated":"2026-07-24T15:23:13.175Z","title":"drm/msm/dsi: don't dump registers past the mapped region","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64230","published":"2026-07-24T15:23:12.616Z","updated":"2026-07-24T15:23:12.616Z","title":"regulator: tps65219: fix irq_data.rdev not being assigned","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64229","published":"2026-07-24T15:23:12.069Z","updated":"2026-07-24T15:23:12.069Z","title":"x86/mm: Disable broadcast TLB flush when PCID is disabled","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64228","published":"2026-07-24T15:23:11.510Z","updated":"2026-07-24T15:23:11.510Z","title":"net: ethtool: phy: avoid NULL deref when PHY driver is unbound","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64227","published":"2026-07-24T15:23:10.936Z","updated":"2026-07-27T04:37:25.776Z","title":"ACPI: driver: Check ACPI_COMPANION() against NULL during probe","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-64226","published":"2026-07-24T15:23:10.388Z","updated":"2026-08-05T12:40:11.672Z","title":"sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-64225","published":"2026-07-24T15:23:09.785Z","updated":"2026-07-24T15:23:09.785Z","title":"octeontx2-af: CGX: add bounds check to cgx_speed_mbps index","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64224","published":"2026-07-24T15:23:09.209Z","updated":"2026-07-24T15:23:09.209Z","title":"octeontx2-pf: fix double free in rvu_rep_rsrc_init()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-64223","published":"2026-07-24T15:23:08.629Z","updated":"2026-10-19T20:28:15.888Z","title":"wifi: mac80211: consume only present negotiated TTLM maps","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2026-64222","published":"2026-07-24T15:23:08.072Z","updated":"2026-10-19T20:28:15.732Z","title":"octeontx2-pf: avoid double free of pool->stack on AQ init failure","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-64221","published":"2026-07-24T15:23:07.502Z","updated":"2026-08-05T12:40:08.448Z","title":"spi: ti-qspi: fix use-after-free after DMA setup failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-64220","published":"2026-07-24T15:23:06.931Z","updated":"2026-07-24T15:23:06.931Z","title":"device property: set fwnode->secondary to NULL in fwnode_init()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64219","published":"2026-07-24T15:23:06.379Z","updated":"2026-10-19T20:28:15.578Z","title":"drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-64218","published":"2026-07-24T15:23:05.814Z","updated":"2026-08-05T12:40:06.269Z","title":"batman-adv: bla: fix report_work leak on backbone_gw purge","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-64217","published":"2026-07-24T15:23:05.261Z","updated":"2026-08-05T12:40:05.203Z","title":"netfs: Fix overrun check in netfs_extract_user_iter()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64216","published":"2026-07-24T15:23:04.673Z","updated":"2026-08-27T12:39:42.119Z","title":"netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00457,"kevAdded":null},{"id":"CVE-2026-64215","published":"2026-07-24T15:23:04.085Z","updated":"2026-07-24T15:23:04.085Z","title":"drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-64214","published":"2026-07-24T15:23:03.529Z","updated":"2026-07-24T15:23:03.529Z","title":"powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64213","published":"2026-07-24T15:23:02.987Z","updated":"2026-10-30T12:27:41.554Z","title":"hwmon: (lm90) Add lock protection to lm90_alert","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64212","published":"2026-07-24T15:23:02.449Z","updated":"2026-07-24T15:23:02.449Z","title":"wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-64211","published":"2026-07-24T15:23:01.889Z","updated":"2026-07-24T15:23:01.889Z","title":"srcu: Don't queue workqueue handlers to never-online CPUs","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-64210","published":"2026-07-24T15:23:01.328Z","updated":"2026-10-19T20:28:15.405Z","title":"net/mlx5e: xsk: Fix unlocked writing to ICOSQ","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2026-64209","published":"2026-07-24T15:23:00.691Z","updated":"2026-07-24T15:23:00.691Z","title":"phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-64208","published":"2026-07-24T15:23:00.113Z","updated":"2026-08-05T12:40:02.002Z","title":"crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-64600","published":"2026-07-23T05:46:56.149Z","updated":"2026-10-19T20:48:43.886Z","title":"xfs: resample the data fork mapping after cycling ILOCK","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-64207","published":"2026-07-20T16:27:54.447Z","updated":"2026-08-17T04:51:54.139Z","title":"net/sched: dualpi2: fix GSO backlog accounting","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64206","published":"2026-07-20T16:27:53.885Z","updated":"2026-10-19T20:28:15.233Z","title":"Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2026-64205","published":"2026-07-20T16:27:53.310Z","updated":"2026-08-17T04:51:51.900Z","title":"i2c: i801: fix hardware state machine corruption in error path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-64192","published":"2026-07-20T16:27:51.720Z","updated":"2026-08-23T12:45:34.754Z","title":"bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2026-64191","published":"2026-07-20T16:27:51.120Z","updated":"2026-10-19T20:28:15.069Z","title":"i2c: stub: Reject I2C block transfers with invalid length","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-64190","published":"2026-07-20T16:27:48.314Z","updated":"2026-10-30T12:27:40.497Z","title":"net: team: fix NULL pointer dereference in team_xmit during mode change","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2026-64189","published":"2026-07-20T16:27:47.767Z","updated":"2026-10-19T20:28:14.906Z","title":"netfilter: ipset: fix race between dump and ip_set_list resize","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-64188","published":"2026-07-20T16:27:47.216Z","updated":"2026-08-05T12:39:57.703Z","title":"net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-64187","published":"2026-07-20T16:27:46.653Z","updated":"2026-08-17T04:51:48.578Z","title":"xfs: fail recovery on a committed log item with no regions","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-64186","published":"2026-07-19T15:41:08.054Z","updated":"2026-07-19T15:41:08.054Z","title":"iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-64185","published":"2026-07-19T15:41:07.340Z","updated":"2026-07-19T15:41:07.340Z","title":"sysfs: don't remove existing directory on update failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-64184","published":"2026-07-19T15:41:06.615Z","updated":"2026-07-19T15:41:06.615Z","title":"mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-64183","published":"2026-07-19T15:41:05.896Z","updated":"2026-07-19T15:41:05.896Z","title":"efi: Allocate runtime workqueue before ACPI init","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-64182","published":"2026-07-19T15:41:05.186Z","updated":"2026-07-19T15:41:05.186Z","title":"drivers/base/memory: fix memory block reference leak in poison accounting","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-64181","published":"2026-07-19T15:41:04.455Z","updated":"2026-08-05T12:39:56.626Z","title":"mm: fix __vm_normal_page() to handle missing support for pmd_special()/pud_special()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-64180","published":"2026-07-19T15:41:03.751Z","updated":"2026-07-19T15:41:03.751Z","title":"mm/memory_hotplug: fix memory block reference leak on remove","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-64179","published":"2026-07-19T15:41:03.019Z","updated":"2026-07-19T15:41:03.019Z","title":"net: wwan: iosm: fix potential memory leaks in ipc_imem_init()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2026-64178","published":"2026-07-19T15:41:02.293Z","updated":"2026-10-19T20:28:14.749Z","title":"Bluetooth: bnep: Fix UAF read of dev->name","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-64177","published":"2026-07-19T15:41:01.534Z","updated":"2026-07-19T15:41:01.534Z","title":"phonet/pep: disable BH around forwarded sk_receive_skb()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-64176","published":"2026-07-19T15:41:00.830Z","updated":"2026-10-19T20:28:14.591Z","title":"wifi: iwlwifi: mvm: fix driver-set TX rates on old devices","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2026-64175","published":"2026-07-19T15:41:00.157Z","updated":"2026-10-19T20:28:14.434Z","title":"wifi: iwlwifi: mld: stop TX during firmware restart","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2026-64174","published":"2026-07-19T15:40:59.360Z","updated":"2026-07-19T15:40:59.360Z","title":"wifi: cfg80211: advance loop vars in cfg80211_merge_profile()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-64173","published":"2026-07-19T15:40:58.251Z","updated":"2026-07-19T15:40:58.251Z","title":"tracing: Do not call map->ops->elt_free() if elt_alloc() fails","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-64172","published":"2026-07-19T15:40:57.153Z","updated":"2026-08-05T12:39:52.348Z","title":"KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-64171","published":"2026-07-19T15:40:56.071Z","updated":"2026-07-19T15:40:56.071Z","title":"i2c: tegra: fix pm_runtime leak on mutex_lock failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00111,"kevAdded":null},{"id":"CVE-2026-64170","published":"2026-07-19T15:40:54.999Z","updated":"2026-07-19T15:40:54.999Z","title":"spi: qup: fix error pointer deref after DMA setup failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-64169","published":"2026-07-19T15:40:54.092Z","updated":"2026-07-19T15:40:54.092Z","title":"spi: ep93xx: fix error pointer deref after DMA setup failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-64168","published":"2026-07-19T15:40:52.741Z","updated":"2026-07-19T15:40:52.741Z","title":"spi: sprd: fix error pointer deref after DMA setup failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2026-64167","published":"2026-07-19T15:40:52.023Z","updated":"2026-07-19T15:40:52.023Z","title":"kho: skip KHO for crash kernel","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-64166","published":"2026-07-19T15:40:51.305Z","updated":"2026-07-19T15:40:51.305Z","title":"firmware: arm_ffa: Check for NULL FF-A ID table while driver registration","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-64165","published":"2026-07-19T15:40:50.585Z","updated":"2026-07-19T15:40:50.585Z","title":"ARM: integrator: Fix early initialization","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-64164","published":"2026-07-19T15:40:49.894Z","updated":"2026-07-19T15:40:49.894Z","title":"btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-64163","published":"2026-07-19T15:40:49.172Z","updated":"2026-10-30T12:27:39.441Z","title":"test_kprobes: clear kprobes between test runs","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-64162","published":"2026-07-19T15:40:48.461Z","updated":"2026-10-19T20:28:14.274Z","title":"idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2026-64161","published":"2026-07-19T15:40:47.761Z","updated":"2026-07-19T15:40:47.761Z","title":"net: ti: icssm-prueth: fix eth_ports_node leak in probe","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64160","published":"2026-07-19T15:40:47.063Z","updated":"2026-10-19T20:28:14.119Z","title":"netfs: Fix potential for tearing in ->remote_i_size and ->zero_point","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00427,"kevAdded":null},{"id":"CVE-2026-64159","published":"2026-07-19T15:40:46.400Z","updated":"2026-10-21T12:43:09.056Z","title":"netfs: Fix zeropoint update where i_size > remote_i_size","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-64157","published":"2026-07-19T15:40:44.964Z","updated":"2026-07-19T15:40:44.964Z","title":"netfs: Fix partial invalidation of streaming-write folio","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-64156","published":"2026-07-19T15:40:44.277Z","updated":"2026-07-19T15:40:44.277Z","title":"netfs, afs: Fix write skipping in dir/link writepages","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64155","published":"2026-07-19T15:40:43.545Z","updated":"2026-07-19T15:40:43.545Z","title":"wifi: ath11k: fix error path leaks in some WMI WOW calls","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64154","published":"2026-07-19T15:40:42.807Z","updated":"2026-10-21T12:43:07.993Z","title":"drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-64153","published":"2026-07-19T15:40:42.102Z","updated":"2026-08-05T12:39:48.053Z","title":"drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-64152","published":"2026-07-19T15:40:41.354Z","updated":"2026-08-05T12:39:46.961Z","title":"iommu: Handle unmap error when iommu_debug is enabled","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2026-64151","published":"2026-07-19T15:40:40.643Z","updated":"2026-08-05T12:39:45.883Z","title":"iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-64150","published":"2026-07-19T15:40:40.027Z","updated":"2026-08-05T12:39:44.813Z","title":"netfilter: nft_inner: release local_lock before re-enabling softirqs","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00649,"kevAdded":null},{"id":"CVE-2026-64149","published":"2026-07-19T15:40:39.423Z","updated":"2026-07-19T15:40:39.423Z","title":"dma-mapping: move dma_map_resource() sanity check into debug code","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64148","published":"2026-07-19T15:40:38.816Z","updated":"2026-08-05T12:39:43.750Z","title":"pds_core: fix error handling in pdsc_devcmd_wait","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00469,"kevAdded":null},{"id":"CVE-2026-64147","published":"2026-07-19T15:40:38.198Z","updated":"2026-07-19T15:40:38.198Z","title":"pds_core: fix debugfs_lookup dentry leak and error handling","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-64146","published":"2026-07-19T15:40:37.474Z","updated":"2026-10-30T12:27:38.382Z","title":"erofs: fix metabuf leak in inode xattr initialization","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-64145","published":"2026-07-19T15:40:36.767Z","updated":"2026-07-19T15:40:36.767Z","title":"wifi: wilc1000: fix dma_buffer leak on bus acquire failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-64144","published":"2026-07-19T15:40:36.041Z","updated":"2026-10-30T12:27:37.325Z","title":"Bluetooth: btmtk: fix urb->setup_packet leak in error paths","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-64143","published":"2026-07-19T15:40:35.337Z","updated":"2026-07-19T15:40:35.337Z","title":"platform/x86: uniwill-laptop: Do not enable the charging limit even when forced","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-64142","published":"2026-07-19T15:40:34.605Z","updated":"2026-08-05T12:39:42.662Z","title":"ksmbd: close durable scavenger races against m_fp_list lookups","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00705,"kevAdded":null},{"id":"CVE-2026-64141","published":"2026-07-19T15:40:33.890Z","updated":"2026-08-05T12:39:41.570Z","title":"ksmbd: fix null pointer dereference in compare_guid_key()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0063,"kevAdded":null},{"id":"CVE-2026-64140","published":"2026-07-19T15:40:33.194Z","updated":"2026-08-05T12:39:40.506Z","title":"ksmbd: fix null pointer dereference in proc_show_files()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-64139","published":"2026-07-19T15:40:32.459Z","updated":"2026-08-23T12:45:33.681Z","title":"ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-64138","published":"2026-07-19T15:40:31.760Z","updated":"2026-10-30T12:27:36.259Z","title":"ksmbd: validate SID in parent security descriptor during ACL inheritance","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00447,"kevAdded":null},{"id":"CVE-2026-64137","published":"2026-07-19T15:40:31.045Z","updated":"2026-08-05T12:39:38.366Z","title":"smb: client: require net admin for CIFS SWN netlink","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64136","published":"2026-07-19T15:40:30.351Z","updated":"2026-10-30T12:27:35.201Z","title":"smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2026-64135","published":"2026-07-19T15:40:29.676Z","updated":"2026-07-19T15:40:29.676Z","title":"hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64134","published":"2026-07-19T15:40:28.974Z","updated":"2026-10-19T20:28:13.823Z","title":"ALSA: pcm: Don't setup bogus iov_iter for silencing","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64133","published":"2026-07-19T15:40:28.277Z","updated":"2026-10-19T20:28:13.681Z","title":"ALSA: asihpi: Fix potential OOB array access at reading cache","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-64132","published":"2026-07-19T15:40:27.590Z","updated":"2026-08-05T12:39:34.060Z","title":"ipv6: ioam: refresh hdr pointer before ioam6_event()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00491,"kevAdded":null},{"id":"CVE-2026-64131","published":"2026-07-19T15:40:26.854Z","updated":"2026-07-19T15:40:26.854Z","title":"mm/memory: fix spurious warning when unmapping device-private/exclusive pages","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64130","published":"2026-07-19T15:40:26.108Z","updated":"2026-07-19T15:40:26.108Z","title":"mm/page_alloc: fix initialization of tags of the huge zero folio with init_on_free","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64129","published":"2026-07-19T15:40:25.385Z","updated":"2026-07-19T15:40:25.385Z","title":"mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-64128","published":"2026-07-19T15:40:24.678Z","updated":"2026-07-19T15:40:24.678Z","title":"Bluetooth: ISO: drop ISO_END frames received without prior ISO_START","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-64127","published":"2026-07-19T15:40:23.960Z","updated":"2026-07-19T15:40:23.960Z","title":"Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-64126","published":"2026-07-19T15:40:23.276Z","updated":"2026-10-19T20:28:13.544Z","title":"Bluetooth: MGMT: validate Add Extended Advertising Data length","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-64125","published":"2026-07-19T15:40:22.590Z","updated":"2026-10-19T20:28:13.405Z","title":"net: bcmgenet: keep RBUF EEE/PM disabled","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00552,"kevAdded":null},{"id":"CVE-2026-64124","published":"2026-07-19T15:40:21.879Z","updated":"2026-08-05T12:39:30.822Z","title":"net: devmem: reject dma-buf bind with non-page-aligned size or SG length","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-64123","published":"2026-07-19T15:40:21.161Z","updated":"2026-10-19T20:28:13.256Z","title":"net: hsr: defer node table free until after RCU readers","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-64122","published":"2026-07-19T15:40:20.446Z","updated":"2026-08-05T12:39:28.664Z","title":"net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00631,"kevAdded":null},{"id":"CVE-2026-64121","published":"2026-07-19T15:40:19.745Z","updated":"2026-07-19T15:40:19.745Z","title":"net: ifb: report ethtool stats over num_tx_queues","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-64120","published":"2026-07-19T15:40:19.044Z","updated":"2026-07-19T15:40:19.044Z","title":"net: ethtool: fix NULL pointer dereference in phy_reply_size","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64119","published":"2026-07-19T15:40:18.331Z","updated":"2026-07-19T15:40:18.331Z","title":"l2tp: use list_del_rcu in l2tp_session_unhash","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-64118","published":"2026-07-19T15:40:17.643Z","updated":"2026-10-19T20:28:13.114Z","title":"qed: fix double free in qed_cxt_tables_alloc()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2026-64117","published":"2026-07-19T15:40:16.941Z","updated":"2026-10-21T12:43:04.607Z","title":"wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2026-64116","published":"2026-07-19T15:40:16.240Z","updated":"2026-08-05T12:39:25.437Z","title":"ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-64115","published":"2026-07-19T15:40:15.513Z","updated":"2026-10-19T20:28:12.821Z","title":"vsock/vmci: fix UAF when peer resets connection during handshake","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-64114","published":"2026-07-19T15:40:14.854Z","updated":"2026-10-19T20:28:12.671Z","title":"ipv4: raw: reject IP_HDRINCL packets with ihl < 5","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-64113","published":"2026-07-19T15:40:14.251Z","updated":"2026-10-19T20:28:12.519Z","title":"ixgbevf: fix use-after-free in VEPA multicast source pruning","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00527,"kevAdded":null},{"id":"CVE-2026-64112","published":"2026-07-19T15:40:13.652Z","updated":"2026-10-19T20:28:12.366Z","title":"rbd: eliminate a race in lock_dwork draining on unmap","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-64111","published":"2026-07-19T15:40:13.007Z","updated":"2026-08-05T12:39:20.048Z","title":"lsm: hold cred_guard_mutex for lsm_set_self_attr()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-64110","published":"2026-07-19T15:40:12.224Z","updated":"2026-07-19T15:40:12.224Z","title":"igc: fix potential skb leak in igc_fpe_xmit_smd_frame()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64109","published":"2026-07-19T15:40:11.510Z","updated":"2026-10-19T20:28:12.212Z","title":"af_unix: Fix UAF read of tail->len in unix_stream_data_wait()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64108","published":"2026-07-19T15:40:10.784Z","updated":"2026-08-05T12:39:17.918Z","title":"cifs: Fix busy dentry used after unmounting","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64107","published":"2026-07-19T15:40:10.079Z","updated":"2026-07-19T15:40:10.079Z","title":"ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512x_overclock_xxx_put()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-64106","published":"2026-07-19T15:40:09.344Z","updated":"2026-10-19T20:28:12.062Z","title":"KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits","severity":"CRITICAL","score":9,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2026-64105","published":"2026-07-19T15:40:08.605Z","updated":"2026-07-19T15:40:08.605Z","title":"KVM: arm64: vgic: Free private_irqs when init fails after allocation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-64104","published":"2026-07-19T15:40:07.994Z","updated":"2026-08-05T12:39:15.778Z","title":"virt: sev-guest: Explicitly leak pages in unknown state","severity":"HIGH","score":8.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-64103","published":"2026-07-19T15:40:07.372Z","updated":"2026-07-19T15:40:07.372Z","title":"scsi: isci: Fix use-after-free in device removal path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-64102","published":"2026-07-19T15:40:06.776Z","updated":"2026-10-19T20:28:11.907Z","title":"RDMA/siw: Reject MPA FPDU length underflow before signed receive math","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.005,"kevAdded":null},{"id":"CVE-2026-64101","published":"2026-07-19T15:40:06.185Z","updated":"2026-07-19T15:40:06.185Z","title":"fwctl: pds: Validate RPC input size before parsing","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64100","published":"2026-07-19T15:40:05.530Z","updated":"2026-07-19T15:40:05.530Z","title":"drm/msm: Fix shrinker deadlock","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-64099","published":"2026-07-19T15:40:04.925Z","updated":"2026-08-05T12:39:13.645Z","title":"drm/v3d: Fix use-after-free of CPU job query arrays on error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-64098","published":"2026-07-19T15:40:04.264Z","updated":"2026-10-19T20:28:11.749Z","title":"drm/virtio: use uninterruptible resv lock for plane updates","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00113,"kevAdded":null},{"id":"CVE-2026-64097","published":"2026-07-19T15:40:03.599Z","updated":"2026-10-19T20:28:11.592Z","title":"drm/amd/display: Validate GPIO pin LUT table size before iterating","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-64096","published":"2026-07-19T15:40:02.969Z","updated":"2026-08-05T12:39:10.448Z","title":"batman-adv: mcast: fix use-after-free in orig_node RCU release","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2026-64095","published":"2026-07-19T15:40:02.360Z","updated":"2026-08-05T12:39:09.386Z","title":"batman-adv: bla: avoid double decrement of bla.num_requests","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2026-64094","published":"2026-07-19T15:40:01.772Z","updated":"2026-07-19T15:40:01.772Z","title":"batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-64093","published":"2026-07-19T15:40:01.172Z","updated":"2026-08-05T12:39:08.305Z","title":"batman-adv: tp_meter: directly shut down timer on cleanup","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-64092","published":"2026-07-19T15:40:00.603Z","updated":"2026-07-19T15:40:00.603Z","title":"batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-64091","published":"2026-07-19T15:40:00.030Z","updated":"2026-08-05T12:39:07.214Z","title":"batman-adv: tt: fix TOCTOU race for reported vlans","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2026-64090","published":"2026-07-19T15:39:59.392Z","updated":"2026-07-19T15:39:59.392Z","title":"batman-adv: tt: avoid empty VLAN responses","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-64089","published":"2026-07-19T15:39:58.729Z","updated":"2026-08-05T12:39:06.132Z","title":"batman-adv: tt: fix negative last_changeset_len","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00552,"kevAdded":null},{"id":"CVE-2026-64088","published":"2026-07-19T15:39:58.084Z","updated":"2026-08-05T12:39:05.060Z","title":"batman-adv: tt: fix negative tt_buff_len","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2026-64087","published":"2026-07-19T15:39:57.371Z","updated":"2026-07-19T15:39:57.371Z","title":"hwmon: (pmbus/adm1266) reject implausible blackbox record_count","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-64086","published":"2026-07-19T15:39:56.749Z","updated":"2026-08-05T12:39:03.986Z","title":"hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-64085","published":"2026-07-19T15:39:56.067Z","updated":"2026-07-19T15:39:56.067Z","title":"hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-64084","published":"2026-07-19T15:39:55.417Z","updated":"2026-08-05T12:39:02.926Z","title":"hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-64083","published":"2026-07-19T15:39:54.756Z","updated":"2026-07-19T15:39:54.756Z","title":"hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-64082","published":"2026-07-19T15:39:54.074Z","updated":"2026-09-02T12:49:41.782Z","title":"riscv: Fix register corruption from uninitialized cregs on error","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64081","published":"2026-07-19T15:39:53.433Z","updated":"2026-08-05T12:39:00.788Z","title":"firmware: arm_ffa: Validate framework notification message layout","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-64080","published":"2026-07-19T15:39:52.818Z","updated":"2026-08-05T12:38:59.719Z","title":"firmware: arm_ffa: Snapshot notifier callbacks under lock","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-64079","published":"2026-07-19T15:39:52.192Z","updated":"2026-10-21T12:43:03.518Z","title":"netfilter: x_tables: allocate hook ops while under mutex","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-64078","published":"2026-07-19T15:39:51.582Z","updated":"2026-08-05T12:38:58.654Z","title":"netfilter: x_tables: add and use xtables_unregister_table_exit","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-64077","published":"2026-07-19T15:39:50.966Z","updated":"2026-10-30T12:27:34.127Z","title":"netfilter: ebtables: move to two-stage removal scheme","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-64076","published":"2026-07-19T15:39:50.346Z","updated":"2026-10-30T12:27:33.060Z","title":"netfilter: bridge: eb_tables: close module init race","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-64075","published":"2026-07-19T15:39:49.679Z","updated":"2026-07-19T15:39:49.679Z","title":"fprobe: Fix unregister_fprobe() to wait for RCU grace period","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-64074","published":"2026-07-19T15:39:49.076Z","updated":"2026-08-05T12:38:55.440Z","title":"fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-64073","published":"2026-07-19T15:39:48.463Z","updated":"2026-10-19T20:28:11.133Z","title":"irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-64072","published":"2026-07-19T15:39:47.823Z","updated":"2026-07-19T15:39:47.823Z","title":"nvme: fix bio leak on mapping failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64071","published":"2026-07-19T15:39:47.162Z","updated":"2026-07-19T15:39:47.162Z","title":"nvme-pci: fix use-after-free in nvme_free_host_mem()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-64070","published":"2026-07-19T15:39:46.536Z","updated":"2026-09-02T12:49:39.984Z","title":"powerpc/hv-gpci: fix preempt count leak in sysfs show paths","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-64069","published":"2026-07-19T15:39:45.932Z","updated":"2026-08-05T12:38:53.294Z","title":"netfs: Fix cancellation of a DIO and single read subrequests","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00649,"kevAdded":null},{"id":"CVE-2026-64068","published":"2026-07-19T15:39:45.306Z","updated":"2026-10-21T12:43:00.243Z","title":"netfs: Fix missing locking around retry adding new subreqs","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00353,"kevAdded":null},{"id":"CVE-2026-64067","published":"2026-07-19T15:39:44.660Z","updated":"2026-10-15T10:08:00.358Z","title":"netfs: Fix missing barriers when accessing stream->subrequests locklessly","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00502,"kevAdded":null},{"id":"CVE-2026-64066","published":"2026-07-19T15:39:44.032Z","updated":"2026-08-05T12:38:50.075Z","title":"netfs: Fix netfs_read_to_pagecache() to pause on subreq failure","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00649,"kevAdded":null},{"id":"CVE-2026-64065","published":"2026-07-19T15:39:43.397Z","updated":"2026-07-19T15:39:43.397Z","title":"netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-64064","published":"2026-07-19T15:39:42.770Z","updated":"2026-07-19T15:39:42.770Z","title":"netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-64063","published":"2026-07-19T15:39:42.123Z","updated":"2026-07-19T15:39:42.123Z","title":"netfs: Fix streaming write being overwritten","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64062","published":"2026-07-19T15:39:41.523Z","updated":"2026-07-19T15:39:41.523Z","title":"netfs: Fix potential deadlock in write-through mode","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00094,"kevAdded":null},{"id":"CVE-2026-64061","published":"2026-07-19T15:39:40.913Z","updated":"2026-08-05T12:38:49.000Z","title":"netfs: Fix early put of sink folio in netfs_read_gaps()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00469,"kevAdded":null},{"id":"CVE-2026-64060","published":"2026-07-19T15:39:40.243Z","updated":"2026-10-21T12:42:59.144Z","title":"netfs: Fix leak of request in netfs_write_begin() error handling","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-64059","published":"2026-07-19T15:39:39.607Z","updated":"2026-07-19T15:39:39.607Z","title":"netfs: Fix folio->private handling in netfs_perform_write()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-64058","published":"2026-07-19T15:39:38.978Z","updated":"2026-09-14T11:58:36.477Z","title":"netfs: Fix netfs_read_folio() to wait on writeback","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64057","published":"2026-07-19T15:39:38.321Z","updated":"2026-10-15T10:07:59.282Z","title":"afs: Fix the locking used by afs_get_link()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-64056","published":"2026-07-19T15:39:37.673Z","updated":"2026-08-05T12:38:45.763Z","title":"net: ethernet: cortina: Make RX SKB per-port","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00552,"kevAdded":null},{"id":"CVE-2026-64055","published":"2026-07-19T15:39:37.077Z","updated":"2026-08-05T12:38:44.658Z","title":"net: ethernet: cortina: Carry over frag counter","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-64054","published":"2026-07-19T15:39:36.475Z","updated":"2026-07-19T15:39:36.475Z","title":"net: shaper: reject duplicate leaves in GROUP request","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-64053","published":"2026-07-19T15:39:35.854Z","updated":"2026-10-19T20:28:10.989Z","title":"block: don't overwrite bip_vcnt in bio_integrity_copy_user()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64052","published":"2026-07-19T15:39:35.223Z","updated":"2026-07-19T15:39:35.223Z","title":"block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-64051","published":"2026-07-19T15:39:34.608Z","updated":"2026-08-05T12:38:42.519Z","title":"accel/qaic: Add overflow check to remap_pfn_range during mmap","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64050","published":"2026-07-19T15:39:33.942Z","updated":"2026-08-05T12:38:41.459Z","title":"drm/msm/dpu: don't mix devm and drmm functions","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-64049","published":"2026-07-19T15:39:33.308Z","updated":"2026-07-19T15:39:33.308Z","title":"drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64048","published":"2026-07-19T15:39:32.664Z","updated":"2026-10-19T20:28:10.855Z","title":"net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-64047","published":"2026-07-19T15:39:31.960Z","updated":"2026-10-19T20:28:10.717Z","title":"net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-64046","published":"2026-07-19T15:39:31.129Z","updated":"2026-10-19T20:28:10.562Z","title":"net: tls: prevent chain-after-chain in plain text SG","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-64045","published":"2026-07-19T15:39:30.526Z","updated":"2026-08-05T12:38:37.111Z","title":"ovpn: tcp - use cached peer pointer in ovpn_tcp_close()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-64044","published":"2026-07-19T15:39:29.869Z","updated":"2026-08-05T12:38:36.035Z","title":"ovpn: respect peer refcount in CMD_NEW_PEER error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-64043","published":"2026-07-19T15:39:29.225Z","updated":"2026-07-19T15:39:29.225Z","title":"ovpn: fix race between deleting interface and adding new peer","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00105,"kevAdded":null},{"id":"CVE-2026-64042","published":"2026-07-19T15:39:28.604Z","updated":"2026-08-05T12:38:34.964Z","title":"vfio/pci: Check BAR resources before exporting a DMABUF","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2026-64041","published":"2026-07-19T15:39:27.967Z","updated":"2026-08-05T12:38:33.905Z","title":"ASoC: codecs: fs210x: fix possible buffer overflow","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-64040","published":"2026-07-19T15:39:27.348Z","updated":"2026-10-15T10:07:58.219Z","title":"cachefiles: Fix error return when vfs_mkdir() fails","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64039","published":"2026-07-19T15:39:26.695Z","updated":"2026-08-05T12:38:32.825Z","title":"drm/msm/snapshot: fix dumping of the unaligned regions","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-64038","published":"2026-07-19T15:39:26.071Z","updated":"2026-10-30T12:27:31.998Z","title":"hwmon: (lm90) Stop work before releasing hwmon device","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00089,"kevAdded":null},{"id":"CVE-2026-64037","published":"2026-07-19T15:39:25.435Z","updated":"2026-10-19T20:28:10.404Z","title":"wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2026-64036","published":"2026-07-19T15:39:24.783Z","updated":"2026-10-30T12:27:30.942Z","title":"cgroup/rstat: validate cpu before css_rstat_cpu() access","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-64035","published":"2026-07-19T15:39:24.128Z","updated":"2026-10-19T20:28:10.044Z","title":"igc: set tx buffer type for SMD frames","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00442,"kevAdded":null},{"id":"CVE-2026-64034","published":"2026-07-19T15:39:23.470Z","updated":"2026-10-19T20:28:09.897Z","title":"net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2026-64033","published":"2026-07-19T15:39:22.872Z","updated":"2026-08-05T12:38:27.449Z","title":"RDMA/rtrs: Fix use-after-free in path file creation cleanup","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-64032","published":"2026-07-19T15:39:22.228Z","updated":"2026-10-19T20:28:09.740Z","title":"bridge: mcast: Fix a possible use-after-free when removing a bridge port","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-64031","published":"2026-07-19T15:39:21.609Z","updated":"2026-09-14T11:58:35.405Z","title":"erofs: fix managed cache race for unaligned extents","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00099,"kevAdded":null},{"id":"CVE-2026-64030","published":"2026-07-19T15:39:20.982Z","updated":"2026-10-19T20:28:09.581Z","title":"wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-64029","published":"2026-07-19T15:39:20.368Z","updated":"2026-10-19T20:28:09.426Z","title":"ALSA: seq: Serialize UMP output teardown with event_input","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00097,"kevAdded":null},{"id":"CVE-2026-64028","published":"2026-07-19T15:39:19.102Z","updated":"2026-07-19T15:39:19.102Z","title":"tracing: Avoid NULL return from hist_field_name() on truncation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-64027","published":"2026-07-19T15:39:18.470Z","updated":"2026-10-19T20:28:09.258Z","title":"net: shaper: rework the VALID marking (again)","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00099,"kevAdded":null},{"id":"CVE-2026-64026","published":"2026-07-19T15:39:17.783Z","updated":"2026-10-19T20:28:09.103Z","title":"rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00109,"kevAdded":null},{"id":"CVE-2026-64025","published":"2026-07-19T15:39:17.178Z","updated":"2026-10-30T12:27:29.882Z","title":"bpf, skmsg: fix verdict sk_data_ready racing with ktls rx","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00369,"kevAdded":null},{"id":"CVE-2026-64024","published":"2026-07-19T15:39:16.598Z","updated":"2026-10-21T12:42:55.876Z","title":"tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction","severity":"CRITICAL","score":9.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2026-64023","published":"2026-07-19T15:39:15.980Z","updated":"2026-08-05T12:38:17.707Z","title":"gpio: aggregator: fix a potential use-after-free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-64022","published":"2026-07-19T15:39:15.345Z","updated":"2026-07-19T15:39:15.345Z","title":"gpio: aggregator: remove the software node when deactivating the aggregator","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-64021","published":"2026-07-19T15:39:14.741Z","updated":"2026-07-19T15:39:14.741Z","title":"drm/xe/oa: Fix exec_queue leak on width check in stream open","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-64020","published":"2026-07-19T15:39:14.115Z","updated":"2026-10-15T10:07:57.141Z","title":"nvme-pci: fix dma_vecs leak on p2p memory","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-64019","published":"2026-07-19T15:39:13.400Z","updated":"2026-10-15T10:07:56.071Z","title":"nvme-pci: fix dma mapping leak on data setup error","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-64018","published":"2026-07-19T15:39:12.704Z","updated":"2026-10-19T20:28:08.648Z","title":"net: mana: validate rx_req_idx to prevent out-of-bounds array access","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-64017","published":"2026-07-19T15:39:11.989Z","updated":"2026-10-30T12:27:28.823Z","title":"blk-mq: pop cached request if it is usable","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-64016","published":"2026-07-19T15:39:11.266Z","updated":"2026-09-14T11:58:34.345Z","title":"ksmbd: fix durable reconnect error path file lifetime","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00671,"kevAdded":null},{"id":"CVE-2026-64015","published":"2026-07-19T15:39:10.557Z","updated":"2026-10-30T12:27:27.767Z","title":"security/keys: fix missed RCU read section on lookup","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-64014","published":"2026-07-19T14:56:27.995Z","updated":"2026-07-19T14:56:27.995Z","title":"Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-64013","published":"2026-07-19T14:56:27.365Z","updated":"2026-10-15T10:07:54.966Z","title":"ACPI: button: Fix ACPI GPE handler leak during removal","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-64012","published":"2026-07-19T14:56:26.608Z","updated":"2026-07-19T14:56:26.608Z","title":"net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-64011","published":"2026-07-19T14:56:25.901Z","updated":"2026-08-05T12:38:11.263Z","title":"nfc: llcp: Fix use-after-free in llcp_sock_release()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-64010","published":"2026-07-19T14:56:25.162Z","updated":"2026-08-05T12:38:10.194Z","title":"nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-64009","published":"2026-07-19T14:56:24.448Z","updated":"2026-10-19T20:28:08.230Z","title":"xfrm: Check for underflow in xfrm_state_mtu","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2026-64008","published":"2026-07-19T14:56:23.746Z","updated":"2026-08-05T12:38:08.050Z","title":"accel/rocket: fix UAF via dangling GEM handle in create_bo","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-64007","published":"2026-07-19T14:56:23.049Z","updated":"2026-10-19T20:28:08.086Z","title":"netfilter: synproxy: refresh tcphdr after skb_ensure_writable","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-64006","published":"2026-07-19T14:56:22.321Z","updated":"2026-10-30T12:27:26.715Z","title":"netfilter: nf_tables: fix dst corruption in same register operation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-64005","published":"2026-07-19T14:56:21.608Z","updated":"2026-10-19T20:18:02.958Z","title":"net/smc: Do not re-initialize smc hashtables","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-64004","published":"2026-07-19T14:56:20.895Z","updated":"2026-10-19T20:18:02.698Z","title":"net/iucv: fix locking in .getsockopt","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-64003","published":"2026-07-19T14:56:20.172Z","updated":"2026-10-19T20:18:02.511Z","title":"scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00441,"kevAdded":null},{"id":"CVE-2026-64002","published":"2026-07-19T14:56:19.495Z","updated":"2026-10-19T20:18:02.288Z","title":"ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-64001","published":"2026-07-19T14:56:18.816Z","updated":"2026-10-21T12:42:53.657Z","title":"ALSA: pcm: oss: Fix setup list UAF on proc write error","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-64000","published":"2026-07-19T14:56:18.116Z","updated":"2026-10-19T20:18:02.077Z","title":"net: hsr: fix potential OOB access in supervision frame handling","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00491,"kevAdded":null},{"id":"CVE-2026-63999","published":"2026-07-19T14:56:17.383Z","updated":"2026-10-21T12:42:52.556Z","title":"ethtool: rss: fix indir_table and hkey leak on get_rxfh failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-63998","published":"2026-07-19T14:56:16.664Z","updated":"2026-10-21T12:42:51.445Z","title":"ethtool: module: call ethnl_ops_complete() on module flash errors","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-63997","published":"2026-07-19T14:56:15.965Z","updated":"2026-07-19T14:56:15.965Z","title":"ethtool: module: avoid leaking a netdev ref on module flash errors","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-63996","published":"2026-07-19T14:56:15.256Z","updated":"2026-10-19T20:18:01.872Z","title":"ethtool: cmis: require exact CDB reply length","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-63995","published":"2026-07-19T14:56:14.580Z","updated":"2026-10-19T20:18:01.681Z","title":"ethtool: cmis: validate start_cmd_payload_size from module","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-63994","published":"2026-07-19T14:56:13.896Z","updated":"2026-10-19T20:18:01.494Z","title":"tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-63993","published":"2026-07-19T14:56:13.218Z","updated":"2026-10-19T20:18:01.347Z","title":"vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-63992","published":"2026-07-19T14:56:12.528Z","updated":"2026-10-19T20:18:01.188Z","title":"tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-63991","published":"2026-07-19T14:56:11.824Z","updated":"2026-07-19T14:56:11.824Z","title":"Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-63990","published":"2026-07-19T14:56:11.111Z","updated":"2026-07-19T14:56:11.111Z","title":"bonding: refuse to enslave CAN devices","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-63989","published":"2026-07-19T14:56:10.396Z","updated":"2026-07-19T14:56:10.396Z","title":"bridge: Fix sleep in atomic context in netlink path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-63988","published":"2026-07-19T14:56:09.677Z","updated":"2026-07-19T14:56:09.677Z","title":"bridge: Fix sleep in atomic context in sysfs path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-63987","published":"2026-07-19T14:56:08.940Z","updated":"2026-10-19T20:18:01.044Z","title":"ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-63986","published":"2026-07-19T14:56:08.203Z","updated":"2026-07-19T14:56:08.203Z","title":"ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-63985","published":"2026-07-19T14:56:07.527Z","updated":"2026-10-19T20:18:00.907Z","title":"ethtool: eeprom: add more safeties to EEPROM Netlink fallback","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-63984","published":"2026-07-19T14:56:06.786Z","updated":"2026-10-19T20:18:00.765Z","title":"ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-63983","published":"2026-07-19T14:56:06.047Z","updated":"2026-10-15T10:07:53.892Z","title":"net/sched: fix packet loop on netem when duplicate is on","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-63982","published":"2026-07-19T14:56:05.329Z","updated":"2026-07-19T14:56:05.329Z","title":"net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-63981","published":"2026-07-19T14:56:04.580Z","updated":"2026-07-19T14:56:04.580Z","title":"net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-63980","published":"2026-07-19T14:56:03.887Z","updated":"2026-10-19T20:18:00.627Z","title":"net/handshake: Use spin_lock_bh for hn_lock","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2026-63979","published":"2026-07-19T14:56:03.177Z","updated":"2026-10-21T12:42:50.338Z","title":"net/handshake: hand off the pinned file reference to accept_doit","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00635,"kevAdded":null},{"id":"CVE-2026-63978","published":"2026-07-19T14:56:02.484Z","updated":"2026-10-21T12:42:49.209Z","title":"net/handshake: Drain pending requests at net namespace exit","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0049,"kevAdded":null},{"id":"CVE-2026-63977","published":"2026-07-19T14:56:01.889Z","updated":"2026-10-19T20:18:00.021Z","title":"dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-63976","published":"2026-07-19T14:56:01.284Z","updated":"2026-10-19T20:17:59.859Z","title":"Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00569,"kevAdded":null},{"id":"CVE-2026-63975","published":"2026-07-19T14:56:00.662Z","updated":"2026-10-19T20:17:59.722Z","title":"Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-63974","published":"2026-07-19T14:55:59.994Z","updated":"2026-10-30T12:27:25.652Z","title":"Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00347,"kevAdded":null},{"id":"CVE-2026-63973","published":"2026-07-19T14:55:59.263Z","updated":"2026-07-19T14:55:59.263Z","title":"net: mana: Add NULL guards in teardown path to prevent panic on attach failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-63972","published":"2026-07-19T14:55:58.503Z","updated":"2026-08-05T12:37:43.858Z","title":"net: mana: Skip redundant detach on already-detached port","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-63971","published":"2026-07-19T14:55:57.792Z","updated":"2026-10-19T20:17:59.440Z","title":"sctp: fix race between sctp_wait_for_connect and peeloff","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-63970","published":"2026-07-19T14:55:57.067Z","updated":"2026-10-19T20:17:59.302Z","title":"vsock/virtio: bind uarg before filling zerocopy skb","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-63969","published":"2026-07-19T14:55:56.330Z","updated":"2026-07-19T14:55:56.330Z","title":"ipv6: fix possible infinite loop in rt6_fill_node()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-63968","published":"2026-07-19T14:55:55.620Z","updated":"2026-10-19T20:17:59.162Z","title":"ipv6: fix possible infinite loop in fib6_select_path()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00665,"kevAdded":null},{"id":"CVE-2026-63967","published":"2026-07-19T14:55:54.999Z","updated":"2026-07-19T14:55:54.999Z","title":"iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-63966","published":"2026-07-19T14:55:54.391Z","updated":"2026-07-19T14:55:54.391Z","title":"iio: imu: adis16550: fix stack leak in trigger handler","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2026-63965","published":"2026-07-19T14:55:53.809Z","updated":"2026-07-19T14:55:53.809Z","title":"iio: pressure: bmp280: fix stack leak in bmp580 trigger handler","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2026-63964","published":"2026-07-19T14:55:53.115Z","updated":"2026-07-20T06:41:45.132Z","title":"usb: typec: ucsi: ccg: reject firmware images without a ':' record header","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-63963","published":"2026-07-19T14:55:52.388Z","updated":"2026-10-30T12:27:24.562Z","title":"usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-63962","published":"2026-07-19T14:55:51.682Z","updated":"2026-10-30T12:27:23.506Z","title":"usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-63961","published":"2026-07-19T14:55:50.993Z","updated":"2026-07-20T06:41:41.563Z","title":"usb: typec: altmodes/displayport: validate count before reading Status Update VDO","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-63960","published":"2026-07-19T14:55:50.282Z","updated":"2026-07-20T06:41:40.389Z","title":"usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-63959","published":"2026-07-19T14:55:49.553Z","updated":"2026-10-30T12:27:22.431Z","title":"usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-63958","published":"2026-07-19T14:55:48.835Z","updated":"2026-07-20T06:41:38.075Z","title":"usb: typec: ucsi: validate connector number in ucsi_connector_change()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-63957","published":"2026-07-19T14:55:48.196Z","updated":"2026-07-19T14:55:48.196Z","title":"USB: serial: safe_serial: fix memory corruption with small endpoint","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-63956","published":"2026-07-19T14:55:47.597Z","updated":"2026-07-19T14:55:47.597Z","title":"USB: serial: cypress_m8: fix memory corruption with small endpoint","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-63955","published":"2026-07-19T14:55:46.903Z","updated":"2026-08-05T12:37:39.551Z","title":"mm/vmalloc: do not trigger BUG() on BH disabled context","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-63954","published":"2026-07-19T14:55:46.183Z","updated":"2026-08-05T12:37:38.482Z","title":"hpfs: fix a crash if hpfs_map_dnode_bitmap fails","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-63953","published":"2026-07-19T14:55:45.509Z","updated":"2026-07-19T14:55:45.509Z","title":"mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2026-63952","published":"2026-07-19T14:55:44.809Z","updated":"2026-10-19T20:17:59.011Z","title":"memfd: deny writeable mappings when implying SEAL_WRITE","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-63951","published":"2026-07-19T14:55:44.105Z","updated":"2026-08-05T12:37:36.330Z","title":"zram: fix use-after-free in zram_writeback_endio","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-63950","published":"2026-07-19T14:55:43.404Z","updated":"2026-08-05T12:37:35.244Z","title":"mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-63949","published":"2026-07-19T14:55:42.679Z","updated":"2026-07-19T14:55:42.679Z","title":"auxdisplay: line-display: fix OOB read on zero-length message_store()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-63948","published":"2026-07-19T14:55:41.985Z","updated":"2026-07-19T14:55:41.985Z","title":"Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-63947","published":"2026-07-19T14:55:41.306Z","updated":"2026-10-19T20:17:58.868Z","title":"Bluetooth: HIDP: fix missing length checks in hidp_input_report()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00347,"kevAdded":null},{"id":"CVE-2026-63946","published":"2026-07-19T14:55:40.577Z","updated":"2026-10-19T20:17:58.710Z","title":"Bluetooth: ISO: fix UAF in iso_recv_frame","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-63945","published":"2026-07-19T14:55:39.859Z","updated":"2026-10-19T20:17:58.555Z","title":"Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-63944","published":"2026-07-19T14:55:39.105Z","updated":"2026-10-19T20:17:58.398Z","title":"Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2026-63943","published":"2026-07-19T14:55:38.411Z","updated":"2026-07-19T14:55:38.411Z","title":"Input: xpad - fix out-of-bounds access for Share button","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-63942","published":"2026-07-19T14:55:37.717Z","updated":"2026-10-19T20:17:58.246Z","title":"parport: Fix race between port and client registration","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-63941","published":"2026-07-19T14:55:37.047Z","updated":"2026-10-19T20:17:58.094Z","title":"KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2026-63940","published":"2026-07-19T14:55:36.408Z","updated":"2026-10-30T12:27:21.359Z","title":"KVM: SEV: Ignore Port I/O requests of length '0'","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-63939","published":"2026-07-19T14:55:35.743Z","updated":"2026-10-19T20:17:57.791Z","title":"KVM: SEV: Compute the correct max length of the in-GHCB scratch area","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-63938","published":"2026-07-19T14:55:35.168Z","updated":"2026-10-19T20:17:57.657Z","title":"KVM: SEV: Check PSC request indices against the actual size of the buffer","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-63937","published":"2026-07-19T14:55:34.554Z","updated":"2026-10-19T20:17:57.516Z","title":"KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-63936","published":"2026-07-19T14:55:33.942Z","updated":"2026-07-19T14:55:33.942Z","title":"iio: adc: mt6359: fix unchecked return value in mt6358_read_imp","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-63935","published":"2026-07-19T14:55:33.321Z","updated":"2026-07-19T14:55:33.321Z","title":"iio: adc: nxp-sar-adc: fix division by zero in write_raw","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-63934","published":"2026-07-19T14:55:32.681Z","updated":"2026-07-19T14:55:32.681Z","title":"iio: gyro: itg3200: fix i2c read into the wrong stack location","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-63933","published":"2026-07-19T14:55:32.071Z","updated":"2026-07-19T14:55:32.071Z","title":"iio: gyro: adis16260: fix division by zero in write_raw","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-63932","published":"2026-07-19T14:55:31.460Z","updated":"2026-07-19T14:55:31.460Z","title":"iio: chemical: mhz19b: reject oversized serial replies","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2026-63931","published":"2026-07-19T14:55:30.718Z","updated":"2026-07-19T14:55:30.718Z","title":"iio: chemical: scd30: fix division by zero in write_raw","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-63930","published":"2026-07-19T14:55:30.016Z","updated":"2026-08-05T12:37:23.422Z","title":"iio: buffer: hw-consumer: fix use-after-free in error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-63929","published":"2026-07-19T14:55:29.309Z","updated":"2026-07-19T14:55:29.309Z","title":"iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-63928","published":"2026-07-19T14:55:28.593Z","updated":"2026-07-19T14:55:28.593Z","title":"USB: serial: omninet: fix memory corruption with small endpoint","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-63927","published":"2026-07-19T14:55:27.864Z","updated":"2026-10-19T20:17:57.379Z","title":"usb: dwc2: Fix use after free in debug code","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-63926","published":"2026-07-19T14:55:27.154Z","updated":"2026-10-19T20:17:57.234Z","title":"bpf: sockmap: fix tail fragment offset in bpf_msg_push_data","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-63925","published":"2026-07-19T14:55:26.442Z","updated":"2026-10-19T20:17:57.078Z","title":"macsec: fix replay protection at XPN lower-PN wrap","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00347,"kevAdded":null},{"id":"CVE-2026-63924","published":"2026-07-19T14:55:25.702Z","updated":"2026-10-19T20:17:56.915Z","title":"ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-63923","published":"2026-07-19T14:55:24.985Z","updated":"2026-10-19T20:17:56.756Z","title":"octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-63922","published":"2026-07-19T14:55:24.268Z","updated":"2026-10-19T20:17:56.594Z","title":"ipv6: exthdrs: refresh nh after handling HAO option","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-63921","published":"2026-07-19T14:55:23.539Z","updated":"2026-10-19T20:17:56.432Z","title":"ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2026-63920","published":"2026-07-19T14:55:22.813Z","updated":"2026-10-19T20:17:56.265Z","title":"ipv6: validate extension header length before copying to cmsg","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-63919","published":"2026-07-19T14:55:22.121Z","updated":"2026-10-19T20:17:56.102Z","title":"xfrm: input: hold netns during deferred transport reinjection","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0065,"kevAdded":null},{"id":"CVE-2026-63918","published":"2026-07-19T14:55:21.414Z","updated":"2026-08-05T12:37:12.656Z","title":"l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-63917","published":"2026-07-19T14:55:20.703Z","updated":"2026-10-19T20:17:55.945Z","title":"ip6: vti: Use ip6_tnl.net in vti6_changelink().","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-63916","published":"2026-07-19T14:55:20.015Z","updated":"2026-10-19T20:17:55.788Z","title":"HID: wacom: Fix OOB write in wacom_hid_set_device_mode()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00355,"kevAdded":null},{"id":"CVE-2026-63915","published":"2026-07-19T14:55:19.305Z","updated":"2026-08-05T12:37:09.414Z","title":"nfc: hci: fix out-of-bounds read in HCP header parsing","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00354,"kevAdded":null},{"id":"CVE-2026-63914","published":"2026-07-19T14:55:18.618Z","updated":"2026-10-19T20:17:55.631Z","title":"xfrm: route MIGRATE notifications to caller's netns","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-63913","published":"2026-07-19T14:55:17.917Z","updated":"2026-10-19T20:17:55.476Z","title":"netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00971,"kevAdded":null},{"id":"CVE-2026-63912","published":"2026-07-19T14:55:17.188Z","updated":"2026-10-19T20:17:55.311Z","title":"xfrm: esp: restore combined single-frag length gate","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-63911","published":"2026-07-19T14:55:16.496Z","updated":"2026-08-05T12:37:05.089Z","title":"xfrm: iptfs: reset runtime state when cloning SAs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-63910","published":"2026-07-19T14:55:15.770Z","updated":"2026-08-05T12:37:04.026Z","title":"dma-buf: fix UAF in dma_buf_fd() tracepoint","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-63909","published":"2026-07-19T14:55:15.060Z","updated":"2026-08-05T12:37:02.949Z","title":"ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00628,"kevAdded":null},{"id":"CVE-2026-63908","published":"2026-07-19T14:55:14.349Z","updated":"2026-07-19T14:55:14.349Z","title":"Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-63907","published":"2026-07-19T14:55:13.652Z","updated":"2026-07-19T14:55:13.652Z","title":"uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-63906","published":"2026-07-19T14:55:12.982Z","updated":"2026-08-05T12:37:01.876Z","title":"usb: musb: omap2430: Fix use-after-free in omap2430_probe()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-63905","published":"2026-07-19T14:55:12.270Z","updated":"2026-07-19T14:55:12.270Z","title":"usbip: vudc: Fix use after free bug in vudc_remove due to race condition","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-63904","published":"2026-07-19T14:55:11.547Z","updated":"2026-07-19T14:55:11.547Z","title":"usb: usbtmc: check URB actual_length for interrupt-IN notifications","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-63903","published":"2026-07-19T14:55:10.905Z","updated":"2026-07-19T14:55:10.905Z","title":"USB: serial: belkin_sa: validate interrupt status length","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-63902","published":"2026-07-19T14:55:10.267Z","updated":"2026-07-19T14:55:10.267Z","title":"USB: serial: cypress_m8: validate interrupt packet headers","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-63901","published":"2026-07-19T14:55:09.553Z","updated":"2026-07-19T14:55:09.553Z","title":"USB: serial: digi_acceleport: fix memory corruption with small endpoints","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-63900","published":"2026-07-19T14:55:08.847Z","updated":"2026-07-19T14:55:08.847Z","title":"USB: serial: keyspan: fix missing indat transfer sanity check","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-63899","published":"2026-07-19T14:55:08.116Z","updated":"2026-07-19T14:55:08.116Z","title":"USB: serial: mxuport: fix memory corruption with small endpoint","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-63898","published":"2026-07-19T14:55:07.452Z","updated":"2026-07-19T14:55:07.452Z","title":"USB: serial: mct_u232: fix memory corruption with small endpoint","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-63897","published":"2026-07-19T14:55:06.845Z","updated":"2026-07-19T14:55:06.845Z","title":"USB: serial: mct_u232: fix missing interrupt-in transfer sanity check","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-63896","published":"2026-07-19T14:55:06.152Z","updated":"2026-07-19T14:55:06.152Z","title":"usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-63895","published":"2026-07-19T14:55:05.479Z","updated":"2026-07-19T14:55:05.479Z","title":"usb: gadget: f_fs: copy only received bytes on short ep0 read","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-63894","published":"2026-07-19T14:55:04.882Z","updated":"2026-08-05T12:37:00.788Z","title":"usb: gadget: f_fs: serialize DMABUF cancel against request completion","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-63893","published":"2026-07-19T14:55:04.288Z","updated":"2026-10-19T20:17:55.146Z","title":"thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00387,"kevAdded":null},{"id":"CVE-2026-63892","published":"2026-07-19T14:55:03.568Z","updated":"2026-07-19T14:55:03.568Z","title":"thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-63891","published":"2026-07-19T14:55:02.840Z","updated":"2026-07-19T14:55:02.840Z","title":"thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2026-63890","published":"2026-07-19T14:55:02.195Z","updated":"2026-07-19T14:55:02.195Z","title":"scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2026-63889","published":"2026-07-19T14:55:01.515Z","updated":"2026-10-19T20:17:54.988Z","title":"scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2026-63888","published":"2026-07-19T14:55:00.803Z","updated":"2026-10-19T20:17:54.825Z","title":"scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00778,"kevAdded":null},{"id":"CVE-2026-63887","published":"2026-07-19T14:55:00.114Z","updated":"2026-10-19T20:17:54.668Z","title":"scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00778,"kevAdded":null},{"id":"CVE-2026-63886","published":"2026-07-19T14:54:59.395Z","updated":"2026-10-19T20:17:54.510Z","title":"scsi: target: iscsi: Validate CHAP_R length before base64 decode","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00711,"kevAdded":null},{"id":"CVE-2026-63885","published":"2026-07-19T14:54:58.590Z","updated":"2026-10-19T20:17:54.350Z","title":"drm/gem: fix race between change_handle and handle_delete","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-63884","published":"2026-07-19T14:54:57.520Z","updated":"2026-10-19T20:17:54.188Z","title":"drm/i915: Fix potential UAF in TTM object purge","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-63883","published":"2026-07-19T14:54:56.356Z","updated":"2026-08-05T12:36:52.126Z","title":"serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-63882","published":"2026-07-19T14:54:55.027Z","updated":"2026-07-20T06:41:35.719Z","title":"drm/amdkfd: fix NULL pointer bug in svm_range_set_attr","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-63881","published":"2026-07-19T14:54:53.676Z","updated":"2026-10-19T20:17:54.018Z","title":"drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-63880","published":"2026-07-19T14:54:52.397Z","updated":"2026-07-19T14:54:52.397Z","title":"drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-63879","published":"2026-07-19T14:54:51.698Z","updated":"2026-10-21T12:42:43.701Z","title":"drm/amdgpu: fix amdgpu_hmm_range_get_pages","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-63878","published":"2026-07-19T14:54:50.977Z","updated":"2026-07-19T14:54:50.977Z","title":"drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-63877","published":"2026-07-19T14:54:50.257Z","updated":"2026-07-19T14:54:50.257Z","title":"serial: dz: Convert to use a platform device","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-63876","published":"2026-07-19T14:54:49.549Z","updated":"2026-07-19T14:54:49.549Z","title":"serial: zs: Convert to use a platform device","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-63875","published":"2026-07-19T14:54:48.842Z","updated":"2026-10-19T20:17:53.723Z","title":"arm64: tlb: Flush walk cache when unsharing PMD tables","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-63874","published":"2026-07-19T14:18:41.907Z","updated":"2026-08-05T12:36:47.817Z","title":"net: mctp: usb: fix race between urb completion and rx_retry cancellation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-63873","published":"2026-07-19T14:18:41.197Z","updated":"2026-07-19T14:18:41.197Z","title":"accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-63871","published":"2026-07-19T14:18:39.787Z","updated":"2026-10-30T12:27:20.291Z","title":"Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-63870","published":"2026-07-19T14:18:39.113Z","updated":"2026-10-19T20:17:53.580Z","title":"ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-63869","published":"2026-07-19T14:18:38.426Z","updated":"2026-10-19T20:17:53.439Z","title":"wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap","severity":"HIGH","score":7.6,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2026-63868","published":"2026-07-19T14:18:37.823Z","updated":"2026-07-19T14:18:37.823Z","title":"net: garp: fix unsigned integer underflow in garp_pdu_parse_attr","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-63867","published":"2026-07-19T14:18:37.234Z","updated":"2026-10-19T20:17:53.288Z","title":"mptcp: close TOCTOU race while computing rcv_wnd","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-63866","published":"2026-07-19T14:04:51.806Z","updated":"2026-08-05T12:36:42.414Z","title":"wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-63865","published":"2026-07-19T14:04:51.215Z","updated":"2026-08-05T12:36:41.333Z","title":"bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-63864","published":"2026-07-19T14:04:50.605Z","updated":"2026-08-05T12:36:40.261Z","title":"bpf: Propagate error from visit_tailcall_insn","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-63863","published":"2026-07-19T14:04:49.967Z","updated":"2026-10-19T20:17:53.141Z","title":"drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-63862","published":"2026-07-19T14:04:49.380Z","updated":"2026-07-19T14:04:49.380Z","title":"PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-63861","published":"2026-07-19T14:04:48.793Z","updated":"2026-07-19T14:04:48.793Z","title":"spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-63860","published":"2026-07-19T14:04:48.153Z","updated":"2026-10-19T20:07:52.376Z","title":"RDMA/core: Prefer NLA_NUL_STRING","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-63859","published":"2026-07-19T14:04:47.572Z","updated":"2026-10-21T12:42:42.608Z","title":"net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-63858","published":"2026-07-19T14:04:46.967Z","updated":"2026-10-19T20:07:52.230Z","title":"netfilter: nf_tables: add hook transactions for device deletions","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-63857","published":"2026-07-19T14:04:46.339Z","updated":"2026-10-21T12:42:41.508Z","title":"net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00671,"kevAdded":null},{"id":"CVE-2026-63856","published":"2026-07-19T14:04:45.716Z","updated":"2026-10-30T12:27:19.219Z","title":"drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-63855","published":"2026-07-19T14:04:45.096Z","updated":"2026-10-30T12:27:18.153Z","title":"drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-63854","published":"2026-07-19T14:04:44.487Z","updated":"2026-10-30T12:27:17.101Z","title":"drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-63853","published":"2026-07-19T14:04:43.885Z","updated":"2026-10-30T12:27:16.028Z","title":"drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-63852","published":"2026-07-19T14:04:43.258Z","updated":"2026-10-19T20:07:51.529Z","title":"drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-63851","published":"2026-07-19T14:04:42.581Z","updated":"2026-10-19T20:07:51.377Z","title":"drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-63850","published":"2026-07-19T14:04:41.975Z","updated":"2026-10-19T20:07:51.232Z","title":"drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-63849","published":"2026-07-19T14:04:41.395Z","updated":"2026-10-19T20:07:51.086Z","title":"drm/amdgpu/vcn: set no_user_fence for VCN v5.0.1 enc ring","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-63848","published":"2026-07-19T14:04:40.798Z","updated":"2026-10-30T12:27:14.972Z","title":"drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-63847","published":"2026-07-19T14:04:40.248Z","updated":"2026-10-30T12:27:13.915Z","title":"drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-63846","published":"2026-07-19T14:04:39.674Z","updated":"2026-10-30T12:27:12.843Z","title":"drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-63845","published":"2026-07-19T14:04:39.084Z","updated":"2026-10-30T12:27:11.777Z","title":"drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-63844","published":"2026-07-19T14:04:38.452Z","updated":"2026-10-19T20:07:50.354Z","title":"drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-63843","published":"2026-07-19T14:04:37.815Z","updated":"2026-10-19T20:07:50.201Z","title":"drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-63842","published":"2026-07-19T14:04:37.212Z","updated":"2026-10-19T20:07:50.047Z","title":"drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-63841","published":"2026-07-19T14:04:36.591Z","updated":"2026-10-19T20:07:49.903Z","title":"drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.1 ring","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-63840","published":"2026-07-19T14:04:35.890Z","updated":"2026-10-19T20:07:49.767Z","title":"drm/amdgpu/jpeg: set no_user_fence for JPEG v5.3.0 ring","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-63839","published":"2026-07-19T14:04:35.146Z","updated":"2026-09-07T15:45:02.719Z","title":"platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-63838","published":"2026-07-19T14:04:34.454Z","updated":"2026-07-19T14:04:34.454Z","title":"ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-63837","published":"2026-07-19T14:04:33.781Z","updated":"2026-07-19T14:04:33.781Z","title":"net: ena: PHC: Check return code before setting timestamp output","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-63836","published":"2026-07-19T12:02:27.166Z","updated":"2026-08-17T04:51:47.476Z","title":"batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-63835","published":"2026-07-19T12:02:26.574Z","updated":"2026-08-17T04:51:45.552Z","title":"batman-adv: v: prevent OGM aggregation on disabled hardif","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-63834","published":"2026-07-19T12:02:26.045Z","updated":"2026-08-17T04:51:44.393Z","title":"batman-adv: tp_meter: restrict number of unacked list entries","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-63833","published":"2026-07-19T12:02:25.469Z","updated":"2026-10-19T20:07:49.624Z","title":"ntfs3: reject direct userspace writes to reserved $LX* xattrs","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2026-63832","published":"2026-07-19T12:02:24.908Z","updated":"2026-10-21T12:42:39.285Z","title":"wifi: mt76: add wcid publish check in mt76_sta_add","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2026-63831","published":"2026-07-19T12:02:24.320Z","updated":"2026-10-19T20:07:49.327Z","title":"mac802154: llsec: add skb_cow_data() before in-place crypto","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00307,"kevAdded":null},{"id":"CVE-2026-63830","published":"2026-07-19T12:02:23.741Z","updated":"2026-10-19T20:07:49.188Z","title":"net: skmsg: preserve sg.copy across SG transforms","severity":"CRITICAL","score":9.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00441,"kevAdded":null},{"id":"CVE-2026-63829","published":"2026-07-19T12:02:23.191Z","updated":"2026-10-19T20:07:49.035Z","title":"net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2026-63828","published":"2026-07-19T12:02:22.644Z","updated":"2026-08-17T04:51:36.839Z","title":"apparmor: mediate the implicit connect of TCP fast open sendmsg","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-63827","published":"2026-07-19T12:02:22.083Z","updated":"2026-08-17T04:51:35.761Z","title":"apparmor: fix use-after-free in rawdata dedup loop","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-63826","published":"2026-07-19T12:02:21.518Z","updated":"2026-10-30T12:27:10.712Z","title":"fbdev: fix use-after-free in store_modes()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-63825","published":"2026-07-19T12:02:20.968Z","updated":"2026-10-30T12:27:09.657Z","title":"gcov: use atomic counter updates to fix concurrent access crashes","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00861,"kevAdded":null},{"id":"CVE-2026-63824","published":"2026-07-19T12:02:20.406Z","updated":"2026-10-19T20:07:48.872Z","title":"KEYS: fix overflow in keyctl_pkey_params_get_2()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-63823","published":"2026-07-19T12:02:19.847Z","updated":"2026-10-19T20:07:48.726Z","title":"keys: Pin request_key_auth payload in instantiate paths","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-63822","published":"2026-07-19T12:02:19.286Z","updated":"2026-08-17T04:51:30.121Z","title":"wifi: ath11k: fix warning when unbinding","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-63821","published":"2026-07-19T12:02:18.751Z","updated":"2026-08-17T04:51:28.975Z","title":"wifi: rtw88: usb: fix memory leaks on USB write failures","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-63820","published":"2026-07-19T12:02:18.211Z","updated":"2026-08-17T04:51:27.881Z","title":"f2fs: fix missing read bio submission on large folio error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-63819","published":"2026-07-19T12:02:17.613Z","updated":"2026-08-17T04:51:26.786Z","title":"f2fs: fix to do sanity check on f2fs_get_node_folio_ra()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-63818","published":"2026-07-19T12:02:17.022Z","updated":"2026-08-17T04:51:25.680Z","title":"f2fs: validate orphan inode entry count","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2026-63817","published":"2026-07-19T12:02:16.441Z","updated":"2026-08-17T04:51:24.577Z","title":"f2fs: validate compress cache inode only when enabled","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-63816","published":"2026-07-19T12:02:15.907Z","updated":"2026-08-17T04:51:23.480Z","title":"f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-63815","published":"2026-07-19T12:02:15.345Z","updated":"2026-08-17T04:51:22.389Z","title":"f2fs: bound i_inline_xattr_size for non-inline-xattr inodes","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-63814","published":"2026-07-19T12:02:14.771Z","updated":"2026-08-17T04:51:21.283Z","title":"f2fs: validate ACL entry sizes in f2fs_acl_from_disk()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-63813","published":"2026-07-19T12:02:14.205Z","updated":"2026-08-17T04:51:20.171Z","title":"Revert \"f2fs: remove non-uptodate folio from the page cache in move_data_block\"","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-63812","published":"2026-07-19T12:02:13.606Z","updated":"2026-10-30T12:27:08.582Z","title":"f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-63811","published":"2026-07-19T12:02:13.057Z","updated":"2026-10-21T12:42:37.074Z","title":"f2fs: read COW data with the original inode during atomic write","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-63810","published":"2026-07-19T12:02:12.484Z","updated":"2026-10-15T01:23:32.309Z","title":"block: Avoid mounting the bdev pseudo-filesystem in userspace","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-63809","published":"2026-07-19T12:02:11.905Z","updated":"2026-10-19T20:07:48.575Z","title":"bpf: use kvfree() for replaced sysctl write buffer","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-63808","published":"2026-07-19T12:02:11.323Z","updated":"2026-10-19T20:07:48.432Z","title":"exfat: fix potential use-after-free in exfat_find_dir_entry()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00527,"kevAdded":null},{"id":"CVE-2026-63807","published":"2026-07-19T12:02:10.759Z","updated":"2026-10-19T20:07:48.277Z","title":"KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-63806","published":"2026-07-19T12:02:10.209Z","updated":"2026-10-19T20:07:48.133Z","title":"KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-63805","published":"2026-07-19T12:02:09.669Z","updated":"2026-08-17T04:51:11.095Z","title":"crypto: nx - fix nx_crypto_ctx_exit argument","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-63804","published":"2026-07-19T12:02:09.111Z","updated":"2026-08-17T04:51:09.991Z","title":"gfs2: fix use-after-free in gfs2_qd_dealloc","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-63803","published":"2026-07-19T12:02:08.574Z","updated":"2026-10-19T20:07:47.971Z","title":"hdlc_ppp: sync per-proto timers before freeing hdlc state","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-63802","published":"2026-07-19T12:02:08.020Z","updated":"2026-10-19T20:07:47.815Z","title":"blk-cgroup: fix UAF in __blkcg_rstat_flush()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00102,"kevAdded":null},{"id":"CVE-2026-63801","published":"2026-07-19T12:02:07.457Z","updated":"2026-10-19T20:07:47.669Z","title":"tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00513,"kevAdded":null},{"id":"CVE-2026-63800","published":"2026-07-19T12:02:06.897Z","updated":"2026-10-19T20:07:47.475Z","title":"pNFS: Fix use-after-free in pnfs_update_layout()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00644,"kevAdded":null},{"id":"CVE-2026-63799","published":"2026-07-19T12:02:06.341Z","updated":"2026-08-17T04:51:04.486Z","title":"sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-63798","published":"2026-07-19T12:02:05.783Z","updated":"2026-08-17T04:51:03.369Z","title":"irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-63797","published":"2026-07-19T12:02:05.227Z","updated":"2026-08-17T04:51:02.287Z","title":"rpmsg: char: Fix use-after-free on probe error path","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-63796","published":"2026-07-19T12:02:04.634Z","updated":"2026-10-19T20:07:47.316Z","title":"ocfs2: reject oversized group bitmap descriptors","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00587,"kevAdded":null},{"id":"CVE-2026-63795","published":"2026-07-19T12:02:04.069Z","updated":"2026-10-19T20:07:47.155Z","title":"9p: avoid putting oldfid in p9_client_walk() error path","severity":"CRITICAL","score":10,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00615,"kevAdded":null},{"id":"CVE-2026-63794","published":"2026-07-19T12:02:03.488Z","updated":"2026-08-17T04:50:58.924Z","title":"KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-63793","published":"2026-07-19T12:02:02.946Z","updated":"2026-08-17T04:50:57.837Z","title":"ntfs: serialize volume label accesses","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-53403","published":"2026-07-19T12:02:02.382Z","updated":"2026-08-17T04:50:56.753Z","title":"fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-53402","published":"2026-07-19T12:02:01.795Z","updated":"2026-10-19T20:07:47.003Z","title":"fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-53401","published":"2026-07-19T12:02:01.209Z","updated":"2026-10-30T12:27:07.510Z","title":"fbdev: omap2: fix use-after-free in omapfb_mmap","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2026-53400","published":"2026-07-19T12:02:00.632Z","updated":"2026-10-19T20:07:46.858Z","title":"i2c: core: fix adapter registration race","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-53399","published":"2026-07-19T12:02:00.055Z","updated":"2026-10-19T20:07:46.712Z","title":"nfsd: release layout stid on setlease failure","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00663,"kevAdded":null},{"id":"CVE-2026-53398","published":"2026-07-19T12:01:59.507Z","updated":"2026-10-19T20:07:46.561Z","title":"NFSD: Fix SECINFO_NO_NAME decode error cleanup","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00543,"kevAdded":null},{"id":"CVE-2026-53397","published":"2026-07-19T12:01:58.938Z","updated":"2026-10-19T20:07:46.415Z","title":"nfsd: fix posix_acl leak on SETACL decode failure","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00529,"kevAdded":null},{"id":"CVE-2026-53396","published":"2026-07-19T12:01:58.375Z","updated":"2026-08-17T04:50:48.148Z","title":"nfsd: fix posix_acl leak and ignored error in nfsd4_create_file","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0038,"kevAdded":null},{"id":"CVE-2026-53395","published":"2026-07-19T12:01:57.816Z","updated":"2026-08-17T04:50:47.054Z","title":"nfsd: fix dead ACL conflict guard in nfsd4_create","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-53394","published":"2026-07-19T12:01:57.261Z","updated":"2026-10-19T20:07:46.251Z","title":"nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0063,"kevAdded":null},{"id":"CVE-2026-53393","published":"2026-07-19T12:01:56.684Z","updated":"2026-08-17T04:50:44.847Z","title":"nfsd: reset write verifier on deferred writeback errors","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-53392","published":"2026-07-19T12:01:56.101Z","updated":"2026-10-19T20:07:46.094Z","title":"NFSv4/flexfiles: reject zero filehandle version count","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00529,"kevAdded":null},{"id":"CVE-2026-53391","published":"2026-07-19T12:01:55.521Z","updated":"2026-10-19T20:07:45.936Z","title":"NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00517,"kevAdded":null},{"id":"CVE-2026-53390","published":"2026-07-19T12:01:54.951Z","updated":"2026-08-17T04:50:41.549Z","title":"ksmbd: fix out-of-bounds read in smb_check_perm_dacl()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0047,"kevAdded":null},{"id":"CVE-2026-53389","published":"2026-07-19T12:01:54.386Z","updated":"2026-08-17T04:50:40.399Z","title":"net/tcp-ao: fix use-after-free of key in del_async path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-53388","published":"2026-07-19T11:59:34.456Z","updated":"2026-10-19T20:07:45.789Z","title":"fuse: re-lock request before replacing page cache folio","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-53387","published":"2026-07-19T11:59:33.888Z","updated":"2026-08-17T04:50:38.188Z","title":"iio: light: veml6075: add bounds check to veml6075_it_ms index","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-53386","published":"2026-07-19T11:59:33.318Z","updated":"2026-08-17T04:50:37.100Z","title":"iio: adc: ti-ads1298: add bounds check to pga_settings index","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-53385","published":"2026-07-19T11:59:32.732Z","updated":"2026-08-17T04:50:36.006Z","title":"vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-53384","published":"2026-07-19T11:59:32.153Z","updated":"2026-10-19T20:07:45.552Z","title":"serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00515,"kevAdded":null},{"id":"CVE-2026-53383","published":"2026-07-19T11:59:31.616Z","updated":"2026-08-17T04:50:33.785Z","title":"ksmbd: reject non-VALID session in compound request branch","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00664,"kevAdded":null},{"id":"CVE-2026-53382","published":"2026-07-19T11:59:31.045Z","updated":"2026-08-17T04:50:32.686Z","title":"media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-53381","published":"2026-07-19T11:59:30.469Z","updated":"2026-10-19T20:07:45.399Z","title":"virtiofs: fix UAF on submount umount","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-53380","published":"2026-07-19T10:02:02.030Z","updated":"2026-08-05T12:35:20.740Z","title":"media: rzv2h-ivc: Fix concurrent buffer list access","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-53379","published":"2026-07-19T10:02:01.410Z","updated":"2026-07-19T10:02:01.410Z","title":"media: i2c: ov8856: free control handler on error in ov8856_init_controls()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53378","published":"2026-07-19T10:02:00.779Z","updated":"2026-07-19T10:02:00.779Z","title":"drm/colorop: Fix blob property reference tracking in state lifecycle","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-53377","published":"2026-07-19T10:02:00.168Z","updated":"2026-10-30T12:27:06.437Z","title":"drm/msm: always recover the gpu","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-53376","published":"2026-07-19T10:01:59.527Z","updated":"2026-10-30T12:27:05.354Z","title":"drm/amdkfd: Add upper bound check for num_of_nodes","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53375","published":"2026-07-19T10:01:58.898Z","updated":"2026-10-19T20:07:45.249Z","title":"drm/amdgpu/vce: Prevent partial address patches","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-53374","published":"2026-07-19T10:01:58.292Z","updated":"2026-10-19T20:07:45.100Z","title":"drm/amdgpu: zero-initialize GART table on allocation","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-53373","published":"2026-07-19T10:01:57.632Z","updated":"2026-08-05T12:35:17.519Z","title":"mm/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-53372","published":"2026-07-19T09:10:32.453Z","updated":"2026-07-19T09:10:32.453Z","title":"iommu/vt-d: Block PASID attachment to nested domain with dirty tracking","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53371","published":"2026-07-19T09:10:31.706Z","updated":"2026-07-19T09:10:31.706Z","title":"RDMA/ionic: bound node_desc sysfs read with %.64s","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53370","published":"2026-07-19T09:10:30.990Z","updated":"2026-07-19T09:10:30.990Z","title":"perf/x86/intel: Improve validation and configuration of ACR masks","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53369","published":"2026-07-19T09:10:30.283Z","updated":"2026-10-19T20:07:44.924Z","title":"udf: reject descriptors with oversized CRC length","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-53368","published":"2026-07-19T09:10:29.573Z","updated":"2026-10-30T12:27:04.292Z","title":"f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-53367","published":"2026-07-19T09:10:28.879Z","updated":"2026-07-19T09:10:28.879Z","title":"selinux: fix avdcache auditing","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53366","published":"2026-07-16T05:13:40.893Z","updated":"2026-10-19T20:07:44.761Z","title":"ipv4: account for fraggap on the paged allocation path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-53365","published":"2026-07-13T17:33:52.863Z","updated":"2026-08-18T13:29:37.454Z","title":"vsock/virtio: fix zerocopy completion for multi-skb sends","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-53364","published":"2026-07-13T17:33:52.302Z","updated":"2026-08-03T09:32:35.820Z","title":"Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-53363","published":"2026-07-10T11:55:31.820Z","updated":"2026-08-05T12:35:13.152Z","title":"xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00411,"kevAdded":null},{"id":"CVE-2026-53362","published":"2026-07-04T11:56:35.864Z","updated":"2026-10-15T01:23:25.441Z","title":"ipv6: account for fraggap on the paged allocation path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":true,"epss":0.00709,"kevAdded":"2026-08-27"},{"id":"CVE-2026-53361","published":"2026-07-04T11:54:52.543Z","updated":"2026-10-19T20:07:44.591Z","title":"af_unix: Set gc_in_progress to true in unix_gc().","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-53360","published":"2026-07-04T11:53:58.657Z","updated":"2026-10-19T20:07:44.426Z","title":"KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00297,"kevAdded":null},{"id":"CVE-2026-53359","published":"2026-07-04T11:51:49.052Z","updated":"2026-10-03T10:55:36.203Z","title":"KVM: x86: Fix shadow paging use-after-free due to unexpected role","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.01368,"kevAdded":null},{"id":"CVE-2026-53358","published":"2026-07-02T13:43:17.630Z","updated":"2026-10-19T20:07:44.244Z","title":"Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2026-53357","published":"2026-07-02T13:43:17.077Z","updated":"2026-10-19T20:07:44.061Z","title":"Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()","severity":"HIGH","score":8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-53356","published":"2026-07-01T13:32:31.428Z","updated":"2026-10-19T20:07:43.886Z","title":"drm/i915/gem: Fix phys BO pread/pwrite with offset","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-53355","published":"2026-07-01T13:32:30.831Z","updated":"2026-08-05T12:35:04.534Z","title":"net: rds: clear i_sends on setup unwind","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00421,"kevAdded":null},{"id":"CVE-2026-53354","published":"2026-07-01T13:32:30.246Z","updated":"2026-10-19T20:07:43.716Z","title":"arm64: errata: Mitigate TLBI errata on various Arm CPUs","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00104,"kevAdded":null},{"id":"CVE-2026-53353","published":"2026-07-01T13:32:29.699Z","updated":"2026-10-30T12:27:03.234Z","title":"hsr: Remove WARN_ONCE() in hsr_addr_is_self().","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-53352","published":"2026-07-01T13:32:29.105Z","updated":"2026-10-15T01:23:20.147Z","title":"signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-53351","published":"2026-07-01T13:32:28.548Z","updated":"2026-07-01T13:32:28.548Z","title":"riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-53350","published":"2026-07-01T13:32:27.975Z","updated":"2026-10-15T01:23:18.550Z","title":"ASoC: wm_adsp: Fix NULL dereference when removing firmware controls","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-53349","published":"2026-07-01T13:32:27.412Z","updated":"2026-10-15T01:23:17.404Z","title":"netfilter: nf_conntrack: destroy stale expectfn expectations on unregister","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-53348","published":"2026-07-01T13:32:26.850Z","updated":"2026-07-01T13:32:26.850Z","title":"ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-53347","published":"2026-07-01T13:32:26.262Z","updated":"2026-07-01T13:32:26.262Z","title":"drm/virtio: Fix driver removal with disabled KMS","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-53346","published":"2026-07-01T13:32:25.668Z","updated":"2026-07-01T13:32:25.668Z","title":"rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-53345","published":"2026-07-01T13:32:25.098Z","updated":"2026-10-30T12:27:01.055Z","title":"KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-53344","published":"2026-07-01T13:32:24.546Z","updated":"2026-07-01T13:32:24.546Z","title":"pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-53343","published":"2026-07-01T13:32:23.979Z","updated":"2026-07-01T13:32:23.979Z","title":"ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-53342","published":"2026-07-01T13:32:23.449Z","updated":"2026-07-01T13:32:23.449Z","title":"arm64: mm: call pagetable dtor when freeing hot-removed page tables","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53341","published":"2026-07-01T13:32:22.873Z","updated":"2026-10-19T20:07:43.543Z","title":"fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-53340","published":"2026-07-01T13:32:22.276Z","updated":"2026-07-01T13:32:22.276Z","title":"i2c: imx: fix clock and pinctrl state inconsistency in runtime PM","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53339","published":"2026-07-01T13:32:21.709Z","updated":"2026-07-01T13:32:21.709Z","title":"i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-53338","published":"2026-07-01T13:32:21.147Z","updated":"2026-07-01T13:32:21.147Z","title":"net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53337","published":"2026-07-01T13:32:19.046Z","updated":"2026-10-15T01:23:16.239Z","title":"net: bonding: fix NULL pointer dereference in bond_do_ioctl()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-53336","published":"2026-07-01T13:32:18.489Z","updated":"2026-07-01T13:32:18.489Z","title":"nvmem: layouts: onie-tlv: fix hang on unknown types","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-53335","published":"2026-07-01T13:32:17.953Z","updated":"2026-07-01T13:32:17.953Z","title":"mm/damon/lru_sort: handle ctx allocation failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-53334","published":"2026-07-01T13:32:17.419Z","updated":"2026-07-01T13:32:17.419Z","title":"mm/damon/reclaim: handle ctx allocation failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-53333","published":"2026-07-01T13:32:16.852Z","updated":"2026-07-01T13:32:16.852Z","title":"mm/mincore: handle non-swap entries before !CONFIG_SWAP guard","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53332","published":"2026-07-01T13:32:16.289Z","updated":"2026-07-24T14:33:51.996Z","title":"slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-53331","published":"2026-07-01T13:32:15.733Z","updated":"2026-07-01T13:32:15.733Z","title":"slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-53330","published":"2026-07-01T13:32:15.160Z","updated":"2026-10-30T12:26:59.997Z","title":"drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-53329","published":"2026-07-01T13:32:14.598Z","updated":"2026-10-19T20:07:43.379Z","title":"drm/amd/display: Use krealloc_array() in dal_vector_reserve()","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-53328","published":"2026-07-01T13:32:14.030Z","updated":"2026-07-01T13:32:14.030Z","title":"sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53327","published":"2026-07-01T13:32:13.493Z","updated":"2026-07-04T11:51:05.892Z","title":"debugobjects: Do not fill_pool() if pi_blocked_on","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-53326","published":"2026-07-01T13:32:12.924Z","updated":"2026-07-04T11:51:04.894Z","title":"debugobjects: Don't call fill_pool() in early boot hardirq context","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-53325","published":"2026-06-29T04:53:35.833Z","updated":"2026-10-15T01:23:14.920Z","title":"agp/amd64: Fix broken error propagation in agp_amd64_probe()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-53324","published":"2026-06-26T19:41:14.708Z","updated":"2026-06-26T19:41:14.708Z","title":"net: mana: Use pci_name() for debugfs directory naming","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53323","published":"2026-06-26T19:41:13.926Z","updated":"2026-06-26T19:41:13.926Z","title":"net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-53322","published":"2026-06-26T19:41:13.245Z","updated":"2026-09-09T12:04:54.439Z","title":"vfio/pci: Clean up DMABUFs before disabling function","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-53321","published":"2026-06-26T19:41:12.589Z","updated":"2026-10-21T12:42:31.622Z","title":"io_uring/napi: cap busy_poll_to 10 msec","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53320","published":"2026-06-26T19:41:11.932Z","updated":"2026-06-26T19:41:11.932Z","title":"nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-53319","published":"2026-06-26T19:41:11.269Z","updated":"2026-06-26T19:41:11.269Z","title":"blk-wbt: remove WARN_ON_ONCE from wbt_init_enable_default()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-53318","published":"2026-06-26T19:41:10.611Z","updated":"2026-06-26T19:41:10.611Z","title":"wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53317","published":"2026-06-26T19:41:09.868Z","updated":"2026-10-30T12:26:58.934Z","title":"wifi: mt76: mt7921: Place upper limit on station AID","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53316","published":"2026-06-26T19:41:08.988Z","updated":"2026-06-26T19:41:08.988Z","title":"drm/amd/ras: Fix NULL deref in ras_core_ras_interrupt_detected()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-53315","published":"2026-06-26T19:41:08.184Z","updated":"2026-06-26T19:41:08.184Z","title":"drm/amd/ras: Fix NULL deref in ras_core_get_utc_second_timestamp()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-53314","published":"2026-06-26T19:41:07.447Z","updated":"2026-06-26T19:41:07.447Z","title":"padata: Put CPU offline callback in ONLINE section to allow failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2026-53313","published":"2026-06-26T19:41:06.568Z","updated":"2026-10-30T12:26:57.879Z","title":"drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2026-53312","published":"2026-06-26T19:41:05.688Z","updated":"2026-06-26T19:41:05.688Z","title":"iommu/riscv: Remove overflows on the invalidation path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53311","published":"2026-06-26T19:41:04.890Z","updated":"2026-06-26T19:41:04.890Z","title":"fuse: fix uninit-value in fuse_dentry_revalidate()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53310","published":"2026-06-26T19:41:04.227Z","updated":"2026-06-26T19:41:04.227Z","title":"soc/tegra: cbb: Fix cross-fabric target timeout lookup","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53309","published":"2026-06-26T19:41:03.505Z","updated":"2026-08-05T12:34:59.157Z","title":"ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2026-53308","published":"2026-06-26T19:41:02.696Z","updated":"2026-10-15T10:07:47.397Z","title":"power: supply: max77705: Free allocated workqueue and fix removal order","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53307","published":"2026-06-26T19:41:02.046Z","updated":"2026-06-26T19:41:02.046Z","title":"pinctrl: pinconf-generic: Fully validate 'pinmux' property","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53306","published":"2026-06-26T19:41:01.338Z","updated":"2026-06-26T19:41:01.338Z","title":"tty: hvc_iucv: fix off-by-one in number of supported devices","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53305","published":"2026-06-26T19:41:00.712Z","updated":"2026-06-26T19:41:00.712Z","title":"usb: typec: ps883x: Fix Oops at unbind","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53304","published":"2026-06-26T19:41:00.056Z","updated":"2026-06-26T19:41:00.056Z","title":"scsi: sg: Resolve soft lockup issue when opening /dev/sgX","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00101,"kevAdded":null},{"id":"CVE-2026-53303","published":"2026-06-26T19:40:59.383Z","updated":"2026-06-26T19:40:59.383Z","title":"f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-53302","published":"2026-06-26T19:40:58.636Z","updated":"2026-06-26T19:40:58.636Z","title":"crypto: eip93 - fix hmac setkey algo selection","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53301","published":"2026-06-26T19:40:57.845Z","updated":"2026-06-26T19:40:57.845Z","title":"reset: amlogic: t7: Fix null reset ops","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53300","published":"2026-06-26T19:40:57.186Z","updated":"2026-08-05T12:34:58.086Z","title":"net: enetc: fix NTMP DMA use-after-free issue","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-53299","published":"2026-06-26T19:40:56.524Z","updated":"2026-06-26T19:40:56.524Z","title":"net: airoha: Move ndesc initialization at end of airoha_qdma_init_tx()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53298","published":"2026-06-26T19:40:55.867Z","updated":"2026-06-26T19:40:55.867Z","title":"net: airoha: Move ndesc initialization at end of airoha_qdma_init_rx_queue()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53297","published":"2026-06-26T19:40:55.155Z","updated":"2026-10-30T12:26:56.822Z","title":"net: mana: Guard mana_remove against double invocation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53296","published":"2026-06-26T19:40:54.341Z","updated":"2026-06-26T19:40:54.341Z","title":"mailbox: mailbox-test: free channels on probe error","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-53295","published":"2026-06-26T19:40:53.670Z","updated":"2026-10-15T01:23:13.773Z","title":"mailbox: add sanity check for channel array","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-53294","published":"2026-06-26T19:40:52.927Z","updated":"2026-06-26T19:40:52.927Z","title":"mailbox: mailbox-test: don't free the reused channel","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-53293","published":"2026-06-26T19:40:52.132Z","updated":"2026-06-26T19:40:52.132Z","title":"drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-53292","published":"2026-06-26T19:40:51.470Z","updated":"2026-10-30T12:26:55.765Z","title":"net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53291","published":"2026-06-26T19:40:50.808Z","updated":"2026-06-26T19:40:50.808Z","title":"ALSA: hda/conexant: Fix missing error check for jack detection","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-53290","published":"2026-06-26T19:40:50.073Z","updated":"2026-10-19T20:07:43.209Z","title":"drm/xe/eustall: Fix drm_dev_put called before stream disable in close","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-53289","published":"2026-06-26T19:40:49.418Z","updated":"2026-06-26T19:40:49.418Z","title":"ice: fix NULL pointer dereference in ice_reset_all_vfs()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-53288","published":"2026-06-26T19:40:48.528Z","updated":"2026-06-26T19:40:48.528Z","title":"arm64: Reserve an extra page for early kernel mapping","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53287","published":"2026-06-26T19:40:47.946Z","updated":"2026-06-26T19:40:47.946Z","title":"audit: fix incorrect inheritable capability in CAPSET records","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-53286","published":"2026-06-26T19:40:47.210Z","updated":"2026-06-26T19:40:47.210Z","title":"idpf: fix double free and use-after-free in aux device error paths","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-53285","published":"2026-06-26T19:40:46.328Z","updated":"2026-10-21T12:42:26.186Z","title":"drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-53284","published":"2026-06-26T19:40:45.444Z","updated":"2026-10-30T12:26:54.710Z","title":"btrfs: only release the dirty pages io tree after successful writes","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-53283","published":"2026-06-26T19:40:44.573Z","updated":"2026-06-26T19:40:44.573Z","title":"iommu/amd: Bounds-check devid in __rlookup_amd_iommu()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53282","published":"2026-06-26T19:40:43.754Z","updated":"2026-06-26T19:40:43.754Z","title":"x86/kexec: Push kjump return address even for non-kjump kexec","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53281","published":"2026-06-26T19:40:43.040Z","updated":"2026-10-21T12:42:23.877Z","title":"iommu/vt-d: Avoid NULL pointer dereference or refcount corruption","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-53280","published":"2026-06-26T19:40:42.226Z","updated":"2026-06-26T19:40:42.226Z","title":"iommu: Fix NULL group->domain dereference in pci_dev_reset_iommu_done()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-53279","published":"2026-06-26T19:40:41.489Z","updated":"2026-06-26T19:40:41.489Z","title":"drm/gma500/oaktrail_lvds: fix hang on init failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53278","published":"2026-06-26T19:40:40.694Z","updated":"2026-06-26T19:40:40.694Z","title":"arm_mpam: Check whether the config array is allocated before destroying it","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-53277","published":"2026-06-25T08:40:00.458Z","updated":"2026-10-21T12:42:22.779Z","title":"KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-53276","published":"2026-06-25T08:39:59.804Z","updated":"2026-08-05T12:34:52.648Z","title":"Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-53275","published":"2026-06-25T08:39:59.115Z","updated":"2026-10-19T19:57:33.329Z","title":"ipv6: mcast: Fix use-after-free when processing MLD queries","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2026-53274","published":"2026-06-25T08:39:58.478Z","updated":"2026-06-25T08:39:58.478Z","title":"net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-53273","published":"2026-06-25T08:39:57.811Z","updated":"2026-10-19T19:57:33.173Z","title":"tee: optee: prevent use-after-free when the client exits before the supplicant","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-53272","published":"2026-06-25T08:39:57.147Z","updated":"2026-10-30T12:26:53.648Z","title":"erofs: fix use-after-free on sbi->sync_decompress","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-53271","published":"2026-06-25T08:39:56.489Z","updated":"2026-06-25T08:39:56.489Z","title":"ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53270","published":"2026-06-25T08:39:55.830Z","updated":"2026-10-19T19:57:32.999Z","title":"ipvs: clear the svc scheduler ptr early on edit","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-53269","published":"2026-06-25T08:39:55.172Z","updated":"2026-10-15T01:23:10.609Z","title":"netfilter: synproxy: add mutex to guard hook reference counting","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-53268","published":"2026-06-25T08:39:54.511Z","updated":"2026-10-19T19:57:32.850Z","title":"netfilter: conntrack_irc: fix possible out-of-bounds read","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00523,"kevAdded":null},{"id":"CVE-2026-53267","published":"2026-06-25T08:39:53.852Z","updated":"2026-10-30T12:26:52.583Z","title":"netfilter: nft_ct: bail out on template ct in get eval","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-53266","published":"2026-06-25T08:39:53.190Z","updated":"2026-09-19T03:56:22.274Z","title":"netfilter: bridge: make ebt_snat ARP rewrite writable","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":true,"epss":0.00934,"kevAdded":"2026-09-18"},{"id":"CVE-2026-53265","published":"2026-06-25T08:39:52.543Z","updated":"2026-10-19T19:57:32.554Z","title":"dm cache policy smq: check allocation under invalidate lock","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00098,"kevAdded":null},{"id":"CVE-2026-53264","published":"2026-06-25T08:39:51.870Z","updated":"2026-10-15T01:23:06.219Z","title":"net/sched: act_api: use RCU with deferred freeing for action lifecycle","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00485,"kevAdded":null},{"id":"CVE-2026-53263","published":"2026-06-25T08:39:51.215Z","updated":"2026-10-15T01:23:05.071Z","title":"6lowpan: fix off-by-one in multicast context address compression","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-53262","published":"2026-06-25T08:39:50.550Z","updated":"2026-10-30T12:26:51.527Z","title":"l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-53261","published":"2026-06-25T08:39:49.891Z","updated":"2026-06-25T08:39:49.891Z","title":"devlink: Release nested relation on devlink free","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-53260","published":"2026-06-25T08:39:49.229Z","updated":"2026-10-19T19:57:32.259Z","title":"tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-53259","published":"2026-06-25T08:39:48.571Z","updated":"2026-08-05T12:34:37.940Z","title":"ipv6: anycast: insert aca into global hash under idev->lock","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2026-53258","published":"2026-06-25T08:39:47.917Z","updated":"2026-10-30T12:26:50.461Z","title":"wifi: fix leak if split 6 GHz scanning fails","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53257","published":"2026-06-25T08:39:47.248Z","updated":"2026-10-15T10:07:44.178Z","title":"wifi: cfg80211: enforce HE/EHT cap/oper consistency","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53256","published":"2026-06-25T08:39:46.591Z","updated":"2026-10-19T19:57:32.092Z","title":"Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()","severity":"HIGH","score":8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2026-53255","published":"2026-06-25T08:39:45.934Z","updated":"2026-10-15T01:23:02.761Z","title":"Bluetooth: MGMT: validate advertising TLV before type checks","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-53254","published":"2026-06-25T08:39:45.273Z","updated":"2026-10-19T19:57:31.915Z","title":"Bluetooth: RFCOMM: validate skb length in MCC handlers","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2026-53253","published":"2026-06-25T08:39:44.612Z","updated":"2026-10-19T19:57:31.739Z","title":"Bluetooth: bnep: reject short frames before parsing","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-53252","published":"2026-06-25T08:39:43.951Z","updated":"2026-06-25T08:39:43.951Z","title":"Bluetooth: fix memory leak in error path of hci_alloc_dev()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-53251","published":"2026-06-25T08:39:43.290Z","updated":"2026-06-25T08:39:43.290Z","title":"Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-53250","published":"2026-06-25T08:39:42.630Z","updated":"2026-10-19T19:57:31.573Z","title":"xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00105,"kevAdded":null},{"id":"CVE-2026-53249","published":"2026-06-25T08:39:41.971Z","updated":"2026-10-15T01:22:59.235Z","title":"ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-53248","published":"2026-06-25T08:39:41.307Z","updated":"2026-08-05T12:34:32.572Z","title":"net: airoha: Fix use-after-free in metadata dst teardown","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00528,"kevAdded":null},{"id":"CVE-2026-53247","published":"2026-06-25T08:39:40.654Z","updated":"2026-08-05T12:34:31.498Z","title":"net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00685,"kevAdded":null},{"id":"CVE-2026-53246","published":"2026-06-25T08:39:39.896Z","updated":"2026-10-19T19:57:31.408Z","title":"sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00442,"kevAdded":null},{"id":"CVE-2026-53245","published":"2026-06-25T08:39:39.108Z","updated":"2026-10-15T01:22:57.577Z","title":"net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-53244","published":"2026-06-25T08:39:38.468Z","updated":"2026-08-05T12:34:29.358Z","title":"VFS: fix possible failure to unlock in nfsd4_create_file()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-53243","published":"2026-06-25T08:39:37.794Z","updated":"2026-06-25T08:39:37.794Z","title":"rseq: Fix using an uninitialized stack variable in rseq_exit_user_update()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-53242","published":"2026-06-25T08:39:37.129Z","updated":"2026-10-19T19:57:31.043Z","title":"ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00102,"kevAdded":null},{"id":"CVE-2026-53241","published":"2026-06-25T08:39:36.482Z","updated":"2026-06-25T08:39:36.482Z","title":"ALSA: seq: dummy: fix UMP event stack overread","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53240","published":"2026-06-25T08:39:35.809Z","updated":"2026-08-05T12:34:26.772Z","title":"xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00565,"kevAdded":null},{"id":"CVE-2026-53239","published":"2026-06-25T08:39:35.149Z","updated":"2026-10-19T19:57:30.877Z","title":"xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00102,"kevAdded":null},{"id":"CVE-2026-53238","published":"2026-06-25T08:39:34.492Z","updated":"2026-06-25T08:39:34.492Z","title":"netlabel: validate unlabeled address and mask attribute lengths","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-53237","published":"2026-06-25T08:39:33.833Z","updated":"2026-10-30T12:26:49.393Z","title":"gpio: mvebu: fix NULL pointer dereference in suspend/resume","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-53236","published":"2026-06-25T08:39:33.170Z","updated":"2026-10-15T01:22:53.447Z","title":"tcp: restrict SO_ATTACH_FILTER to priv users","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-53235","published":"2026-06-25T08:39:32.518Z","updated":"2026-08-05T12:34:24.581Z","title":"net: add pskb_may_pull() to skb_gro_receive_list()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00441,"kevAdded":null},{"id":"CVE-2026-53234","published":"2026-06-25T08:39:31.852Z","updated":"2026-06-25T08:39:31.852Z","title":"net: ibm: emac: Fix use-after-free during device removal","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-53233","published":"2026-06-25T08:39:31.191Z","updated":"2026-06-25T08:39:31.191Z","title":"netdev: fix double-free in netdev_nl_bind_rx_doit()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-53232","published":"2026-06-25T08:39:30.527Z","updated":"2026-10-30T12:26:48.332Z","title":"net: phy: clean the sfp upstream if phy probing fails","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2026-53231","published":"2026-06-25T08:39:29.871Z","updated":"2026-06-25T08:39:29.871Z","title":"net: phy: don't try to setup PHY-driven SFP cages when using genphy","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00111,"kevAdded":null},{"id":"CVE-2026-53230","published":"2026-06-25T08:39:29.210Z","updated":"2026-10-30T12:26:47.244Z","title":"net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list","severity":"HIGH","score":8.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-53229","published":"2026-06-25T08:39:28.552Z","updated":"2026-10-30T12:26:46.174Z","title":"net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-53228","published":"2026-06-25T08:39:27.893Z","updated":"2026-10-19T19:57:30.192Z","title":"ipv6: sit: reload inner IPv6 header after GSO offloads","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00576,"kevAdded":null},{"id":"CVE-2026-53227","published":"2026-06-25T08:39:27.229Z","updated":"2026-10-15T01:22:50.635Z","title":"net: openvswitch: fix possible kfree_skb of ERR_PTR","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-53226","published":"2026-06-25T08:39:26.567Z","updated":"2026-10-21T12:42:17.298Z","title":"gpio: rockchip: fix generic IRQ chip leak on remove","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-53225","published":"2026-06-25T08:39:25.911Z","updated":"2026-10-19T19:57:29.994Z","title":"sctp: fix uninit-value in __sctp_rcv_asconf_lookup()","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00576,"kevAdded":null},{"id":"CVE-2026-53224","published":"2026-06-25T08:39:25.254Z","updated":"2026-10-30T12:26:45.107Z","title":"sctp: validate embedded INIT chunk and address list lengths in cookie","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2026-53223","published":"2026-06-25T08:39:24.588Z","updated":"2026-10-19T19:57:29.682Z","title":"net: guard timestamp cmsgs to real error queue skbs","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-53222","published":"2026-06-25T08:39:23.934Z","updated":"2026-10-15T10:07:43.087Z","title":"ptp: ocp: fix resource freeing order","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-53221","published":"2026-06-25T08:39:23.177Z","updated":"2026-10-19T19:57:29.527Z","title":"ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00576,"kevAdded":null},{"id":"CVE-2026-53220","published":"2026-06-25T08:39:22.394Z","updated":"2026-10-30T12:26:44.009Z","title":"netfilter: revalidate bridge ports","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-53219","published":"2026-06-25T08:39:21.730Z","updated":"2026-10-15T01:22:45.178Z","title":"netfilter: x_tables: avoid leaking percpu counter pointers","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-53218","published":"2026-06-25T08:39:21.069Z","updated":"2026-10-15T01:22:43.516Z","title":"netfilter: nft_exthdr: fix register tracking for F_PRESENT flag","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-53217","published":"2026-06-25T08:39:20.186Z","updated":"2026-10-19T19:57:29.347Z","title":"net: mvpp2: sync RX data at the hardware packet offset","severity":"HIGH","score":8.6,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2026-53216","published":"2026-06-25T08:39:19.529Z","updated":"2026-08-05T12:34:12.526Z","title":"net: mvpp2: limit XDP frame size to the RX buffer","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00502,"kevAdded":null},{"id":"CVE-2026-53215","published":"2026-06-25T08:39:18.875Z","updated":"2026-10-19T19:57:29.177Z","title":"net: mvpp2: refill RX buffers before XDP or skb use","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00502,"kevAdded":null},{"id":"CVE-2026-53214","published":"2026-06-25T08:39:18.209Z","updated":"2026-06-25T08:39:18.209Z","title":"ipv6: Fix a potential NPD in cleanup_prefix_route()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-53213","published":"2026-06-25T08:39:17.552Z","updated":"2026-06-25T08:39:17.552Z","title":"drm/vc4: fix krealloc() memory leak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-53212","published":"2026-06-25T08:39:16.888Z","updated":"2026-10-19T19:57:29.000Z","title":"netfilter: nft_tunnel: fix use-after-free on object destroy","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-53211","published":"2026-06-25T08:39:16.234Z","updated":"2026-06-25T08:39:16.234Z","title":"netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53210","published":"2026-06-25T08:39:15.569Z","updated":"2026-06-25T08:39:15.569Z","title":"tee: shm: fix shm leak in register_shm_helper()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-53209","published":"2026-06-25T08:39:14.915Z","updated":"2026-10-19T19:57:28.852Z","title":"Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-53208","published":"2026-06-25T08:39:14.257Z","updated":"2026-10-15T01:22:40.680Z","title":"Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-53207","published":"2026-06-25T08:39:13.592Z","updated":"2026-06-25T08:39:13.592Z","title":"mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-53206","published":"2026-06-25T08:39:12.925Z","updated":"2026-06-25T08:39:12.925Z","title":"accel/ivpu: Add bounds check for firmware runtime memory","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-53205","published":"2026-06-25T08:39:12.268Z","updated":"2026-10-19T19:57:28.697Z","title":"accel/ivpu: Add bounds checks for firmware log indices","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-53204","published":"2026-06-25T08:39:11.618Z","updated":"2026-06-25T08:39:11.618Z","title":"firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in probe","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-53203","published":"2026-06-25T08:39:10.950Z","updated":"2026-10-19T19:57:28.553Z","title":"accel/ivpu: Add buffer overflow check in MS get_info_ioctl","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-53202","published":"2026-06-25T08:39:10.287Z","updated":"2026-10-19T19:57:28.409Z","title":"accel/ivpu: Fix signed integer truncation in IPC receive","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-53201","published":"2026-06-25T08:39:09.631Z","updated":"2026-08-05T12:34:05.024Z","title":"Revert \"drm/xe: Skip exec queue schedule toggle if queue is idle during suspend\"","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-53200","published":"2026-06-25T08:39:08.968Z","updated":"2026-08-05T12:34:03.957Z","title":"KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-53199","published":"2026-06-25T08:39:08.320Z","updated":"2026-10-19T19:57:28.257Z","title":"hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-53198","published":"2026-06-25T08:39:07.650Z","updated":"2026-10-15T01:22:39.317Z","title":"ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2026-53197","published":"2026-06-25T08:39:06.991Z","updated":"2026-06-25T08:39:06.991Z","title":"xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-53196","published":"2026-06-25T08:39:06.330Z","updated":"2026-09-18T12:04:49.281Z","title":"USB: serial: io_ti: fix heap overflow in get_manuf_info()","severity":"MEDIUM","score":6.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2026-53195","published":"2026-06-25T08:39:05.673Z","updated":"2026-06-25T08:39:05.673Z","title":"USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-53194","published":"2026-06-25T08:39:05.017Z","updated":"2026-10-19T19:57:28.103Z","title":"USB: serial: kl5kusb105: fix bulk-out buffer overflow","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2026-53193","published":"2026-06-25T08:39:04.346Z","updated":"2026-10-19T19:57:27.947Z","title":"ALSA: timer: Forcibly close timer instances at closing","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2026-53192","published":"2026-06-25T08:39:03.696Z","updated":"2026-10-19T19:57:27.788Z","title":"ALSA: timer: Fix UAF at snd_timer_user_params()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00097,"kevAdded":null},{"id":"CVE-2026-53191","published":"2026-06-25T08:39:03.052Z","updated":"2026-10-19T19:57:27.637Z","title":"io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-53190","published":"2026-06-25T08:39:02.366Z","updated":"2026-06-25T08:39:02.366Z","title":"drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-53189","published":"2026-06-25T08:39:01.708Z","updated":"2026-10-19T19:57:27.480Z","title":"mm/huge_memory: update file PMD counter before folio_put()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-53188","published":"2026-06-25T08:39:00.960Z","updated":"2026-10-19T19:57:27.314Z","title":"RDMA/core: Validate the passed in fops for ib_get_ucaps()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-53187","published":"2026-06-25T08:39:00.175Z","updated":"2026-10-19T19:57:27.163Z","title":"RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-53186","published":"2026-06-25T08:38:59.508Z","updated":"2026-10-19T19:57:27.012Z","title":"RDMA/srp: bound SRP_RSP sense copy by the received length","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-53185","published":"2026-06-25T08:38:58.853Z","updated":"2026-10-19T19:57:26.863Z","title":"zram: fix use-after-free in zram_bvec_write_partial()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-53184","published":"2026-06-25T08:38:58.189Z","updated":"2026-10-19T19:57:26.714Z","title":"udp: clear skb->dev before running a sockmap verdict","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0049,"kevAdded":null},{"id":"CVE-2026-53183","published":"2026-06-25T08:38:57.443Z","updated":"2026-10-19T19:57:26.574Z","title":"mptcp: allow subflow rcv wnd to shrink","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0049,"kevAdded":null},{"id":"CVE-2026-53182","published":"2026-06-25T08:38:56.654Z","updated":"2026-10-19T19:57:26.414Z","title":"wifi: nl80211: reject oversized EMA RNR lists","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-53181","published":"2026-06-25T08:38:55.994Z","updated":"2026-10-15T01:22:34.587Z","title":"vsock/vmci: fix sk_ack_backlog leak on failed handshake","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-53180","published":"2026-06-25T08:38:55.332Z","updated":"2026-10-19T19:57:26.272Z","title":"timers/migration: Fix livelock in tmigr_handle_remote_up()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2026-53179","published":"2026-06-25T08:38:54.677Z","updated":"2026-10-21T12:42:14.034Z","title":"staging: rtl8723bs: fix buffer over-read in rtw_update_protection","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-53178","published":"2026-06-25T08:38:54.018Z","updated":"2026-10-30T12:26:42.902Z","title":"staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-53177","published":"2026-06-25T08:38:53.347Z","updated":"2026-10-15T01:22:33.431Z","title":"bnxt_en: Fix NULL pointer dereference","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-53176","published":"2026-06-25T08:38:52.693Z","updated":"2026-10-19T19:57:26.130Z","title":"IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00761,"kevAdded":null},{"id":"CVE-2026-53175","published":"2026-06-25T08:38:52.034Z","updated":"2026-09-01T12:04:57.559Z","title":"inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-53174","published":"2026-06-25T08:38:51.366Z","updated":"2026-08-05T12:33:43.620Z","title":"ovl: keep err zero after successful ovl_cache_get()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-53173","published":"2026-06-25T08:38:50.709Z","updated":"2026-08-05T12:33:42.554Z","title":"accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-53172","published":"2026-06-25T08:38:50.056Z","updated":"2026-08-05T12:33:41.473Z","title":"accel/ethosu: fix IFM region index out-of-bounds in command stream parser","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-53171","published":"2026-06-25T08:38:49.392Z","updated":"2026-08-05T12:33:40.393Z","title":"accel/ethosu: fix arithmetic issues in dma_length()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-53170","published":"2026-06-25T08:38:48.728Z","updated":"2026-08-05T12:33:39.324Z","title":"accel/ethosu: reject DMA commands with uninitialized length","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-53169","published":"2026-06-25T08:38:48.068Z","updated":"2026-06-25T08:38:48.068Z","title":"accel/ethosu: reject NPU_OP_RESIZE commands from userspace","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-53168","published":"2026-06-25T08:38:47.420Z","updated":"2026-10-15T01:22:32.273Z","title":"fuse: reject fuse_notify() pagecache ops on directories","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-53167","published":"2026-06-25T08:38:46.751Z","updated":"2026-10-15T01:22:31.107Z","title":"fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-53165","published":"2026-06-25T08:38:45.445Z","updated":"2026-08-05T12:33:38.251Z","title":"iomap: avoid potential null folio->mapping deref during error reporting","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-53164","published":"2026-06-25T08:38:44.770Z","updated":"2026-06-25T08:38:44.770Z","title":"iommu/dma: Do not try to iommu_map a 0 length region in swiotlb","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53163","published":"2026-06-25T08:38:44.108Z","updated":"2026-07-24T14:33:48.972Z","title":"locking/rtmutex: Skip remove_waiter() when waiter is not enqueued","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-53162","published":"2026-06-25T08:38:43.453Z","updated":"2026-08-05T12:33:37.176Z","title":"memcg: use round-robin victim selection in refill_stock","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-53161","published":"2026-06-25T08:38:42.789Z","updated":"2026-08-05T12:33:36.090Z","title":"misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-53160","published":"2026-06-25T08:38:42.138Z","updated":"2026-08-05T12:33:35.015Z","title":"misc: fastrpc: fix use-after-free race in fastrpc_map_create","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-53159","published":"2026-06-25T08:38:41.482Z","updated":"2026-08-05T12:33:33.871Z","title":"misc: fastrpc: fix DMA address corruption due to find_vma misuse","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-53158","published":"2026-06-25T08:38:40.818Z","updated":"2026-07-04T11:50:56.161Z","title":"misc: fastrpc: Fix NULL pointer dereference in rpmsg callback","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-53157","published":"2026-06-25T08:38:40.132Z","updated":"2026-07-04T11:50:55.214Z","title":"net: phonet: free phonet_device after RCU grace period","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-53156","published":"2026-06-25T08:38:39.495Z","updated":"2026-10-21T12:42:11.803Z","title":"nvmem: core: fix use-after-free bugs in error paths","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-53155","published":"2026-06-25T08:38:38.828Z","updated":"2026-06-25T08:38:38.828Z","title":"mm/huge_memory: use correct flags for device private PMD entry","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-53154","published":"2026-06-25T08:38:38.168Z","updated":"2026-06-25T08:38:38.168Z","title":"mm/hugetlb: restore reservation on error in hugetlb folio copy paths","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-53153","published":"2026-06-25T08:38:37.521Z","updated":"2026-09-02T12:04:29.912Z","title":"mm/list_lru: drain before clearing xarray entry on reparent","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00099,"kevAdded":null},{"id":"CVE-2026-53152","published":"2026-06-25T08:38:36.850Z","updated":"2026-06-25T08:38:36.850Z","title":"mmc: dw_mmc-rockchip: Add missing private data for very old controllers","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53151","published":"2026-06-25T08:38:36.187Z","updated":"2026-10-19T19:57:25.967Z","title":"rxrpc: Fix the ACK parser to extract the SACK table for parsing","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00671,"kevAdded":null},{"id":"CVE-2026-53150","published":"2026-06-25T08:38:35.531Z","updated":"2026-10-15T01:22:29.955Z","title":"thunderbolt: Reject zero-length property entries in validator","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-53149","published":"2026-06-25T08:38:34.869Z","updated":"2026-10-15T01:22:28.808Z","title":"thunderbolt: Bound root directory content to block size","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-53148","published":"2026-06-25T08:38:34.208Z","updated":"2026-10-15T01:22:27.646Z","title":"thunderbolt: Clamp XDomain response data copy to allocation size","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-53147","published":"2026-06-25T08:38:33.547Z","updated":"2026-10-19T19:57:25.830Z","title":"thunderbolt: Validate XDomain request packet size before type cast","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2026-53146","published":"2026-06-25T08:38:32.877Z","updated":"2026-10-19T19:57:25.679Z","title":"thunderbolt: Limit XDomain response copy to actual frame size","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2026-53145","published":"2026-06-25T08:38:32.228Z","updated":"2026-10-19T19:57:25.538Z","title":"drm/gem: Try to fix change_handle ioctl, attempt 4","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-53144","published":"2026-06-25T08:38:31.569Z","updated":"2026-06-25T08:38:31.569Z","title":"drm/amdkfd: fix NULL dereference in get_queue_ids()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-53143","published":"2026-06-25T08:38:30.901Z","updated":"2026-08-20T12:32:03.965Z","title":"drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2026-53142","published":"2026-06-25T08:38:30.158Z","updated":"2026-07-04T11:50:53.138Z","title":"drm/xe/display: fix oops in suspend/shutdown without display","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-53141","published":"2026-06-25T08:38:29.283Z","updated":"2026-06-25T08:38:29.283Z","title":"drm/v3d: Fix global performance monitor reference counting","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53140","published":"2026-06-25T08:38:28.494Z","updated":"2026-06-25T08:38:28.494Z","title":"drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-53139","published":"2026-06-25T08:38:27.738Z","updated":"2026-07-04T11:50:52.146Z","title":"drm/v3d: Skip CSD when it has zeroed workgroups","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-53138","published":"2026-06-25T08:38:26.859Z","updated":"2026-07-04T11:50:51.199Z","title":"drm/amd/display: Bound VBIOS record-chain walk loops","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-53137","published":"2026-06-25T08:38:25.977Z","updated":"2026-06-25T08:38:25.977Z","title":"drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-53136","published":"2026-06-25T08:38:25.097Z","updated":"2026-06-29T04:18:52.196Z","title":"drm/amd/display: Clamp VBIOS HDMI retimer register count to array size","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-53135","published":"2026-06-25T08:38:24.216Z","updated":"2026-06-25T08:38:24.216Z","title":"drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-53134","published":"2026-06-25T08:38:23.348Z","updated":"2026-10-15T01:22:24.109Z","title":"netfilter: nft_fib: fix stale stack leak via the OIFNAME register","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-53133","published":"2026-06-25T08:38:22.469Z","updated":"2026-10-19T19:57:25.374Z","title":"RDMA/umem: Fix truncation for block sizes >= 4G","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-53132","published":"2026-06-25T08:38:21.575Z","updated":"2026-10-19T19:57:25.210Z","title":"vsock/virtio: fix potential unbounded skb queue","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-53131","published":"2026-06-25T08:38:20.489Z","updated":"2026-10-19T19:57:25.041Z","title":"netfilter: require Ethernet MAC header before using eth_hdr()","severity":"CRITICAL","score":9.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2026-53130","published":"2026-06-24T16:30:57.227Z","updated":"2026-08-05T12:33:24.185Z","title":"fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-53129","published":"2026-06-24T16:30:56.562Z","updated":"2026-10-30T12:26:41.852Z","title":"fs/mbcache: cancel shrink work before destroying the cache","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-53128","published":"2026-06-24T16:30:55.911Z","updated":"2026-06-24T16:30:55.911Z","title":"drbd: Balance RCU calls in drbd_adm_dump_devices()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53127","published":"2026-06-24T16:30:55.252Z","updated":"2026-06-24T16:30:55.252Z","title":"block: fix zones_cond memory leak on zone revalidation error paths","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-53126","published":"2026-06-24T16:30:54.594Z","updated":"2026-06-24T16:30:54.594Z","title":"blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-53125","published":"2026-06-24T16:30:53.934Z","updated":"2026-06-24T16:30:53.934Z","title":"md: fix array_state=clear sysfs deadlock","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-53124","published":"2026-06-24T16:30:53.268Z","updated":"2026-10-15T10:07:41.921Z","title":"ublk: reset per-IO canceled flag on each fetch","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53123","published":"2026-06-24T16:30:52.609Z","updated":"2026-10-21T12:42:09.638Z","title":"md: wake raid456 reshape waiters before suspend","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2026-53122","published":"2026-06-24T16:30:51.941Z","updated":"2026-10-30T12:26:40.798Z","title":"btrfs: fix deadlock between reflink and transaction commit when using flushoncommit","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-53121","published":"2026-06-24T16:30:51.294Z","updated":"2026-06-24T16:30:51.294Z","title":"amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53120","published":"2026-06-24T16:30:50.592Z","updated":"2026-10-21T12:42:07.442Z","title":"PCI: use generic driver_override infrastructure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-53119","published":"2026-06-24T16:30:49.969Z","updated":"2026-06-24T16:30:49.969Z","title":"platform/wmi: use generic driver_override infrastructure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-53118","published":"2026-06-24T16:30:49.308Z","updated":"2026-10-21T12:42:06.359Z","title":"vdpa: use generic driver_override infrastructure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-53117","published":"2026-06-24T16:30:48.645Z","updated":"2026-06-24T16:30:48.645Z","title":"s390/cio: use generic driver_override infrastructure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-53116","published":"2026-06-24T16:30:47.982Z","updated":"2026-06-24T16:30:47.982Z","title":"s390/ap: use generic driver_override infrastructure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-53115","published":"2026-06-24T16:30:47.330Z","updated":"2026-10-21T12:42:05.258Z","title":"bus: fsl-mc: use generic driver_override infrastructure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-53114","published":"2026-06-24T16:30:46.662Z","updated":"2026-06-24T16:30:46.662Z","title":"perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-53113","published":"2026-06-24T16:30:46.011Z","updated":"2026-10-21T12:42:04.174Z","title":"wifi: ath11k: fix memory leaks in beacon template setup","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-53112","published":"2026-06-24T16:30:45.359Z","updated":"2026-06-24T16:30:45.359Z","title":"wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-53111","published":"2026-06-24T16:30:44.691Z","updated":"2026-06-24T16:30:44.691Z","title":"bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-53110","published":"2026-06-24T16:30:44.036Z","updated":"2026-10-19T19:57:24.880Z","title":"s390/bpf: Zero-extend bpf prog return values and kfunc arguments","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-53109","published":"2026-06-24T16:30:43.364Z","updated":"2026-10-21T12:42:03.105Z","title":"powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-53108","published":"2026-06-24T16:30:42.707Z","updated":"2026-10-30T12:26:39.730Z","title":"powerpc/64s: Fix unmap race with PMD migration entries","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0009,"kevAdded":null},{"id":"CVE-2026-53107","published":"2026-06-24T16:30:42.056Z","updated":"2026-06-24T16:30:42.056Z","title":"wifi: libertas: don't kill URBs in interrupt context","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53106","published":"2026-06-24T16:30:41.382Z","updated":"2026-06-24T16:30:41.382Z","title":"bpf: Do not allow deleting local storage in NMI","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-53105","published":"2026-06-24T16:30:40.632Z","updated":"2026-06-24T16:30:40.632Z","title":"wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53104","published":"2026-06-24T16:30:39.844Z","updated":"2026-10-21T12:42:00.899Z","title":"wifi: mt76: Fix memory leak destroying device","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53103","published":"2026-06-24T16:30:39.184Z","updated":"2026-10-21T12:41:59.799Z","title":"wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-53102","published":"2026-06-24T16:30:38.536Z","updated":"2026-10-30T12:26:38.678Z","title":"wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-53101","published":"2026-06-24T16:30:37.871Z","updated":"2026-07-04T11:50:50.214Z","title":"wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-53100","published":"2026-06-24T16:30:37.216Z","updated":"2026-06-24T16:30:37.216Z","title":"wifi: mt76: fix deadlock in remain-on-channel","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-53099","published":"2026-06-24T16:30:36.549Z","updated":"2026-06-24T16:30:36.549Z","title":"bpf: Switch CONFIG_CFI_CLANG to CONFIG_CFI","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-53098","published":"2026-06-24T16:30:35.887Z","updated":"2026-09-14T11:58:31.148Z","title":"wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-53097","published":"2026-06-24T16:30:35.223Z","updated":"2026-10-21T12:41:57.624Z","title":"wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-53096","published":"2026-06-24T16:30:34.477Z","updated":"2026-10-19T19:57:24.715Z","title":"bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00102,"kevAdded":null},{"id":"CVE-2026-53095","published":"2026-06-24T16:30:33.684Z","updated":"2026-06-24T16:30:33.684Z","title":"bpf: Fix abuse of kprobe_write_ctx via freplace","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53094","published":"2026-06-24T16:30:32.815Z","updated":"2026-10-19T19:57:24.560Z","title":"bpf: Fix stale offload->prog pointer after constant blinding","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-53093","published":"2026-06-24T16:30:32.053Z","updated":"2026-06-24T16:30:32.053Z","title":"wifi: brcmfmac: Fix error pointer dereference","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53092","published":"2026-06-24T16:30:31.168Z","updated":"2026-10-19T19:57:24.407Z","title":"bpf: Fix linked reg delta tracking when src_reg == dst_reg","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-53091","published":"2026-06-24T16:30:30.290Z","updated":"2026-10-21T12:41:56.505Z","title":"net: pull headers in qdisc_pkt_len_segs_init()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-53090","published":"2026-06-24T16:30:29.413Z","updated":"2026-10-19T19:47:16.504Z","title":"bpf: Fix ld_{abs,ind} failure path analysis in subprogs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2026-53089","published":"2026-06-24T16:30:28.531Z","updated":"2026-09-02T12:49:34.606Z","title":"bpf: Fix use-after-free in offloaded map/prog info fill","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-53088","published":"2026-06-24T16:30:27.655Z","updated":"2026-10-19T19:47:16.337Z","title":"net: bcmgenet: fix off-by-one in bcmgenet_put_txcb","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2026-53087","published":"2026-06-24T16:30:26.881Z","updated":"2026-08-05T12:33:15.520Z","title":"net: bcmgenet: fix leaking free_bds","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00684,"kevAdded":null},{"id":"CVE-2026-53086","published":"2026-06-24T16:30:26.111Z","updated":"2026-10-19T19:47:16.194Z","title":"net: bcmgenet: fix racing timeout handler","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-53085","published":"2026-06-24T16:30:25.232Z","updated":"2026-10-19T19:47:16.049Z","title":"bpf: fix mm lifecycle in open-coded task_vma iterator","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-53084","published":"2026-06-24T16:30:24.356Z","updated":"2026-06-24T16:30:24.356Z","title":"bpf: return VMA snapshot from task_vma iterator","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53083","published":"2026-06-24T16:30:23.568Z","updated":"2026-10-30T12:26:37.618Z","title":"bpf: Fix RCU stall in bpf_fd_array_map_clear()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53082","published":"2026-06-24T16:30:22.817Z","updated":"2026-06-24T16:30:22.817Z","title":"net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53081","published":"2026-06-24T16:30:21.959Z","updated":"2026-10-19T19:47:15.896Z","title":"bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-53080","published":"2026-06-24T16:30:21.172Z","updated":"2026-10-15T01:22:21.282Z","title":"net/sched: cls_fw: fix NULL dereference of \"old\" filters before change()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-53079","published":"2026-06-24T16:30:20.163Z","updated":"2026-06-24T16:30:20.163Z","title":"net_sched: fix skb memory leak in deferred qdisc drops","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-53078","published":"2026-06-24T16:30:18.858Z","updated":"2026-10-19T19:47:15.752Z","title":"bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-53077","published":"2026-06-24T16:30:17.972Z","updated":"2026-08-05T12:33:10.122Z","title":"net/rds: Restrict use of RDS/IB to the initial network namespace","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-53076","published":"2026-06-24T16:30:17.092Z","updated":"2026-10-30T12:26:36.563Z","title":"bpf: Fix OOB in pcpu_init_value","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-53075","published":"2026-06-24T16:30:16.214Z","updated":"2026-10-19T19:47:15.461Z","title":"ppp: require CAP_NET_ADMIN in target netns for unattached ioctls","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2026-53074","published":"2026-06-24T16:30:15.337Z","updated":"2026-06-24T16:30:15.337Z","title":"bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-53073","published":"2026-06-24T16:30:14.463Z","updated":"2026-06-24T16:30:14.463Z","title":"Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-53072","published":"2026-06-24T16:30:13.570Z","updated":"2026-10-19T19:47:15.316Z","title":"Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-53071","published":"2026-06-24T16:30:12.694Z","updated":"2026-10-19T19:47:15.158Z","title":"Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00429,"kevAdded":null},{"id":"CVE-2026-53070","published":"2026-06-24T16:30:11.816Z","updated":"2026-10-30T12:26:35.465Z","title":"sctp: disable BH before calling udp_tunnel_xmit_skb()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2026-53069","published":"2026-06-24T16:30:10.930Z","updated":"2026-10-19T19:47:14.857Z","title":"net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0038,"kevAdded":null},{"id":"CVE-2026-53068","published":"2026-06-24T16:30:10.140Z","updated":"2026-08-05T12:33:02.612Z","title":"drm/komeda: fix integer overflow in AFBC framebuffer size check","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-53067","published":"2026-06-24T16:30:09.492Z","updated":"2026-06-24T16:30:09.492Z","title":"PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-53066","published":"2026-06-24T16:30:08.824Z","updated":"2026-06-24T16:30:08.824Z","title":"drm/sun4i: backend: fix error pointer dereference","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53065","published":"2026-06-24T16:30:08.161Z","updated":"2026-06-24T16:30:08.161Z","title":"ASoC: sti: use managed regmap_field allocations","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53064","published":"2026-06-24T16:30:07.536Z","updated":"2026-06-24T16:30:07.536Z","title":"dm cache: fix null-deref with concurrent writes in passthrough mode","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-53063","published":"2026-06-24T16:30:06.857Z","updated":"2026-06-24T16:30:06.857Z","title":"dm cache: fix write hang in passthrough mode","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-53062","published":"2026-06-24T16:30:06.189Z","updated":"2026-10-19T19:47:14.719Z","title":"dm cache policy smq: fix missing locks in invalidating cache blocks","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00097,"kevAdded":null},{"id":"CVE-2026-53061","published":"2026-06-24T16:30:05.522Z","updated":"2026-06-24T16:30:05.522Z","title":"dm cache: fix dirty mapping checking in passthrough mode switching","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-53060","published":"2026-06-24T16:30:04.872Z","updated":"2026-06-24T16:30:04.872Z","title":"dm cache metadata: fix memory leak on metadata abort retry","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-53059","published":"2026-06-24T16:30:04.210Z","updated":"2026-09-04T12:04:41.314Z","title":"dm log: fix out-of-bounds write due to region_count overflow","severity":"MEDIUM","score":6.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2026-53058","published":"2026-06-24T16:30:03.463Z","updated":"2026-06-24T16:30:03.463Z","title":"drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53057","published":"2026-06-24T16:30:02.571Z","updated":"2026-08-05T12:33:00.472Z","title":"iommu/riscv: Add IOTINVAL after updating DDT/PDT entries","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-53056","published":"2026-06-24T16:30:01.694Z","updated":"2026-06-24T16:30:01.694Z","title":"drm/msm/dpu: fix mismatch between power and frequency","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53055","published":"2026-06-24T16:30:00.876Z","updated":"2026-08-05T12:32:59.383Z","title":"crypto: hisilicon/sec2 - prevent req used-after-free for sec","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2026-53054","published":"2026-06-24T16:29:59.982Z","updated":"2026-08-05T12:32:58.323Z","title":"drm/msm: Fix VM_BIND UNMAP locking","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-53053","published":"2026-06-24T16:29:59.093Z","updated":"2026-10-30T12:26:34.347Z","title":"iommu/amd: Fix clone_alias() to use the original device's devid","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-53052","published":"2026-06-24T16:29:58.030Z","updated":"2026-06-24T16:29:58.030Z","title":"ASoC: qcom: qdsp6: topology: check widget type before accessing data","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53051","published":"2026-06-24T16:29:56.949Z","updated":"2026-06-24T16:29:56.949Z","title":"PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53050","published":"2026-06-24T16:29:56.043Z","updated":"2026-10-15T01:22:19.854Z","title":"quota: Fix race of dquot_scan_active() with quota deactivation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00104,"kevAdded":null},{"id":"CVE-2026-53049","published":"2026-06-24T16:29:55.190Z","updated":"2026-10-19T19:47:14.439Z","title":"gfs2: add some missing log locking","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00388,"kevAdded":null},{"id":"CVE-2026-53048","published":"2026-06-24T16:29:54.268Z","updated":"2026-06-24T16:29:54.268Z","title":"gfs2: prevent NULL pointer dereference during unmount","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-53047","published":"2026-06-24T16:29:53.491Z","updated":"2026-06-24T16:29:53.491Z","title":"efi/capsule-loader: fix incorrect sizeof in phys array reallocation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-53046","published":"2026-06-24T16:29:52.676Z","updated":"2026-08-05T12:32:53.990Z","title":"ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00717,"kevAdded":null},{"id":"CVE-2026-53045","published":"2026-06-24T16:29:51.795Z","updated":"2026-08-05T12:32:52.914Z","title":"memory: tegra124-emc: Fix dll_change check","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-53044","published":"2026-06-24T16:29:51.013Z","updated":"2026-08-05T12:32:51.816Z","title":"soc/tegra: cbb: Fix incorrect ARRAY_SIZE in fabric lookup tables","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-53043","published":"2026-06-24T16:29:49.480Z","updated":"2026-08-05T12:32:50.728Z","title":"ocfs2/dlm: validate qr_numregions in dlm_match_regions()","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-53042","published":"2026-06-24T16:29:48.273Z","updated":"2026-06-24T16:29:48.273Z","title":"fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53041","published":"2026-06-24T16:29:47.501Z","updated":"2026-08-05T12:32:49.657Z","title":"ocfs2: fix listxattr handling when the buffer is full","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-53040","published":"2026-06-24T16:29:46.737Z","updated":"2026-08-05T12:32:48.568Z","title":"ocfs2: validate bg_bits during freefrag scan","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-53039","published":"2026-06-24T16:29:45.853Z","updated":"2026-06-24T16:29:45.853Z","title":"ocfs2: validate group add input before caching","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53038","published":"2026-06-24T16:29:45.086Z","updated":"2026-06-24T16:29:45.086Z","title":"ima_fs: Correctly create securityfs files for unsupported hash algos","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53037","published":"2026-06-24T16:29:44.311Z","updated":"2026-06-24T16:29:44.311Z","title":"HID: usbhid: fix deadlock in hid_post_reset()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-53036","published":"2026-06-24T16:29:43.449Z","updated":"2026-08-05T12:32:47.252Z","title":"bpf, arm64: Fix off-by-one in check_imm signed range check","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-53035","published":"2026-06-24T16:29:42.560Z","updated":"2026-06-24T16:29:42.560Z","title":"bpf, sockmap: Fix af_unix iter deadlock","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-53034","published":"2026-06-24T16:29:41.676Z","updated":"2026-06-24T16:29:41.676Z","title":"bpf, sockmap: Fix af_unix null-ptr-deref in proto update","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-53033","published":"2026-06-24T16:29:40.794Z","updated":"2026-10-19T19:47:14.287Z","title":"bpf, sockmap: Take state lock for af_unix iter","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-53032","published":"2026-06-24T16:29:39.916Z","updated":"2026-06-24T16:29:39.916Z","title":"bpf: Fix NULL deref in map_kptr_match_type for scalar regs","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-53031","published":"2026-06-24T16:29:39.043Z","updated":"2026-10-19T19:47:14.152Z","title":"bpf: Validate node_id in arena_alloc_pages()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-53030","published":"2026-06-24T16:29:38.158Z","updated":"2026-06-24T16:29:38.158Z","title":"i3c: master: renesas: Fix memory leak in renesas_i3c_i3c_xfers()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53029","published":"2026-06-24T16:29:37.361Z","updated":"2026-06-24T16:29:37.361Z","title":"fs/ntfs3: prevent uninitialized lcn caused by zero len","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-53028","published":"2026-06-24T16:29:36.615Z","updated":"2026-06-24T16:29:36.615Z","title":"usb: typec: Fix error pointer dereference","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53027","published":"2026-06-24T16:29:35.740Z","updated":"2026-10-30T12:26:33.290Z","title":"fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-53026","published":"2026-06-24T16:29:34.855Z","updated":"2026-08-05T12:32:44.026Z","title":"NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2026-53025","published":"2026-06-24T16:29:33.971Z","updated":"2026-10-30T12:26:32.237Z","title":"greybus: raw: fix use-after-free on cdev close","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-53024","published":"2026-06-24T16:29:33.184Z","updated":"2026-10-30T12:26:31.167Z","title":"greybus: raw: fix use-after-free if write is called after disconnect","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-53023","published":"2026-06-24T16:29:32.440Z","updated":"2026-06-24T16:29:32.440Z","title":"fs/ntfs3: terminate the cached volume label after UTF-8 conversion","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53022","published":"2026-06-24T16:29:31.552Z","updated":"2026-06-24T16:29:31.552Z","title":"platform/x86: dell-wmi-sysman: bound enumeration string aggregation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53021","published":"2026-06-24T16:29:30.671Z","updated":"2026-06-24T16:29:30.671Z","title":"scsi: target: core: Fix integer overflow in UNMAP bounds check","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-53020","published":"2026-06-24T16:29:29.796Z","updated":"2026-08-05T12:32:40.781Z","title":"um: Fix potential race condition in TLB sync","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-53019","published":"2026-06-24T16:29:28.910Z","updated":"2026-06-24T16:29:28.910Z","title":"clk: spacemit: ccu_mix: fix inverted condition in ccu_mix_trigger_fc()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53018","published":"2026-06-24T16:29:28.051Z","updated":"2026-10-30T12:26:30.098Z","title":"f2fs: avoid reading already updated pages during GC","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53017","published":"2026-06-24T16:29:27.154Z","updated":"2026-10-30T12:26:29.040Z","title":"f2fs: fix data loss caused by incorrect use of nat_entry flag","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53016","published":"2026-06-24T16:29:26.272Z","updated":"2026-10-19T19:47:14.003Z","title":"crypto: ccp - copy IV using skcipher ivsize","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2026-53015","published":"2026-06-24T16:29:25.396Z","updated":"2026-10-30T12:26:27.980Z","title":"erofs: unify lcn as u64 for 32-bit platforms","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-53014","published":"2026-06-24T16:29:24.605Z","updated":"2026-06-24T16:29:24.605Z","title":"net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-53013","published":"2026-06-24T16:29:23.856Z","updated":"2026-06-24T16:29:23.856Z","title":"macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-53012","published":"2026-06-24T16:29:22.973Z","updated":"2026-10-15T01:22:18.192Z","title":"nexthop: fix IPv6 route referencing IPv4 nexthop","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2026-53011","published":"2026-06-24T16:29:22.082Z","updated":"2026-10-19T19:47:13.860Z","title":"net/sched: taprio: fix use-after-free in advance_sched() on schedule switch","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-53010","published":"2026-06-24T16:29:21.211Z","updated":"2026-09-14T11:58:29.019Z","title":"ksmbd: fix use-after-free in smb2_open during durable reconnect","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00444,"kevAdded":null},{"id":"CVE-2026-53009","published":"2026-06-24T16:29:20.332Z","updated":"2026-10-30T12:26:26.927Z","title":"ice: fix double-free of tx_buf skb","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-53008","published":"2026-06-24T16:29:19.459Z","updated":"2026-10-15T10:07:36.576Z","title":"ice: fix race condition in TX timestamp ring cleanup","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00109,"kevAdded":null},{"id":"CVE-2026-53007","published":"2026-06-24T16:29:18.570Z","updated":"2026-10-15T10:07:35.515Z","title":"ice: fix potential NULL pointer deref in error path of ice_set_ringparam()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-53006","published":"2026-06-24T16:29:17.691Z","updated":"2026-10-19T19:47:13.572Z","title":"ipv6: fix possible UAF in icmpv6_rcv()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-53005","published":"2026-06-24T16:29:16.901Z","updated":"2026-10-19T19:47:13.426Z","title":"af_unix: Drop all SCM attributes for SOCKMAP.","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-53004","published":"2026-06-24T16:29:16.151Z","updated":"2026-06-24T16:29:16.151Z","title":"sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-53003","published":"2026-06-24T16:29:15.268Z","updated":"2026-10-19T19:47:13.280Z","title":"pppoe: drop PFC frames","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00716,"kevAdded":null},{"id":"CVE-2026-53002","published":"2026-06-24T16:29:14.391Z","updated":"2026-10-19T19:47:13.138Z","title":"netfilter: conntrack: remove sprintf usage","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2026-53001","published":"2026-06-24T16:29:13.513Z","updated":"2026-10-15T01:22:13.020Z","title":"netfilter: xtables: restrict several matches to inet family","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-53000","published":"2026-06-24T16:29:12.635Z","updated":"2026-10-30T12:26:25.872Z","title":"netfilter: nat: use kfree_rcu to release ops","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-52999","published":"2026-06-24T16:29:11.757Z","updated":"2026-10-19T19:47:12.850Z","title":"netfilter: nfnetlink_osf: fix out-of-bounds read on option matching","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00591,"kevAdded":null},{"id":"CVE-2026-52998","published":"2026-06-24T16:29:10.874Z","updated":"2026-10-19T19:47:12.693Z","title":"netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00579,"kevAdded":null},{"id":"CVE-2026-52997","published":"2026-06-24T16:29:09.997Z","updated":"2026-06-24T16:29:09.997Z","title":"net/sched: sch_dualpi2: drain both C-queue and L-queue in dualpi2_change()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-52996","published":"2026-06-24T16:29:09.113Z","updated":"2026-06-24T16:29:09.113Z","title":"ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-52995","published":"2026-06-24T16:29:08.229Z","updated":"2026-06-24T16:29:08.229Z","title":"net/rds: zero per-item info buffer before handing it to visitors","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-52994","published":"2026-06-24T16:29:07.360Z","updated":"2026-06-24T16:29:07.360Z","title":"vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-52993","published":"2026-06-24T16:29:06.475Z","updated":"2026-10-19T19:47:12.544Z","title":"tipc: fix double-free in tipc_buf_append()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00404,"kevAdded":null},{"id":"CVE-2026-52992","published":"2026-06-24T16:29:05.592Z","updated":"2026-06-24T16:29:05.592Z","title":"fs/adfs: validate nzones in adfs_validate_bblk()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-52991","published":"2026-06-24T16:29:04.810Z","updated":"2026-10-30T12:26:24.799Z","title":"sched/psi: fix race between file release and pressure write","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-52990","published":"2026-06-24T16:29:04.148Z","updated":"2026-10-30T12:26:23.722Z","title":"fsnotify: fix inode reference leak in fsnotify_recalc_mask()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-52989","published":"2026-06-24T16:29:03.398Z","updated":"2026-08-24T12:07:11.778Z","title":"nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00356,"kevAdded":null},{"id":"CVE-2026-52988","published":"2026-06-24T16:29:02.580Z","updated":"2026-10-19T19:47:12.239Z","title":"netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00102,"kevAdded":null},{"id":"CVE-2026-52987","published":"2026-06-24T16:29:01.633Z","updated":"2026-09-10T12:05:00.486Z","title":"drm/amdgpu: avoid double drm_exec_fini() in userq validate","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-52986","published":"2026-06-24T16:29:00.752Z","updated":"2026-10-19T19:47:12.088Z","title":"netfilter: nf_conntrack_sip: don't use simple_strtoul","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00634,"kevAdded":null},{"id":"CVE-2026-52985","published":"2026-06-24T16:28:59.871Z","updated":"2026-06-24T16:28:59.871Z","title":"netdevsim: zero initialize struct iphdr in dummy sk_buff","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-52984","published":"2026-06-24T16:28:59.088Z","updated":"2026-06-24T16:28:59.088Z","title":"net/sched: netem: fix queue limit check to include reordered packets","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-52983","published":"2026-06-24T16:28:58.437Z","updated":"2026-10-21T12:41:43.028Z","title":"net: airoha: fix BQL imbalance in TX path","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0063,"kevAdded":null},{"id":"CVE-2026-52982","published":"2026-06-24T16:28:57.763Z","updated":"2026-10-19T19:47:11.935Z","title":"net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00536,"kevAdded":null},{"id":"CVE-2026-52981","published":"2026-06-24T16:28:57.074Z","updated":"2026-10-19T19:47:11.784Z","title":"neigh: let neigh_xmit take skb ownership","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00532,"kevAdded":null},{"id":"CVE-2026-52980","published":"2026-06-24T16:28:56.457Z","updated":"2026-06-24T16:28:56.457Z","title":"sched/fair: Clear rel_deadline when initializing forked entities","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-52979","published":"2026-06-24T16:28:55.696Z","updated":"2026-06-24T16:28:55.696Z","title":"net: psp: check for device unregister when creating assoc","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-52978","published":"2026-06-24T16:28:54.809Z","updated":"2026-06-24T16:28:54.809Z","title":"net: psp: require admin permission for dev-set and key-rotate","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-52977","published":"2026-06-24T16:28:53.937Z","updated":"2026-08-19T16:28:04.076Z","title":"futex: Prevent lockup in requeue-PI during signal/ timeout wakeup","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-52976","published":"2026-06-24T16:28:53.147Z","updated":"2026-10-19T19:47:11.627Z","title":"drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-52975","published":"2026-06-24T16:28:52.514Z","updated":"2026-10-19T19:47:11.478Z","title":"bonding: 3ad: implement proper RCU rules for port->aggregator","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-52974","published":"2026-06-24T16:28:51.826Z","updated":"2026-10-19T19:47:11.322Z","title":"net: tls: fix strparser anchor skb leak on offload RX setup failure","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.005,"kevAdded":null},{"id":"CVE-2026-52973","published":"2026-06-24T16:28:51.171Z","updated":"2026-10-19T19:47:11.166Z","title":"futex: Drop CLONE_THREAD requirement for private default hash alloc","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-52972","published":"2026-06-24T16:28:50.425Z","updated":"2026-08-17T04:50:24.931Z","title":"crypto: af_alg - Cap AEAD AD length to 0x80000000","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2026-52971","published":"2026-06-24T16:28:49.637Z","updated":"2026-10-19T19:47:11.012Z","title":"net: ena: PHC: Fix potential use-after-free in get_timestamp","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00103,"kevAdded":null},{"id":"CVE-2026-52970","published":"2026-06-24T16:28:48.882Z","updated":"2026-10-15T01:22:06.447Z","title":"netfilter: nft_ct: fix missing expect put in obj eval","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-52969","published":"2026-06-24T16:28:48.085Z","updated":"2026-07-15T02:48:28.368Z","title":"KVM: Reject wrapped offset in kvm_reset_dirty_gfn()","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-52968","published":"2026-06-24T16:28:47.438Z","updated":"2026-10-19T19:47:10.859Z","title":"KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-52967","published":"2026-06-24T16:28:46.661Z","updated":"2026-10-19T19:47:10.711Z","title":"smb/client: fix possible infinite loop and oob read in symlink_data()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2026-52966","published":"2026-06-24T16:28:45.891Z","updated":"2026-06-24T16:28:45.891Z","title":"drm: Replace old pointer to new idr","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-52965","published":"2026-06-24T16:28:45.090Z","updated":"2026-10-15T10:07:34.455Z","title":"drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-52964","published":"2026-06-24T16:28:44.345Z","updated":"2026-06-24T16:28:44.345Z","title":"ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-52963","published":"2026-06-24T16:28:43.593Z","updated":"2026-06-24T16:28:43.593Z","title":"ALSA: usb-audio: Bound MIDI endpoint descriptor scans","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-52962","published":"2026-06-24T16:28:42.688Z","updated":"2026-06-29T04:18:48.908Z","title":"ceph: fix a buffer leak in __ceph_setxattr()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-52961","published":"2026-06-24T16:28:41.836Z","updated":"2026-10-30T12:26:22.665Z","title":"ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-52960","published":"2026-06-24T16:28:41.044Z","updated":"2026-10-21T12:41:41.907Z","title":"ceph: put folios not suitable for writeback","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-52959","published":"2026-06-24T16:28:40.391Z","updated":"2026-08-05T12:32:09.604Z","title":"virt: sev-guest: Do not use host-controlled page order in cleanup path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00113,"kevAdded":null},{"id":"CVE-2026-52958","published":"2026-06-24T16:28:39.723Z","updated":"2026-10-19T19:47:10.414Z","title":"libceph: Fix potential out-of-bounds access in osdmap_decode()","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00735,"kevAdded":null},{"id":"CVE-2026-52957","published":"2026-06-24T16:28:39.066Z","updated":"2026-10-19T19:47:10.252Z","title":"libceph: Fix potential null-ptr-deref in decode_choose_args()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00523,"kevAdded":null},{"id":"CVE-2026-52956","published":"2026-06-24T16:28:38.414Z","updated":"2026-10-30T12:26:21.612Z","title":"libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00684,"kevAdded":null},{"id":"CVE-2026-52955","published":"2026-06-24T16:28:37.748Z","updated":"2026-10-19T19:47:09.949Z","title":"libceph: Fix potential out-of-bounds access in crush_decode()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0038,"kevAdded":null},{"id":"CVE-2026-52954","published":"2026-06-24T16:28:36.992Z","updated":"2026-10-19T19:47:09.795Z","title":"libceph: handle rbtree insertion error in decode_choose_args()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00523,"kevAdded":null},{"id":"CVE-2026-52953","published":"2026-06-24T16:28:36.110Z","updated":"2026-10-19T19:47:09.648Z","title":"iommu/vt-d: Fix oops due to out of scope access","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-52952","published":"2026-06-24T16:28:35.247Z","updated":"2026-08-05T12:32:02.035Z","title":"iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-52951","published":"2026-06-24T16:28:34.351Z","updated":"2026-10-19T19:47:09.499Z","title":"drm/xe/dma-buf: handle empty bo and UAF races","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-52950","published":"2026-06-24T16:28:33.469Z","updated":"2026-10-19T19:47:09.349Z","title":"drm/xe/dma-buf: fix UAF with retry loop","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-52949","published":"2026-06-24T16:28:32.684Z","updated":"2026-10-15T10:07:31.247Z","title":"drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-52948","published":"2026-06-24T16:26:05.719Z","updated":"2026-10-15T01:22:04.803Z","title":"i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-52947","published":"2026-06-24T16:26:05.062Z","updated":"2026-10-19T19:47:09.200Z","title":"net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00106,"kevAdded":null},{"id":"CVE-2026-52946","published":"2026-06-24T16:26:04.419Z","updated":"2026-10-19T19:47:09.047Z","title":"fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-52945","published":"2026-06-24T16:26:03.313Z","updated":"2026-10-19T19:47:08.895Z","title":"Revert \"wireguard: device: enable threaded NAPI\"","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00316,"kevAdded":null},{"id":"CVE-2026-52944","published":"2026-06-24T09:59:09.149Z","updated":"2026-09-14T11:58:26.890Z","title":"ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-52943","published":"2026-06-24T09:00:12.292Z","updated":"2026-10-19T19:47:08.739Z","title":"net: skbuff: fix missing zerocopy reference in pskb_carve helpers","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2026-52942","published":"2026-06-24T07:14:30.610Z","updated":"2026-10-19T19:47:08.584Z","title":"netfilter: nf_log: validate MAC header was set before dumping it","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-52941","published":"2026-06-24T07:14:29.943Z","updated":"2026-06-24T07:14:29.943Z","title":"net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-52940","published":"2026-06-24T07:14:29.281Z","updated":"2026-06-24T07:14:29.281Z","title":"tun: zero the whole vnet header in tun_put_user()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-52939","published":"2026-06-24T07:14:28.622Z","updated":"2026-06-24T07:14:28.622Z","title":"net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-52938","published":"2026-06-24T07:14:27.952Z","updated":"2026-06-27T10:25:25.035Z","title":"bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-52937","published":"2026-06-24T07:14:27.305Z","updated":"2026-10-30T12:26:20.549Z","title":"tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2026-52936","published":"2026-06-24T07:14:26.649Z","updated":"2026-10-30T12:26:19.497Z","title":"crypto: jitterentropy - replace long-held spinlock with mutex","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-52935","published":"2026-06-24T07:14:25.988Z","updated":"2026-10-19T19:47:08.440Z","title":"xfrm: espintcp: do not reuse an in-progress partial send","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00096,"kevAdded":null},{"id":"CVE-2026-52934","published":"2026-06-24T07:14:25.321Z","updated":"2026-08-05T12:31:52.290Z","title":"batman-adv: tvlv: reject oversized TVLV packets","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2026-52933","published":"2026-06-24T07:14:24.678Z","updated":"2026-10-19T19:47:08.287Z","title":"io_uring/poll: fix signed comparison in io_poll_get_ownership()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2026-52932","published":"2026-06-24T07:14:24.002Z","updated":"2026-08-05T12:31:50.048Z","title":"xfrm: ipcomp: Free destination pages on acomp errors","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-52931","published":"2026-06-24T07:14:23.349Z","updated":"2026-10-19T19:47:08.135Z","title":"batman-adv: tp_meter: avoid use of uninit sender vars","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2026-52930","published":"2026-06-24T07:14:22.704Z","updated":"2026-10-15T01:21:54.648Z","title":"ipc/shm: serialize orphan cleanup with shm_nattch updates","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-52929","published":"2026-06-24T07:14:22.020Z","updated":"2026-10-19T19:47:07.980Z","title":"sctp: stream: fully roll back denied add-stream state","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00873,"kevAdded":null},{"id":"CVE-2026-52928","published":"2026-06-24T07:14:21.367Z","updated":"2026-10-15T01:21:51.788Z","title":"af_unix: Reject SIOCATMARK on non-stream sockets","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-52927","published":"2026-06-24T07:14:20.704Z","updated":"2026-10-19T19:47:07.826Z","title":"netfilter: ebtables: fix OOB read in compat_mtw_from_user","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-52926","published":"2026-06-24T07:14:20.057Z","updated":"2026-06-24T07:14:20.057Z","title":"batman-adv: clear current gateway during teardown","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-52925","published":"2026-06-24T07:14:19.351Z","updated":"2026-06-24T07:14:19.351Z","title":"vrf: Fix a potential NPD when removing a port from a VRF","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-52924","published":"2026-06-24T07:14:18.646Z","updated":"2026-10-19T19:47:07.681Z","title":"sctp: purge outqueue on stale COOKIE-ECHO handling","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00659,"kevAdded":null},{"id":"CVE-2026-52923","published":"2026-06-24T07:14:17.849Z","updated":"2026-10-19T19:47:07.539Z","title":"ipc: limit next_id allocation to the valid ID range","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-52922","published":"2026-06-24T07:14:17.185Z","updated":"2026-08-05T12:31:43.495Z","title":"batman-adv: dat: handle forward allocation error","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2026-52921","published":"2026-06-24T07:14:16.533Z","updated":"2026-06-24T07:14:16.533Z","title":"netfilter: ipset: stop hash:* range iteration at end","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-52920","published":"2026-06-24T07:14:15.866Z","updated":"2026-10-19T19:37:00.676Z","title":"netfilter: xt_policy: fix strict mode inbound policy matching","severity":"HIGH","score":8.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2026-52919","published":"2026-06-24T07:14:15.201Z","updated":"2026-08-05T12:31:41.245Z","title":"batman-adv: fix tp_meter counter underflow during shutdown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-52918","published":"2026-06-24T07:14:14.539Z","updated":"2026-10-19T19:37:00.541Z","title":"Bluetooth: serialize accept_q access","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2026-52917","published":"2026-06-24T07:14:13.886Z","updated":"2026-10-19T19:37:00.367Z","title":"sctp: diag: reject stale associations in dump_one path","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-52916","published":"2026-06-24T07:14:13.221Z","updated":"2026-06-24T07:14:13.221Z","title":"batman-adv: frag: disallow unicast fragment in fragment","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-52915","published":"2026-06-24T07:14:12.569Z","updated":"2026-10-19T19:37:00.201Z","title":"netfilter: ip6t_hbh: reject oversized option lists","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-52914","published":"2026-06-24T07:14:11.906Z","updated":"2026-10-19T19:36:59.956Z","title":"batman-adv: fix fragment reassembly length accounting","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00626,"kevAdded":null},{"id":"CVE-2026-52913","published":"2026-06-24T07:14:11.248Z","updated":"2026-06-24T07:14:11.248Z","title":"batman-adv: v: stop OGMv2 on disabled interface","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-52912","published":"2026-06-24T07:14:10.583Z","updated":"2026-10-19T19:36:59.798Z","title":"netfilter: nf_queue: hold bridge skb->dev while queued","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-52911","published":"2026-06-21T06:18:49.342Z","updated":"2026-08-05T12:31:34.753Z","title":"ksmbd: scope conn->binding slowpath to bound sessions only","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00663,"kevAdded":null},{"id":"CVE-2026-52910","published":"2026-06-19T14:43:33.952Z","updated":"2026-10-19T19:36:59.652Z","title":"bpf: Free reuseport cBPF prog after RCU grace period.","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-52909","published":"2026-06-19T14:43:33.214Z","updated":"2026-10-19T19:36:59.506Z","title":"ip6_vti: set netns_immutable on the fallback device.","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00113,"kevAdded":null},{"id":"CVE-2026-52908","published":"2026-06-19T14:00:35.971Z","updated":"2026-10-19T19:36:59.343Z","title":"RDMA: During rereg_mr ensure that REREG_ACCESS is compatible","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-46331","published":"2026-06-16T06:26:21.066Z","updated":"2026-10-15T01:21:40.294Z","title":"net/sched: fix pedit partial COW leading to page cache corruption","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00639,"kevAdded":null},{"id":"CVE-2026-52907","published":"2026-06-09T12:36:04.617Z","updated":"2026-08-05T12:31:30.487Z","title":"media: rockchip: rkcif: fix off by one bugs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-52906","published":"2026-06-09T12:36:03.521Z","updated":"2026-08-05T12:31:29.381Z","title":"9p: fix access mode flags being ORed instead of replaced","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-52905","published":"2026-06-09T12:36:02.516Z","updated":"2026-06-14T18:09:36.556Z","title":"mm/damon/core: disallow non-power of two min_region_sz on damon_start()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-52904","published":"2026-06-09T12:36:01.237Z","updated":"2026-06-14T18:09:32.591Z","title":"drm/nouveau: fix nvkm_device leak on aperture removal failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-46332","published":"2026-06-09T12:36:00.450Z","updated":"2026-08-05T12:31:27.125Z","title":"greybus: gb-beagleplay: bound bootloader receive buffering","severity":"HIGH","score":8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2026-46330","published":"2026-06-09T12:25:59.413Z","updated":"2026-10-30T12:26:18.431Z","title":"Revert \"net/smc: Introduce TCP ULP support\"","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-46329","published":"2026-06-09T12:25:58.520Z","updated":"2026-06-09T12:25:58.520Z","title":"erofs: handle end of filesystem properly for file-backed mounts","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-46328","published":"2026-06-09T12:25:57.629Z","updated":"2026-08-05T12:31:23.796Z","title":"apparmor: fix rlimit for posix cpu timers","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-46327","published":"2026-06-09T12:25:54.781Z","updated":"2026-10-19T19:36:58.906Z","title":"dm: fix unlocked test for dm_suspended_md","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00096,"kevAdded":null},{"id":"CVE-2026-46326","published":"2026-06-09T12:25:53.893Z","updated":"2026-08-05T12:31:21.635Z","title":"iio: pressure: mprls0025pa: fix spi_transfer struct initialisation","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-46325","published":"2026-06-09T12:25:52.792Z","updated":"2026-10-21T12:41:37.480Z","title":"RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0045,"kevAdded":null},{"id":"CVE-2026-46324","published":"2026-06-09T12:11:16.602Z","updated":"2026-10-30T12:26:17.369Z","title":"netfilter: nf_tables: use list_del_rcu for netlink hooks","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-46323","published":"2026-06-09T12:11:15.562Z","updated":"2026-10-19T19:36:58.470Z","title":"net: gro: don't merge zcopy skbs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2026-46322","published":"2026-06-09T12:11:14.776Z","updated":"2026-10-19T19:36:58.325Z","title":"tun: free page on build_skb failure in tun_xdp_one()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-46321","published":"2026-06-09T12:11:13.872Z","updated":"2026-10-15T01:21:35.519Z","title":"tun: free page on short-frame rejection in tun_xdp_one()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-46320","published":"2026-06-09T12:11:12.882Z","updated":"2026-10-19T19:36:58.167Z","title":"tap: free page on error paths in tap_get_user_xdp()","severity":"HIGH","score":7.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-46319","published":"2026-06-09T12:11:12.128Z","updated":"2026-10-19T19:36:58.008Z","title":"net/sched: act_ct: Only release RCU read lock after ct_ft","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00105,"kevAdded":null},{"id":"CVE-2026-46318","published":"2026-06-09T12:11:11.181Z","updated":"2026-06-14T18:08:52.009Z","title":"Revert \"mm/hugetlbfs: update hugetlbfs to use mmap_prepare\"","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-46317","published":"2026-06-09T11:52:30.333Z","updated":"2026-10-19T19:36:57.837Z","title":"KVM: arm64: Reassign nested_mmus array behind mmu_lock","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-46316","published":"2026-06-09T11:52:29.349Z","updated":"2026-10-19T19:36:57.668Z","title":"KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00337,"kevAdded":null},{"id":"CVE-2026-46315","published":"2026-06-09T07:38:13.713Z","updated":"2026-06-14T18:08:38.384Z","title":"io_uring/waitid: clear waitid info before copying it to userspace","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-46314","published":"2026-06-08T15:50:45.305Z","updated":"2026-06-19T12:00:14.686Z","title":"drm/v3d: Reject empty multisync extension to prevent infinite loop","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2026-46313","published":"2026-06-08T15:50:44.065Z","updated":"2026-06-14T18:08:30.237Z","title":"media: intel/ipu6: fix error pointer dereference","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-46312","published":"2026-06-08T15:50:42.964Z","updated":"2026-10-30T12:26:16.266Z","title":"media: videobuf2: Set vma_flags in vb2_dma_sg_mmap","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-46311","published":"2026-06-08T15:50:41.866Z","updated":"2026-10-19T19:36:57.524Z","title":"drm/amdgpu/userq: fix access to stale wptr mapping","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-46310","published":"2026-06-08T15:50:40.776Z","updated":"2026-06-14T18:08:17.039Z","title":"media: renesas: vsp1: Fix NULL pointer deref on module unload","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-46309","published":"2026-06-08T15:50:39.689Z","updated":"2026-07-15T00:50:51.323Z","title":"drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-46308","published":"2026-06-08T15:46:36.218Z","updated":"2026-06-14T18:08:08.039Z","title":"pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2026-46307","published":"2026-06-08T15:46:35.059Z","updated":"2026-10-15T01:21:33.220Z","title":"wifi: ath5k: do not access array OOB","severity":"HIGH","score":8.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2026-46306","published":"2026-06-08T15:46:33.936Z","updated":"2026-10-19T19:36:57.372Z","title":"flow_dissector: do not dissect PPPoE PFC frames","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00449,"kevAdded":null},{"id":"CVE-2026-46305","published":"2026-06-08T15:46:32.831Z","updated":"2026-09-14T11:58:25.835Z","title":"staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-46304","published":"2026-06-08T15:46:31.747Z","updated":"2026-10-19T19:36:57.215Z","title":"nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00349,"kevAdded":null},{"id":"CVE-2026-46303","published":"2026-06-08T15:46:30.642Z","updated":"2026-10-15T01:21:29.328Z","title":"isofs: validate Rock Ridge CE continuation extent against volume size","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2026-46302","published":"2026-06-08T15:46:29.545Z","updated":"2026-10-30T12:26:15.203Z","title":"selinux: allow multiple opens of /sys/fs/selinux/policy","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2026-46301","published":"2026-06-08T15:46:28.004Z","updated":"2026-06-14T18:07:38.861Z","title":"spi: topcliff-pch: fix use-after-free on unbind","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-46299","published":"2026-06-08T15:46:26.670Z","updated":"2026-08-05T12:31:04.308Z","title":"hfsplus: fix held lock freed on hfsplus_fill_super()","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00091,"kevAdded":null},{"id":"CVE-2026-46298","published":"2026-06-08T15:46:25.568Z","updated":"2026-10-15T10:07:28.056Z","title":"pseries/papr-hvpipe: Fix race with interrupt handler","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00085,"kevAdded":null},{"id":"CVE-2026-46297","published":"2026-06-08T15:46:24.446Z","updated":"2026-06-14T18:07:20.155Z","title":"net: libwx: use request_irq for VF misc interrupt","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-46296","published":"2026-06-08T15:46:23.539Z","updated":"2026-06-19T12:00:10.948Z","title":"spi: s3c64xx: fix NULL-deref on driver unbind","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-46295","published":"2026-06-08T15:46:22.494Z","updated":"2026-06-14T18:07:10.912Z","title":"KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-46294","published":"2026-06-08T15:46:21.401Z","updated":"2026-10-15T01:21:25.925Z","title":"dm: fix a buffer overflow in ioctl processing","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-46293","published":"2026-06-08T15:46:20.288Z","updated":"2026-06-14T18:07:01.688Z","title":"clk: microchip: mpfs-ccc: fix out of bounds access during output registration","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-46292","published":"2026-06-08T15:46:19.431Z","updated":"2026-06-19T12:00:08.563Z","title":"pmdomain: core: Fix detach procedure for virtual devices in genpd","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46291","published":"2026-06-08T15:46:18.317Z","updated":"2026-06-19T12:00:06.481Z","title":"crypto: caam - guard HMAC key hex dumps in hash_digest_key","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46290","published":"2026-06-08T15:46:17.224Z","updated":"2026-06-14T18:06:47.501Z","title":"x86/efi: Fix graceful fault handling after FPU softirq changes","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-46289","published":"2026-06-08T15:46:15.888Z","updated":"2026-08-05T12:31:03.214Z","title":"lib/scatterlist: fix length calculations in extract_kvec_to_sg","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00457,"kevAdded":null},{"id":"CVE-2026-46288","published":"2026-06-08T15:41:31.868Z","updated":"2026-08-05T12:31:02.134Z","title":"of: unittest: fix use-after-free in of_unittest_changeset()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2026-46287","published":"2026-06-08T15:41:30.791Z","updated":"2026-06-14T18:06:33.846Z","title":"net: txgbe: fix RTNL assertion warning when remove module","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-46286","published":"2026-06-08T15:41:29.682Z","updated":"2026-06-14T18:06:28.805Z","title":"leds: qcom-lpg: Check for array overflow when selecting the high resolution","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-46285","published":"2026-06-08T15:41:28.566Z","updated":"2026-06-14T18:06:23.744Z","title":"mtd: docg3: fix use-after-free in docg3_release()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-46284","published":"2026-06-08T15:41:27.467Z","updated":"2026-06-14T18:06:18.465Z","title":"mm/hugetlb: fix early boot crash on parameters without '=' separator","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-46283","published":"2026-06-08T15:41:26.425Z","updated":"2026-06-14T18:06:13.398Z","title":"tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-46282","published":"2026-06-08T15:41:25.273Z","updated":"2026-10-21T12:41:34.192Z","title":"iio: frequency: admv1013: fix NULL pointer dereference on str","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-46281","published":"2026-06-08T15:41:24.168Z","updated":"2026-06-14T18:06:05.046Z","title":"vmalloc: fix buffer overflow in vrealloc_node_align()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2026-46280","published":"2026-06-08T15:41:23.095Z","updated":"2026-10-19T19:36:56.915Z","title":"lib: test_hmm: evict device pages on file close to avoid use-after-free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-46279","published":"2026-06-08T15:41:21.972Z","updated":"2026-06-14T18:05:55.795Z","title":"mm/alloc_tag: clear codetag for pages allocated before page_ext initialization","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-46278","published":"2026-06-08T15:41:20.876Z","updated":"2026-06-14T18:05:51.630Z","title":"drm/imagination: Fix segfault when updating ftrace mask","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-46277","published":"2026-06-08T15:41:19.760Z","updated":"2026-08-05T12:30:59.977Z","title":"mm/zone_device: do not touch device folio after calling ->folio_free()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-46276","published":"2026-06-08T15:41:18.672Z","updated":"2026-06-14T18:05:43.582Z","title":"drm/amdgpu: fix zero-size GDS range init on RDNA4","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46275","published":"2026-06-08T14:30:54.232Z","updated":"2026-10-19T19:36:56.765Z","title":"Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2026-46274","published":"2026-06-08T14:30:53.323Z","updated":"2026-08-05T12:30:57.842Z","title":"io-wq: check that the predecessor is hashed in io_wq_remove_pending()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2025-71315","published":"2026-06-08T14:30:52.457Z","updated":"2026-06-09T07:37:22.884Z","title":"drm/vkms: Convert to DRM's vblank timer","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-46273","published":"2026-06-03T16:19:18.056Z","updated":"2026-08-07T12:54:55.431Z","title":"ibmveth: Disable GSO for packets with small MSS","severity":"HIGH","score":8.6,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2026-46272","published":"2026-06-03T15:50:14.618Z","updated":"2026-10-21T12:41:33.089Z","title":"coresight: tmc-etr: Fix race condition between sysfs and perf mode","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-46271","published":"2026-06-03T15:50:13.645Z","updated":"2026-10-19T19:36:56.613Z","title":"wifi: ath12k: do WoW offloads only on primary link","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46270","published":"2026-06-03T15:50:12.537Z","updated":"2026-08-05T12:30:54.591Z","title":"power: supply: rt9455: Fix use-after-free in power_supply_changed()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-46269","published":"2026-06-03T15:50:11.254Z","updated":"2026-06-03T15:50:11.254Z","title":"pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetree","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00113,"kevAdded":null},{"id":"CVE-2026-46268","published":"2026-06-03T15:50:10.101Z","updated":"2026-06-03T15:50:10.101Z","title":"PCI/P2PDMA: Fix p2pmem_alloc_mmap() warning condition","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00113,"kevAdded":null},{"id":"CVE-2026-46267","published":"2026-06-03T15:50:09.035Z","updated":"2026-06-03T15:50:09.035Z","title":"nfc: hci: shdlc: Stop timers and work before freeing context","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-46266","published":"2026-06-03T15:50:07.907Z","updated":"2026-10-19T19:36:56.452Z","title":"inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00465,"kevAdded":null},{"id":"CVE-2026-46265","published":"2026-06-03T15:50:05.933Z","updated":"2026-10-30T12:26:14.155Z","title":"RDMA/hns: Fix WQ_MEM_RECLAIM warning","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2026-46264","published":"2026-06-03T15:50:04.620Z","updated":"2026-08-05T12:30:51.365Z","title":"drm/xe/pf: Fix sysfs initialization","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-46263","published":"2026-06-03T15:50:02.572Z","updated":"2026-10-19T19:36:56.301Z","title":"drm/amd/display: Fix out-of-bounds stream encoder index v3","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-46262","published":"2026-06-03T15:49:59.980Z","updated":"2026-06-03T15:49:59.980Z","title":"ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00091,"kevAdded":null},{"id":"CVE-2026-46261","published":"2026-06-03T15:49:58.684Z","updated":"2026-06-03T15:49:58.684Z","title":"spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-46260","published":"2026-06-03T15:49:57.561Z","updated":"2026-08-05T12:30:49.200Z","title":"ipv6: Fix out-of-bound access in fib6_add_rt2node().","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-46259","published":"2026-06-03T15:49:56.428Z","updated":"2026-10-19T19:36:56.158Z","title":"procfs: fix missing RCU protection when reading real_parent in do_task_stat()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-46258","published":"2026-06-03T15:49:55.372Z","updated":"2026-06-03T15:49:55.372Z","title":"gpio: cdev: Avoid NULL dereference in linehandle_create()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-46257","published":"2026-06-03T15:49:54.286Z","updated":"2026-06-03T15:49:54.286Z","title":"clocksource/drivers/timer-sp804: Fix an Oops when read_current_timer is called on ARM32 platforms where the SP804 is not registered as the sched_clock.","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-46256","published":"2026-06-03T15:49:53.168Z","updated":"2026-10-21T12:41:32.006Z","title":"NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-46255","published":"2026-06-03T15:49:52.091Z","updated":"2026-06-03T15:49:52.091Z","title":"dmaengine: fsl-edma: don't explicitly disable clocks in .remove()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-46254","published":"2026-06-03T15:49:50.994Z","updated":"2026-10-30T12:26:13.086Z","title":"AppArmor: Allow apparmor to handle unaligned dfa tables","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-46253","published":"2026-06-03T15:49:49.864Z","updated":"2026-10-19T19:36:56.007Z","title":"pstore/ram: fix buffer overflow in persistent_ram_save_old()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-46252","published":"2026-06-03T15:49:48.784Z","updated":"2026-07-04T11:50:44.068Z","title":"regulator: core: fix locking in regulator_resolve_supply() error path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00091,"kevAdded":null},{"id":"CVE-2026-46251","published":"2026-06-03T15:49:47.684Z","updated":"2026-08-05T12:30:45.952Z","title":"btrfs: fix block_group_tree dirty_list corruption","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-46250","published":"2026-06-03T15:49:46.390Z","updated":"2026-08-05T12:30:44.867Z","title":"MIPS: Work around LLVM bug when gp is used as global register variable","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-46249","published":"2026-06-03T15:49:45.252Z","updated":"2026-06-03T15:49:45.252Z","title":"octeontx2-af: Fix PF driver crash with kexec kernel booting","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2026-46248","published":"2026-06-03T15:49:43.934Z","updated":"2026-06-03T15:49:43.934Z","title":"wifi: ath12k: clear stale link mapping of ahvif->links_map","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-46247","published":"2026-06-03T15:49:42.833Z","updated":"2026-06-03T15:49:42.833Z","title":"clk: qcom: gfx3d: add parent to parent request map","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46246","published":"2026-06-03T15:49:41.607Z","updated":"2026-06-03T15:49:41.607Z","title":"power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-46245","published":"2026-06-03T15:49:40.645Z","updated":"2026-10-21T12:41:29.783Z","title":"drm/amd/display: Fix dc_link NULL handling in HPD init","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2025-71314","published":"2026-06-03T15:49:39.523Z","updated":"2026-06-03T15:49:39.523Z","title":"drm/panthor: Recover from panthor_gpu_flush_caches() failures","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2025-71313","published":"2026-06-03T15:49:38.450Z","updated":"2026-10-30T12:23:37.692Z","title":"PCI: endpoint: Add missing NULL check for alloc_workqueue()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-46244","published":"2026-06-03T15:48:59.049Z","updated":"2026-10-19T19:36:55.855Z","title":"netfilter: nft_inner: Fix IPv6 inner_thoff desync","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00418,"kevAdded":null},{"id":"CVE-2026-46243","published":"2026-06-01T16:22:29.211Z","updated":"2026-10-15T01:21:23.530Z","title":"smb: client: reject userspace cifs.spnego descriptions","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00413,"kevAdded":null},{"id":"CVE-2026-46242","published":"2026-05-30T12:13:45.594Z","updated":"2026-10-19T19:36:55.705Z","title":"eventpoll: fix ep_remove struct eventpoll / struct file UAF","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0439,"kevAdded":null},{"id":"CVE-2026-46241","published":"2026-05-28T09:41:09.145Z","updated":"2026-10-30T12:26:12.028Z","title":"spi: mpc52xx: fix use-after-free on registration failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-46240","published":"2026-05-28T09:41:08.376Z","updated":"2026-08-05T12:30:40.467Z","title":"media: iris: Fix use-after-free in iris_release_internal_buffers()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-46239","published":"2026-05-28T09:41:07.609Z","updated":"2026-06-14T18:05:01.235Z","title":"media: i2c: ov5647: Fix runtime PM refcount leak in s_ctrl","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00105,"kevAdded":null},{"id":"CVE-2026-46238","published":"2026-05-28T09:41:06.816Z","updated":"2026-08-05T12:30:39.402Z","title":"batman-adv: stop caching unowned originator pointers in BAT IV","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2026-46236","published":"2026-05-28T09:41:05.230Z","updated":"2026-06-14T18:04:50.463Z","title":"media: rc: xbox_remote: heed DMA restrictions","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-46235","published":"2026-05-28T09:41:04.419Z","updated":"2026-06-14T18:04:45.615Z","title":"media: saa7164: add ioremap return checks and cleanups","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-46234","published":"2026-05-28T09:40:58.373Z","updated":"2026-10-15T01:21:22.279Z","title":"vsock: fix buffer size clamping order","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-46233","published":"2026-05-28T09:40:55.019Z","updated":"2026-06-14T18:04:36.157Z","title":"batman-adv: bla: only purge non-released claims","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-46232","published":"2026-05-28T09:40:54.248Z","updated":"2026-08-05T12:30:38.317Z","title":"HID: playstation: Clamp num_touch_reports","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2026-46231","published":"2026-05-28T09:40:53.471Z","updated":"2026-06-14T18:04:27.129Z","title":"batman-adv: bla: put backbone reference on failed claim hash insert","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-46230","published":"2026-05-28T09:40:52.696Z","updated":"2026-10-19T19:36:55.550Z","title":"drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46229","published":"2026-05-28T09:40:51.300Z","updated":"2026-10-30T12:26:10.964Z","title":"drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-46228","published":"2026-05-28T09:40:48.689Z","updated":"2026-10-21T12:41:27.598Z","title":"spi: ch341: fix devres lifetime","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-46227","published":"2026-05-28T09:40:47.518Z","updated":"2026-10-19T19:36:55.398Z","title":"sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00104,"kevAdded":null},{"id":"CVE-2026-46226","published":"2026-05-28T09:40:46.027Z","updated":"2026-10-30T12:26:09.902Z","title":"spi: fsl: fix controller deregistration","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-46225","published":"2026-05-28T09:40:44.066Z","updated":"2026-10-30T12:26:08.842Z","title":"spi: rspi: fix controller deregistration","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-46224","published":"2026-05-28T09:40:42.819Z","updated":"2026-06-14T18:03:55.011Z","title":"drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-46223","published":"2026-05-28T09:40:40.791Z","updated":"2026-06-14T18:03:52.610Z","title":"cgroup: Defer css percpu_ref kill on rmdir until cgroup is depopulated","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00083,"kevAdded":null},{"id":"CVE-2026-46222","published":"2026-05-28T09:40:38.777Z","updated":"2026-06-14T18:03:47.570Z","title":"media: rockchip: rkcif: Add missing MUST_CONNECT flag to pads","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00105,"kevAdded":null},{"id":"CVE-2026-46221","published":"2026-05-28T09:40:36.679Z","updated":"2026-06-14T18:03:43.057Z","title":"EDAC/versalnet: Fix device name memory leak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-46220","published":"2026-05-28T09:40:35.971Z","updated":"2026-06-14T18:03:38.077Z","title":"drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-46219","published":"2026-05-28T09:40:35.297Z","updated":"2026-06-14T18:03:33.018Z","title":"spi: mpc52xx: fix use-after-free on unbind","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-46218","published":"2026-05-28T09:40:34.367Z","updated":"2026-08-05T12:30:34.974Z","title":"drm/amdgpu: Add bounds checking to ib_{get,set}_value","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-46216","published":"2026-05-28T09:40:32.891Z","updated":"2026-06-14T18:03:22.909Z","title":"drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-46215","published":"2026-05-28T09:40:32.050Z","updated":"2026-08-05T12:30:33.895Z","title":"drm: Set old handle to NULL before prime swap in change_handle","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-46214","published":"2026-05-28T09:40:31.245Z","updated":"2026-10-15T01:21:19.627Z","title":"vsock/virtio: fix accept queue count leak on transport mismatch","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-46213","published":"2026-05-28T09:40:30.429Z","updated":"2026-06-14T18:03:11.677Z","title":"HID: appletb-kbd: fix UAF in inactivity-timer cleanup path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-46212","published":"2026-05-28T09:40:29.712Z","updated":"2026-08-05T12:30:32.814Z","title":"batman-adv: bla: prevent use-after-free when deleting claims","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-46211","published":"2026-05-28T09:40:28.890Z","updated":"2026-06-14T18:03:02.808Z","title":"drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-46210","published":"2026-05-28T09:40:27.884Z","updated":"2026-10-15T10:07:25.926Z","title":"media: iris: fix use-after-free of fmt_src during MBPF check","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-46209","published":"2026-05-28T09:40:27.092Z","updated":"2026-10-19T19:36:55.238Z","title":"drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-46208","published":"2026-05-28T09:40:26.341Z","updated":"2026-08-05T12:30:29.443Z","title":"batman-adv: stop tp_meter sessions during mesh teardown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-46207","published":"2026-05-28T09:40:25.583Z","updated":"2026-06-14T18:02:44.626Z","title":"vsock/virtio: fix empty payload in tap skb for non-linear buffers","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-46206","published":"2026-05-28T09:40:23.993Z","updated":"2026-08-05T12:30:28.363Z","title":"batman-adv: reject new tp_meter sessions during teardown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-46205","published":"2026-05-28T09:40:23.117Z","updated":"2026-08-05T12:30:27.283Z","title":"staging: media: atomisp: Disallow all private IOCTLs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2026-46204","published":"2026-05-28T09:40:21.933Z","updated":"2026-10-30T12:26:07.773Z","title":"drm/amdgpu/vcn4: Prevent OOB reads when parsing IB","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-46203","published":"2026-05-28T09:40:20.631Z","updated":"2026-06-19T12:00:01.077Z","title":"spi: cadence-quadspi: fix unclocked access on unbind","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-46202","published":"2026-05-28T09:40:18.687Z","updated":"2026-06-14T18:02:25.494Z","title":"HID: appletb-kbd: run inactivity autodim from workqueues","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-46201","published":"2026-05-28T09:40:17.964Z","updated":"2026-10-19T19:36:54.904Z","title":"drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-46200","published":"2026-05-28T09:40:16.828Z","updated":"2026-10-30T12:26:06.731Z","title":"spi: mpc52xx: fix controller deregistration","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-46199","published":"2026-05-28T09:40:16.061Z","updated":"2026-10-19T19:36:54.755Z","title":"drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-46198","published":"2026-05-28T09:40:14.558Z","updated":"2026-08-05T12:30:22.970Z","title":"batman-adv: fix integer overflow on buff_pos","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2026-46197","published":"2026-05-28T09:40:13.722Z","updated":"2026-10-19T19:36:54.598Z","title":"drm/amdkfd: validate SVM ioctl nattr against buffer size","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-46196","published":"2026-05-28T09:36:49.293Z","updated":"2026-10-15T01:21:17.317Z","title":"tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-46195","published":"2026-05-28T09:36:48.259Z","updated":"2026-10-19T19:36:54.445Z","title":"smb: client: validate dacloffset before building DACL pointers","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00675,"kevAdded":null},{"id":"CVE-2026-46193","published":"2026-05-28T09:36:46.611Z","updated":"2026-10-15T01:21:14.935Z","title":"xfrm: ah: account for ESN high bits in async callbacks","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-46192","published":"2026-05-28T09:36:45.770Z","updated":"2026-06-14T18:01:35.461Z","title":"spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-46191","published":"2026-05-28T09:36:44.961Z","updated":"2026-10-15T01:21:13.270Z","title":"fbcon: Avoid OOB font access if console rotation fails","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2026-46190","published":"2026-05-28T09:36:44.017Z","updated":"2026-10-15T01:21:11.983Z","title":"mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-46189","published":"2026-05-28T09:36:43.205Z","updated":"2026-09-09T12:04:49.181Z","title":"RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-46188","published":"2026-05-28T09:36:42.251Z","updated":"2026-06-14T18:01:19.185Z","title":"octeon_ep_vf: add NULL check for napi_build_skb()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-46187","published":"2026-05-28T09:36:41.427Z","updated":"2026-10-15T01:21:10.806Z","title":"wifi: rsi: fix kthread lifetime race between self-exit and external-stop","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-46186","published":"2026-05-28T09:36:40.349Z","updated":"2026-06-14T18:01:09.675Z","title":"Bluetooth: virtio_bt: validate rx pkt_type header length","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46185","published":"2026-05-28T09:36:39.318Z","updated":"2026-10-19T19:36:54.280Z","title":"smb/client: fix out-of-bounds read in symlink_data()","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00525,"kevAdded":null},{"id":"CVE-2026-46184","published":"2026-05-28T09:36:38.134Z","updated":"2026-06-14T18:00:59.666Z","title":"sound: ua101: fix division by zero at probe","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-46183","published":"2026-05-28T09:36:36.582Z","updated":"2026-06-14T18:00:54.954Z","title":"mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-46182","published":"2026-05-28T09:36:35.528Z","updated":"2026-06-14T18:00:50.449Z","title":"pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-46181","published":"2026-05-28T09:36:34.706Z","updated":"2026-10-30T12:26:04.829Z","title":"RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2026-46180","published":"2026-05-28T09:36:33.904Z","updated":"2026-10-15T01:21:08.231Z","title":"wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2026-46179","published":"2026-05-28T09:36:33.062Z","updated":"2026-06-14T18:00:36.371Z","title":"ASoC: SOF: Don't allow pointer operations on unconfigured streams","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46178","published":"2026-05-28T09:36:32.222Z","updated":"2026-10-19T19:36:53.902Z","title":"RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-46177","published":"2026-05-28T09:36:31.286Z","updated":"2026-10-15T01:21:07.039Z","title":"ipmi: Add limits to event and receive message requests","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-46176","published":"2026-05-28T09:36:30.398Z","updated":"2026-10-19T19:36:53.745Z","title":"RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-46175","published":"2026-05-28T09:36:29.522Z","updated":"2026-10-30T12:26:03.732Z","title":"f2fs: fix fsck inconsistency caused by FGGC of node block","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-46174","published":"2026-05-28T09:36:28.703Z","updated":"2026-10-19T19:36:53.596Z","title":"x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2026-46173","published":"2026-05-28T09:36:27.892Z","updated":"2026-10-19T19:36:53.446Z","title":"exit: prevent preemption of oopsing TASK_DEAD task","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-46172","published":"2026-05-28T09:36:26.926Z","updated":"2026-10-15T01:21:02.038Z","title":"ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-46171","published":"2026-05-28T09:36:25.966Z","updated":"2026-10-21T12:41:22.651Z","title":"riscv: kvm: fix vector context allocation leak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-46170","published":"2026-05-28T09:36:25.184Z","updated":"2026-09-14T11:58:24.772Z","title":"mptcp: pm: ADD_ADDR rtx: free sk if last","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-46169","published":"2026-05-28T09:36:24.361Z","updated":"2026-06-19T11:59:47.129Z","title":"hfsplus: fix uninit-value by validating catalog record size","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-46168","published":"2026-05-28T09:36:23.394Z","updated":"2026-10-15T01:21:00.385Z","title":"mptcp: fix scheduling with atomic in timestamp sockopt","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-46167","published":"2026-05-28T09:36:22.434Z","updated":"2026-10-15T01:20:59.172Z","title":"usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-46166","published":"2026-05-28T09:36:21.675Z","updated":"2026-10-19T19:36:53.276Z","title":"wifi: mac80211: use safe list iteration in radar detect work","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2026-46165","published":"2026-05-28T09:36:20.855Z","updated":"2026-10-30T12:26:02.679Z","title":"openvswitch: vport: fix self-deadlock on release of tunnel ports","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00099,"kevAdded":null},{"id":"CVE-2026-46164","published":"2026-05-28T09:36:19.810Z","updated":"2026-08-05T12:30:08.949Z","title":"btrfs: fix double free in create_space_info_sub_group() error path","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-46163","published":"2026-05-28T09:36:18.946Z","updated":"2026-10-15T01:20:55.170Z","title":"wifi: b43legacy: enforce bounds check on firmware key index in RX path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-46162","published":"2026-05-28T09:36:17.479Z","updated":"2026-06-14T17:59:13.179Z","title":"ice: fix double free in ice_sf_eth_activate() error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-46161","published":"2026-05-28T09:36:16.428Z","updated":"2026-10-15T01:20:53.911Z","title":"md/raid10: fix divide-by-zero in setup_geo() with zero far_copies","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-46160","published":"2026-05-28T09:36:15.580Z","updated":"2026-06-19T11:59:43.255Z","title":"btrfs: fix missing last_unlink_trans update when removing a directory","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-46159","published":"2026-05-28T09:36:14.676Z","updated":"2026-10-15T01:20:52.767Z","title":"btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00098,"kevAdded":null},{"id":"CVE-2026-46158","published":"2026-05-28T09:36:13.821Z","updated":"2026-09-14T11:58:23.714Z","title":"mptcp: pm: ADD_ADDR rtx: always decrease sk refcount","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-46157","published":"2026-05-28T09:36:12.895Z","updated":"2026-10-30T12:26:01.629Z","title":"ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-46156","published":"2026-05-28T09:36:12.075Z","updated":"2026-06-14T17:58:44.149Z","title":"LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-46155","published":"2026-05-28T09:36:11.092Z","updated":"2026-10-19T19:36:53.105Z","title":"smb/client: fix out-of-bounds read in smb2_compound_op()","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00478,"kevAdded":null},{"id":"CVE-2026-46154","published":"2026-05-28T09:36:10.310Z","updated":"2026-08-05T12:30:05.703Z","title":"sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-46153","published":"2026-05-28T09:36:09.415Z","updated":"2026-06-14T17:58:29.635Z","title":"8021q: delete cleared egress QoS mappings","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-46152","published":"2026-05-28T09:36:08.211Z","updated":"2026-10-19T19:36:52.937Z","title":"wifi: mac80211: drop stray 'static' from fast-RX rx_result","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-46151","published":"2026-05-28T09:36:07.397Z","updated":"2026-10-15T01:20:51.612Z","title":"usb: usblp: fix heap leak in IEEE 1284 device ID via short response","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-46150","published":"2026-05-28T09:36:06.494Z","updated":"2026-10-19T19:36:52.765Z","title":"fanotify: fix false positive on permission events","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-46149","published":"2026-05-28T09:36:05.706Z","updated":"2026-10-19T19:36:52.452Z","title":"scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-46148","published":"2026-05-28T09:36:04.805Z","updated":"2026-10-30T12:26:00.561Z","title":"spi: microchip-core-qspi: control built-in cs manually","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46147","published":"2026-05-28T09:36:03.892Z","updated":"2026-06-14T17:58:03.230Z","title":"KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-46146","published":"2026-05-28T09:36:02.794Z","updated":"2026-10-15T01:20:47.967Z","title":"ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-46145","published":"2026-05-28T09:36:01.805Z","updated":"2026-10-19T19:36:52.289Z","title":"RDMA/mana: Validate rx_hash_key_len","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-46144","published":"2026-05-28T09:36:00.412Z","updated":"2026-06-14T17:57:49.375Z","title":"RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-46143","published":"2026-05-28T09:35:59.117Z","updated":"2026-06-14T17:57:43.842Z","title":"ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-46142","published":"2026-05-28T09:35:57.837Z","updated":"2026-06-14T17:57:38.598Z","title":"net: libwx: fix VF illegal register access","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-46141","published":"2026-05-28T09:35:56.940Z","updated":"2026-06-14T17:57:33.523Z","title":"powerpc/xive: fix kmemleak caused by incorrect chip_data lookup","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-46140","published":"2026-05-28T09:35:56.104Z","updated":"2026-07-04T11:50:42.029Z","title":"Bluetooth: btmtk: validate WMT event SKB length before struct access","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-46139","published":"2026-05-28T09:35:55.234Z","updated":"2026-06-14T17:57:22.559Z","title":"smb: client: use kzalloc to zero-initialize security descriptor buffer","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-46138","published":"2026-05-28T09:35:54.467Z","updated":"2026-10-19T19:36:52.126Z","title":"Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-46137","published":"2026-05-28T09:35:53.628Z","updated":"2026-10-19T19:36:51.963Z","title":"mptcp: pm: ADD_ADDR rtx: fix potential data-race","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00477,"kevAdded":null},{"id":"CVE-2026-46136","published":"2026-05-28T09:35:52.004Z","updated":"2026-10-15T01:20:45.666Z","title":"wifi: mt76: mt7921: fix a potential clc buffer length underflow","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-46135","published":"2026-05-28T09:35:49.828Z","updated":"2026-10-19T19:36:51.823Z","title":"nvmet-tcp: fix race between ICReq handling and queue teardown","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00397,"kevAdded":null},{"id":"CVE-2026-46134","published":"2026-05-28T09:35:48.624Z","updated":"2026-06-14T17:56:59.651Z","title":"platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-46133","published":"2026-05-28T09:35:47.819Z","updated":"2026-10-19T19:36:51.685Z","title":"RDMA/rxe: Reject unknown opcodes before ICRC processing","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2026-46132","published":"2026-05-28T09:35:47.047Z","updated":"2026-10-15T01:20:44.498Z","title":"net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-46131","published":"2026-05-28T09:35:46.220Z","updated":"2026-06-14T17:56:46.141Z","title":"KVM: x86: check for nEPT/nNPT in slow flush hypercalls","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-46130","published":"2026-05-28T09:35:45.387Z","updated":"2026-10-21T12:41:19.483Z","title":"dm-verity-fec: fix reading parity bytes split across blocks (take 3)","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-46129","published":"2026-05-28T09:35:44.271Z","updated":"2026-08-05T12:29:55.996Z","title":"btrfs: fix double free in create_space_info() error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-46128","published":"2026-05-28T09:35:43.326Z","updated":"2026-10-15T01:20:42.825Z","title":"ipmi: Check event message buffer response for bad data","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-46127","published":"2026-05-28T09:35:42.368Z","updated":"2026-06-14T17:56:27.705Z","title":"RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-46126","published":"2026-05-28T09:35:41.364Z","updated":"2026-06-14T17:56:23.136Z","title":"RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-46125","published":"2026-05-28T09:35:39.809Z","updated":"2026-10-19T19:36:51.538Z","title":"wifi: mac80211: remove station if connection prep fails","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-46124","published":"2026-05-28T09:35:38.887Z","updated":"2026-10-19T19:36:51.382Z","title":"isofs: validate block number from NFS file handle in isofs_export_iget","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00476,"kevAdded":null},{"id":"CVE-2026-46123","published":"2026-05-28T09:35:38.003Z","updated":"2026-08-05T12:29:52.762Z","title":"Bluetooth: virtio_bt: clamp rx length before skb_put","severity":"HIGH","score":7.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-46122","published":"2026-05-28T09:35:37.141Z","updated":"2026-10-15T01:20:39.214Z","title":"wifi: b43: enforce bounds check on firmware key index in b43_rx()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-46121","published":"2026-05-28T09:35:36.292Z","updated":"2026-06-14T17:55:59.503Z","title":"mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-46120","published":"2026-05-28T09:35:35.385Z","updated":"2026-10-19T19:36:51.221Z","title":"ip6_gre: Use cached t->net in ip6erspan_changelink().","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-46119","published":"2026-05-28T09:35:34.543Z","updated":"2026-10-19T19:26:44.844Z","title":"libceph: Fix slab-out-of-bounds access in auth message processing","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00525,"kevAdded":null},{"id":"CVE-2026-46118","published":"2026-05-28T09:35:33.635Z","updated":"2026-10-15T10:07:24.840Z","title":"pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-46117","published":"2026-05-28T09:35:32.344Z","updated":"2026-10-19T19:26:44.688Z","title":"RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-46116","published":"2026-05-28T09:35:30.689Z","updated":"2026-10-19T19:26:44.530Z","title":"xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-46115","published":"2026-05-28T09:35:26.735Z","updated":"2026-10-19T19:26:44.371Z","title":"block: add pgmap check to biovec_phys_mergeable","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00491,"kevAdded":null},{"id":"CVE-2026-46114","published":"2026-05-28T09:35:24.638Z","updated":"2026-10-19T19:26:44.201Z","title":"RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-46113","published":"2026-05-28T09:35:23.035Z","updated":"2026-10-19T19:26:44.053Z","title":"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-46112","published":"2026-05-28T09:35:20.879Z","updated":"2026-08-05T12:29:44.058Z","title":"RDMA/hns: Fix unlocked call to hns_roce_qp_remove()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-46111","published":"2026-05-28T09:35:19.970Z","updated":"2026-10-19T19:26:43.906Z","title":"Bluetooth: hci_conn: fix potential UAF in create_big_sync","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-46110","published":"2026-05-28T09:35:18.359Z","updated":"2026-10-15T01:20:33.839Z","title":"net: stmmac: Prevent NULL deref when RX memory exhausted","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-46109","published":"2026-05-28T09:35:16.409Z","updated":"2026-06-14T17:55:07.015Z","title":"usb: ulpi: fix memory leak on ulpi_register() error paths","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46108","published":"2026-05-28T09:35:14.978Z","updated":"2026-06-14T17:55:01.962Z","title":"ipmi:si: Return state to normal if message allocation fails","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46107","published":"2026-05-28T09:35:13.051Z","updated":"2026-10-19T19:26:43.751Z","title":"dm-thin: fix metadata refcount underflow","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00102,"kevAdded":null},{"id":"CVE-2026-46106","published":"2026-05-28T09:35:11.034Z","updated":"2026-06-14T17:54:53.367Z","title":"eventfs: Hold eventfs_mutex and SRCU when remount walks events","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-46105","published":"2026-05-28T09:35:09.126Z","updated":"2026-08-05T12:29:39.746Z","title":"scsi: mpt3sas: Limit NVMe request size to 2 MiB","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-46104","published":"2026-05-28T09:35:07.397Z","updated":"2026-06-14T17:54:43.918Z","title":"selinux: use sk blob accessor in socket permission helpers","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-46103","published":"2026-05-27T12:59:11.533Z","updated":"2026-06-19T11:59:29.306Z","title":"can: ucan: fix devres lifetime","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-46102","published":"2026-05-27T12:59:09.526Z","updated":"2026-10-19T19:26:43.592Z","title":"net: strparser: fix skb_head leak in strp_abort_strp()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-46101","published":"2026-05-27T12:59:08.220Z","updated":"2026-10-15T01:20:30.172Z","title":"netfilter: reject zero shift in nft_bitwise","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-46100","published":"2026-05-27T12:59:06.853Z","updated":"2026-08-05T12:29:37.582Z","title":"fs: afs: revert mmap_prepare() change","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2026-46099","published":"2026-05-27T12:59:04.628Z","updated":"2026-10-19T19:26:43.421Z","title":"net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2026-46098","published":"2026-05-27T12:59:02.308Z","updated":"2026-06-14T17:54:16.006Z","title":"net: caif: clear client service pointer on teardown","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46097","published":"2026-05-27T12:58:59.100Z","updated":"2026-06-14T17:54:10.915Z","title":"Input: edt-ft5x06 - fix use-after-free in debugfs teardown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2026-46096","published":"2026-05-27T12:58:56.233Z","updated":"2026-06-14T17:54:06.722Z","title":"tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-46095","published":"2026-05-27T12:58:48.179Z","updated":"2026-06-14T17:54:02.473Z","title":"md/md-llbitmap: raise barrier before state machine transition","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-46094","published":"2026-05-27T12:58:45.304Z","updated":"2026-06-14T17:53:57.266Z","title":"ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-46093","published":"2026-05-27T12:58:43.458Z","updated":"2026-08-05T12:29:35.424Z","title":"mm/vmalloc: take vmap_purge_lock in shrinker","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-46092","published":"2026-05-27T12:58:37.088Z","updated":"2026-10-15T01:20:27.183Z","title":"wifi: rtw88: check for PCI upstream bridge existence","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-46091","published":"2026-05-27T12:58:35.422Z","updated":"2026-06-19T11:59:27.632Z","title":"media: rc: igorplugusb: heed coherency rules","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46090","published":"2026-05-27T12:58:34.428Z","updated":"2026-10-19T19:26:43.250Z","title":"ALSA: aloop: Fix peer runtime UAF during format-change stop","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00104,"kevAdded":null},{"id":"CVE-2026-46089","published":"2026-05-27T12:58:32.606Z","updated":"2026-06-14T17:53:34.164Z","title":"zram: do not forget to endio for partial discard requests","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-46088","published":"2026-05-27T12:58:31.895Z","updated":"2026-10-15T01:20:25.966Z","title":"ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-46087","published":"2026-05-27T12:58:30.611Z","updated":"2026-06-14T17:53:23.838Z","title":"mm/damon/stat: fix memory leak on damon_start() failure in damon_stat_start()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-46086","published":"2026-05-27T12:58:28.137Z","updated":"2026-10-15T01:20:24.801Z","title":"net: bridge: use a stable FDB dst snapshot in RCU readers","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-46085","published":"2026-05-27T12:58:27.125Z","updated":"2026-08-05T12:29:33.154Z","title":"rxrpc: Fix rxkad crypto unalignment handling","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00441,"kevAdded":null},{"id":"CVE-2026-46084","published":"2026-05-27T12:58:25.435Z","updated":"2026-06-14T17:53:09.762Z","title":"RDMA/mana_ib: Disable RX steering on RSS QP destroy","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-46083","published":"2026-05-27T12:58:23.376Z","updated":"2026-10-15T01:20:23.148Z","title":"spi: fix resource leaks on device setup failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46082","published":"2026-05-27T12:58:21.629Z","updated":"2026-06-14T17:53:00.593Z","title":"KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46081","published":"2026-05-27T12:58:19.498Z","updated":"2026-08-05T12:29:32.090Z","title":"crypto: acomp - fix wrong pointer stored by acomp_save_req()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-46080","published":"2026-05-27T12:58:17.103Z","updated":"2026-06-14T17:52:50.929Z","title":"ocfs2: split transactions in dio completion to avoid credit exhaustion","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-46079","published":"2026-05-27T12:58:13.903Z","updated":"2026-06-14T17:52:46.214Z","title":"rbd: fix null-ptr-deref when device_add_disk() fails","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-46078","published":"2026-05-27T12:58:11.916Z","updated":"2026-10-19T19:26:43.106Z","title":"erofs: fix the out-of-bounds nameoff handling for trailing dirents","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-46077","published":"2026-05-27T12:58:10.542Z","updated":"2026-06-14T17:52:37.968Z","title":"crypto: atmel-tdes - fix DMA sync direction","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46076","published":"2026-05-27T12:58:09.169Z","updated":"2026-10-21T12:41:18.394Z","title":"KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1","severity":"HIGH","score":7.9,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2026-46075","published":"2026-05-27T12:58:07.080Z","updated":"2026-06-14T17:52:29.232Z","title":"crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-46074","published":"2026-05-27T12:58:04.703Z","updated":"2026-06-14T17:52:24.650Z","title":"spi: ch341: fix memory leaks on probe failures","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-46073","published":"2026-05-27T12:58:01.478Z","updated":"2026-06-14T17:52:19.817Z","title":"hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-46072","published":"2026-05-27T12:58:00.299Z","updated":"2026-06-14T17:52:15.329Z","title":"ntfs3: add buffer boundary checks to run_unpack()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46071","published":"2026-05-27T12:57:57.316Z","updated":"2026-10-30T12:25:59.492Z","title":"KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46070","published":"2026-05-27T12:57:54.345Z","updated":"2026-10-19T19:26:42.780Z","title":"md/raid5: validate payload size before accessing journal metadata","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-46069","published":"2026-05-27T12:57:50.213Z","updated":"2026-10-15T01:20:20.801Z","title":"wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-46068","published":"2026-05-27T12:57:48.457Z","updated":"2026-06-14T17:51:58.785Z","title":"crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-46067","published":"2026-05-27T12:57:45.648Z","updated":"2026-06-14T17:51:55.381Z","title":"mm/damon/core: validate damos_quota_goal->nid for node_memcg_{used,free}_bp","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-46066","published":"2026-05-27T12:57:41.865Z","updated":"2026-10-21T12:41:16.157Z","title":"ceph: fix num_ops off-by-one when crypto allocation fails","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-46065","published":"2026-05-27T12:57:32.968Z","updated":"2026-10-19T19:26:42.635Z","title":"fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-46064","published":"2026-05-27T12:57:30.247Z","updated":"2026-10-15T01:20:18.166Z","title":"ibmasm: fix heap over-read in ibmasm_send_i2o_message()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-46063","published":"2026-05-27T12:57:27.336Z","updated":"2026-06-14T17:51:37.005Z","title":"x86/shstk: Prevent deadlock during shstk sigreturn","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00094,"kevAdded":null},{"id":"CVE-2026-46062","published":"2026-05-27T12:57:24.416Z","updated":"2026-08-05T12:29:26.689Z","title":"ntfs3: fix integer overflow in run_unpack() volume boundary check","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-46061","published":"2026-05-27T12:57:22.041Z","updated":"2026-06-14T17:51:27.666Z","title":"jbd2: fix deadlock in jbd2_journal_cancel_revoke()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00094,"kevAdded":null},{"id":"CVE-2026-46060","published":"2026-05-27T12:57:20.991Z","updated":"2026-06-14T17:51:23.100Z","title":"crypto: qat - fix IRQ cleanup on 6xxx probe failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-46059","published":"2026-05-27T12:57:19.928Z","updated":"2026-10-30T12:25:58.422Z","title":"KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46058","published":"2026-05-27T12:57:17.853Z","updated":"2026-08-05T12:29:25.621Z","title":"media: amphion: Fix race between m2m job_abort and device_run","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00097,"kevAdded":null},{"id":"CVE-2026-46057","published":"2026-05-27T12:57:16.076Z","updated":"2026-06-14T17:51:11.492Z","title":"landlock: Fix LOG_SUBDOMAINS_OFF inheritance across fork()","severity":"LOW","score":3.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2026-46056","published":"2026-05-27T12:57:15.150Z","updated":"2026-10-19T19:26:42.490Z","title":"Bluetooth: hci_event: fix potential UAF in SSP passkey handlers","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2026-46055","published":"2026-05-27T12:57:13.671Z","updated":"2026-08-05T12:29:23.386Z","title":"apparmor: Fix string overrun due to missing termination","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2026-46054","published":"2026-05-27T12:57:12.813Z","updated":"2026-10-19T19:26:42.348Z","title":"selinux: fix overlayfs mmap() and mprotect() access checks","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46053","published":"2026-05-27T12:57:11.870Z","updated":"2026-08-05T12:29:21.209Z","title":"net: rds: fix MR cleanup on copy error","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-46052","published":"2026-05-27T12:57:10.777Z","updated":"2026-10-19T19:26:42.195Z","title":"ceph: only d_add() negative dentries when they are unhashed","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-46051","published":"2026-05-27T12:57:09.274Z","updated":"2026-10-15T01:20:15.806Z","title":"md/raid5: fix soft lockup in retry_aligned_read()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00097,"kevAdded":null},{"id":"CVE-2026-46050","published":"2026-05-27T12:57:06.732Z","updated":"2026-10-15T01:20:14.500Z","title":"md/raid10: fix deadlock with check operation and nowait requests","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-46049","published":"2026-05-27T12:57:05.761Z","updated":"2026-06-14T17:50:38.717Z","title":"ALSA: ctxfi: Add fallback to default RSR for S/PDIF","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46048","published":"2026-05-27T12:57:04.477Z","updated":"2026-06-14T17:50:34.000Z","title":"ALSA: caiaq: fix usb_dev refcount leak on probe failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46047","published":"2026-05-27T12:57:03.471Z","updated":"2026-10-15T01:20:13.330Z","title":"net: qrtr: ns: Fix use-after-free in driver remove()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-46046","published":"2026-05-27T12:57:02.610Z","updated":"2026-10-15T01:20:12.134Z","title":"ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-46045","published":"2026-05-27T12:57:00.839Z","updated":"2026-06-14T17:50:20.949Z","title":"md/md-llbitmap: skip reading rdevs that are not in_sync","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-46044","published":"2026-05-27T12:56:59.663Z","updated":"2026-10-21T12:41:13.996Z","title":"ipmi:ssif: Clean up kthread on errors","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46043","published":"2026-05-27T12:56:57.987Z","updated":"2026-10-19T19:26:42.012Z","title":"RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-46042","published":"2026-05-27T12:56:56.830Z","updated":"2026-06-14T17:50:08.044Z","title":"mm/mempolicy: fix memory leaks in weighted_interleave_auto_store()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-46041","published":"2026-05-27T12:56:54.418Z","updated":"2026-06-14T17:50:02.909Z","title":"greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-46040","published":"2026-05-27T12:56:52.161Z","updated":"2026-10-15T01:20:09.109Z","title":"inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-46039","published":"2026-05-27T12:56:51.317Z","updated":"2026-08-05T12:29:17.995Z","title":"rxgk: Fix potential integer overflow in length check","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00442,"kevAdded":null},{"id":"CVE-2026-46038","published":"2026-05-27T12:56:50.125Z","updated":"2026-10-15T01:20:07.435Z","title":"net: qrtr: ns: Free the node during ctrl_cmd_bye()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-46037","published":"2026-05-27T12:56:47.795Z","updated":"2026-10-19T19:26:41.864Z","title":"ipv4: icmp: validate reply type before using icmp_pointers","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00512,"kevAdded":null},{"id":"CVE-2026-46036","published":"2026-05-27T12:56:46.381Z","updated":"2026-08-05T12:29:15.525Z","title":"vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-46035","published":"2026-05-27T12:56:44.260Z","updated":"2026-06-14T17:49:34.298Z","title":"mm/page_alloc: return NULL early from alloc_frozen_pages_nolock() in NMI on UP","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-46034","published":"2026-05-27T12:56:43.389Z","updated":"2026-06-14T17:49:29.082Z","title":"vfio/cdx: Fix NULL pointer dereference in interrupt trigger path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-46033","published":"2026-05-27T12:56:42.038Z","updated":"2026-10-15T01:20:04.446Z","title":"crypto: authencesn - reject short ahash digests during instance creation","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-46032","published":"2026-05-27T12:56:41.159Z","updated":"2026-10-30T12:25:57.350Z","title":"KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-46031","published":"2026-05-27T12:56:40.357Z","updated":"2026-08-05T12:29:14.460Z","title":"net: ks8851: Reinstate disabling of BHs around IRQ handler","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2026-46030","published":"2026-05-27T12:56:39.170Z","updated":"2026-06-14T17:49:10.170Z","title":"EDAC/versalnet: Fix device_node leak in mc_probe()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-46029","published":"2026-05-27T12:56:38.376Z","updated":"2026-08-05T12:29:13.390Z","title":"mm/slab: return NULL early from kmalloc_nolock() in NMI on UP","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-46028","published":"2026-05-27T12:56:36.847Z","updated":"2026-06-14T17:49:01.589Z","title":"crypto: algif_aead - snapshot IV for async AEAD requests","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46027","published":"2026-05-27T12:56:35.628Z","updated":"2026-10-19T19:26:41.717Z","title":"net/smc: avoid early lgr access in smc_clc_wait_msg","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-46026","published":"2026-05-27T12:56:32.596Z","updated":"2026-10-15T01:20:02.583Z","title":"net: qrtr: ns: Limit the maximum number of lookups","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-46025","published":"2026-05-27T12:56:31.784Z","updated":"2026-06-14T17:48:48.849Z","title":"mm/damon/core: fix damon_call() vs kdamond_fn() exit race","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00088,"kevAdded":null},{"id":"CVE-2026-46024","published":"2026-05-27T12:56:29.932Z","updated":"2026-10-19T19:26:41.575Z","title":"libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0049,"kevAdded":null},{"id":"CVE-2026-46023","published":"2026-05-27T12:56:28.756Z","updated":"2026-10-15T01:20:01.369Z","title":"dm mirror: fix integer overflow in create_dirty_log()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-46022","published":"2026-05-27T12:56:26.791Z","updated":"2026-10-15T01:20:00.194Z","title":"misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2026-46021","published":"2026-05-27T12:56:23.515Z","updated":"2026-10-15T01:19:59.016Z","title":"thermal: core: Fix thermal zone governor cleanup issues","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-46020","published":"2026-05-27T12:56:21.920Z","updated":"2026-06-14T17:48:26.041Z","title":"mm/damon/core: validate damos_quota_goal->nid for node_mem_{used,free}_bp","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-46019","published":"2026-05-27T12:56:21.100Z","updated":"2026-06-14T17:48:21.711Z","title":"crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-46018","published":"2026-05-27T12:56:19.588Z","updated":"2026-10-15T01:19:57.388Z","title":"ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-46017","published":"2026-05-27T12:56:18.800Z","updated":"2026-06-14T17:48:14.283Z","title":"mm: fix deferred split queue races during migration","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00105,"kevAdded":null},{"id":"CVE-2026-46016","published":"2026-05-27T12:56:17.970Z","updated":"2026-06-14T17:48:10.556Z","title":"remoteproc: xlnx: Only access buffer information if IPI is buffered","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-46015","published":"2026-05-27T12:56:17.249Z","updated":"2026-10-19T19:26:41.435Z","title":"tcp: call sk_data_ready() after listener migration","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-46014","published":"2026-05-27T12:56:16.052Z","updated":"2026-10-21T12:41:11.773Z","title":"KVM: SVM: Add missing save/restore handling of LBR MSRs","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-46013","published":"2026-05-27T12:56:15.236Z","updated":"2026-06-14T17:47:59.320Z","title":"mm/memfd_luo: fix physical address conversion in put_folios cleanup","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-46012","published":"2026-05-27T12:56:14.131Z","updated":"2026-10-30T12:25:56.289Z","title":"rxrpc: Fix memory leaks in rxkad_verify_response()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46011","published":"2026-05-27T12:56:13.198Z","updated":"2026-08-05T12:29:08.321Z","title":"media: mtk-jpeg: fix use-after-free in release path due to uncancelled work","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-46010","published":"2026-05-27T12:56:11.456Z","updated":"2026-08-05T12:29:07.239Z","title":"rxrpc: Fix error handling in rxgk_extract_token()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2026-46009","published":"2026-05-27T12:56:09.581Z","updated":"2026-06-14T17:47:44.154Z","title":"PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46008","published":"2026-05-27T12:56:08.315Z","updated":"2026-10-21T12:41:10.467Z","title":"mm/damon/core: fix damos_walk() vs kdamond_fn() exit race","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0009,"kevAdded":null},{"id":"CVE-2026-46007","published":"2026-05-27T12:56:06.623Z","updated":"2026-06-14T17:47:37.205Z","title":"hwmon: (powerz) Avoid cacheline sharing for DMA buffer","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-46006","published":"2026-05-27T12:56:05.273Z","updated":"2026-08-05T12:29:06.114Z","title":"drm/nouveau: fix u32 overflow in pushbuf reloc bounds check","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-46005","published":"2026-05-27T12:56:03.201Z","updated":"2026-06-19T11:58:58.503Z","title":"xfs: fix a resource leak in xfs_alloc_buftarg()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-46004","published":"2026-05-27T12:56:01.851Z","updated":"2026-06-14T17:47:26.278Z","title":"ALSA: caiaq: Handle probe errors properly","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-46003","published":"2026-05-27T12:55:59.509Z","updated":"2026-10-15T01:19:54.582Z","title":"net: qrtr: ns: Limit the total number of nodes","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-46002","published":"2026-05-27T12:55:57.898Z","updated":"2026-06-14T17:47:19.832Z","title":"ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-46001","published":"2026-05-27T12:55:56.128Z","updated":"2026-06-14T17:47:16.457Z","title":"hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-46000","published":"2026-05-27T12:55:55.288Z","updated":"2026-10-30T12:25:55.222Z","title":"rxrpc: Fix conn-level packet handling to unshare RESPONSE packets","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45999","published":"2026-05-27T12:55:53.846Z","updated":"2026-08-05T12:29:04.993Z","title":"erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-45998","published":"2026-05-27T12:55:52.756Z","updated":"2026-09-16T12:04:16.191Z","title":"rxrpc: Fix potential UAF after skb_unshare() failure","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2026-45997","published":"2026-05-27T12:55:51.154Z","updated":"2026-10-15T01:19:51.836Z","title":"scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-45996","published":"2026-05-27T12:55:50.195Z","updated":"2026-06-19T11:58:52.649Z","title":"spi: imx: fix use-after-free on unbind","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-45995","published":"2026-05-27T12:55:48.587Z","updated":"2026-06-14T17:46:58.368Z","title":"io_uring/zcrx: fix user_struct uaf","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-45994","published":"2026-05-27T12:55:47.612Z","updated":"2026-06-14T17:46:55.731Z","title":"ibmasm: fix OOB reads in command_file_write due to missing size checks","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-45993","published":"2026-05-27T12:55:46.480Z","updated":"2026-06-19T11:58:50.818Z","title":"LoongArch: Add spectre boundry for syscall dispatch table","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-45991","published":"2026-05-27T12:55:43.449Z","updated":"2026-10-19T19:26:41.286Z","title":"udf: fix partition descriptor append bookkeeping","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-45990","published":"2026-05-27T12:55:42.572Z","updated":"2026-06-14T17:46:45.762Z","title":"slub: fix data loss and overflow in krealloc()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-45989","published":"2026-05-27T12:55:41.276Z","updated":"2026-06-14T17:46:43.307Z","title":"of: unittest: fix use-after-free in testdrv_probe()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-45988","published":"2026-05-27T12:55:39.740Z","updated":"2026-10-19T19:26:41.147Z","title":"rxrpc: Fix re-decryption of RESPONSE packets","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00457,"kevAdded":null},{"id":"CVE-2026-45987","published":"2026-05-27T12:55:38.653Z","updated":"2026-06-14T17:46:36.929Z","title":"KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-45986","published":"2026-05-27T12:55:35.838Z","updated":"2026-06-14T17:46:33.494Z","title":"crypto: ccree - fix a memory leak in cc_mac_digest()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-71312","published":"2026-05-27T12:24:03.532Z","updated":"2026-10-26T15:12:54.381Z","title":"fs/ntfs3: fix ntfs_mount_options leak in ntfs_fill_super()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-71311","published":"2026-05-27T12:24:02.532Z","updated":"2026-08-05T12:12:45.568Z","title":"fs/ntfs3: Initialize new folios before use","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2026-45985","published":"2026-05-27T12:18:43.844Z","updated":"2026-10-30T12:25:54.163Z","title":"ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-45984","published":"2026-05-27T12:18:42.964Z","updated":"2026-10-19T19:26:41.006Z","title":"gfs2: Fix use-after-free in iomap inline data write path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-45983","published":"2026-05-27T12:18:41.619Z","updated":"2026-05-27T12:18:41.619Z","title":"nfsd: never defer requests during idmap lookup","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-45982","published":"2026-05-27T12:18:40.822Z","updated":"2026-05-27T12:18:40.822Z","title":"ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-45981","published":"2026-05-27T12:18:39.923Z","updated":"2026-06-01T16:16:41.646Z","title":"s390/cio: Fix device lifecycle handling in css_alloc_subchannel()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-45980","published":"2026-05-27T12:18:39.136Z","updated":"2026-08-05T12:29:00.693Z","title":"accel/amdxdna: Stop job scheduling across aie2_release_resource()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-45979","published":"2026-05-27T12:18:37.936Z","updated":"2026-05-27T12:18:37.936Z","title":"drm/amdgpu: clean up the amdgpu_cs_parser_bos","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-45978","published":"2026-05-27T12:18:36.753Z","updated":"2026-05-27T12:18:36.753Z","title":"staging: greybus: lights: avoid NULL deref","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-45977","published":"2026-05-27T12:18:35.858Z","updated":"2026-05-27T12:18:35.858Z","title":"fbnic: close fw_log race between users and teardown","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-45976","published":"2026-05-27T12:18:34.772Z","updated":"2026-05-27T12:18:34.772Z","title":"drm/amdgpu: Fix memory leak in amdgpu_ras_init()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-45975","published":"2026-05-27T12:18:33.939Z","updated":"2026-05-27T12:18:33.939Z","title":"ublk: use READ_ONCE() to read struct ublksrv_ctrl_cmd","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-45974","published":"2026-05-27T12:18:33.107Z","updated":"2026-05-27T12:18:33.107Z","title":"btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-45973","published":"2026-05-27T12:18:32.270Z","updated":"2026-10-30T12:25:53.094Z","title":"RDMA/mlx5: Fix UMR hang in LAG error state unload","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45972","published":"2026-05-27T12:18:31.500Z","updated":"2026-10-19T19:26:40.861Z","title":"smb: client: fix potential UAF and double free in smb2_open_file()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2026-45971","published":"2026-05-27T12:18:30.651Z","updated":"2026-05-27T12:18:30.651Z","title":"bpf: Limit bpf program signature size","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-45970","published":"2026-05-27T12:18:29.878Z","updated":"2026-10-19T19:26:40.725Z","title":"bonding: alb: fix UAF in rlb_arp_recv during bond up/down","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-45969","published":"2026-05-27T12:18:28.112Z","updated":"2026-05-27T12:18:28.112Z","title":"HID: playstation: Add missing check for input_ff_create_memless","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-45968","published":"2026-05-27T12:18:27.247Z","updated":"2026-05-27T12:18:27.247Z","title":"cpuidle: Skip governor when only one idle state is available","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-45967","published":"2026-05-27T12:18:25.572Z","updated":"2026-05-27T12:18:25.572Z","title":"bpf: Return proper address for non-zero offsets in insn array","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-45966","published":"2026-05-27T12:18:24.300Z","updated":"2026-05-27T12:18:24.300Z","title":"apparmor: fix NULL pointer dereference in __unix_needs_revalidation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-45965","published":"2026-05-27T12:18:23.170Z","updated":"2026-05-27T12:18:23.170Z","title":"apparmor: fix invalid deref of rawdata when export_binary is unset","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45964","published":"2026-05-27T12:18:22.052Z","updated":"2026-05-27T12:18:22.052Z","title":"SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45963","published":"2026-05-27T12:18:21.228Z","updated":"2026-09-02T12:49:32.465Z","title":"ASoC: nau8821: Cancel delayed work on component remove","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-45962","published":"2026-05-27T12:18:19.070Z","updated":"2026-05-27T12:18:19.070Z","title":"ublk: Validate SQE128 flag before accessing the cmd","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45961","published":"2026-05-27T12:18:17.637Z","updated":"2026-10-30T12:25:52.033Z","title":"gfs2: fix memory leaks in gfs2_fill_super error path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-45960","published":"2026-05-27T12:18:16.851Z","updated":"2026-05-27T12:18:16.851Z","title":"hfsplus: return error when node already exists in hfs_bnode_create","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-45959","published":"2026-05-27T12:18:16.039Z","updated":"2026-10-19T19:26:40.585Z","title":"crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-45958","published":"2026-05-27T12:18:14.878Z","updated":"2026-08-05T12:28:56.396Z","title":"drm/exynos: vidi: fix to avoid directly dereferencing user pointer","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-45957","published":"2026-05-27T12:18:13.145Z","updated":"2026-10-30T12:25:50.966Z","title":"rcu: Fix rcu_read_unlock() deadloop due to softirq","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-45956","published":"2026-05-27T12:18:11.972Z","updated":"2026-10-21T12:41:06.321Z","title":"drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-45955","published":"2026-05-27T12:18:10.951Z","updated":"2026-10-19T19:26:40.445Z","title":"md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-45954","published":"2026-05-27T12:18:10.004Z","updated":"2026-05-27T12:18:10.004Z","title":"fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-45953","published":"2026-05-27T12:18:09.203Z","updated":"2026-05-27T12:18:09.203Z","title":"md/raid5: fix IO hang with degraded array with llbitmap","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-45952","published":"2026-05-27T12:18:08.442Z","updated":"2026-05-27T12:18:08.442Z","title":"eth: fbnic: Add validation for MTU changes","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-45951","published":"2026-05-27T12:18:07.255Z","updated":"2026-08-05T12:28:53.157Z","title":"bpf: Fix a potential use-after-free of BTF object","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-45950","published":"2026-05-27T12:18:06.482Z","updated":"2026-05-27T12:18:06.482Z","title":"crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-45949","published":"2026-05-27T12:18:05.718Z","updated":"2026-10-30T12:25:49.889Z","title":"hwrng: core - use RCU and work_struct to fix race condition","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00089,"kevAdded":null},{"id":"CVE-2026-45948","published":"2026-05-27T12:18:04.937Z","updated":"2026-05-27T12:18:04.937Z","title":"ext4: fix memory leak in ext4_ext_shift_extents()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45947","published":"2026-05-27T12:18:04.117Z","updated":"2026-05-27T12:18:04.117Z","title":"drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-45946","published":"2026-05-27T12:18:02.708Z","updated":"2026-05-27T12:18:02.708Z","title":"power: supply: ab8500: Fix use-after-free in power_supply_changed()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45945","published":"2026-05-27T12:18:01.345Z","updated":"2026-10-19T19:26:40.294Z","title":"iommu/vt-d: Fix race condition during PASID entry replacement","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-45944","published":"2026-05-27T12:18:00.481Z","updated":"2026-10-30T12:25:48.827Z","title":"iommu/vt-d: Clear Present bit before tearing down context entry","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-45943","published":"2026-05-27T12:17:58.764Z","updated":"2026-10-30T12:25:47.758Z","title":"erofs: fix inline data read failure for ztailpacking pclusters","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-45942","published":"2026-05-27T12:17:57.950Z","updated":"2026-10-30T12:25:46.692Z","title":"ext4: fix e4b bitmap inconsistency reports","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-45941","published":"2026-05-27T12:17:57.155Z","updated":"2026-05-27T12:17:57.155Z","title":"tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-45940","published":"2026-05-27T12:17:56.350Z","updated":"2026-10-30T12:25:45.615Z","title":"net: stmmac: fix oops when split header is enabled","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-45939","published":"2026-05-27T12:17:55.481Z","updated":"2026-05-27T12:17:55.481Z","title":"gpib: Fix memory leak in ni_usb_init()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-45938","published":"2026-05-27T12:17:54.812Z","updated":"2026-05-27T12:17:54.812Z","title":"power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-45937","published":"2026-05-27T12:17:54.131Z","updated":"2026-05-27T12:17:54.131Z","title":"crypto: inside-secure/eip93 - fix kernel panic in driver detach","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-45936","published":"2026-05-27T12:17:53.451Z","updated":"2026-05-27T12:17:53.451Z","title":"power: supply: goldfish: Fix use-after-free in power_supply_changed()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-45935","published":"2026-05-27T12:17:52.705Z","updated":"2026-08-05T12:28:48.879Z","title":"fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2026-45934","published":"2026-05-27T12:17:51.905Z","updated":"2026-10-30T12:25:44.551Z","title":"btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-45933","published":"2026-05-27T12:17:51.127Z","updated":"2026-10-19T19:26:39.760Z","title":"bpf: Preserve id of register in sync_linked_regs()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-45932","published":"2026-05-27T12:17:50.353Z","updated":"2026-10-21T12:40:59.729Z","title":"bpf: Fix tcx/netkit detach permissions when prog fd isn't given","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-45931","published":"2026-05-27T12:17:49.527Z","updated":"2026-08-05T12:28:45.338Z","title":"accel/amdxdna: Hold mm structure across iommu_sva_unbind_device()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-45930","published":"2026-05-27T12:17:48.689Z","updated":"2026-06-19T11:58:46.478Z","title":"net: mctp: ensure our nlmsg responses are initialised","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-45929","published":"2026-05-27T12:17:47.891Z","updated":"2026-08-05T12:28:44.254Z","title":"ovpn: fix possible use-after-free in ovpn_net_xmit","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2026-45928","published":"2026-05-27T12:17:47.075Z","updated":"2026-05-27T12:17:47.075Z","title":"media: chips-media: wave5: Fix memory leak on codec_info allocation failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-45927","published":"2026-05-27T12:17:46.284Z","updated":"2026-05-27T12:17:46.284Z","title":"bpf: Require frozen map for calculating map hash","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00092,"kevAdded":null},{"id":"CVE-2026-45926","published":"2026-05-27T12:17:45.351Z","updated":"2026-05-27T12:17:45.351Z","title":"rust: pwm: Fix potential memory leak on init error","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00113,"kevAdded":null},{"id":"CVE-2026-45925","published":"2026-05-27T12:17:43.889Z","updated":"2026-05-27T12:17:43.889Z","title":"thermal/of: Fix reference leak in thermal_of_cm_lookup()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45924","published":"2026-05-27T12:17:43.229Z","updated":"2026-05-27T12:17:43.229Z","title":"ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-45923","published":"2026-05-27T12:17:42.312Z","updated":"2026-05-27T12:17:42.312Z","title":"net: usb: catc: enable basic endpoint checking","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45922","published":"2026-05-27T12:17:41.431Z","updated":"2026-05-27T12:17:41.431Z","title":"RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45921","published":"2026-05-27T12:17:40.032Z","updated":"2026-05-27T12:17:40.032Z","title":"mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-45920","published":"2026-05-27T12:17:38.234Z","updated":"2026-05-27T12:17:38.234Z","title":"ext4: fix dirtyclusters double decrement on fs shutdown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-45919","published":"2026-05-27T12:17:37.165Z","updated":"2026-05-27T12:17:37.165Z","title":"sched/rt: Skip currently executing CPU in rto_next_cpu()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-45918","published":"2026-05-27T12:17:34.500Z","updated":"2026-05-27T12:17:34.500Z","title":"ovpn: tcp - don't deref NULL sk_socket member after tcp_close()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-45917","published":"2026-05-27T12:17:33.337Z","updated":"2026-10-30T12:25:43.461Z","title":"ipvs: do not keep dest_dst if dev is going down","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-45916","published":"2026-05-27T12:17:32.565Z","updated":"2026-05-27T12:17:32.565Z","title":"power: supply: sbs-battery: Fix use-after-free in power_supply_changed()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-45915","published":"2026-05-27T12:17:30.699Z","updated":"2026-05-27T12:17:30.699Z","title":"fat: avoid parent link count underflow in rmdir","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45914","published":"2026-05-27T12:17:29.426Z","updated":"2026-05-27T12:17:29.426Z","title":"Revert \"hwmon: (ibmpex) fix use-after-free in high/low store\"","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-45913","published":"2026-05-27T12:17:28.607Z","updated":"2026-05-27T12:17:28.607Z","title":"net: bridge: mcast: always update mdb_n_entries for vlan contexts","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45912","published":"2026-05-27T12:17:27.805Z","updated":"2026-05-30T10:41:46.666Z","title":"ext4: don't cache extent during splitting extent","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-45911","published":"2026-05-27T12:17:26.924Z","updated":"2026-05-27T12:17:26.924Z","title":"usb: cdns3: fix role switching during resume","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45910","published":"2026-05-27T12:17:24.619Z","updated":"2026-10-19T19:26:39.625Z","title":"RDMA/rxe: Fix race condition in QP timer handlers","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-45909","published":"2026-05-27T12:17:23.099Z","updated":"2026-08-05T12:28:42.127Z","title":"clk: mediatek: Drop __initconst from gates","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-45908","published":"2026-05-27T12:17:22.048Z","updated":"2026-05-27T12:17:22.048Z","title":"accel/amdxdna: Fix memory leak in amdxdna_ubuf_map","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-45907","published":"2026-05-27T12:17:20.424Z","updated":"2026-05-27T12:17:20.424Z","title":"net/mlx5e: Fix deadlocks between devlink and netdev instance locks","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-45906","published":"2026-05-27T12:17:16.142Z","updated":"2026-05-27T12:17:16.142Z","title":"power: supply: pf1550: Fix use-after-free in power_supply_changed()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-45905","published":"2026-05-27T12:17:15.050Z","updated":"2026-05-27T12:17:15.050Z","title":"xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00111,"kevAdded":null},{"id":"CVE-2026-45904","published":"2026-05-27T12:17:12.504Z","updated":"2026-05-27T12:17:12.504Z","title":"powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45903","published":"2026-05-27T12:17:11.382Z","updated":"2026-05-27T12:17:11.382Z","title":"bpf: Fix memory access flags in helper prototypes","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2026-45902","published":"2026-05-27T12:17:10.508Z","updated":"2026-05-27T12:17:10.508Z","title":"power: supply: bq256xx: Fix use-after-free in power_supply_changed()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-45901","published":"2026-05-27T12:17:09.861Z","updated":"2026-10-21T12:40:57.498Z","title":"netfilter: nf_tables: revert commit_mutex usage in reset path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-45900","published":"2026-05-27T12:17:09.109Z","updated":"2026-05-27T12:17:09.109Z","title":"crypto: caam - fix netdev memory leak in dpaa2_caam_probe","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-45899","published":"2026-05-27T12:17:08.447Z","updated":"2026-10-30T12:25:42.327Z","title":"ext4: drop extent cache when splitting extent fails","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45898","published":"2026-05-27T12:17:07.737Z","updated":"2026-10-19T19:26:39.480Z","title":"RDMA/iwcm: Fix workqueue list corruption by removing work_list","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00529,"kevAdded":null},{"id":"CVE-2026-45897","published":"2026-05-27T12:17:07.038Z","updated":"2026-09-14T11:58:21.488Z","title":"netfilter: nft_counter: serialize reset with spinlock","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45896","published":"2026-05-27T12:17:06.332Z","updated":"2026-05-27T12:17:06.332Z","title":"mtd: intel-dg: Fix accessing regions before setting nregions","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-45895","published":"2026-05-27T12:17:05.666Z","updated":"2026-05-27T12:17:05.666Z","title":"quota: fix livelock between quotactl and freeze_super","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45894","published":"2026-05-27T12:17:04.866Z","updated":"2026-10-30T12:25:41.262Z","title":"iommu/vt-d: Clear Present bit before tearing down PASID entry","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-45893","published":"2026-05-27T12:17:04.135Z","updated":"2026-10-30T12:25:40.191Z","title":"apparmor: Fix & Optimize table creation from possibly unaligned memory","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-45892","published":"2026-05-27T12:17:03.175Z","updated":"2026-05-30T10:41:42.703Z","title":"ext4: drop extent cache after doing PARTIAL_VALID1 zeroout","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45891","published":"2026-05-27T12:17:02.306Z","updated":"2026-05-27T12:17:02.306Z","title":"net: hns3: fix double free issue for tx spare buffer","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-45890","published":"2026-05-27T12:17:01.466Z","updated":"2026-05-27T12:17:01.466Z","title":"xen-netback: reject zero-queue configuration from guest","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-45889","published":"2026-05-27T12:17:00.509Z","updated":"2026-05-27T12:17:00.509Z","title":"mptcp: do not account for OoO in mptcp_rcvbuf_grow()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-45888","published":"2026-05-27T12:16:59.751Z","updated":"2026-05-27T12:16:59.751Z","title":"md/raid1: fix memory leak in raid1_run()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45887","published":"2026-05-27T12:16:58.720Z","updated":"2026-05-27T12:16:58.720Z","title":"af_unix: Fix memleak of newsk in unix_stream_connect().","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-45886","published":"2026-05-27T12:16:58.000Z","updated":"2026-05-27T12:16:58.000Z","title":"bpf: Fix bpf_xdp_store_bytes proto for read-only arg","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45885","published":"2026-05-27T12:16:57.246Z","updated":"2026-05-27T12:16:57.246Z","title":"power: supply: cpcap-battery: Fix use-after-free in power_supply_changed()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45884","published":"2026-05-27T12:16:56.542Z","updated":"2026-05-27T12:16:56.542Z","title":"apparmor: avoid per-cpu hold underflow in aa_get_buffer","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45883","published":"2026-05-27T12:16:55.840Z","updated":"2026-05-27T12:16:55.840Z","title":"iio: sca3000: Fix a resource leak in sca3000_probe()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45882","published":"2026-05-27T12:16:55.144Z","updated":"2026-05-27T12:16:55.144Z","title":"power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-45881","published":"2026-05-27T12:16:53.677Z","updated":"2026-05-27T12:16:53.677Z","title":"soc: mediatek: svs: Fix memory leak in svs_enable_debug_write()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45880","published":"2026-05-27T12:16:52.117Z","updated":"2026-05-27T12:16:52.117Z","title":"PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45879","published":"2026-05-27T12:16:50.137Z","updated":"2026-05-27T12:16:50.137Z","title":"power: supply: bq25980: Fix use-after-free in power_supply_changed()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-45878","published":"2026-05-27T12:16:49.108Z","updated":"2026-10-19T19:26:39.200Z","title":"drm/amdkfd: Fix watch_id bounds checking in debug address watch v2","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-45877","published":"2026-05-27T12:16:46.910Z","updated":"2026-10-30T12:25:39.136Z","title":"HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-45876","published":"2026-05-27T12:16:43.350Z","updated":"2026-05-27T12:16:43.350Z","title":"arm64/gcs: Fix error handling in arch_set_shadow_stack_status()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-45875","published":"2026-05-27T12:15:56.675Z","updated":"2026-05-27T12:15:56.675Z","title":"mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-45874","published":"2026-05-27T12:15:53.604Z","updated":"2026-05-27T12:15:53.604Z","title":"phy: freescale: imx8qm-hsio: fix NULL pointer dereference","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-45873","published":"2026-05-27T12:15:52.916Z","updated":"2026-05-27T12:15:52.916Z","title":"netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45872","published":"2026-05-27T12:15:52.133Z","updated":"2026-05-27T12:15:52.133Z","title":"scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-45871","published":"2026-05-27T12:15:51.317Z","updated":"2026-05-27T12:15:51.317Z","title":"tpm: st33zp24: Fix missing cleanup on get_burstcount() error","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-45870","published":"2026-05-27T12:15:50.199Z","updated":"2026-05-27T12:15:50.199Z","title":"SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45869","published":"2026-05-27T12:15:49.107Z","updated":"2026-05-27T12:15:49.107Z","title":"power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45868","published":"2026-05-27T12:15:48.311Z","updated":"2026-05-27T12:15:48.311Z","title":"pinctrl: single: fix refcount leak in pcs_add_gpio_func()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45867","published":"2026-05-27T12:15:47.222Z","updated":"2026-05-27T12:15:47.222Z","title":"power: supply: act8945a: Fix use-after-free in power_supply_changed()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-45866","published":"2026-05-27T12:15:46.135Z","updated":"2026-05-27T12:15:46.135Z","title":"serial: caif: fix use-after-free in caif_serial ldisc_close()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-45865","published":"2026-05-27T12:15:45.082Z","updated":"2026-05-27T12:15:45.082Z","title":"mctp i2c: initialise event handler read bytes","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45864","published":"2026-05-27T12:15:43.807Z","updated":"2026-05-27T12:15:43.807Z","title":"fs/ntfs3: prevent infinite loops caused by the next valid being the same","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45863","published":"2026-05-27T12:15:42.685Z","updated":"2026-05-27T12:15:42.685Z","title":"i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-45862","published":"2026-05-27T12:15:41.903Z","updated":"2026-10-19T19:26:39.041Z","title":"iommu/vt-d: Flush cache for PASID table before using it","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-45861","published":"2026-05-27T12:15:41.057Z","updated":"2026-10-21T12:40:53.402Z","title":"gfs2: Fix slab-use-after-free in qd_put","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-45860","published":"2026-05-27T12:15:40.080Z","updated":"2026-10-19T19:26:38.757Z","title":"netfilter: nf_conncount: increase the connection clean up limit to 64","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00745,"kevAdded":null},{"id":"CVE-2026-45859","published":"2026-05-27T12:15:39.322Z","updated":"2026-10-30T12:25:38.053Z","title":"netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00712,"kevAdded":null},{"id":"CVE-2026-45858","published":"2026-05-27T12:15:37.738Z","updated":"2026-05-30T10:41:40.719Z","title":"ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45857","published":"2026-05-27T12:15:35.967Z","updated":"2026-05-27T12:15:35.967Z","title":"scsi: csiostor: Fix dereference of null pointer rn","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45856","published":"2026-05-27T12:15:33.209Z","updated":"2026-10-19T19:26:38.460Z","title":"RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-45855","published":"2026-05-27T12:15:31.080Z","updated":"2026-10-30T12:25:36.974Z","title":"ata: libata-scsi: avoid Non-NCQ command starvation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-45854","published":"2026-05-27T12:15:28.988Z","updated":"2026-05-27T12:15:28.988Z","title":"crypto: inside-secure/eip93 - unregister only available algorithm","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-45853","published":"2026-05-27T12:15:27.453Z","updated":"2026-05-27T12:15:27.453Z","title":"drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-45852","published":"2026-05-27T12:15:26.084Z","updated":"2026-10-19T19:26:38.312Z","title":"RDMA/rxe: Fix double free in rxe_srq_from_init","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2026-45851","published":"2026-05-27T12:15:23.221Z","updated":"2026-05-27T12:15:23.221Z","title":"efi: Fix reservation of unaccepted memory table","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-45850","published":"2026-05-27T12:15:21.389Z","updated":"2026-10-15T01:19:49.362Z","title":"ipvs: skip ipv6 extension headers for csum checks","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-45849","published":"2026-05-27T12:15:15.494Z","updated":"2026-05-27T12:15:15.494Z","title":"net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2026-45848","published":"2026-05-27T12:15:12.310Z","updated":"2026-05-27T12:15:12.310Z","title":"apparmor: fix NULL sock in aa_sock_file_perm","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-45847","published":"2026-05-27T12:15:07.344Z","updated":"2026-05-27T12:15:07.344Z","title":"net: remove WARN_ON_ONCE when accessing forward path array","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2025-71309","published":"2026-05-27T12:15:03.360Z","updated":"2026-05-27T12:15:03.360Z","title":"fs/ntfs3: fix deadlock in ni_read_folio_cmpr","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00106,"kevAdded":null},{"id":"CVE-2025-71308","published":"2026-05-27T12:15:02.207Z","updated":"2026-10-15T10:06:54.040Z","title":"accel/amdxdna: Fix potential NULL pointer dereference in context cleanup","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-71307","published":"2026-05-27T12:14:59.693Z","updated":"2026-05-27T12:14:59.693Z","title":"drm/panthor: Fix NULL pointer dereference on panthor_fw_unplug","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2025-71306","published":"2026-05-27T12:14:57.182Z","updated":"2026-10-21T12:38:43.000Z","title":"ima: Fix stack-out-of-bounds in is_bprm_creds_for_exec()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-71305","published":"2026-05-27T12:14:55.722Z","updated":"2026-05-30T10:41:38.273Z","title":"drm/display/dp_mst: Add protection against 0 vcpi","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2025-71304","published":"2026-05-27T12:14:53.289Z","updated":"2026-05-27T12:14:53.289Z","title":"smack: /smack/doi: accept previously used values","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2025-71303","published":"2026-05-27T12:14:51.799Z","updated":"2026-10-15T10:06:52.979Z","title":"accel/amdxdna: Fix race condition when checking rpm_on","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-45846","published":"2026-05-27T09:24:52.122Z","updated":"2026-06-14T17:46:30.495Z","title":"bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-45845","published":"2026-05-27T09:24:48.438Z","updated":"2026-06-14T17:46:27.191Z","title":"net/sched: taprio: fix NULL pointer dereference in class dump","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-45844","published":"2026-05-27T09:24:47.041Z","updated":"2026-10-15T01:19:48.196Z","title":"netfilter: arp_tables: fix IEEE1394 ARP payload parsing","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-45843","published":"2026-05-27T09:24:45.516Z","updated":"2026-10-19T19:26:38.168Z","title":"slip: bound decode() reads against the compressed packet length","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2026-45842","published":"2026-05-27T09:24:42.637Z","updated":"2026-10-15T01:19:45.645Z","title":"slip: reject VJ receive packets on instances with no rstate array","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-45841","published":"2026-05-27T09:24:40.805Z","updated":"2026-10-15T01:19:44.352Z","title":"netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-45840","published":"2026-05-27T09:24:39.478Z","updated":"2026-10-15T01:19:42.649Z","title":"openvswitch: cap upcall PID array size and pre-size vport replies","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-45839","published":"2026-05-27T09:24:37.855Z","updated":"2026-10-15T01:19:41.412Z","title":"bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-45838","published":"2026-05-27T09:24:36.561Z","updated":"2026-10-15T01:19:40.227Z","title":"bpf: fix end-of-list detection in cgroup_storage_get_next_key()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-45837","published":"2026-05-27T09:24:32.833Z","updated":"2026-06-14T17:46:01.781Z","title":"bpf: Fix use-after-free in arena_vm_close on fork","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2026-45836","published":"2026-05-26T16:14:13.568Z","updated":"2026-10-15T01:19:39.061Z","title":"Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-45835","published":"2026-05-26T16:14:12.195Z","updated":"2026-10-15T01:19:37.905Z","title":"Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-45834","published":"2026-05-26T16:14:11.198Z","updated":"2026-10-15T01:19:36.750Z","title":"Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-46300","published":"2026-05-23T11:44:02.231Z","updated":"2026-10-29T03:55:37.330Z","title":"net: skbuff: preserve shared-frag marker during coalescing","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":true,"epss":0.1613,"kevAdded":"2026-10-28"},{"id":"CVE-2026-43503","published":"2026-05-23T11:44:01.103Z","updated":"2026-10-16T18:44:47.794Z","title":"net: skbuff: propagate shared-frag marker through frag-transfer helpers","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.01987,"kevAdded":null},{"id":"CVE-2026-43502","published":"2026-05-21T12:17:50.444Z","updated":"2026-10-15T01:19:32.714Z","title":"net/rds: handle zerocopy send cleanup before the message is queued","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2026-43501","published":"2026-05-21T12:17:49.885Z","updated":"2026-10-19T19:26:38.012Z","title":"ipv6: rpl: reserve mac_len headroom when recompressed SRH grows","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00732,"kevAdded":null},{"id":"CVE-2026-43499","published":"2026-05-21T12:17:49.281Z","updated":"2026-10-15T01:19:29.734Z","title":"rtmutex: Use waiter::task instead of current in remove_waiter()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00891,"kevAdded":null},{"id":"CVE-2026-43498","published":"2026-05-21T12:17:48.550Z","updated":"2026-08-05T12:28:20.973Z","title":"accel/ivpu: Disallow re-exporting imported GEM objects","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00113,"kevAdded":null},{"id":"CVE-2026-43497","published":"2026-05-21T12:12:47.150Z","updated":"2026-08-05T12:28:19.915Z","title":"fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00113,"kevAdded":null},{"id":"CVE-2026-43496","published":"2026-05-21T12:12:46.584Z","updated":"2026-10-15T01:19:27.947Z","title":"net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43495","published":"2026-05-21T12:12:45.988Z","updated":"2026-08-05T12:28:18.825Z","title":"net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00318,"kevAdded":null},{"id":"CVE-2026-43494","published":"2026-05-21T10:49:21.310Z","updated":"2026-10-19T19:26:37.859Z","title":"net/rds: reset op_nents when zerocopy page pin fails","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00411,"kevAdded":null},{"id":"CVE-2026-43493","published":"2026-05-19T10:44:25.402Z","updated":"2026-10-19T19:26:37.700Z","title":"crypto: pcrypt - Fix handling of MAY_BACKLOG requests","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00681,"kevAdded":null},{"id":"CVE-2026-43492","published":"2026-05-19T10:44:24.719Z","updated":"2026-10-15T01:19:25.509Z","title":"lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-43491","published":"2026-05-19T10:44:23.832Z","updated":"2026-08-19T16:27:59.057Z","title":"net: qrtr: ns: Limit the maximum server registration per node","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2026-46333","published":"2026-05-15T12:58:44.599Z","updated":"2026-10-15T01:21:42.063Z","title":"ptrace: slightly saner 'get_dumpable()' logic","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.04299,"kevAdded":null},{"id":"CVE-2026-43490","published":"2026-05-15T05:15:37.666Z","updated":"2026-10-30T12:25:35.905Z","title":"ksmbd: validate inherited ACE SID length","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2026-43489","published":"2026-05-13T15:08:33.810Z","updated":"2026-05-13T15:08:33.810Z","title":"liveupdate: luo_file: remember retrieve() status","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00102,"kevAdded":null},{"id":"CVE-2026-43488","published":"2026-05-13T15:08:33.196Z","updated":"2026-05-14T14:31:22.390Z","title":"usb: xhci: Prevent interrupt storm on host controller error (HCE)","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43487","published":"2026-05-13T15:08:32.631Z","updated":"2026-05-13T15:08:32.631Z","title":"ata: libata-core: Disable LPM on ST1000DM010-2EP102","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43486","published":"2026-05-13T15:08:32.085Z","updated":"2026-05-13T15:08:32.085Z","title":"arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43485","published":"2026-05-13T15:08:31.508Z","updated":"2026-10-21T12:40:51.314Z","title":"nouveau/gsp: drop WARN_ON in ACPI probes","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43484","published":"2026-05-13T15:08:30.919Z","updated":"2026-05-13T15:08:30.919Z","title":"mmc: core: Avoid bitfield RMW for claim/retune flags","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43483","published":"2026-05-13T15:08:30.319Z","updated":"2026-05-13T15:08:30.319Z","title":"KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43482","published":"2026-05-13T15:08:29.739Z","updated":"2026-05-13T15:08:29.739Z","title":"sched_ext: Disable preemption between scx_claim_exit() and kicking helper work","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43481","published":"2026-05-13T15:08:29.116Z","updated":"2026-08-05T12:28:12.884Z","title":"net-shapers: don't free reply skb after genlmsg_reply()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-43480","published":"2026-05-13T15:08:28.517Z","updated":"2026-05-13T15:08:28.517Z","title":"ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43479","published":"2026-05-13T15:08:27.932Z","updated":"2026-05-13T15:08:27.932Z","title":"net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-43478","published":"2026-05-13T15:08:27.352Z","updated":"2026-05-13T15:08:27.352Z","title":"ASoC: codecs: rt1011: Use component to get the dapm context in spk_mode_put","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-43477","published":"2026-05-13T15:08:26.763Z","updated":"2026-05-13T15:08:26.763Z","title":"drm/i915/vrr: Configure VRR timings after enabling TRANS_DDI_FUNC_CTL","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-43476","published":"2026-05-13T15:08:26.152Z","updated":"2026-08-05T12:28:11.813Z","title":"iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43500","published":"2026-05-11T06:26:45.838Z","updated":"2026-09-01T12:05:00.158Z","title":"rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.94118,"kevAdded":null},{"id":"CVE-2026-43475","published":"2026-05-08T14:22:33.553Z","updated":"2026-05-11T22:25:19.772Z","title":"scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43474","published":"2026-05-08T14:22:32.871Z","updated":"2026-05-11T22:25:18.616Z","title":"fs: init flags_valid before calling vfs_fileattr_get","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-43473","published":"2026-05-08T14:22:32.210Z","updated":"2026-05-11T22:25:17.395Z","title":"scsi: mpi3mr: Add NULL checks when resetting request and reply queues","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43472","published":"2026-05-08T14:22:31.556Z","updated":"2026-05-11T22:25:16.258Z","title":"unshare: fix unshare_fs() handling","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43471","published":"2026-05-08T14:22:30.909Z","updated":"2026-05-23T16:07:11.013Z","title":"scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43470","published":"2026-05-08T14:22:30.218Z","updated":"2026-05-11T22:25:13.820Z","title":"nfs: return EISDIR on nfs3_proc_create if d_alias is a dir","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2026-43469","published":"2026-05-08T14:22:29.550Z","updated":"2026-10-19T19:26:37.543Z","title":"xprtrdma: Decrement re_receiving on the early exit paths","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2026-43468","published":"2026-05-08T14:22:28.889Z","updated":"2026-05-11T22:25:11.471Z","title":"net/mlx5: Fix deadlock between devlink lock and esw->wq","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00091,"kevAdded":null},{"id":"CVE-2026-43467","published":"2026-05-08T14:22:28.216Z","updated":"2026-05-23T16:07:09.943Z","title":"net/mlx5: Fix crash when moving to switchdev mode","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43466","published":"2026-05-08T14:22:27.513Z","updated":"2026-10-19T19:26:37.388Z","title":"net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00412,"kevAdded":null},{"id":"CVE-2026-43465","published":"2026-05-08T14:22:26.822Z","updated":"2026-10-21T12:40:50.278Z","title":"net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00537,"kevAdded":null},{"id":"CVE-2026-43464","published":"2026-05-08T14:22:26.039Z","updated":"2026-10-21T12:40:49.291Z","title":"net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00547,"kevAdded":null},{"id":"CVE-2026-43463","published":"2026-05-08T14:22:25.346Z","updated":"2026-10-21T12:40:48.202Z","title":"rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43462","published":"2026-05-08T14:22:24.686Z","updated":"2026-08-05T12:28:06.464Z","title":"net: spacemit: Fix error handling in emac_tx_mem_map()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2026-43461","published":"2026-05-08T14:22:23.999Z","updated":"2026-08-05T12:28:05.393Z","title":"spi: amlogic: spifc-a4: Fix DMA mapping error handling","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-43460","published":"2026-05-08T14:22:23.332Z","updated":"2026-05-11T22:25:00.962Z","title":"spi: rockchip-sfc: Fix double-free in remove() callback","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-43459","published":"2026-05-08T14:22:22.651Z","updated":"2026-10-19T19:26:37.236Z","title":"ASoC: soc-core: flush delayed work before removing DAIs and widgets","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-43458","published":"2026-05-08T14:22:21.997Z","updated":"2026-05-11T22:24:58.635Z","title":"serial: caif: hold tty->link reference in ldisc_open and ser_release","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-43457","published":"2026-05-08T14:22:20.725Z","updated":"2026-05-11T22:24:57.488Z","title":"mctp: i2c: fix skb memory leak in receive path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43456","published":"2026-05-08T14:22:20.036Z","updated":"2026-10-30T12:25:34.806Z","title":"bonding: fix type confusion in bond_setup_by_slave()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2026-43455","published":"2026-05-08T14:22:19.375Z","updated":"2026-05-11T22:24:55.256Z","title":"mctp: route: hold key->lock in mctp_flow_prepare_output()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43454","published":"2026-05-08T14:22:18.719Z","updated":"2026-08-05T12:28:02.179Z","title":"netfilter: nf_tables: Fix for duplicate device in netdev hooks","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-43453","published":"2026-05-08T14:22:18.087Z","updated":"2026-05-11T22:24:52.944Z","title":"netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43452","published":"2026-05-08T14:22:17.361Z","updated":"2026-10-19T19:26:36.945Z","title":"netfilter: x_tables: guard option walkers against 1-byte tail reads","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00541,"kevAdded":null},{"id":"CVE-2026-43451","published":"2026-05-08T14:22:16.716Z","updated":"2026-05-11T22:24:50.659Z","title":"netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43450","published":"2026-05-08T14:22:15.915Z","updated":"2026-05-11T22:24:49.527Z","title":"netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-43449","published":"2026-05-08T14:22:15.276Z","updated":"2026-05-23T16:07:01.436Z","title":"nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43448","published":"2026-05-08T14:22:14.633Z","updated":"2026-05-11T22:24:47.245Z","title":"nvme-pci: Fix race bug in nvme_poll_irqdisable()","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00089,"kevAdded":null},{"id":"CVE-2026-43447","published":"2026-05-08T14:22:13.988Z","updated":"2026-08-05T12:28:00.059Z","title":"iavf: fix PTP use-after-free during reset","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-43446","published":"2026-05-08T14:22:13.328Z","updated":"2026-10-15T10:07:20.573Z","title":"accel/amdxdna: Fix runtime suspend deadlock when there is pending job","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0009,"kevAdded":null},{"id":"CVE-2026-43445","published":"2026-05-08T14:22:12.660Z","updated":"2026-05-11T22:24:43.676Z","title":"e1000/e1000e: Fix leak in DMA error cleanup","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43444","published":"2026-05-08T14:22:11.976Z","updated":"2026-05-11T22:24:42.516Z","title":"drm/amdkfd: Unreserve bo if queue update failed","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43443","published":"2026-05-08T14:22:11.303Z","updated":"2026-10-30T12:25:33.716Z","title":"ASoC: amd: acp-mach-common: Add missing error check for clock acquisition","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43442","published":"2026-05-08T14:22:10.656Z","updated":"2026-08-05T12:27:59.003Z","title":"io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte ops","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-43441","published":"2026-05-08T14:22:09.982Z","updated":"2026-10-19T19:26:36.805Z","title":"net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00585,"kevAdded":null},{"id":"CVE-2026-43440","published":"2026-05-08T14:22:09.334Z","updated":"2026-05-11T22:24:37.924Z","title":"net/mana: Null service_wq on setup error to prevent double destroy","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-43439","published":"2026-05-08T14:22:08.626Z","updated":"2026-05-23T16:07:00.399Z","title":"cgroup: fix race between task migration and iteration","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00089,"kevAdded":null},{"id":"CVE-2026-43438","published":"2026-05-08T14:22:07.980Z","updated":"2026-08-05T12:27:56.866Z","title":"sched_ext: Remove redundant css_put() in scx_cgroup_init()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-43437","published":"2026-05-08T14:22:07.314Z","updated":"2026-10-19T19:26:36.663Z","title":"ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-43436","published":"2026-05-08T14:22:06.632Z","updated":"2026-05-11T22:24:33.336Z","title":"ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43435","published":"2026-05-08T14:22:05.921Z","updated":"2026-05-11T22:24:32.185Z","title":"rust_binder: fix oneway spam detection","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43434","published":"2026-05-08T14:22:05.269Z","updated":"2026-08-05T12:27:54.685Z","title":"rust_binder: check ownership before using vma","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43433","published":"2026-05-08T14:22:04.632Z","updated":"2026-08-05T12:27:53.626Z","title":"rust_binder: avoid reading the written value in offsets array","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00099,"kevAdded":null},{"id":"CVE-2026-43432","published":"2026-05-08T14:22:03.985Z","updated":"2026-05-23T16:06:59.368Z","title":"usb: xhci: Fix memory leak in xhci_disable_slot()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43431","published":"2026-05-08T14:22:03.298Z","updated":"2026-05-11T22:24:27.454Z","title":"xhci: Fix NULL pointer dereference when reading portli debugfs files","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-43430","published":"2026-05-08T14:22:02.458Z","updated":"2026-05-11T22:24:26.330Z","title":"usb: yurex: fix race in probe","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00089,"kevAdded":null},{"id":"CVE-2026-43429","published":"2026-05-08T14:22:01.739Z","updated":"2026-05-11T22:24:25.178Z","title":"USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43428","published":"2026-05-08T14:22:01.027Z","updated":"2026-05-11T22:24:24.020Z","title":"USB: core: Limit the length of unkillable synchronous timeouts","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43427","published":"2026-05-08T14:22:00.345Z","updated":"2026-05-11T22:24:22.781Z","title":"usb: class: cdc-wdm: fix reordering issue in read code path","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-43426","published":"2026-05-08T14:21:59.668Z","updated":"2026-05-11T22:24:21.643Z","title":"usb: renesas_usbhs: fix use-after-free in ISR during device removal","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43425","published":"2026-05-08T14:21:59.020Z","updated":"2026-05-11T22:24:20.496Z","title":"usb: image: mdc800: kill download URB on timeout","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43424","published":"2026-05-08T14:21:58.365Z","updated":"2026-05-11T22:24:19.268Z","title":"usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43421","published":"2026-05-08T14:21:56.363Z","updated":"2026-10-15T01:19:23.793Z","title":"usb: gadget: f_ncm: Fix net_device lifecycle with device_move","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43420","published":"2026-05-08T14:21:55.717Z","updated":"2026-05-11T22:24:14.623Z","title":"ceph: fix i_nlink underrun during async unlink","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00093,"kevAdded":null},{"id":"CVE-2026-43419","published":"2026-05-08T14:21:55.037Z","updated":"2026-10-30T12:25:32.654Z","title":"ceph: fix memory leaks in ceph_mdsc_build_path()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43418","published":"2026-05-08T14:21:54.362Z","updated":"2026-05-11T22:24:12.301Z","title":"sched/mmcid: Prevent CID stalls due to concurrent forks","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-43417","published":"2026-05-08T14:21:53.618Z","updated":"2026-05-11T22:24:11.172Z","title":"sched/mmcid: Handle vfork()/CLONE_VM correctly","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-43416","published":"2026-05-08T14:21:52.954Z","updated":"2026-05-11T22:24:10.050Z","title":"powerpc, perf: Check that current->mm is alive before getting user callchain","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43415","published":"2026-05-08T14:21:52.293Z","updated":"2026-05-23T16:06:57.367Z","title":"scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00089,"kevAdded":null},{"id":"CVE-2026-43414","published":"2026-05-08T14:21:51.604Z","updated":"2026-10-30T12:25:31.583Z","title":"scsi: qla2xxx: Completely fix fcport double free","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.006,"kevAdded":null},{"id":"CVE-2026-43413","published":"2026-05-08T14:21:50.923Z","updated":"2026-10-30T12:25:30.524Z","title":"scsi: hisi_sas: Fix NULL pointer exception during user_scan()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43412","published":"2026-05-08T14:21:50.187Z","updated":"2026-05-11T22:24:05.456Z","title":"ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43411","published":"2026-05-08T14:21:49.543Z","updated":"2026-05-11T22:24:04.295Z","title":"tipc: fix divide-by-zero in tipc_sk_filter_connect()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43410","published":"2026-05-08T14:21:48.885Z","updated":"2026-05-11T22:24:02.917Z","title":"firmware: stratix10-rsu: Fix NULL pointer dereference when RSU is disabled","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2026-43409","published":"2026-05-08T14:21:48.239Z","updated":"2026-05-11T22:24:01.453Z","title":"kprobes: avoid crash when rmmod/insmod after ftrace killed","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43408","published":"2026-05-08T14:21:47.579Z","updated":"2026-10-21T12:40:44.899Z","title":"ceph: add a bunch of missing ceph_path_info initializers","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-43407","published":"2026-05-08T14:21:46.927Z","updated":"2026-10-19T19:26:36.220Z","title":"libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00656,"kevAdded":null},{"id":"CVE-2026-43406","published":"2026-05-08T14:21:46.246Z","updated":"2026-10-19T19:16:28.625Z","title":"libceph: prevent potential out-of-bounds reads in process_message_header()","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00613,"kevAdded":null},{"id":"CVE-2026-43405","published":"2026-05-08T14:21:45.581Z","updated":"2026-10-19T19:16:28.480Z","title":"libceph: Use u32 for non-negative values in ceph_monmap_decode()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00598,"kevAdded":null},{"id":"CVE-2026-43404","published":"2026-05-08T14:21:44.929Z","updated":"2026-05-11T22:23:55.638Z","title":"mm: Fix a hmm_range_fault() livelock / starvation problem","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00093,"kevAdded":null},{"id":"CVE-2026-43403","published":"2026-05-08T14:21:44.204Z","updated":"2026-08-05T12:27:47.212Z","title":"nsfs: tighten permission checks for ns iteration ioctls","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-43402","published":"2026-05-08T14:21:43.550Z","updated":"2026-10-19T19:16:28.340Z","title":"kthread: consolidate kthread exit paths to prevent use-after-free","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00557,"kevAdded":null},{"id":"CVE-2026-43401","published":"2026-05-08T14:21:42.876Z","updated":"2026-05-11T22:23:52.197Z","title":"cpufreq: intel_pstate: Fix NULL pointer dereference in update_cpu_qos_request()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43400","published":"2026-05-08T14:21:42.225Z","updated":"2026-05-11T22:23:51.059Z","title":"drm/amdgpu: add upper bound check on user inputs in signal ioctl","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43399","published":"2026-05-08T14:21:41.529Z","updated":"2026-05-11T22:23:49.924Z","title":"drm/amdgpu/userq: Fix reference leak in amdgpu_userq_wait_ioctl","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43398","published":"2026-05-08T14:21:40.895Z","updated":"2026-05-11T22:23:48.775Z","title":"drm/amdgpu: add upper bound check on user inputs in wait ioctl","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43397","published":"2026-05-08T14:21:40.185Z","updated":"2026-05-11T22:23:47.602Z","title":"drm/bridge: samsung-dsim: Fix memory leak in error path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43396","published":"2026-05-08T14:21:39.443Z","updated":"2026-05-11T22:23:46.445Z","title":"drm/xe/sync: Fix user fence leak on alloc failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43395","published":"2026-05-08T14:21:38.756Z","updated":"2026-05-11T22:23:45.325Z","title":"drm/xe/sync: Cleanup partially initialized sync on parse failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43394","published":"2026-05-08T14:21:38.127Z","updated":"2026-05-11T22:23:44.189Z","title":"nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43393","published":"2026-05-08T14:21:37.368Z","updated":"2026-05-11T22:23:43.050Z","title":"btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43392","published":"2026-05-08T14:21:36.692Z","updated":"2026-05-11T22:23:41.885Z","title":"sched_ext: Fix starvation of scx_enable() under fair-class saturation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-43391","published":"2026-05-08T14:21:36.012Z","updated":"2026-09-07T15:44:55.215Z","title":"nsfs: tighten permission checks for handle opening","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43390","published":"2026-05-08T14:21:35.337Z","updated":"2026-05-11T22:23:39.579Z","title":"nstree: tighten permission checks for listing","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-43389","published":"2026-05-08T14:21:34.658Z","updated":"2026-05-11T22:23:38.437Z","title":"mm: memfd_luo: always dirty all folios","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-43388","published":"2026-05-08T14:21:33.966Z","updated":"2026-05-11T22:23:37.300Z","title":"mm/damon/core: clear walk_control on inactive context in damos_walk()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-43387","published":"2026-05-08T14:21:33.323Z","updated":"2026-05-11T22:23:36.159Z","title":"staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43386","published":"2026-05-08T14:21:32.646Z","updated":"2026-05-11T22:23:35.007Z","title":"staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43385","published":"2026-05-08T14:21:32.007Z","updated":"2026-08-05T12:27:43.989Z","title":"net: Fix rcu_tasks stall in threaded busypoll","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2026-43384","published":"2026-05-08T14:21:31.355Z","updated":"2026-08-05T12:27:42.918Z","title":"net/tcp-ao: Fix MAC comparison to be constant-time","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00457,"kevAdded":null},{"id":"CVE-2026-43383","published":"2026-05-08T14:21:30.704Z","updated":"2026-10-19T19:16:28.193Z","title":"net/tcp-md5: Fix MAC comparison to be constant-time","severity":"CRITICAL","score":9.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00541,"kevAdded":null},{"id":"CVE-2026-43382","published":"2026-05-08T14:21:30.062Z","updated":"2026-05-23T16:06:54.305Z","title":"batman-adv: Avoid double-rtnl_lock ELP metric worker","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-43381","published":"2026-05-08T14:21:29.340Z","updated":"2026-05-11T22:23:29.324Z","title":"nouveau/dpcd: return EBUSY for aux xfer if the device is asleep","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43380","published":"2026-05-08T14:21:28.702Z","updated":"2026-08-05T12:27:40.763Z","title":"hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-43379","published":"2026-05-08T14:21:28.027Z","updated":"2026-08-05T12:27:39.686Z","title":"ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00444,"kevAdded":null},{"id":"CVE-2026-43378","published":"2026-05-08T14:21:27.319Z","updated":"2026-08-05T12:27:38.612Z","title":"smb: server: fix use-after-free in smb2_open()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2026-43377","published":"2026-05-08T14:21:26.618Z","updated":"2026-08-05T12:27:36.806Z","title":"ksmbd: Don't log keys in SMB3 signing and encryption key generation","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2026-43376","published":"2026-05-08T14:21:25.854Z","updated":"2026-08-05T12:27:35.730Z","title":"ksmbd: fix use-after-free by using call_rcu() for oplock_info","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00444,"kevAdded":null},{"id":"CVE-2026-43375","published":"2026-05-08T14:21:25.193Z","updated":"2026-05-11T22:23:22.359Z","title":"net: mctp: fix device leak on probe failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43374","published":"2026-05-08T14:21:24.537Z","updated":"2026-10-19T19:16:28.049Z","title":"net: nexthop: fix percpu use-after-free in remove_nh_grp_entry","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-43373","published":"2026-05-08T14:21:23.875Z","updated":"2026-08-05T12:27:33.592Z","title":"net: ncsi: fix skb leak in error paths","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-43372","published":"2026-05-08T14:21:23.221Z","updated":"2026-05-23T16:06:51.157Z","title":"net: dsa: microchip: Fix error path in PTP IRQ setup","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43371","published":"2026-05-08T14:21:22.577Z","updated":"2026-05-11T22:23:17.582Z","title":"net: macb: Shuffle the tx ring before enabling tx","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43370","published":"2026-05-08T14:21:21.926Z","updated":"2026-10-19T19:16:27.897Z","title":"drm/amdgpu: Fix use-after-free race in VM acquire","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43369","published":"2026-05-08T14:21:21.174Z","updated":"2026-05-11T22:23:15.282Z","title":"drm/amd: Fix NULL pointer dereference in device cleanup","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43368","published":"2026-05-08T14:21:20.500Z","updated":"2026-10-19T19:16:27.757Z","title":"drm/i915: Fix potential overflow of shmem scatterlist length","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-43367","published":"2026-05-08T14:21:19.851Z","updated":"2026-05-11T22:23:12.981Z","title":"drm/amd: Fix a few more NULL pointer dereference in device cleanup","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43366","published":"2026-05-08T14:21:19.191Z","updated":"2026-10-19T19:16:27.613Z","title":"io_uring/kbuf: check if target buffer list is still legacy on recycle","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-43365","published":"2026-05-08T14:21:18.405Z","updated":"2026-10-19T19:16:27.470Z","title":"xfs: fix undersized l_iclog_roundoff values","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00506,"kevAdded":null},{"id":"CVE-2026-43364","published":"2026-05-08T14:21:17.654Z","updated":"2026-05-11T22:23:09.555Z","title":"ublk: fix NULL pointer dereference in ublk_ctrl_set_size()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43363","published":"2026-05-08T14:21:16.986Z","updated":"2026-05-11T22:23:08.290Z","title":"x86/apic: Disable x2apic on resume if the kernel expects so","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43362","published":"2026-05-08T14:21:16.358Z","updated":"2026-10-19T19:16:27.315Z","title":"smb: client: fix in-place encryption corruption in SMB2_write()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2026-43361","published":"2026-05-08T14:21:15.683Z","updated":"2026-05-11T22:23:05.901Z","title":"btrfs: fix transaction abort when snapshotting received subvolumes","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43360","published":"2026-05-08T14:21:15.008Z","updated":"2026-05-11T22:23:04.705Z","title":"btrfs: fix transaction abort on file creation due to name hash collision","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-43359","published":"2026-05-08T14:21:14.357Z","updated":"2026-05-11T22:23:03.390Z","title":"btrfs: fix transaction abort on set received ioctl due to item overflow","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43358","published":"2026-05-08T14:21:13.719Z","updated":"2026-05-23T16:06:50.155Z","title":"btrfs: add missing RCU unlock in error path in try_release_subpage_extent_buffer()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43357","published":"2026-05-08T14:21:13.050Z","updated":"2026-05-11T22:23:00.799Z","title":"iio: gyro: mpu3050-core: fix pm_runtime error handling","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43356","published":"2026-05-08T14:21:12.373Z","updated":"2026-05-11T22:22:59.595Z","title":"iio: imu: adis: Fix NULL pointer dereference in adis_init","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43355","published":"2026-05-08T14:21:11.609Z","updated":"2026-07-04T11:50:39.069Z","title":"iio: light: bh1780: fix PM runtime leak on error path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43354","published":"2026-05-08T14:21:10.949Z","updated":"2026-05-11T22:22:57.289Z","title":"iio: proximity: hx9023s: Protect against division by zero in set_samp_freq","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43353","published":"2026-05-08T14:21:10.282Z","updated":"2026-10-30T12:25:29.436Z","title":"i3c: mipi-i3c-hci: Fix race in DMA ring dequeue","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-43352","published":"2026-05-08T14:21:09.552Z","updated":"2026-10-30T12:25:28.372Z","title":"i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-43351","published":"2026-05-08T14:21:08.868Z","updated":"2026-05-11T22:22:53.725Z","title":"KVM: arm64: Eagerly init vgic dist/redist on vgic creation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43350","published":"2026-05-08T13:41:53.276Z","updated":"2026-10-19T19:16:27.167Z","title":"smb: client: require a full NFS mode SID before reading mode bits","severity":"HIGH","score":7.6,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2026-43349","published":"2026-05-08T13:41:52.611Z","updated":"2026-06-14T17:45:02.911Z","title":"f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-43348","published":"2026-05-08T13:41:51.909Z","updated":"2026-06-14T17:44:59.767Z","title":"mshv_vtl: Fix vmemmap_shift exceeding MAX_FOLIO_ORDER","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-43347","published":"2026-05-08T13:39:32.598Z","updated":"2026-08-05T12:27:23.879Z","title":"arm64: dts: qcom: monaco: Reserve full Gunyah metadata region","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2026-43346","published":"2026-05-08T13:39:31.930Z","updated":"2026-10-21T12:40:41.560Z","title":"ice: ptp: don't WARN when controlling PF is unavailable","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43345","published":"2026-05-08T13:39:31.222Z","updated":"2026-08-05T12:27:22.811Z","title":"net: ipa: fix event ring index not programmed for IPA v5.0+","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00353,"kevAdded":null},{"id":"CVE-2026-43344","published":"2026-05-08T13:39:30.537Z","updated":"2026-10-30T12:25:27.301Z","title":"perf/x86/intel/uncore: Fix die ID init and look up bugs","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-43343","published":"2026-05-08T13:37:20.663Z","updated":"2026-05-11T22:22:44.192Z","title":"usb: gadget: f_subset: Fix unbalanced refcnt in geth_free","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43342","published":"2026-05-08T13:37:19.920Z","updated":"2026-05-11T22:22:43.032Z","title":"usb: gadget: f_rndis: Protect RNDIS options with mutex","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00086,"kevAdded":null},{"id":"CVE-2026-43341","published":"2026-05-08T13:37:19.256Z","updated":"2026-10-19T19:16:27.020Z","title":"net/ipv6: ioam6: prevent schema length wraparound in trace fill","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00512,"kevAdded":null},{"id":"CVE-2026-43340","published":"2026-05-08T13:37:18.580Z","updated":"2026-05-11T22:22:40.639Z","title":"comedi: Reinit dev->spinlock between attachments to low-level drivers","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43339","published":"2026-05-08T13:31:24.315Z","updated":"2026-10-19T19:16:26.883Z","title":"ipv6: prevent possible UaF in addrconf_permanent_addr()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-43338","published":"2026-05-08T13:31:23.623Z","updated":"2026-10-30T12:25:26.239Z","title":"btrfs: reserve enough transaction items for qgroup ioctls","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2026-43337","published":"2026-05-08T13:31:22.967Z","updated":"2026-10-21T12:40:39.405Z","title":"drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43336","published":"2026-05-08T13:31:22.280Z","updated":"2026-08-05T12:27:19.605Z","title":"lib/crypto: chacha: Zeroize permuted_state before it leaves scope","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00425,"kevAdded":null},{"id":"CVE-2026-43335","published":"2026-05-08T13:31:21.623Z","updated":"2026-05-11T22:22:34.774Z","title":"interconnect: qcom: sm8450: Fix NULL pointer dereference in icc_link_nodes()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-43334","published":"2026-05-08T13:31:20.923Z","updated":"2026-10-19T19:16:26.745Z","title":"Bluetooth: SMP: force responder MITM requirements before building the pairing response","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-43333","published":"2026-05-08T13:31:20.107Z","updated":"2026-05-23T16:06:46.060Z","title":"bpf: reject direct access to nullable PTR_TO_BUF pointers","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43332","published":"2026-05-08T13:31:19.460Z","updated":"2026-10-19T19:16:26.610Z","title":"thermal: core: Fix thermal zone device registration error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-43331","published":"2026-05-08T13:31:18.787Z","updated":"2026-06-19T11:58:29.321Z","title":"x86/kexec: Disable KCOV instrumentation after load_segments()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43330","published":"2026-05-08T13:31:18.133Z","updated":"2026-08-05T12:27:16.367Z","title":"crypto: caam - fix overflow on long hmac keys","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-43329","published":"2026-05-08T13:31:17.479Z","updated":"2026-10-19T19:16:26.468Z","title":"netfilter: flowtable: strictly check for maximum number of actions","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-43328","published":"2026-05-08T13:31:16.787Z","updated":"2026-06-01T16:15:39.421Z","title":"cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-43327","published":"2026-05-08T13:31:12.896Z","updated":"2026-05-23T16:06:42.428Z","title":"USB: dummy-hcd: Fix locking/synchronization error","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-43326","published":"2026-05-08T13:31:10.184Z","updated":"2026-05-11T22:22:24.156Z","title":"sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00083,"kevAdded":null},{"id":"CVE-2026-43325","published":"2026-05-08T13:31:09.536Z","updated":"2026-10-21T12:40:38.291Z","title":"wifi: iwlwifi: mvm: don't send a 6E related command when not supported","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43324","published":"2026-05-08T13:31:08.850Z","updated":"2026-08-05T12:27:14.134Z","title":"USB: dummy-hcd: Fix interrupt synchronization error","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-43323","published":"2026-05-08T13:31:08.188Z","updated":"2026-05-11T22:22:20.507Z","title":"sched/fair: Fix zero_vruntime tracking fix","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43322","published":"2026-05-08T13:31:07.436Z","updated":"2026-08-05T12:27:13.066Z","title":"Bluetooth: hci_sync: Fix UAF in le_read_features_complete","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-43321","published":"2026-05-08T13:26:15.600Z","updated":"2026-10-19T19:16:26.326Z","title":"bpf: Properly mark live registers for indirect jumps","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2026-43320","published":"2026-05-08T13:26:14.930Z","updated":"2026-05-23T16:06:41.400Z","title":"drm/amd/display: Fix dsc eDP issue","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43319","published":"2026-05-08T13:26:14.231Z","updated":"2026-06-01T16:15:35.875Z","title":"spi: spidev: fix lock inversion between spi_lock and buf_lock","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00094,"kevAdded":null},{"id":"CVE-2026-43318","published":"2026-05-08T13:26:13.557Z","updated":"2026-05-11T22:22:14.662Z","title":"drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43317","published":"2026-05-08T13:26:12.899Z","updated":"2026-10-21T12:40:37.217Z","title":"most: core: fix leak on early registration failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43316","published":"2026-05-08T13:26:12.217Z","updated":"2026-05-11T22:22:12.135Z","title":"media: solo6x10: Check for out of bounds chip_id","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-71302","published":"2026-05-08T13:26:11.418Z","updated":"2026-08-05T12:12:44.474Z","title":"drm/panthor: fix for dma-fence safe access rules","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2025-71301","published":"2026-05-08T13:15:22.100Z","updated":"2026-05-11T21:57:33.226Z","title":"drm/tests: shmem: Hold reservation lock around vmap/vunmap","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2025-71300","published":"2026-05-08T13:15:21.406Z","updated":"2026-08-05T12:12:43.409Z","title":"Revert \"arm64: zynqmp: Add an OP-TEE node to the device tree\"","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-43315","published":"2026-05-08T13:11:31.784Z","updated":"2026-05-11T22:22:10.929Z","title":"KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-43314","published":"2026-05-08T13:11:31.068Z","updated":"2026-05-11T22:22:09.779Z","title":"dm: remove fake timeout to avoid leak request","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-43313","published":"2026-05-08T13:11:30.386Z","updated":"2026-05-11T22:22:08.644Z","title":"ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43312","published":"2026-05-08T13:11:29.719Z","updated":"2026-05-11T22:22:07.459Z","title":"media: i2c: ov5647: Initialize subdev before controls","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43311","published":"2026-05-08T13:11:29.068Z","updated":"2026-10-21T12:40:36.236Z","title":"soc/tegra: pmc: Fix unsafe generic_handle_irq() call","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43310","published":"2026-05-08T13:11:28.372Z","updated":"2026-10-30T12:25:25.171Z","title":"media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43309","published":"2026-05-08T13:11:27.595Z","updated":"2026-10-21T12:40:34.118Z","title":"md raid: fix hang when stopping arrays with metadata through dm-raid","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43308","published":"2026-05-08T13:11:26.937Z","updated":"2026-10-30T12:25:24.107Z","title":"btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43307","published":"2026-05-08T13:11:26.295Z","updated":"2026-08-05T12:27:10.945Z","title":"iio: accel: adxl380: Avoid reading more entries than present in FIFO","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-43306","published":"2026-05-08T13:11:25.624Z","updated":"2026-05-11T22:22:00.468Z","title":"bpf: crypto: Use the correct destructor kfunc type","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43305","published":"2026-05-08T13:11:24.952Z","updated":"2026-05-11T22:21:59.194Z","title":"drm/amd/display: Fix mismatched unlock for DMUB HW lock in HWSS fast path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00083,"kevAdded":null},{"id":"CVE-2026-43304","published":"2026-05-08T13:11:24.264Z","updated":"2026-10-19T19:16:26.177Z","title":"libceph: define and enforce CEPH_MAX_KEY_LEN","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00613,"kevAdded":null},{"id":"CVE-2026-43303","published":"2026-05-08T13:11:23.561Z","updated":"2026-10-19T19:16:26.022Z","title":"mm/page_alloc: clear page->private in free_pages_prepare()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-43302","published":"2026-05-08T13:11:22.886Z","updated":"2026-05-11T22:21:55.721Z","title":"drm/v3d: Set DMA segment size to avoid debug warnings","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43301","published":"2026-05-08T13:11:22.234Z","updated":"2026-05-11T22:21:54.560Z","title":"media: chips-media: wave5: Fix PM runtime usage count underflow","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43300","published":"2026-05-08T13:11:21.530Z","updated":"2026-05-11T22:21:53.416Z","title":"drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43299","published":"2026-05-08T13:11:20.872Z","updated":"2026-10-30T12:25:23.043Z","title":"btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-43298","published":"2026-05-08T13:11:20.215Z","updated":"2026-10-21T12:40:30.864Z","title":"drm/amdgpu: Skip vcn poison irq release on VF","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-43297","published":"2026-05-08T13:11:19.530Z","updated":"2026-05-11T22:21:49.907Z","title":"media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43296","published":"2026-05-08T13:11:18.870Z","updated":"2026-08-05T12:27:07.797Z","title":"octeontx2-af: Workaround SQM/PSE stalls by disabling sticky","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00387,"kevAdded":null},{"id":"CVE-2026-43295","published":"2026-05-08T13:11:18.226Z","updated":"2026-05-11T22:21:47.637Z","title":"rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43294","published":"2026-05-08T13:11:17.483Z","updated":"2026-10-21T12:40:29.748Z","title":"drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-43293","published":"2026-05-08T13:11:16.812Z","updated":"2026-05-11T22:21:45.305Z","title":"media: chips-media: wave5: Fix kthread worker destruction in polling mode","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43292","published":"2026-05-08T13:11:16.017Z","updated":"2026-05-11T22:21:44.094Z","title":"mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43291","published":"2026-05-08T13:11:15.312Z","updated":"2026-08-05T12:27:06.691Z","title":"net: nfc: nci: Fix parameter validation for packet data","severity":"HIGH","score":8.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2026-43290","published":"2026-05-08T13:11:14.646Z","updated":"2026-08-05T12:27:05.626Z","title":"media: uvcvideo: Return queued buffers on start_streaming() failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43289","published":"2026-05-08T13:11:13.860Z","updated":"2026-05-23T16:06:38.103Z","title":"kexec: derive purgatory entry from symbol","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43288","published":"2026-05-08T13:11:13.195Z","updated":"2026-09-14T11:58:19.350Z","title":"ext4: move ext4_percpu_param_init() before ext4_mb_init()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-43287","published":"2026-05-08T13:11:12.541Z","updated":"2026-05-11T22:21:38.413Z","title":"drm: Account property blob allocations to memcg","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43286","published":"2026-05-08T13:11:11.867Z","updated":"2026-05-23T16:06:37.088Z","title":"mm/hugetlb: restore failed global reservations to subpool","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43285","published":"2026-05-08T13:11:11.191Z","updated":"2026-05-11T22:21:36.072Z","title":"mm/slab: do not access current->mems_allowed_seq if !allow_spin","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2025-71299","published":"2026-05-08T13:11:10.518Z","updated":"2026-05-23T16:03:36.757Z","title":"spi: cadence-quadspi: Parse DT for flashes with the rest of the DT parsing","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2025-71298","published":"2026-05-08T13:11:09.797Z","updated":"2026-05-11T21:57:29.659Z","title":"drm/tests: shmem: Hold reservation lock around madvise","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2025-71297","published":"2026-05-08T13:11:09.120Z","updated":"2026-05-11T21:57:28.537Z","title":"wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-71296","published":"2026-05-08T13:11:08.251Z","updated":"2026-05-11T21:57:27.350Z","title":"drm/tests: shmem: Hold reservation lock around purge","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43284","published":"2026-05-08T07:21:47.524Z","updated":"2026-10-15T01:19:19.235Z","title":"xfrm: esp: avoid in-place decrypt on shared skb frags","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.94194,"kevAdded":null},{"id":"CVE-2025-71295","published":"2026-05-06T11:32:25.917Z","updated":"2026-05-23T16:03:35.695Z","title":"fs/buffer: add alert in try_to_free_buffers() for folios without buffers","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-71294","published":"2026-05-06T11:32:25.247Z","updated":"2026-05-11T21:57:25.049Z","title":"drm/amdgpu: fix NULL pointer issue buffer funcs","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2025-71293","published":"2026-05-06T11:32:24.583Z","updated":"2026-05-11T21:57:23.917Z","title":"drm/amdgpu/ras: Move ras data alloc before bad page check","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2025-71292","published":"2026-05-06T11:32:23.897Z","updated":"2026-08-05T12:12:42.348Z","title":"jfs: nlink overflow in jfs_rename","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2025-71291","published":"2026-05-06T11:32:23.223Z","updated":"2026-05-11T21:57:21.624Z","title":"misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2025-71290","published":"2026-05-06T11:32:22.378Z","updated":"2026-05-11T21:57:20.450Z","title":"misc: ti_fpc202: fix a potential memory leak in probe function","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2025-71289","published":"2026-05-06T11:32:21.715Z","updated":"2026-10-30T12:23:36.617Z","title":"fs/ntfs3: handle attr_set_size() errors when truncating files","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2025-71288","published":"2026-05-06T11:32:20.840Z","updated":"2026-05-11T21:57:18.140Z","title":"memory: mtk-smi: fix device leaks on common probe","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2025-71287","published":"2026-05-06T11:32:20.136Z","updated":"2026-05-11T21:57:17.006Z","title":"memory: mtk-smi: fix device leak on larb probe","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2025-71286","published":"2026-05-06T11:32:19.468Z","updated":"2026-10-19T18:25:25.461Z","title":"ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2025-71285","published":"2026-05-06T11:32:18.774Z","updated":"2026-10-30T12:23:35.535Z","title":"net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-43283","published":"2026-05-06T11:29:03.726Z","updated":"2026-08-05T12:27:03.376Z","title":"net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-43282","published":"2026-05-06T11:29:03.000Z","updated":"2026-05-11T22:21:32.612Z","title":"RDMA/ionic: Fix potential NULL pointer dereference in ionic_query_port","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-43281","published":"2026-05-06T11:29:02.278Z","updated":"2026-06-01T16:15:32.145Z","title":"mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-43280","published":"2026-05-06T11:29:01.562Z","updated":"2026-10-19T19:16:25.879Z","title":"drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2026-43279","published":"2026-05-06T11:29:00.844Z","updated":"2026-10-19T19:16:25.738Z","title":"ALSA: usb-audio: Add sanity check for OOB writes at silencing","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43278","published":"2026-05-06T11:29:00.193Z","updated":"2026-10-19T19:16:25.598Z","title":"dm: clear cloned request bio pointer when last clone bio completes","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-43277","published":"2026-05-06T11:28:59.486Z","updated":"2026-05-11T22:21:26.865Z","title":"APEI/GHES: ensure that won't go past CPER allocated record","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43276","published":"2026-05-06T11:28:58.840Z","updated":"2026-05-11T22:21:25.701Z","title":"net: mana: Fix double destroy_workqueue on service rescan PCI path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2026-43275","published":"2026-05-06T11:28:58.174Z","updated":"2026-05-11T22:21:24.558Z","title":"scsi: ufs: core: Flush exception handling work when RPM level is zero","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00091,"kevAdded":null},{"id":"CVE-2026-43274","published":"2026-05-06T11:28:57.503Z","updated":"2026-08-05T12:26:59.090Z","title":"mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-43273","published":"2026-05-06T11:28:56.851Z","updated":"2026-05-11T22:21:22.184Z","title":"ceph: supply snapshot context in ceph_zero_partial_object()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-43272","published":"2026-05-06T11:28:56.162Z","updated":"2026-10-21T12:40:28.662Z","title":"ring-buffer: Fix possible dereference of uninitialized pointer","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-43271","published":"2026-05-06T11:28:55.507Z","updated":"2026-10-30T12:25:21.976Z","title":"md-cluster: fix NULL pointer dereference in process_metadata_update","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-43270","published":"2026-05-06T11:28:54.866Z","updated":"2026-05-11T22:21:18.648Z","title":"media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43269","published":"2026-05-06T11:28:54.178Z","updated":"2026-05-11T22:21:17.527Z","title":"drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43268","published":"2026-05-06T11:28:53.534Z","updated":"2026-05-11T22:21:16.404Z","title":"hfsplus: pretend special inodes as regular files","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-43267","published":"2026-05-06T11:28:52.887Z","updated":"2026-05-11T22:21:15.288Z","title":"wifi: rtw89: fix potential zero beacon interval in beacon tracking","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-43266","published":"2026-05-06T11:28:52.238Z","updated":"2026-05-11T22:21:14.159Z","title":"EFI/CPER: don't go past the ARM processor CPER record buffer","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-43265","published":"2026-05-06T11:28:51.552Z","updated":"2026-05-11T22:21:13.005Z","title":"KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-43264","published":"2026-05-06T11:28:50.867Z","updated":"2026-05-11T22:21:11.841Z","title":"fbdev: of: display_timing: fix refcount leak in of_get_display_timings()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43263","published":"2026-05-06T11:28:50.188Z","updated":"2026-10-21T12:40:27.588Z","title":"media: chips-media: wave5: Fix Null reference while testing fluster","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-43262","published":"2026-05-06T11:28:49.480Z","updated":"2026-05-11T22:21:09.600Z","title":"gfs2: fiemap page fault fix","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43261","published":"2026-05-06T11:28:48.823Z","updated":"2026-05-23T16:06:36.101Z","title":"arm64: Add support for TSV110 Spectre-BHB mitigation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43260","published":"2026-05-06T11:28:48.113Z","updated":"2026-05-11T22:21:07.350Z","title":"bnxt_en: Fix RSS context delete logic","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-43259","published":"2026-05-06T11:28:47.370Z","updated":"2026-05-11T22:21:06.217Z","title":"phy: fsl-imx8mq-usb: set platform driver data","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43258","published":"2026-05-06T11:28:46.536Z","updated":"2026-10-30T12:25:20.904Z","title":"alpha: fix user-space corruption during memory compaction","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-43257","published":"2026-05-06T11:28:45.872Z","updated":"2026-05-11T22:21:03.247Z","title":"media: cx88: Add missing unmap in snd_cx88_hw_params()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43256","published":"2026-05-06T11:28:45.209Z","updated":"2026-08-05T12:26:55.873Z","title":"media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-43255","published":"2026-05-06T11:28:44.522Z","updated":"2026-05-11T22:21:00.707Z","title":"wifi: libertas: fix WARNING in usb_tx_block","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43254","published":"2026-05-06T11:28:43.871Z","updated":"2026-08-05T12:26:54.790Z","title":"ovpn: tcp - fix packet extraction from stream","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00451,"kevAdded":null},{"id":"CVE-2026-43253","published":"2026-05-06T11:28:43.160Z","updated":"2026-10-30T12:25:19.840Z","title":"iommu/amd: move wait_on_sem() out of spinlock","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2026-43252","published":"2026-05-06T11:28:42.512Z","updated":"2026-05-23T16:06:35.049Z","title":"mptcp: pm: in-kernel: always set ID as avail when rm endp","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-43251","published":"2026-05-06T11:28:41.835Z","updated":"2026-05-11T22:20:55.964Z","title":"HID: prodikeys: Check presence of pm->input_ep82","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43250","published":"2026-05-06T11:28:41.158Z","updated":"2026-10-30T12:25:18.775Z","title":"usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-43249","published":"2026-05-06T11:28:40.290Z","updated":"2026-10-30T12:25:17.710Z","title":"9p/xen: protect xen_9pfs_front_free against concurrent calls","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2026-43248","published":"2026-05-06T11:28:39.578Z","updated":"2026-10-30T12:25:16.645Z","title":"vhost: move vdpa group bound check to vhost_vdpa","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-43247","published":"2026-05-06T11:28:38.902Z","updated":"2026-05-11T22:20:51.341Z","title":"media: chips-media: wave5: Fix SError of kernel panic when closed","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43246","published":"2026-05-06T11:28:38.246Z","updated":"2026-05-11T22:20:50.199Z","title":"media: i2c/tw9906: Fix potential memory leak in tw9906_probe()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43245","published":"2026-05-06T11:28:37.602Z","updated":"2026-08-05T12:26:50.510Z","title":"ntfs: ->d_compare() must not block","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00441,"kevAdded":null},{"id":"CVE-2026-43244","published":"2026-05-06T11:28:36.946Z","updated":"2026-10-30T12:25:15.565Z","title":"kcm: fix zero-frag skb in frag_list on partial sendmsg error","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-43243","published":"2026-05-06T11:28:36.287Z","updated":"2026-05-11T22:20:46.641Z","title":"drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43242","published":"2026-05-06T11:28:35.614Z","updated":"2026-05-23T16:06:32.886Z","title":"soc: ti: k3-socinfo: Fix regmap leak on probe failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43241","published":"2026-05-06T11:28:34.927Z","updated":"2026-05-11T22:20:44.266Z","title":"ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43240","published":"2026-05-06T11:28:34.269Z","updated":"2026-06-19T11:58:23.596Z","title":"x86/kexec: add a sanity check on previous kernel's ima kexec buffer","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43239","published":"2026-05-06T11:28:33.623Z","updated":"2026-10-30T12:25:14.475Z","title":"smb: client: prevent races in ->query_interfaces()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-43238","published":"2026-05-06T11:28:32.950Z","updated":"2026-05-11T22:20:40.634Z","title":"net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43237","published":"2026-05-06T11:28:32.300Z","updated":"2026-10-19T19:16:25.016Z","title":"drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-43236","published":"2026-05-06T11:28:31.543Z","updated":"2026-08-05T12:26:47.254Z","title":"drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-43235","published":"2026-05-06T11:28:30.872Z","updated":"2026-05-11T22:20:37.087Z","title":"media: iris: Add missing platform data entries for SM8750","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43234","published":"2026-05-06T11:28:30.212Z","updated":"2026-10-30T12:25:13.412Z","title":"team: avoid NETDEV_CHANGEMTU event when unregistering slave","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-43233","published":"2026-05-06T11:28:29.565Z","updated":"2026-10-19T19:16:24.877Z","title":"netfilter: nf_conntrack_h323: fix OOB read in decode_choice()","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00463,"kevAdded":null},{"id":"CVE-2026-43232","published":"2026-05-06T11:28:28.910Z","updated":"2026-08-05T12:26:45.086Z","title":"net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00387,"kevAdded":null},{"id":"CVE-2026-43231","published":"2026-05-06T11:28:28.268Z","updated":"2026-05-11T22:20:32.379Z","title":"media: radio-keene: fix memory leak in error path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43230","published":"2026-05-06T11:28:27.620Z","updated":"2026-08-05T12:26:43.969Z","title":"net/rds: Clear reconnect pending bit","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00523,"kevAdded":null},{"id":"CVE-2026-43229","published":"2026-05-06T11:28:26.951Z","updated":"2026-05-11T22:20:30.108Z","title":"media: chips-media: wave5: Fix device cleanup order to prevent kernel panic","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-43228","published":"2026-05-06T11:28:26.292Z","updated":"2026-10-15T10:07:13.116Z","title":"hfs: Replace BUG_ON with error handling for CNID count checks","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43227","published":"2026-05-06T11:28:25.629Z","updated":"2026-05-11T22:20:27.826Z","title":"clocksource/drivers/sh_tmu: Always leave device running after probe","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43226","published":"2026-05-06T11:28:24.952Z","updated":"2026-08-05T12:26:42.896Z","title":"net/rds: No shortcut out of RDS_CONN_ERROR","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00523,"kevAdded":null},{"id":"CVE-2026-43225","published":"2026-05-06T11:28:24.289Z","updated":"2026-05-11T22:20:25.453Z","title":"staging: rtl8723bs: fix memory leak on failure path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43224","published":"2026-05-06T11:28:23.620Z","updated":"2026-05-11T22:20:24.269Z","title":"io_uring/zcrx: fix sgtable leak on mapping failures","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43223","published":"2026-05-06T11:28:22.952Z","updated":"2026-05-11T22:20:23.149Z","title":"media: pvrusb2: fix URB leak in pvr2_send_request_ex","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43222","published":"2026-05-06T11:28:22.291Z","updated":"2026-08-05T12:26:41.823Z","title":"media: verisilicon: AV1: Fix tile info buffer size","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-43221","published":"2026-05-06T11:28:21.579Z","updated":"2026-05-11T22:20:20.815Z","title":"ipmi: ipmb: initialise event handler read bytes","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43220","published":"2026-05-06T11:28:20.905Z","updated":"2026-10-30T12:25:12.344Z","title":"iommu/amd: serialize sequence allocation under concurrent TLB invalidations","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-43219","published":"2026-05-06T11:28:20.243Z","updated":"2026-07-04T11:50:36.668Z","title":"net: cpsw_new: Fix potential unregister of netdev that has not been registered yet","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43218","published":"2026-05-06T11:28:19.570Z","updated":"2026-05-11T22:20:17.331Z","title":"media: i2c/tw9903: Fix potential memory leak in tw9903_probe()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43217","published":"2026-05-06T11:28:18.922Z","updated":"2026-05-11T22:20:16.065Z","title":"media: iris: gen2: Add sanity check for session stop","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43216","published":"2026-05-06T11:28:18.277Z","updated":"2026-10-15T01:19:17.492Z","title":"net: Drop the lock in skb_may_tx_timestamp()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-43215","published":"2026-05-06T11:28:17.425Z","updated":"2026-10-30T12:25:11.274Z","title":"cifs: Fix locking usage for tcon fields","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2026-43214","published":"2026-05-06T11:28:16.766Z","updated":"2026-10-19T19:16:24.580Z","title":"KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-43213","published":"2026-05-06T11:28:15.998Z","updated":"2026-10-30T12:25:10.203Z","title":"wifi: rtw89: pci: validate sequence number of TX release report","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-43212","published":"2026-05-06T11:28:15.272Z","updated":"2026-08-05T12:26:37.524Z","title":"LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-43211","published":"2026-05-06T11:28:14.423Z","updated":"2026-10-19T19:16:24.271Z","title":"PCI: Fix pci_slot_trylock() error handling","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-43210","published":"2026-05-06T11:28:13.609Z","updated":"2026-05-11T22:20:07.951Z","title":"tracing: ring-buffer: Fix to check event length before using","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-43209","published":"2026-05-06T11:28:12.965Z","updated":"2026-05-11T22:20:06.809Z","title":"minix: Add required sanity checking to minix_check_superblock()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43208","published":"2026-05-06T11:28:12.292Z","updated":"2026-08-05T12:26:35.377Z","title":"net: do not pass flow_id to set_rps_cpu()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00481,"kevAdded":null},{"id":"CVE-2026-43207","published":"2026-05-06T11:28:11.601Z","updated":"2026-08-05T12:26:34.312Z","title":"media: mtk-mdp: Fix error handling in probe function","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-43206","published":"2026-05-06T11:28:10.937Z","updated":"2026-10-19T19:16:24.115Z","title":"drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-43205","published":"2026-05-06T11:28:10.270Z","updated":"2026-05-11T22:20:00.994Z","title":"dpaa2-switch: validate num_ifs to prevent out-of-bounds write","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-43204","published":"2026-05-06T11:28:09.617Z","updated":"2026-10-30T12:25:09.149Z","title":"ASoC: qcom: q6asm: drop DSP responses for closed data streams","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-43203","published":"2026-05-06T11:28:08.949Z","updated":"2026-08-05T12:26:31.918Z","title":"atm: fore200e: fix use-after-free in tasklets during device removal","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-43202","published":"2026-05-06T11:28:08.226Z","updated":"2026-05-11T22:19:57.436Z","title":"fbdev: vt8500lcdfb: fix missing dma_free_coherent()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43201","published":"2026-05-06T11:28:07.565Z","updated":"2026-05-23T16:06:29.674Z","title":"APEI/GHES: ARM processor Error: don't go past allocated memory","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-43200","published":"2026-05-06T11:28:06.904Z","updated":"2026-05-11T22:19:49.591Z","title":"PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43199","published":"2026-05-06T11:28:06.232Z","updated":"2026-10-21T12:40:17.684Z","title":"net/mlx5e: Fix \"scheduling while atomic\" in IPsec MAC address query","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00415,"kevAdded":null},{"id":"CVE-2026-43198","published":"2026-05-06T11:28:05.569Z","updated":"2026-10-19T19:16:23.821Z","title":"tcp: fix potential race in tcp_v6_syn_recv_sock()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00298,"kevAdded":null},{"id":"CVE-2026-43197","published":"2026-05-06T11:28:04.829Z","updated":"2026-10-21T12:40:16.564Z","title":"netconsole: avoid OOB reads, msg is not nul-terminated","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2026-43196","published":"2026-05-06T11:28:04.132Z","updated":"2026-05-11T22:19:42.186Z","title":"soc: ti: pruss: Fix double free in pruss_clk_mux_setup()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-43195","published":"2026-05-06T11:28:03.437Z","updated":"2026-05-11T22:19:41.010Z","title":"drm/amdgpu: validate user queue size constraints","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43194","published":"2026-05-06T11:28:02.794Z","updated":"2026-10-19T19:16:23.529Z","title":"net: consume xmit errors of GSO frames","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00533,"kevAdded":null},{"id":"CVE-2026-43193","published":"2026-05-06T11:28:01.926Z","updated":"2026-05-11T22:19:38.671Z","title":"nfsd: fix nfs4_file refcount leak in nfsd_get_dir_deleg()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-43192","published":"2026-05-06T11:28:01.182Z","updated":"2026-05-11T22:19:37.538Z","title":"dm mpath: Add missing dm_put_device when failing to get scsi dh name","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-43191","published":"2026-05-06T11:28:00.470Z","updated":"2026-10-21T12:40:15.487Z","title":"drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-43190","published":"2026-05-06T11:27:59.798Z","updated":"2026-10-19T19:16:23.381Z","title":"netfilter: xt_tcpmss: check remaining length before reading optlen","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00463,"kevAdded":null},{"id":"CVE-2026-43189","published":"2026-05-06T11:27:59.108Z","updated":"2026-05-11T22:19:34.106Z","title":"media: v4l2-async: Fix error handling on steps after finding a match","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-43188","published":"2026-05-06T11:27:58.402Z","updated":"2026-10-21T12:40:14.398Z","title":"ceph: do not propagate page array emplacement errors as batch errors","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-43187","published":"2026-05-06T11:27:57.727Z","updated":"2026-10-19T19:16:23.230Z","title":"xfs: delete attr leaf freemap entries when empty","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00469,"kevAdded":null},{"id":"CVE-2026-43186","published":"2026-05-06T11:27:57.053Z","updated":"2026-10-19T19:16:23.065Z","title":"ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00642,"kevAdded":null},{"id":"CVE-2026-43185","published":"2026-05-06T11:27:56.386Z","updated":"2026-10-30T12:25:08.090Z","title":"ksmbd: fix signededness bug in smb_direct_prepare_negotiation()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00887,"kevAdded":null},{"id":"CVE-2026-43184","published":"2026-05-06T11:27:55.672Z","updated":"2026-08-05T12:26:22.170Z","title":"rnbd-srv: Zero the rsp buffer before using it","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00444,"kevAdded":null},{"id":"CVE-2026-43183","published":"2026-05-06T11:27:54.977Z","updated":"2026-05-11T22:19:27.248Z","title":"media: cx25821: Fix a resource leak in cx25821_dev_setup()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43182","published":"2026-05-06T11:27:54.307Z","updated":"2026-05-11T22:19:25.995Z","title":"media: ccs: Avoid possible division by zero","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43181","published":"2026-05-06T11:27:53.626Z","updated":"2026-05-11T22:19:24.836Z","title":"gpio: sysfs: fix chip removal with GPIOs exported over sysfs","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43180","published":"2026-05-06T11:27:52.983Z","updated":"2026-10-19T19:16:22.908Z","title":"net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-43179","published":"2026-05-06T11:27:52.324Z","updated":"2026-05-11T22:19:22.391Z","title":"erofs: fix incorrect early exits for invalid metabox-enabled images","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43178","published":"2026-05-06T11:27:51.524Z","updated":"2026-08-05T12:26:20.039Z","title":"procfs: fix possible double mmput() in do_procmap_query()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-43177","published":"2026-05-06T11:27:50.843Z","updated":"2026-05-11T22:19:16.753Z","title":"media: ipu6: Fix RPM reference leak in probe error paths","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-43176","published":"2026-05-06T11:27:50.150Z","updated":"2026-10-19T19:16:22.766Z","title":"wifi: rtw89: pci: validate release report content before using for RTL8922DE","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2026-43175","published":"2026-05-06T11:27:49.496Z","updated":"2026-05-11T22:19:14.361Z","title":"clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-43174","published":"2026-05-06T11:27:48.785Z","updated":"2026-05-11T22:19:13.127Z","title":"io_uring/zcrx: fix post open error handling","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-43173","published":"2026-05-06T11:27:48.097Z","updated":"2026-06-01T16:15:27.758Z","title":"net: ethernet: xscale: Check for PTP support properly","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43172","published":"2026-05-06T11:27:47.358Z","updated":"2026-10-21T12:40:12.169Z","title":"wifi: iwlwifi: fix 22000 series SMEM parsing","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00325,"kevAdded":null},{"id":"CVE-2026-43171","published":"2026-05-06T11:27:46.698Z","updated":"2026-05-11T22:19:09.627Z","title":"EFI/CPER: don't dump the entire memory region","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43170","published":"2026-05-06T11:27:46.021Z","updated":"2026-10-30T12:25:07.027Z","title":"usb: dwc3: gadget: Move vbus draw to workqueue context","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-43169","published":"2026-05-06T11:27:45.356Z","updated":"2026-05-11T22:19:07.323Z","title":"drm/buddy: Prevent BUG_ON by validating rounded allocation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-43168","published":"2026-05-06T11:27:44.570Z","updated":"2026-05-11T22:19:06.078Z","title":"ocfs2: fix reflink preserve cleanup issue","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43167","published":"2026-05-06T11:27:43.904Z","updated":"2026-10-30T12:25:05.944Z","title":"xfrm: always flush state and policy upon NETDEV_UNREGISTER event","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43166","published":"2026-05-06T11:27:43.242Z","updated":"2026-08-05T12:26:16.817Z","title":"erofs: fix interlaced plain identification for encoded extents","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-43165","published":"2026-05-06T11:27:42.588Z","updated":"2026-05-11T22:19:01.397Z","title":"hwmon: (nct7363) Fix a resource leak in nct7363_present_pwm_fanin","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43164","published":"2026-05-06T11:27:41.928Z","updated":"2026-08-05T12:26:15.706Z","title":"udplite: Fix null-ptr-deref in __udp_enqueue_schedule_skb().","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00451,"kevAdded":null},{"id":"CVE-2026-43163","published":"2026-05-06T11:27:41.265Z","updated":"2026-05-11T22:18:58.873Z","title":"md/bitmap: fix GPF in write_page caused by resize race","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00091,"kevAdded":null},{"id":"CVE-2026-43162","published":"2026-05-06T11:27:40.580Z","updated":"2026-05-11T22:18:57.725Z","title":"media: tegra-video: Fix memory leak in __tegra_channel_try_format()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43161","published":"2026-05-06T11:27:39.881Z","updated":"2026-05-23T16:06:27.637Z","title":"iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43160","published":"2026-05-06T11:27:39.223Z","updated":"2026-05-11T22:18:55.379Z","title":"mfd: macsmc: Initialize mutex","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43159","published":"2026-05-06T11:27:38.541Z","updated":"2026-05-11T22:18:54.249Z","title":"staging: rtl8723bs: fix null dereference in find_network","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43158","published":"2026-05-06T11:27:37.848Z","updated":"2026-10-19T19:16:22.481Z","title":"xfs: fix freemap adjustments when adding xattrs to leaf blocks","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00469,"kevAdded":null},{"id":"CVE-2026-43157","published":"2026-05-06T11:27:37.185Z","updated":"2026-05-11T22:18:51.830Z","title":"octeontx2-af: CGX: fix bitmap leaks","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43156","published":"2026-05-06T11:27:36.491Z","updated":"2026-05-11T22:18:50.696Z","title":"net: usb: pegasus: enable basic endpoint checking","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43155","published":"2026-05-06T11:27:35.800Z","updated":"2026-05-11T22:18:49.584Z","title":"mux: mmio: fix regmap leak on probe failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43154","published":"2026-05-06T11:27:35.116Z","updated":"2026-05-11T22:18:48.424Z","title":"erofs: fix incorrect early exits in volume label handling","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43153","published":"2026-05-06T11:27:34.446Z","updated":"2026-10-30T12:25:04.870Z","title":"xfs: remove xfs_attr_leaf_hasname","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-43152","published":"2026-05-06T11:27:33.736Z","updated":"2026-05-11T22:18:46.106Z","title":"HID: hid-pl: handle probe errors","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43151","published":"2026-05-06T11:27:33.084Z","updated":"2026-05-23T16:06:26.572Z","title":"Revert \"media: iris: Add sanity check for stop streaming\"","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43150","published":"2026-05-06T11:27:32.359Z","updated":"2026-10-19T19:16:22.180Z","title":"perf/arm-cmn: Reject unsupported hardware configurations","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-43149","published":"2026-05-06T11:27:31.708Z","updated":"2026-05-11T22:18:42.659Z","title":"net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43148","published":"2026-05-06T11:27:30.902Z","updated":"2026-05-11T22:18:41.424Z","title":"powerpc/smp: Add check for kcalloc() failure in parse_thread_groups()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43147","published":"2026-05-06T11:27:30.235Z","updated":"2026-05-23T16:06:24.518Z","title":"Revert \"PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV\"","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-43146","published":"2026-05-06T11:27:29.562Z","updated":"2026-05-11T22:18:39.117Z","title":"media: iris: Add buffer to list only after successful allocation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43145","published":"2026-05-06T11:27:28.911Z","updated":"2026-05-23T16:06:23.479Z","title":"remoteproc: imx_rproc: Fix invalid loaded resource table detection","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43144","published":"2026-05-06T11:27:28.220Z","updated":"2026-05-11T22:18:36.548Z","title":"wifi: brcmfmac: Fix potential kernel oops when probe fails","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43143","published":"2026-05-06T11:27:27.506Z","updated":"2026-05-11T22:18:35.396Z","title":"mfd: core: Add locking around 'mfd_of_node_list'","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43142","published":"2026-05-06T11:27:26.856Z","updated":"2026-05-11T22:18:34.249Z","title":"media: iris: gen1: Destroy internal buffers after FW releases","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43141","published":"2026-05-06T11:27:26.193Z","updated":"2026-05-11T22:18:33.118Z","title":"ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-43140","published":"2026-05-06T11:27:25.536Z","updated":"2026-05-11T22:18:31.955Z","title":"HID: magicmouse: Do not crash on missing msc->input","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43139","published":"2026-05-06T11:27:24.898Z","updated":"2026-10-19T19:16:22.034Z","title":"xfrm6: fix uninitialized saddr in xfrm6_get_saddr()","severity":"HIGH","score":8.6,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-43138","published":"2026-05-06T11:27:24.232Z","updated":"2026-05-11T22:18:29.633Z","title":"reset: gpio: suppress bind attributes in sysfs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-43137","published":"2026-05-06T11:27:23.592Z","updated":"2026-05-23T11:25:56.128Z","title":"ASoC: SOF: Intel: hda: Fix NULL pointer dereference","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-43136","published":"2026-05-06T11:27:22.892Z","updated":"2026-05-11T22:18:27.298Z","title":"HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43135","published":"2026-05-06T11:27:22.226Z","updated":"2026-05-11T22:18:26.070Z","title":"media: cx23885: Add missing unmap in snd_cx23885_hw_params()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43134","published":"2026-05-06T11:27:21.541Z","updated":"2026-10-19T19:16:21.882Z","title":"Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-43133","published":"2026-05-06T11:27:20.882Z","updated":"2026-10-19T19:16:21.731Z","title":"KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation","severity":"HIGH","score":7.9,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-43132","published":"2026-05-06T11:27:20.213Z","updated":"2026-05-11T22:18:22.593Z","title":"dm-verity: correctly handle dm_bufio_client_create() failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43131","published":"2026-05-06T11:27:19.528Z","updated":"2026-05-11T22:18:21.421Z","title":"drm/amd/pm: Fix null pointer dereference issue","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-43130","published":"2026-05-06T11:27:18.825Z","updated":"2026-05-23T16:06:22.409Z","title":"iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43129","published":"2026-05-06T11:27:18.180Z","updated":"2026-10-30T12:25:03.802Z","title":"ima: verify the previous kernel's IMA buffer lies in addressable RAM","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43128","published":"2026-05-06T11:27:17.474Z","updated":"2026-10-19T19:06:14.792Z","title":"RDMA/umem: Fix double dma_buf_unpin in failure path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-43127","published":"2026-05-06T11:27:16.794Z","updated":"2026-10-21T12:40:09.954Z","title":"ntfs3: fix circular locking dependency in run_unpack_ex","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-43126","published":"2026-05-06T11:27:15.765Z","updated":"2026-10-30T12:25:02.723Z","title":"ALSA: mixer: oss: Add card disconnect checkpoints","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-43125","published":"2026-05-06T11:27:10.903Z","updated":"2026-10-30T12:25:01.642Z","title":"dlm: validate length in dlm_search_rsb_tree","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00538,"kevAdded":null},{"id":"CVE-2026-43124","published":"2026-05-06T11:27:10.221Z","updated":"2026-05-23T16:06:20.362Z","title":"pstore: ram_core: fix incorrect success return when vmap() fails","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43123","published":"2026-05-06T11:27:09.553Z","updated":"2026-05-11T22:18:12.071Z","title":"fbcon: check return value of con2fb_acquire_newinfo()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43121","published":"2026-05-06T11:27:08.216Z","updated":"2026-05-11T22:18:09.791Z","title":"io_uring/zcrx: fix user_ref race between scrub and refill paths","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00111,"kevAdded":null},{"id":"CVE-2025-71274","published":"2026-05-06T11:27:07.525Z","updated":"2026-10-19T18:25:25.313Z","title":"rpmsg: core: fix race in driver_override_show() and use core helper","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2025-71273","published":"2026-05-06T11:27:06.825Z","updated":"2026-10-30T12:23:34.478Z","title":"wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2025-71272","published":"2026-05-06T11:27:05.998Z","updated":"2026-10-21T12:38:39.259Z","title":"most: core: fix resource leak in most_register_interface error paths","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2025-71271","published":"2026-05-06T11:27:05.321Z","updated":"2026-05-11T21:57:10.064Z","title":"hfsplus: ensure sb->s_fs_info is always cleaned up","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43120","published":"2026-05-06T07:40:43.923Z","updated":"2026-10-19T19:06:14.514Z","title":"RDMA/irdma: Fix double free related to rereg_user_mr","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43119","published":"2026-05-06T07:40:43.257Z","updated":"2026-10-30T12:25:00.556Z","title":"Bluetooth: hci_sync: annotate data-races around hdev->req_status","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43118","published":"2026-05-06T07:40:42.598Z","updated":"2026-10-30T12:24:59.447Z","title":"btrfs: fix zero size inode with non-zero size after log replay","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-43117","published":"2026-05-06T07:40:41.862Z","updated":"2026-10-19T19:06:14.380Z","title":"btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00458,"kevAdded":null},{"id":"CVE-2026-43116","published":"2026-05-06T07:40:41.185Z","updated":"2026-10-19T19:06:14.222Z","title":"netfilter: ctnetlink: ensure safe access to master conntrack","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00101,"kevAdded":null},{"id":"CVE-2026-43115","published":"2026-05-06T07:40:40.541Z","updated":"2026-10-30T12:24:58.376Z","title":"srcu: Use irq_work to start GP in tiny SRCU","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2026-43114","published":"2026-05-06T07:40:39.877Z","updated":"2026-10-19T19:06:14.068Z","title":"netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry","severity":"CRITICAL","score":9.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2026-43113","published":"2026-05-06T07:40:39.234Z","updated":"2026-08-05T12:26:00.700Z","title":"wifi: wl1251: validate packet IDs before indexing tx_frames","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2026-43112","published":"2026-05-06T07:40:38.563Z","updated":"2026-10-19T19:06:13.909Z","title":"fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2026-43111","published":"2026-05-06T07:40:37.916Z","updated":"2026-10-19T19:06:13.763Z","title":"HID: roccat: fix use-after-free in roccat_report_event","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00098,"kevAdded":null},{"id":"CVE-2026-43110","published":"2026-05-06T07:40:37.250Z","updated":"2026-10-19T19:06:13.623Z","title":"wifi: brcmfmac: validate bsscfg indices in IF events","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-43109","published":"2026-05-06T07:40:36.532Z","updated":"2026-05-17T15:21:37.731Z","title":"x86: shadow stacks: proper error handling for mmap lock","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43108","published":"2026-05-06T07:40:35.854Z","updated":"2026-05-11T22:17:53.487Z","title":"soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43107","published":"2026-05-06T07:40:35.068Z","updated":"2026-10-30T12:24:57.315Z","title":"xfrm: account XFRMA_IF_ID in aevent size calculation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-43106","published":"2026-05-06T07:40:34.365Z","updated":"2026-08-05T12:25:56.425Z","title":"cachefiles: fix incorrect dentry refcount in cachefiles_cull()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-43105","published":"2026-05-06T07:40:33.706Z","updated":"2026-06-01T16:14:55.616Z","title":"drm/vc4: Fix memory leak of BO array in hang state","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43104","published":"2026-05-06T07:40:33.036Z","updated":"2026-06-01T16:14:51.659Z","title":"drm/vc4: Fix a memory leak in hang state error path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43103","published":"2026-05-06T07:40:32.357Z","updated":"2026-06-01T16:14:48.824Z","title":"net: lapbether: handle NETDEV_PRE_TYPE_CHANGE","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43102","published":"2026-05-06T07:40:31.683Z","updated":"2026-05-11T22:17:46.322Z","title":"net: airoha: Fix memory leak in airoha_qdma_rx_process()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43101","published":"2026-05-06T07:40:30.969Z","updated":"2026-10-30T12:24:56.256Z","title":"ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00585,"kevAdded":null},{"id":"CVE-2026-43100","published":"2026-05-06T07:40:30.309Z","updated":"2026-05-11T22:17:43.866Z","title":"bridge: guard local VLAN-0 FDB helpers against NULL vlan group","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43099","published":"2026-05-06T07:40:29.567Z","updated":"2026-10-15T01:19:07.639Z","title":"ipv4: icmp: fix null-ptr-deref in icmp_build_probe()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-43098","published":"2026-05-06T07:40:28.845Z","updated":"2026-06-01T16:14:42.508Z","title":"nfc: s3fwrn5: allocate rx skb before consuming bytes","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43097","published":"2026-05-06T07:40:28.157Z","updated":"2026-05-11T22:17:40.279Z","title":"PCI: hv: Fix double ida_free in hv_pci_probe error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-43096","published":"2026-05-06T07:40:27.453Z","updated":"2026-05-11T22:17:39.132Z","title":"mshv: Fix infinite fault loop on permission-denied GPA intercepts","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-43095","published":"2026-05-06T07:40:26.743Z","updated":"2026-05-11T22:17:37.965Z","title":"ASoC: SDCA: Fix errors in IRQ cleanup","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-43094","published":"2026-05-06T07:40:25.930Z","updated":"2026-10-15T01:19:06.481Z","title":"ixgbevf: add missing negotiate_features op to Hyper-V ops table","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43093","published":"2026-05-06T07:40:25.266Z","updated":"2026-10-19T19:06:13.475Z","title":"xsk: tighten UMEM headroom validation to account for tailroom and min frame","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-43092","published":"2026-05-06T07:40:24.619Z","updated":"2026-05-11T22:17:34.476Z","title":"xsk: validate MTU against usable frame size on bind","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43091","published":"2026-05-06T07:40:23.955Z","updated":"2026-10-30T12:24:55.188Z","title":"xfrm: Wait for RCU readers during policy netns exit","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-43090","published":"2026-05-06T07:40:23.286Z","updated":"2026-05-11T22:17:32.208Z","title":"xfrm: fix refcount leak in xfrm_migrate_policy_find","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43089","published":"2026-05-06T07:40:22.630Z","updated":"2026-10-15T01:19:04.146Z","title":"xfrm_user: fix info leak in build_mapping()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-43088","published":"2026-05-06T07:40:21.962Z","updated":"2026-09-14T11:58:17.134Z","title":"net: af_key: zero aligned sockaddr tail in PF_KEY exports","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43087","published":"2026-05-06T07:40:21.303Z","updated":"2026-05-11T22:17:28.465Z","title":"pinctrl: mcp23s08: Disable all pin interrupts during probe","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-43086","published":"2026-05-06T07:40:20.631Z","updated":"2026-05-11T22:17:27.288Z","title":"ipvs: fix NULL deref in ip_vs_add_service error path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43085","published":"2026-05-06T07:40:19.915Z","updated":"2026-10-15T01:19:02.526Z","title":"netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-43084","published":"2026-05-06T07:40:19.253Z","updated":"2026-10-19T19:06:13.178Z","title":"netfilter: nfnetlink_queue: make hash table per queue","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-43083","published":"2026-05-06T07:40:18.504Z","updated":"2026-10-30T12:24:54.065Z","title":"net: ioam6: fix OOB and missing lock","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.006,"kevAdded":null},{"id":"CVE-2026-43082","published":"2026-05-06T07:40:17.842Z","updated":"2026-05-11T22:17:22.658Z","title":"net: txgbe: leave space for null terminators on property_entry","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43081","published":"2026-05-06T07:40:17.159Z","updated":"2026-05-11T22:17:21.426Z","title":"net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43080","published":"2026-05-06T07:40:16.491Z","updated":"2026-10-15T01:19:00.903Z","title":"l2tp: Drop large packets with UDP encap","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-43079","published":"2026-05-06T07:40:15.767Z","updated":"2026-06-01T16:14:21.072Z","title":"perf/x86/intel/uncore: Skip discovery table for offline dies","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43078","published":"2026-05-06T07:40:15.092Z","updated":"2026-10-19T19:06:12.864Z","title":"crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-43077","published":"2026-05-06T07:40:14.409Z","updated":"2026-05-11T22:17:16.763Z","title":"crypto: algif_aead - Fix minimum RX size check for decryption","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43076","published":"2026-05-06T07:40:13.634Z","updated":"2026-08-05T12:25:47.888Z","title":"ocfs2: validate inline data i_size during inode read","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-43075","published":"2026-05-06T07:40:03.337Z","updated":"2026-08-05T12:25:46.787Z","title":"ocfs2: fix out-of-bounds write in ocfs2_write_end_inline","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43074","published":"2026-05-06T07:21:58.210Z","updated":"2026-10-19T19:06:12.716Z","title":"eventpoll: defer struct eventpoll free to RCU grace period","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00482,"kevAdded":null},{"id":"CVE-2026-43073","published":"2026-05-05T15:29:29.510Z","updated":"2026-10-21T12:40:01.081Z","title":"x86-64: rename misleadingly named '__copy_user_nocache()' function","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-43072","published":"2026-05-05T15:29:28.795Z","updated":"2026-06-14T17:44:50.409Z","title":"drm/vc4: platform_get_irq_byname() returns an int","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43071","published":"2026-05-05T15:29:28.081Z","updated":"2026-10-19T19:06:12.548Z","title":"dcache: Limit the minimal number of bucket to two","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00459,"kevAdded":null},{"id":"CVE-2026-43070","published":"2026-05-05T15:23:28.819Z","updated":"2026-08-05T12:25:43.557Z","title":"bpf: Reset register ID for BPF_END value tracking","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2026-43069","published":"2026-05-05T15:23:28.120Z","updated":"2026-05-11T22:17:07.130Z","title":"Bluetooth: hci_ll: Fix firmware leak on error path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43068","published":"2026-05-05T15:23:27.371Z","updated":"2026-05-11T22:17:05.953Z","title":"ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-43067","published":"2026-05-05T15:23:26.717Z","updated":"2026-10-19T19:06:12.380Z","title":"ext4: handle wraparound when searching for blocks for indirect mapped blocks","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00504,"kevAdded":null},{"id":"CVE-2026-43066","published":"2026-05-05T15:23:25.984Z","updated":"2026-05-11T22:17:03.438Z","title":"ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-43065","published":"2026-05-05T15:23:25.326Z","updated":"2026-05-11T22:17:02.221Z","title":"ext4: always drain queued discard work in ext4_mb_release()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-43064","published":"2026-05-05T15:23:24.687Z","updated":"2026-06-19T11:58:11.415Z","title":"dmaengine: idxd: Fix not releasing workqueue on .release()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43063","published":"2026-05-05T15:23:24.034Z","updated":"2026-10-19T19:06:12.211Z","title":"xfs: don't irele after failing to iget in xfs_attri_recover_work","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43062","published":"2026-05-05T15:17:27.830Z","updated":"2026-10-19T19:06:12.056Z","title":"Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-43061","published":"2026-05-05T15:17:27.079Z","updated":"2026-05-23T16:06:10.956Z","title":"serial: 8250: Fix TX deadlock when using DMA","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00091,"kevAdded":null},{"id":"CVE-2026-43060","published":"2026-05-05T15:17:26.393Z","updated":"2026-10-19T19:06:11.915Z","title":"netfilter: nft_ct: drop pending enqueued packets on removal","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43059","published":"2026-05-05T15:17:25.727Z","updated":"2026-10-21T12:39:59.993Z","title":"Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-43058","published":"2026-05-02T06:11:50.870Z","updated":"2026-06-14T17:44:43.464Z","title":"media: vidtv: fix pass-by-value structs causing MSAN warnings","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43057","published":"2026-05-01T14:15:49.551Z","updated":"2026-10-15T01:18:55.064Z","title":"net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00437,"kevAdded":null},{"id":"CVE-2026-43056","published":"2026-05-01T14:15:48.837Z","updated":"2026-10-19T19:06:11.769Z","title":"net: mana: fix use-after-free in add_adev() error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-43055","published":"2026-05-01T14:15:48.139Z","updated":"2026-10-19T19:06:11.626Z","title":"scsi: target: file: Use kzalloc_flex for aio_cmd","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2026-43054","published":"2026-05-01T14:15:47.396Z","updated":"2026-05-11T22:16:49.357Z","title":"scsi: target: tcm_loop: Drain commands in target_reset handler","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43053","published":"2026-05-01T14:15:46.709Z","updated":"2026-10-21T12:39:58.886Z","title":"xfs: close crash window in attr dabtree inactivation","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-43052","published":"2026-05-01T14:15:46.029Z","updated":"2026-10-15T01:18:53.241Z","title":"wifi: mac80211: check tdls flag in ieee80211_tdls_oper","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43051","published":"2026-05-01T14:15:45.314Z","updated":"2026-10-19T19:06:11.476Z","title":"HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2026-43050","published":"2026-05-01T14:15:44.542Z","updated":"2026-05-11T22:16:44.767Z","title":"atm: lec: fix use-after-free in sock_def_readable()","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-43049","published":"2026-05-01T14:15:43.870Z","updated":"2026-10-30T12:24:53.010Z","title":"HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-43048","published":"2026-05-01T14:15:43.227Z","updated":"2026-10-30T12:24:51.935Z","title":"HID: core: Mitigate potential OOB by removing bogus memset()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00316,"kevAdded":null},{"id":"CVE-2026-43047","published":"2026-05-01T14:15:42.562Z","updated":"2026-10-19T19:06:11.151Z","title":"HID: multitouch: Check to ensure report responses match the request","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-43046","published":"2026-05-01T14:15:41.849Z","updated":"2026-05-11T22:16:40.193Z","title":"btrfs: reject root items with drop_progress and zero drop_level","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43045","published":"2026-05-01T14:15:40.976Z","updated":"2026-10-15T10:07:06.820Z","title":"mshv: Fix error handling in mshv_region_pin","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-43044","published":"2026-05-01T14:15:40.317Z","updated":"2026-08-05T12:25:31.725Z","title":"crypto: caam - fix DMA corruption on long hmac keys","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-43043","published":"2026-05-01T14:15:39.576Z","updated":"2026-05-11T22:16:36.820Z","title":"crypto: af-alg - fix NULL pointer dereference in scatterwalk","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43042","published":"2026-05-01T14:15:38.882Z","updated":"2026-10-30T12:24:50.878Z","title":"mpls: add seqcount to protect the platform_label{,s} pair","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-43041","published":"2026-05-01T14:15:38.112Z","updated":"2026-05-11T22:16:34.530Z","title":"net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-43040","published":"2026-05-01T14:15:37.364Z","updated":"2026-10-15T01:18:52.082Z","title":"net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-43039","published":"2026-05-01T14:15:36.698Z","updated":"2026-08-05T12:25:29.511Z","title":"net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatch","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2026-43038","published":"2026-05-01T14:15:35.986Z","updated":"2026-10-19T19:06:10.839Z","title":"ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2026-43037","published":"2026-05-01T14:15:35.314Z","updated":"2026-10-19T19:06:10.690Z","title":"ip6_tunnel: clear skb2->cb[] in ip4ip6_err()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00688,"kevAdded":null},{"id":"CVE-2026-43036","published":"2026-05-01T14:15:34.640Z","updated":"2026-10-30T12:24:49.808Z","title":"net: use skb_header_pointer() for TCPv4 GSO frag_off check","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-43035","published":"2026-05-01T14:15:33.922Z","updated":"2026-10-15T01:18:48.168Z","title":"net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-43034","published":"2026-05-01T14:15:33.260Z","updated":"2026-10-21T12:39:53.398Z","title":"bnxt_en: set backing store type from query type","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-43033","published":"2026-05-01T14:15:32.583Z","updated":"2026-10-19T19:06:10.536Z","title":"crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-43032","published":"2026-05-01T14:15:31.921Z","updated":"2026-05-11T22:16:23.913Z","title":"NFC: pn533: bound the UART receive buffer","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43031","published":"2026-05-01T14:15:31.256Z","updated":"2026-08-05T12:25:24.979Z","title":"net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2026-43030","published":"2026-05-01T14:15:30.564Z","updated":"2026-10-19T19:06:10.383Z","title":"bpf: Fix regsafe() for pointers to packet","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-43029","published":"2026-05-01T14:15:29.885Z","updated":"2026-08-05T12:25:22.854Z","title":"mptcp: fix soft lockup in mptcp_recvmsg()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2026-43028","published":"2026-05-01T14:15:29.192Z","updated":"2026-10-19T19:06:10.219Z","title":"netfilter: x_tables: ensure names are nul-terminated","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-43027","published":"2026-05-01T14:15:28.521Z","updated":"2026-10-15T01:18:41.165Z","title":"netfilter: nf_conntrack_helper: pass helper to expect cleanup","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-43026","published":"2026-05-01T14:15:27.854Z","updated":"2026-10-15T01:18:39.379Z","title":"netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-43025","published":"2026-05-01T14:15:27.103Z","updated":"2026-10-19T19:06:10.067Z","title":"netfilter: ctnetlink: ignore explicit helper on new expectations","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-43024","published":"2026-05-01T14:15:26.424Z","updated":"2026-10-15T01:18:35.521Z","title":"netfilter: nf_tables: reject immediate NF_QUEUE verdict","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-43023","published":"2026-05-01T14:15:25.736Z","updated":"2026-10-19T19:06:09.917Z","title":"Bluetooth: SCO: fix race conditions in sco_sock_connect()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00097,"kevAdded":null},{"id":"CVE-2026-43022","published":"2026-05-01T14:15:25.059Z","updated":"2026-10-30T12:24:48.669Z","title":"Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-43021","published":"2026-05-01T14:15:24.374Z","updated":"2026-05-11T22:16:10.521Z","title":"Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-43020","published":"2026-05-01T14:15:23.699Z","updated":"2026-05-11T22:16:09.294Z","title":"Bluetooth: MGMT: validate LTK enc_size on load","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-43019","published":"2026-05-01T14:15:23.035Z","updated":"2026-10-19T19:06:09.770Z","title":"Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-43018","published":"2026-05-01T14:15:22.308Z","updated":"2026-10-19T19:06:09.619Z","title":"Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2026-43017","published":"2026-05-01T14:15:21.561Z","updated":"2026-05-11T22:16:05.863Z","title":"Bluetooth: MGMT: validate mesh send advertising payload length","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43016","published":"2026-05-01T14:15:20.887Z","updated":"2026-10-30T12:24:45.865Z","title":"bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready().","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43015","published":"2026-05-01T14:15:20.242Z","updated":"2026-05-23T16:05:58.376Z","title":"net: macb: fix clk handling on PCI glue driver removal","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-43014","published":"2026-05-01T14:15:19.571Z","updated":"2026-05-11T22:16:02.195Z","title":"net: macb: properly unregister fixed rate clocks","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43013","published":"2026-05-01T14:15:18.907Z","updated":"2026-05-11T22:16:00.983Z","title":"net/mlx5: lag: Check for LAG device before creating debugfs","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43012","published":"2026-05-01T14:15:18.256Z","updated":"2026-05-23T16:05:57.203Z","title":"net/mlx5: Fix switchdev mode rollback in case of failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-43011","published":"2026-05-01T14:15:17.597Z","updated":"2026-10-19T19:06:09.316Z","title":"net/x25: Fix potential double free of skb","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00591,"kevAdded":null},{"id":"CVE-2026-43010","published":"2026-05-01T14:15:16.947Z","updated":"2026-10-30T12:24:44.728Z","title":"bpf: Reject sleepable kprobe_multi programs at attach time","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-43009","published":"2026-05-01T14:15:16.271Z","updated":"2026-10-30T12:24:43.671Z","title":"bpf: Fix incorrect pruning due to atomic fetch precision tracking","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-43008","published":"2026-05-01T14:15:15.580Z","updated":"2026-05-11T22:15:55.149Z","title":"gpio: qixis-fpga: Fix error handling for devm_regmap_init_mmio()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-43007","published":"2026-05-01T14:15:14.914Z","updated":"2026-05-11T22:15:54.042Z","title":"accel/qaic: Handle DBC deactivation if the owner went away","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-43006","published":"2026-05-01T14:15:14.176Z","updated":"2026-08-05T12:25:13.184Z","title":"io_uring/rsrc: reject zero-length fixed buffer import","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-43005","published":"2026-05-01T14:15:13.513Z","updated":"2026-05-11T22:15:51.731Z","title":"hwmon: (tps53679) Fix array access with zero-length block read","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-43004","published":"2026-05-01T14:15:12.032Z","updated":"2026-05-11T22:15:50.593Z","title":"spi: stm32-ospi: Fix resource leak in remove() callback","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31785","published":"2026-05-01T14:15:10.792Z","updated":"2026-05-11T22:15:45.926Z","title":"drm/xe/xe_pagefault: Disallow writes to read-only VMAs","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-31784","published":"2026-05-01T14:15:09.945Z","updated":"2026-05-11T22:15:44.809Z","title":"drm/xe/pxp: Clear restart flag in pxp_start after jumping back","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31783","published":"2026-05-01T14:15:09.279Z","updated":"2026-05-11T22:15:43.675Z","title":"spi: amlogic: spifc-a4: unregister ECC engine on probe failure and remove() callback","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31782","published":"2026-05-01T14:15:08.586Z","updated":"2026-08-05T12:25:09.961Z","title":"perf/x86: Fix potential bad container_of in intel_pmu_hw_config","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-31781","published":"2026-05-01T14:15:07.933Z","updated":"2026-05-23T16:05:56.217Z","title":"drm/ioc32: stop speculation on the drm_compat_ioctl path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31780","published":"2026-05-01T14:15:07.253Z","updated":"2026-08-05T12:25:08.895Z","title":"wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-31779","published":"2026-05-01T14:15:06.506Z","updated":"2026-10-19T19:06:08.628Z","title":"wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2026-31778","published":"2026-05-01T14:15:05.804Z","updated":"2026-05-11T22:15:37.687Z","title":"ALSA: caiaq: fix stack out-of-bounds read in init_card","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-31777","published":"2026-05-01T14:15:05.127Z","updated":"2026-10-15T10:07:04.688Z","title":"ALSA: ctxfi: Check the error for index mapping","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31776","published":"2026-05-01T14:15:04.423Z","updated":"2026-05-11T22:15:35.385Z","title":"ALSA: ctxfi: Fix missing SPDIFI1 index handling","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-31775","published":"2026-05-01T14:15:03.664Z","updated":"2026-10-26T15:12:57.000Z","title":"ALSA: ctxfi: Don't enumerate SPDIF1 at DAIO initialization","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31774","published":"2026-05-01T14:15:02.903Z","updated":"2026-10-19T19:06:08.469Z","title":"io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-31773","published":"2026-05-01T14:15:01.277Z","updated":"2026-10-19T19:06:08.313Z","title":"Bluetooth: SMP: derive legacy responder STK authentication from MITM state","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-31772","published":"2026-05-01T14:15:00.582Z","updated":"2026-10-19T19:06:08.134Z","title":"Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-31771","published":"2026-05-01T14:14:59.918Z","updated":"2026-10-30T12:24:42.601Z","title":"Bluetooth: hci_event: move wake reason storage into validated event handlers","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2026-31770","published":"2026-05-01T14:14:59.256Z","updated":"2026-05-11T22:15:28.590Z","title":"hwmon: (occ) Fix division by zero in occ_show_power_1()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31769","published":"2026-05-01T14:14:58.617Z","updated":"2026-08-05T12:25:02.500Z","title":"gpib: fix use-after-free in IO ioctl handlers","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-31768","published":"2026-05-01T14:14:57.971Z","updated":"2026-10-15T01:18:15.322Z","title":"iio: adc: ti-adc161s626: use DMA-safe memory for spi_read()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-31767","published":"2026-05-01T14:14:57.287Z","updated":"2026-10-30T12:24:40.575Z","title":"drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-31766","published":"2026-05-01T14:14:56.622Z","updated":"2026-08-05T12:25:00.359Z","title":"drm/amdgpu: validate doorbell_offset in user queue creation","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-31765","published":"2026-05-01T14:14:55.907Z","updated":"2026-05-11T22:15:22.861Z","title":"drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31764","published":"2026-05-01T14:14:55.230Z","updated":"2026-05-11T22:15:21.708Z","title":"iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-31763","published":"2026-05-01T14:14:54.557Z","updated":"2026-05-11T22:15:20.588Z","title":"iio: gyro: mpu3050: Fix incorrect free_irq() variable","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31762","published":"2026-05-01T14:14:53.891Z","updated":"2026-05-11T22:15:19.429Z","title":"iio: gyro: mpu3050: Fix irq resource leak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31761","published":"2026-05-01T14:14:53.223Z","updated":"2026-10-15T01:18:13.588Z","title":"iio: gyro: mpu3050: Move iio_device_register() to correct location","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00104,"kevAdded":null},{"id":"CVE-2026-31760","published":"2026-05-01T14:14:52.553Z","updated":"2026-05-11T22:15:17.036Z","title":"gpib: lpvo_usb: fix memory leak on disconnect","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31759","published":"2026-05-01T14:14:51.895Z","updated":"2026-05-11T22:15:15.896Z","title":"usb: ulpi: fix double free in ulpi_register_interface() error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31758","published":"2026-05-01T14:14:48.390Z","updated":"2026-10-19T19:06:07.783Z","title":"usb: usbtmc: Flush anchored URBs in usbtmc_release","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-31757","published":"2026-05-01T14:14:47.659Z","updated":"2026-05-11T22:15:13.527Z","title":"usb: misc: usbio: Fix URB memory leak on submit failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31756","published":"2026-05-01T14:14:47.000Z","updated":"2026-05-23T16:05:53.039Z","title":"usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-31755","published":"2026-05-01T14:14:46.288Z","updated":"2026-07-04T11:50:33.684Z","title":"usb: cdns3: gadget: fix NULL pointer dereference in ep_queue","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31754","published":"2026-05-01T14:14:45.628Z","updated":"2026-05-11T22:15:10.071Z","title":"usb: cdns3: gadget: fix state inconsistency on gadget init failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31753","published":"2026-05-01T14:14:44.953Z","updated":"2026-05-11T22:15:08.690Z","title":"auxdisplay: line-display: fix NULL dereference in linedisp_release","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-31752","published":"2026-05-01T14:14:44.298Z","updated":"2026-10-15T01:18:11.729Z","title":"bridge: br_nd_send: validate ND option lengths","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31751","published":"2026-05-01T14:14:43.551Z","updated":"2026-05-11T22:15:06.157Z","title":"comedi: dt2815: add hardware detection to prevent crash","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00089,"kevAdded":null},{"id":"CVE-2026-31750","published":"2026-05-01T14:14:42.887Z","updated":"2026-05-11T22:15:04.978Z","title":"comedi: runflags cannot determine whether to reclaim chanlist","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-31749","published":"2026-05-01T14:14:42.227Z","updated":"2026-05-11T22:15:02.951Z","title":"comedi: ni_atmio16d: Fix invalid clean-up after failed attach","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31748","published":"2026-05-01T14:14:41.545Z","updated":"2026-05-11T22:15:00.272Z","title":"comedi: me_daq: Fix potential overrun of firmware buffer","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31747","published":"2026-05-01T14:14:40.844Z","updated":"2026-05-11T22:14:59.031Z","title":"comedi: me4000: Fix potential overrun of firmware buffer","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31746","published":"2026-05-01T14:14:40.196Z","updated":"2026-10-21T12:39:47.494Z","title":"s390/zcrypt: Fix memory leak with CCA cards used as accelerator","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-31745","published":"2026-05-01T14:14:39.529Z","updated":"2026-05-11T22:14:56.434Z","title":"reset: gpio: fix double free in reset_add_gpio_aux_device() error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-31744","published":"2026-05-01T14:14:38.820Z","updated":"2026-05-11T22:14:55.237Z","title":"PM: EM: Fix NULL pointer dereference when perf domain ID is not found","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-31743","published":"2026-05-01T14:14:38.154Z","updated":"2026-08-05T12:24:57.154Z","title":"nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31742","published":"2026-05-01T14:14:37.495Z","updated":"2026-10-19T19:06:07.610Z","title":"vt: discard stale unicode buffer on alt screen exit after resize","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-31741","published":"2026-05-01T14:14:36.845Z","updated":"2026-05-11T22:14:51.833Z","title":"counter: rz-mtu3-cnt: prevent counter from being toggled multiple times","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31740","published":"2026-05-01T14:14:36.183Z","updated":"2026-05-11T22:14:50.719Z","title":"counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31739","published":"2026-05-01T14:14:35.551Z","updated":"2026-10-19T19:06:07.448Z","title":"crypto: tegra - Add missing CRYPTO_ALG_ASYNC","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00415,"kevAdded":null},{"id":"CVE-2026-31738","published":"2026-05-01T14:14:34.900Z","updated":"2026-05-23T16:05:52.050Z","title":"vxlan: validate ND option lengths in vxlan_na_create","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31737","published":"2026-05-01T14:14:34.229Z","updated":"2026-10-15T01:18:10.065Z","title":"net: ftgmac100: fix ring allocation unwind on open failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31736","published":"2026-05-01T14:14:33.583Z","updated":"2026-05-11T22:14:45.998Z","title":"net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31735","published":"2026-05-01T14:14:32.923Z","updated":"2026-08-05T12:24:53.937Z","title":"iommupt: Fix short gather if the unmap goes into a large mapping","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-31734","published":"2026-05-01T14:14:32.217Z","updated":"2026-05-11T22:14:43.725Z","title":"sched_ext: Fix is_bpf_migration_disabled() false negative on non-PREEMPT_RCU","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31733","published":"2026-05-01T14:14:31.558Z","updated":"2026-05-11T22:14:42.580Z","title":"sched_ext: Fix stale direct dispatch state in ddsp_dsq_id","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-31732","published":"2026-05-01T14:14:30.844Z","updated":"2026-07-04T11:50:32.706Z","title":"gpio: Fix resource leaks on errors in gpiochip_add_data_with_key()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31731","published":"2026-05-01T14:14:30.177Z","updated":"2026-10-19T19:06:07.291Z","title":"thermal: core: Address thermal zone removal races with resume","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00097,"kevAdded":null},{"id":"CVE-2026-31730","published":"2026-05-01T14:14:29.522Z","updated":"2026-08-05T12:24:51.799Z","title":"misc: fastrpc: possible double-free of cctx->remote_heap","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31729","published":"2026-05-01T14:14:28.868Z","updated":"2026-05-11T22:14:37.986Z","title":"usb: typec: ucsi: validate connector number in ucsi_notify_common()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31728","published":"2026-05-01T14:14:28.231Z","updated":"2026-05-11T22:14:36.858Z","title":"usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00089,"kevAdded":null},{"id":"CVE-2026-31727","published":"2026-05-01T14:14:27.552Z","updated":"2026-06-19T11:58:05.053Z","title":"usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31726","published":"2026-05-01T14:14:26.882Z","updated":"2026-05-23T16:05:51.035Z","title":"usb: gadget: uvc: fix NULL pointer dereference during unbind race","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-31725","published":"2026-05-01T14:14:26.200Z","updated":"2026-10-30T12:24:39.526Z","title":"usb: gadget: f_ecm: Fix net_device lifecycle with device_move","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-31724","published":"2026-05-01T14:14:25.544Z","updated":"2026-10-30T12:24:38.467Z","title":"usb: gadget: f_eem: Fix net_device lifecycle with device_move","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-31723","published":"2026-05-01T14:14:24.876Z","updated":"2026-10-30T12:24:37.385Z","title":"usb: gadget: f_subset: Fix net_device lifecycle with device_move","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-31722","published":"2026-05-01T14:14:24.156Z","updated":"2026-10-30T12:24:36.328Z","title":"usb: gadget: f_rndis: Fix net_device lifecycle with device_move","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-31721","published":"2026-05-01T14:14:23.492Z","updated":"2026-05-11T22:14:28.436Z","title":"usb: gadget: f_hid: move list and spinlock inits from bind to alloc","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-31720","published":"2026-05-01T14:14:22.832Z","updated":"2026-05-11T22:14:27.286Z","title":"usb: gadget: f_uac1_legacy: validate control request size","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31719","published":"2026-05-01T13:56:13.385Z","updated":"2026-10-19T19:06:07.136Z","title":"crypto: krb5enc - fix async decrypt skipping hash verification","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-31718","published":"2026-05-01T13:56:12.680Z","updated":"2026-08-05T12:24:49.667Z","title":"ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00356,"kevAdded":null},{"id":"CVE-2026-31717","published":"2026-05-01T13:56:12.012Z","updated":"2026-08-05T12:24:48.598Z","title":"ksmbd: validate owner of durable handle on reconnect","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00437,"kevAdded":null},{"id":"CVE-2026-31716","published":"2026-05-01T13:56:11.263Z","updated":"2026-08-05T12:24:47.538Z","title":"fs/ntfs3: validate rec->used in journal-replay file record check","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-31715","published":"2026-05-01T13:56:10.591Z","updated":"2026-06-19T11:58:02.837Z","title":"f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-31714","published":"2026-05-01T13:56:09.925Z","updated":"2026-06-14T17:44:19.741Z","title":"f2fs: fix to avoid memory leak in f2fs_rename()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-31713","published":"2026-05-01T13:56:09.254Z","updated":"2026-06-14T17:44:16.737Z","title":"fuse: abort on fatal signal during sync init","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2026-31712","published":"2026-05-01T13:56:08.583Z","updated":"2026-10-15T01:18:08.369Z","title":"ksmbd: require minimum ACE size in smb_check_perm_dacl()","severity":"HIGH","score":8.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2026-31711","published":"2026-05-01T13:56:07.904Z","updated":"2026-10-15T01:18:07.160Z","title":"smb: server: fix active_num_conn leak on transport allocation failure","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00554,"kevAdded":null},{"id":"CVE-2026-31710","published":"2026-05-01T13:56:07.217Z","updated":"2026-09-21T13:13:35.436Z","title":"smb: client: fix dir separator in SMB1 UNIX mounts","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-31709","published":"2026-05-01T13:56:06.522Z","updated":"2026-10-19T19:06:06.980Z","title":"smb: client: validate the whole DACL before rewriting it in cifsacl","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-31708","published":"2026-05-01T13:56:05.880Z","updated":"2026-10-19T19:06:06.825Z","title":"smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2026-31707","published":"2026-05-01T13:56:05.219Z","updated":"2026-10-30T12:24:35.243Z","title":"ksmbd: validate response sizes in ipc_validate_msg()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-31706","published":"2026-05-01T13:56:04.552Z","updated":"2026-10-30T12:24:34.180Z","title":"ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00493,"kevAdded":null},{"id":"CVE-2026-31705","published":"2026-05-01T13:56:03.896Z","updated":"2026-10-15T01:18:03.133Z","title":"ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2026-31704","published":"2026-05-01T13:56:03.243Z","updated":"2026-10-15T01:18:01.953Z","title":"ksmbd: use check_add_overflow() to prevent u16 DACL size overflow","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-31703","published":"2026-05-01T13:56:02.415Z","updated":"2026-08-20T12:32:00.881Z","title":"writeback: Fix use after free in inode_switch_wbs_work_fn()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-31702","published":"2026-05-01T13:56:01.601Z","updated":"2026-06-14T17:43:43.186Z","title":"f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-31701","published":"2026-05-01T13:56:00.869Z","updated":"2026-06-14T17:43:40.642Z","title":"ALSA: caiaq: take a reference on the USB device in create_card()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-31700","published":"2026-05-01T13:56:00.205Z","updated":"2026-10-19T19:06:06.659Z","title":"net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00111,"kevAdded":null},{"id":"CVE-2026-31699","published":"2026-05-01T13:55:59.520Z","updated":"2026-10-19T19:06:06.521Z","title":"crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-31698","published":"2026-05-01T13:55:58.854Z","updated":"2026-10-19T19:06:06.375Z","title":"crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-31697","published":"2026-05-01T13:55:58.184Z","updated":"2026-10-19T18:56:05.156Z","title":"crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-31696","published":"2026-05-01T13:55:57.485Z","updated":"2026-10-15T01:17:54.785Z","title":"rxrpc: Fix missing validation of ticket length in non-XDR key preparsing","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-31695","published":"2026-05-01T13:53:36.857Z","updated":"2026-08-05T12:24:33.507Z","title":"wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-31694","published":"2026-05-01T13:53:36.048Z","updated":"2026-10-15T01:17:53.619Z","title":"fuse: reject oversized dirents in page cache","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2026-31693","published":"2026-04-30T11:47:01.230Z","updated":"2026-10-19T18:56:04.992Z","title":"cifs: some missing initializations on replay","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-31692","published":"2026-04-30T10:34:51.589Z","updated":"2026-05-11T22:13:52.952Z","title":"rtnetlink: add missing netlink_ns_capable() check for peer netns","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-31787","published":"2026-04-30T10:31:28.992Z","updated":"2026-06-14T17:44:41.402Z","title":"xen/privcmd: fix double free via VMA splitting","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-31786","published":"2026-04-30T10:31:28.293Z","updated":"2026-10-19T19:06:08.809Z","title":"Buffer overflow in drivers/xen/sys-hypervisor.c","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-31691","published":"2026-04-27T17:34:29.738Z","updated":"2026-05-11T22:13:48.573Z","title":"igb: remove napi_synchronize() in igb_down()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-31690","published":"2026-04-27T17:34:28.738Z","updated":"2026-05-11T22:13:45.476Z","title":"firmware: thead: Fix buffer overflow and use standard endian macros","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-31689","published":"2026-04-27T17:34:27.793Z","updated":"2026-05-11T22:13:44.271Z","title":"EDAC/mc: Fix error path ordering in edac_mc_alloc()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2026-31687","published":"2026-04-27T17:32:37.227Z","updated":"2026-05-23T16:05:41.824Z","title":"gpio: omap: do not register driver in probe()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00096,"kevAdded":null},{"id":"CVE-2026-31686","published":"2026-04-27T17:30:53.853Z","updated":"2026-06-14T17:43:23.463Z","title":"mm/kasan: fix double free for kasan pXds","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31685","published":"2026-04-25T08:47:02.857Z","updated":"2026-10-19T18:56:04.835Z","title":"netfilter: ip6t_eui64: reject invalid MAC header for all packets","severity":"CRITICAL","score":9.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00485,"kevAdded":null},{"id":"CVE-2026-31684","published":"2026-04-25T08:47:01.555Z","updated":"2026-06-01T16:13:24.352Z","title":"net: sched: act_csum: validate nested VLAN headers","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-31683","published":"2026-04-25T08:47:00.334Z","updated":"2026-08-05T12:24:28.913Z","title":"batman-adv: avoid OGM aggregation when skb tailroom is insufficient","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31682","published":"2026-04-25T08:46:59.106Z","updated":"2026-10-19T18:56:04.675Z","title":"bridge: br_nd_send: linearize skb before parsing ND options","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00638,"kevAdded":null},{"id":"CVE-2026-31681","published":"2026-04-25T08:46:57.995Z","updated":"2026-10-15T01:17:49.413Z","title":"netfilter: xt_multiport: validate range encoding in checkentry","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31680","published":"2026-04-25T08:46:56.807Z","updated":"2026-10-19T18:56:04.513Z","title":"net: ipv6: flowlabel: defer exclusive option free until RCU teardown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-31679","published":"2026-04-25T08:46:55.584Z","updated":"2026-10-19T18:56:04.364Z","title":"openvswitch: validate MPLS set/set_masked payload length","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-31678","published":"2026-04-25T08:46:54.476Z","updated":"2026-10-30T12:24:33.112Z","title":"openvswitch: defer tunnel netdev_put to RCU release","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-31677","published":"2026-04-25T08:46:53.379Z","updated":"2026-10-30T12:24:31.991Z","title":"crypto: af_alg - limit RX SG extraction by receive buffer budget","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-31676","published":"2026-04-25T08:46:52.285Z","updated":"2026-10-19T18:56:04.018Z","title":"rxrpc: only handle RESPONSE during service challenge","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00471,"kevAdded":null},{"id":"CVE-2026-31675","published":"2026-04-25T08:46:51.184Z","updated":"2026-10-30T12:24:30.924Z","title":"net/sched: sch_netem: fix out-of-bounds access in packet corruption","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-31674","published":"2026-04-25T08:46:50.180Z","updated":"2026-10-19T18:56:03.661Z","title":"netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-31673","published":"2026-04-25T08:46:49.246Z","updated":"2026-10-19T18:56:03.514Z","title":"af_unix: read UNIX_DIAG_VFS data under unix_state_lock","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-31672","published":"2026-04-24T14:45:19.725Z","updated":"2026-05-11T22:13:24.521Z","title":"wifi: rt2x00usb: fix devres lifetime","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-31671","published":"2026-04-24T14:45:18.669Z","updated":"2026-10-15T01:17:41.666Z","title":"xfrm_user: fix info leak in build_report()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-31670","published":"2026-04-24T14:45:17.958Z","updated":"2026-10-15T01:17:39.751Z","title":"net: rfkill: prevent unlimited numbers of rfkill events from being created","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-31669","published":"2026-04-24T14:45:17.295Z","updated":"2026-10-19T18:56:03.360Z","title":"mptcp: fix slab-use-after-free in __inet_lookup_established","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00471,"kevAdded":null},{"id":"CVE-2026-31668","published":"2026-04-24T14:45:16.630Z","updated":"2026-10-19T18:56:03.191Z","title":"seg6: separate dst_cache for input and output paths in seg6 lwtunnel","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00443,"kevAdded":null},{"id":"CVE-2026-31667","published":"2026-04-24T14:45:15.937Z","updated":"2026-10-19T18:56:02.976Z","title":"Input: uinput - fix circular locking dependency with ff-core","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00096,"kevAdded":null},{"id":"CVE-2026-31666","published":"2026-04-24T14:45:15.271Z","updated":"2026-10-19T18:56:02.816Z","title":"btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-31665","published":"2026-04-24T14:45:14.613Z","updated":"2026-10-19T18:56:02.639Z","title":"netfilter: nft_ct: fix use-after-free in timeout object destroy","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31664","published":"2026-04-24T14:45:13.922Z","updated":"2026-10-15T01:17:34.288Z","title":"xfrm: clear trailing padding in build_polexpire()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-31663","published":"2026-04-24T14:45:13.239Z","updated":"2026-10-30T12:24:29.867Z","title":"xfrm: hold dev ref until after transport_finish NF_HOOK","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-31662","published":"2026-04-24T14:45:12.593Z","updated":"2026-10-19T18:56:02.280Z","title":"tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2026-31661","published":"2026-04-24T14:45:11.917Z","updated":"2026-05-11T22:13:08.559Z","title":"wifi: brcmsmac: Fix dma_free_coherent() size","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-31660","published":"2026-04-24T14:45:11.039Z","updated":"2026-05-11T22:13:07.366Z","title":"nfc: pn533: allocate rx skb before consuming bytes","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-31659","published":"2026-04-24T14:45:10.254Z","updated":"2026-10-19T18:56:02.093Z","title":"batman-adv: reject oversized global TT response buffers","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00421,"kevAdded":null},{"id":"CVE-2026-31658","published":"2026-04-24T14:45:09.566Z","updated":"2026-10-15T01:17:32.555Z","title":"net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-31657","published":"2026-04-24T14:45:08.867Z","updated":"2026-10-19T18:56:01.882Z","title":"batman-adv: hold claim backbone gateways by reference","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2026-31656","published":"2026-04-24T14:45:07.738Z","updated":"2026-10-19T18:56:01.711Z","title":"drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00094,"kevAdded":null},{"id":"CVE-2026-31655","published":"2026-04-24T14:45:07.085Z","updated":"2026-10-30T12:24:28.799Z","title":"pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-31654","published":"2026-04-24T14:45:06.387Z","updated":"2026-05-11T22:12:59.768Z","title":"mm/vma: fix memory leak in __mmap_region()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00113,"kevAdded":null},{"id":"CVE-2026-31653","published":"2026-04-24T14:45:05.689Z","updated":"2026-05-11T22:12:58.645Z","title":"mm/damon/sysfs: dealloc repeat_call_control if damon_call() fails","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-31652","published":"2026-04-24T14:45:04.930Z","updated":"2026-05-11T22:12:57.491Z","title":"mm/damon/stat: deallocate damon_call() failure leaking damon_ctx","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00115,"kevAdded":null},{"id":"CVE-2026-31651","published":"2026-04-24T14:45:03.905Z","updated":"2026-10-15T01:17:30.725Z","title":"mmc: vub300: fix NULL-deref on disconnect","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-31650","published":"2026-04-24T14:45:03.210Z","updated":"2026-10-21T12:39:38.649Z","title":"mmc: vub300: fix use-after-free on disconnect","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-31649","published":"2026-04-24T14:45:02.520Z","updated":"2026-10-19T18:56:01.547Z","title":"net: stmmac: fix integer underflow in chain mode","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00459,"kevAdded":null},{"id":"CVE-2026-31648","published":"2026-04-24T14:45:01.728Z","updated":"2026-10-19T18:56:01.381Z","title":"mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-31647","published":"2026-04-24T14:45:00.734Z","updated":"2026-05-11T22:12:51.719Z","title":"idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31646","published":"2026-04-24T14:44:59.874Z","updated":"2026-05-11T22:12:50.586Z","title":"net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31645","published":"2026-04-24T14:44:58.868Z","updated":"2026-10-21T12:39:37.535Z","title":"net: lan966x: fix page pool leak in error paths","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-31644","published":"2026-04-24T14:44:58.197Z","updated":"2026-08-05T12:24:06.448Z","title":"net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-31643","published":"2026-04-24T14:44:57.540Z","updated":"2026-05-11T22:12:46.954Z","title":"rxrpc: Fix key parsing memleak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31642","published":"2026-04-24T14:44:56.888Z","updated":"2026-10-15T01:17:26.893Z","title":"rxrpc: Fix call removal to use RCU safe deletion","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31641","published":"2026-04-24T14:44:56.204Z","updated":"2026-08-20T12:31:55.191Z","title":"rxrpc: Fix RxGK token loading to check bounds","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-31640","published":"2026-04-24T14:44:54.024Z","updated":"2026-08-05T12:24:04.294Z","title":"rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2026-31639","published":"2026-04-24T14:44:52.769Z","updated":"2026-05-11T22:12:42.283Z","title":"rxrpc: Fix key reference count leak from call->key","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31638","published":"2026-04-24T14:44:52.122Z","updated":"2026-10-19T18:56:01.209Z","title":"rxrpc: Only put the call ref if one was acquired","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00441,"kevAdded":null},{"id":"CVE-2026-31637","published":"2026-04-24T14:44:51.364Z","updated":"2026-10-19T18:56:01.051Z","title":"rxrpc: reject undecryptable rxkad response tickets","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0059,"kevAdded":null},{"id":"CVE-2026-31636","published":"2026-04-24T14:44:50.637Z","updated":"2026-08-05T12:24:00.729Z","title":"rxrpc: fix RESPONSE authenticator parser OOB read","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00442,"kevAdded":null},{"id":"CVE-2026-31635","published":"2026-04-24T14:44:49.963Z","updated":"2026-08-05T12:23:59.642Z","title":"rxrpc: fix oversized RESPONSE authenticator length check","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.01017,"kevAdded":null},{"id":"CVE-2026-31634","published":"2026-04-24T14:44:49.307Z","updated":"2026-10-15T01:17:24.353Z","title":"rxrpc: fix reference count leak in rxrpc_server_keyring()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31633","published":"2026-04-24T14:44:48.621Z","updated":"2026-10-19T18:56:00.901Z","title":"rxrpc: Fix integer overflow in rxgk_verify_response()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00469,"kevAdded":null},{"id":"CVE-2026-31632","published":"2026-04-24T14:44:47.969Z","updated":"2026-05-11T22:12:34.136Z","title":"rxrpc: Fix leak of rxgk context in rxgk_verify_response()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31631","published":"2026-04-24T14:44:47.305Z","updated":"2026-10-19T18:56:00.756Z","title":"rxrpc: Fix buffer overread in rxgk_do_verify_authenticator()","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2026-31630","published":"2026-04-24T14:44:46.606Z","updated":"2026-10-21T12:39:36.441Z","title":"rxrpc: proc: size address buffers for %pISpc output","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-31629","published":"2026-04-24T14:42:49.849Z","updated":"2026-10-15T01:17:21.139Z","title":"nfc: llcp: add missing return after LLCP_CLOSED checks","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2026-31628","published":"2026-04-24T14:42:49.181Z","updated":"2026-10-15T01:17:19.544Z","title":"x86/CPU: Fix FPDSS on Zen1","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31627","published":"2026-04-24T14:42:48.342Z","updated":"2026-08-05T12:23:54.379Z","title":"i2c: s3c24xx: check the size of the SMBUS message before using it","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-31626","published":"2026-04-24T14:42:47.493Z","updated":"2026-08-05T12:23:53.335Z","title":"staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2026-31625","published":"2026-04-24T14:42:42.481Z","updated":"2026-10-15T01:17:17.626Z","title":"HID: alps: fix NULL pointer dereference in alps_raw_event()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31624","published":"2026-04-24T14:42:41.655Z","updated":"2026-10-15T01:17:16.412Z","title":"HID: core: clamp report_size in s32ton() to avoid undefined shift","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31623","published":"2026-04-24T14:42:40.566Z","updated":"2026-06-14T17:43:10.837Z","title":"net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-31622","published":"2026-04-24T14:42:39.916Z","updated":"2026-10-15T01:17:15.197Z","title":"NFC: digital: Bounds check NFC-A cascade depth in SDD response handler","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2026-31621","published":"2026-04-24T14:42:39.274Z","updated":"2026-06-14T17:43:07.914Z","title":"bnge: return after auxiliary_device_uninit() in error path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31620","published":"2026-04-24T14:42:38.607Z","updated":"2026-06-14T17:43:06.553Z","title":"ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0","severity":"MEDIUM","score":4.6,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-31619","published":"2026-04-24T14:42:37.944Z","updated":"2026-06-14T17:43:05.168Z","title":"ALSA: fireworks: bound device-supplied status before string array lookup","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-31618","published":"2026-04-24T14:42:37.173Z","updated":"2026-06-14T17:43:03.888Z","title":"fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-31617","published":"2026-04-24T14:42:36.191Z","updated":"2026-10-15T01:17:13.982Z","title":"usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-31616","published":"2026-04-24T14:42:35.480Z","updated":"2026-06-14T17:43:01.212Z","title":"usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-31615","published":"2026-04-24T14:42:34.806Z","updated":"2026-06-14T17:42:59.822Z","title":"usb: gadget: renesas_usb3: validate endpoint index in standard request handlers","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-31614","published":"2026-04-24T14:42:34.153Z","updated":"2026-06-14T17:42:58.516Z","title":"smb: client: fix off-by-8 bounds check in check_wsl_eas()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-31613","published":"2026-04-24T14:42:33.453Z","updated":"2026-10-19T18:56:00.442Z","title":"smb: client: fix OOB reads parsing symlink error response","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00387,"kevAdded":null},{"id":"CVE-2026-31612","published":"2026-04-24T14:42:32.760Z","updated":"2026-10-15T01:17:11.549Z","title":"ksmbd: validate EaNameLength in smb2_get_ea()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00425,"kevAdded":null},{"id":"CVE-2026-31611","published":"2026-04-24T14:42:32.124Z","updated":"2026-10-15T01:17:10.339Z","title":"ksmbd: require 3 sub-authorities before reading sub_auth[2]","severity":"HIGH","score":8.6,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-31610","published":"2026-04-24T14:42:31.471Z","updated":"2026-07-24T14:33:31.688Z","title":"ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-31609","published":"2026-04-24T14:42:30.797Z","updated":"2026-10-19T18:56:00.237Z","title":"smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00457,"kevAdded":null},{"id":"CVE-2026-31608","published":"2026-04-24T14:42:30.137Z","updated":"2026-08-05T12:23:46.955Z","title":"smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00457,"kevAdded":null},{"id":"CVE-2026-31607","published":"2026-04-24T14:42:29.468Z","updated":"2026-10-19T18:56:00.074Z","title":"usbip: validate number_of_packets in usbip_pack_ret_submit()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2026-31606","published":"2026-04-24T14:42:28.792Z","updated":"2026-10-30T12:24:27.746Z","title":"usb: gadget: f_hid: don't call cdev_init while cdev in use","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-31605","published":"2026-04-24T14:42:28.120Z","updated":"2026-06-14T17:42:46.052Z","title":"fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-31604","published":"2026-04-24T14:42:27.342Z","updated":"2026-06-14T17:42:45.063Z","title":"wifi: rtw88: fix device leak on probe failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31603","published":"2026-04-24T14:42:26.601Z","updated":"2026-06-14T17:42:44.030Z","title":"staging: sm750fb: fix division by zero in ps_to_hz()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-31602","published":"2026-04-24T14:42:25.935Z","updated":"2026-08-05T12:23:44.562Z","title":"ALSA: ctxfi: Limit PTP to a single page","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-31601","published":"2026-04-24T14:42:25.287Z","updated":"2026-06-14T17:42:42.047Z","title":"vfio/xe: Reorganize the init to decouple migration from reset","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31600","published":"2026-04-24T14:42:24.641Z","updated":"2026-10-19T18:55:59.896Z","title":"arm64: mm: Handle invalid large leaf mappings correctly","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2026-31599","published":"2026-04-24T14:42:23.961Z","updated":"2026-06-14T17:42:40.045Z","title":"media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-31598","published":"2026-04-24T14:42:23.304Z","updated":"2026-10-19T18:55:59.744Z","title":"ocfs2: fix possible deadlock between unlink and dio_end_io_write","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2026-31597","published":"2026-04-24T14:42:22.655Z","updated":"2026-08-05T12:23:41.347Z","title":"ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-31596","published":"2026-04-24T14:42:22.003Z","updated":"2026-06-14T17:42:37.033Z","title":"ocfs2: handle invalid dinode in ocfs2_group_extend","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-31595","published":"2026-04-24T14:42:21.355Z","updated":"2026-06-14T17:42:36.054Z","title":"PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31594","published":"2026-04-24T14:42:20.556Z","updated":"2026-06-14T17:42:35.028Z","title":"PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31593","published":"2026-04-24T14:42:19.567Z","updated":"2026-06-14T17:42:33.985Z","title":"KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31592","published":"2026-04-24T14:42:18.921Z","updated":"2026-10-30T12:24:24.633Z","title":"KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-31591","published":"2026-04-24T14:42:18.276Z","updated":"2026-06-14T17:42:31.923Z","title":"KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31590","published":"2026-04-24T14:42:17.629Z","updated":"2026-06-14T17:42:30.901Z","title":"KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-31589","published":"2026-04-24T14:42:16.955Z","updated":"2026-08-05T12:23:40.286Z","title":"mm: call ->free_folio() directly in folio_unmap_invalidate()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00444,"kevAdded":null},{"id":"CVE-2026-31588","published":"2026-04-24T14:42:16.288Z","updated":"2026-10-19T18:55:59.596Z","title":"KVM: x86: Use scratch field in MMIO fragment to hold small write values","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-31587","published":"2026-04-24T14:42:15.625Z","updated":"2026-08-05T12:23:38.154Z","title":"ASoC: qcom: q6apm: move component registration to unmanaged version","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-31586","published":"2026-04-24T14:42:14.937Z","updated":"2026-10-19T18:55:59.448Z","title":"mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-31585","published":"2026-04-24T14:42:14.266Z","updated":"2026-06-14T17:42:17.844Z","title":"media: vidtv: fix nfeeds state corruption on start_streaming failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-31584","published":"2026-04-24T14:42:13.586Z","updated":"2026-08-05T12:23:36.030Z","title":"media: mediatek: vcodec: fix use-after-free in encoder release path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-31583","published":"2026-04-24T14:42:12.923Z","updated":"2026-10-15T01:17:07.863Z","title":"media: em28xx: fix use-after-free in em28xx_v4l2_open()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-31582","published":"2026-04-24T14:42:12.257Z","updated":"2026-06-14T17:42:10.056Z","title":"hwmon: (powerz) Fix use-after-free on USB disconnect","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-31581","published":"2026-04-24T14:42:11.557Z","updated":"2026-06-14T17:42:07.970Z","title":"ALSA: 6fire: fix use-after-free on disconnect","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-31580","published":"2026-04-24T14:42:10.874Z","updated":"2026-10-15T01:17:05.087Z","title":"bcache: fix cached_dev.sb_bio use-after-free and crash","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-31579","published":"2026-04-24T14:42:10.208Z","updated":"2026-10-21T12:39:33.170Z","title":"wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-31578","published":"2026-04-24T14:42:09.519Z","updated":"2026-06-14T17:42:03.244Z","title":"media: as102: fix to not free memory after the device is registered in as102_usb_probe()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-31577","published":"2026-04-24T14:42:08.879Z","updated":"2026-06-14T17:42:01.611Z","title":"nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-31576","published":"2026-04-24T14:42:08.188Z","updated":"2026-06-14T17:42:00.110Z","title":"media: hackrf: fix to not free memory after the device is registered in hackrf_probe()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-31575","published":"2026-04-24T14:42:07.502Z","updated":"2026-06-14T17:41:58.519Z","title":"mm/userfaultfd: fix hugetlb fault mutex hash calculation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31574","published":"2026-04-24T14:42:06.707Z","updated":"2026-06-14T17:41:57.072Z","title":"clockevents: Add missing resets of the next_event_forced flag","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-31573","published":"2026-04-24T14:35:51.421Z","updated":"2026-10-30T12:24:23.572Z","title":"media: verisilicon: Fix kernel panic due to __initconst misuse","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-31572","published":"2026-04-24T14:35:50.736Z","updated":"2026-05-11T22:11:22.941Z","title":"i2c: designware: amdisp: Fix resume-probe race condition issue","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00088,"kevAdded":null},{"id":"CVE-2026-31571","published":"2026-04-24T14:35:50.094Z","updated":"2026-05-11T22:11:21.787Z","title":"drm/i915: Unlink NV12 planes earlier","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31570","published":"2026-04-24T14:35:49.435Z","updated":"2026-10-19T18:55:59.285Z","title":"can: gw: fix OOB heap access in cgw_csum_crc8_rel()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2026-31569","published":"2026-04-24T14:35:48.768Z","updated":"2026-08-05T12:23:33.914Z","title":"LoongArch: KVM: Handle the case that EIOINTC's coremap is empty","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-31568","published":"2026-04-24T14:35:48.125Z","updated":"2026-10-30T12:24:22.511Z","title":"s390/mm: Add missing secure storage access fixups for donated memory","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-31567","published":"2026-04-24T14:35:47.453Z","updated":"2026-05-23T16:05:25.080Z","title":"PM: sleep: Drop spurious WARN_ON() from pm_restore_gfp_mask()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-31566","published":"2026-04-24T14:35:46.740Z","updated":"2026-10-19T18:55:59.130Z","title":"drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-31565","published":"2026-04-24T14:35:46.006Z","updated":"2026-10-15T01:17:03.861Z","title":"RDMA/irdma: Fix deadlock during netdev reset with active connections","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00099,"kevAdded":null},{"id":"CVE-2026-31564","published":"2026-04-24T14:35:45.302Z","updated":"2026-05-11T22:11:13.366Z","title":"LoongArch: KVM: Fix base address calculation in kvm_eiointc_regs_access()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-31563","published":"2026-04-24T14:35:44.610Z","updated":"2026-10-15T01:17:01.889Z","title":"net: macb: Use dev_consume_skb_any() to free TX SKBs","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-31562","published":"2026-04-24T14:35:43.950Z","updated":"2026-10-21T12:39:29.897Z","title":"drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-31561","published":"2026-04-24T14:35:43.302Z","updated":"2026-05-11T22:11:09.941Z","title":"x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31560","published":"2026-04-24T14:35:42.634Z","updated":"2026-10-30T12:24:21.457Z","title":"spi: spi-dw-dma: fix print error log when wait finish transaction","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-31559","published":"2026-04-24T14:35:41.961Z","updated":"2026-05-23T16:05:21.935Z","title":"LoongArch: Fix missing NULL checks for kstrdup()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31558","published":"2026-04-24T14:35:41.209Z","updated":"2026-08-05T12:23:30.748Z","title":"LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31557","published":"2026-04-24T14:35:40.544Z","updated":"2026-10-30T12:24:20.397Z","title":"nvmet: move async event work off nvmet-wq","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00451,"kevAdded":null},{"id":"CVE-2026-31556","published":"2026-04-24T14:35:39.880Z","updated":"2026-05-11T22:11:04.289Z","title":"xfs: scrub: unlock dquot before early return in quota scrub","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31555","published":"2026-04-24T14:35:39.211Z","updated":"2026-10-15T01:17:00.034Z","title":"futex: Clear stale exiting pointer in futex_lock_pi() retry path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31554","published":"2026-04-24T14:35:38.527Z","updated":"2026-10-19T18:55:58.799Z","title":"futex: Require sys_futex_requeue() to have identical flags","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-31553","published":"2026-04-24T14:35:37.828Z","updated":"2026-08-05T12:23:27.579Z","title":"KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-31552","published":"2026-04-24T14:33:19.065Z","updated":"2026-08-05T12:23:26.516Z","title":"wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-31551","published":"2026-04-24T14:33:18.230Z","updated":"2026-05-11T22:10:57.880Z","title":"wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31550","published":"2026-04-24T14:33:17.508Z","updated":"2026-05-11T22:10:56.707Z","title":"pmdomain: bcm: bcm2835-power: Increase ASB control timeout","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31549","published":"2026-04-24T14:33:16.814Z","updated":"2026-05-11T22:10:55.565Z","title":"i2c: cp2615: fix serial string NULL-deref at probe","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31548","published":"2026-04-24T14:33:16.021Z","updated":"2026-10-19T18:55:58.636Z","title":"wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-31547","published":"2026-04-24T14:33:15.262Z","updated":"2026-05-11T22:10:53.255Z","title":"drm/xe: Fix missing runtime PM reference in ccs_mode_store","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-31546","published":"2026-04-24T14:33:14.572Z","updated":"2026-10-15T01:16:58.231Z","title":"net: bonding: fix NULL deref in bond_debug_rlb_hash_show","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31545","published":"2026-04-24T14:33:13.885Z","updated":"2026-05-11T22:10:50.934Z","title":"NFC: nxp-nci: allow GPIOs to sleep","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31544","published":"2026-04-24T14:33:13.173Z","updated":"2026-05-11T22:10:49.780Z","title":"firmware: arm_scmi: Fix NULL dereference on notify error path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31543","published":"2026-04-24T14:33:12.163Z","updated":"2026-05-11T22:10:48.645Z","title":"crash_dump: don't log dm-crypt key bytes in read_key_from_user_keying","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31542","published":"2026-04-24T14:33:11.205Z","updated":"2026-05-11T22:10:47.496Z","title":"x86/platform/uv: Handle deconfigured sockets","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31541","published":"2026-04-24T14:33:10.505Z","updated":"2026-05-11T22:10:46.355Z","title":"tracing: Fix trace_marker copy link list updates","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-31540","published":"2026-04-24T14:33:09.705Z","updated":"2026-05-11T22:10:45.183Z","title":"drm/i915/gt: Check set_default_submission() before deferencing","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31539","published":"2026-04-24T14:30:26.326Z","updated":"2026-10-19T18:55:58.491Z","title":"smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2026-31538","published":"2026-04-24T14:30:25.598Z","updated":"2026-08-05T12:23:22.947Z","title":"smb: server: make use of smbdirect_socket.recv_io.credits.available","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2026-31537","published":"2026-04-24T14:30:24.907Z","updated":"2026-05-11T22:10:41.629Z","title":"smb: server: make use of smbdirect_socket.send_io.bcredits","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31536","published":"2026-04-24T14:30:24.224Z","updated":"2026-08-05T12:23:21.869Z","title":"smb: server: let send_done handle a completion without IB_SEND_SIGNALED","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00442,"kevAdded":null},{"id":"CVE-2026-31535","published":"2026-04-24T14:30:23.540Z","updated":"2026-05-11T22:10:39.307Z","title":"smb: client: make use of smbdirect_socket.recv_io.credits.available","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00088,"kevAdded":null},{"id":"CVE-2026-31533","published":"2026-04-23T15:11:06.955Z","updated":"2026-10-19T18:45:55.376Z","title":"net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2026-31532","published":"2026-04-23T11:12:44.829Z","updated":"2026-10-19T18:45:55.225Z","title":"can: raw: fix ro->uniq use-after-free in raw_rcv()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-31531","published":"2026-04-23T11:12:44.143Z","updated":"2026-10-30T12:24:19.337Z","title":"ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-31530","published":"2026-04-22T13:54:42.563Z","updated":"2026-10-21T12:39:25.498Z","title":"cxl/port: Fix use after free of parent_port in cxl_detach_ep()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-31529","published":"2026-04-22T13:54:41.853Z","updated":"2026-05-11T22:10:33.610Z","title":"cxl/region: Fix leakage in __construct_region()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-31528","published":"2026-04-22T13:54:41.180Z","updated":"2026-10-19T18:45:55.081Z","title":"perf: Make sure to use pmu_ctx->pmu for groups","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31527","published":"2026-04-22T13:54:40.485Z","updated":"2026-06-01T16:11:39.964Z","title":"driver core: platform: use generic driver_override infrastructure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31526","published":"2026-04-22T13:54:39.800Z","updated":"2026-10-21T12:39:24.405Z","title":"bpf: Fix exception exit lock checking for subprogs","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-31525","published":"2026-04-22T13:54:39.144Z","updated":"2026-10-19T18:45:54.927Z","title":"bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-31524","published":"2026-04-22T13:54:38.389Z","updated":"2026-05-11T22:10:27.784Z","title":"HID: asus: avoid memory leak in asus_report_fixup()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31523","published":"2026-04-22T13:54:37.568Z","updated":"2026-05-11T22:10:26.646Z","title":"nvme-pci: ensure we're polling a polled queue","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00089,"kevAdded":null},{"id":"CVE-2026-31522","published":"2026-04-22T13:54:36.885Z","updated":"2026-05-23T16:05:16.510Z","title":"HID: magicmouse: avoid memory leak in magicmouse_report_fixup()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31521","published":"2026-04-22T13:54:36.211Z","updated":"2026-10-15T01:16:53.401Z","title":"module: Fix kernel panic when a symbol st_shndx is out of bounds","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31520","published":"2026-04-22T13:54:35.534Z","updated":"2026-05-11T22:10:23.085Z","title":"HID: apple: avoid memory leak in apple_report_fixup()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31519","published":"2026-04-22T13:54:34.860Z","updated":"2026-05-23T16:05:15.433Z","title":"btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31518","published":"2026-04-22T13:54:34.191Z","updated":"2026-10-15T01:16:51.564Z","title":"esp: fix skb leak with espintcp and async crypto","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31517","published":"2026-04-22T13:54:33.522Z","updated":"2026-05-11T22:10:19.646Z","title":"xfrm: iptfs: fix skb_put() panic on non-linear skb during reassembly","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31516","published":"2026-04-22T13:54:32.851Z","updated":"2026-10-19T18:45:54.791Z","title":"xfrm: prevent policy_hthresh.work from racing with netns teardown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-31515","published":"2026-04-22T13:54:32.194Z","updated":"2026-10-15T01:16:49.668Z","title":"af_key: validate families in pfkey_send_migrate()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31514","published":"2026-04-22T13:54:31.531Z","updated":"2026-10-23T08:20:15.576Z","title":"erofs: set fileio bio failed in short read case","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31513","published":"2026-04-22T13:54:30.835Z","updated":"2026-10-19T18:45:54.652Z","title":"Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2026-31512","published":"2026-04-22T13:54:30.171Z","updated":"2026-05-11T22:10:13.614Z","title":"Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31511","published":"2026-04-22T13:54:29.420Z","updated":"2026-10-19T18:45:54.516Z","title":"Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31510","published":"2026-04-22T13:54:28.712Z","updated":"2026-05-11T22:10:11.263Z","title":"Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31509","published":"2026-04-22T13:54:27.436Z","updated":"2026-05-11T22:10:10.109Z","title":"nfc: nci: fix circular locking dependency in nci_close_device","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-31508","published":"2026-04-22T13:54:26.599Z","updated":"2026-10-19T18:45:54.377Z","title":"net: openvswitch: Avoid releasing netdev before teardown completes","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00105,"kevAdded":null},{"id":"CVE-2026-31507","published":"2026-04-22T13:54:25.910Z","updated":"2026-10-19T18:45:54.233Z","title":"net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-31506","published":"2026-04-22T13:54:25.219Z","updated":"2026-10-21T12:39:23.279Z","title":"net: bcmasp: fix double free of WoL irq","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-31505","published":"2026-04-22T13:54:24.524Z","updated":"2026-10-30T12:24:18.267Z","title":"iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-31504","published":"2026-04-22T13:54:23.862Z","updated":"2026-10-19T18:45:53.946Z","title":"net: fix fanout UAF in packet_release() via NETDEV_UP race","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00105,"kevAdded":null},{"id":"CVE-2026-31503","published":"2026-04-22T13:54:23.221Z","updated":"2026-10-15T01:16:42.154Z","title":"udp: Fix wildcard bind conflict check when using hash2","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-31502","published":"2026-04-22T13:54:22.481Z","updated":"2026-10-30T12:24:17.203Z","title":"team: fix header_ops type confusion with non-Ethernet ports","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-31501","published":"2026-04-22T13:54:21.749Z","updated":"2026-10-15T10:07:00.443Z","title":"net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2026-31500","published":"2026-04-22T13:54:21.071Z","updated":"2026-10-15T01:16:40.314Z","title":"Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-31499","published":"2026-04-22T13:54:20.384Z","updated":"2026-05-23T16:05:12.236Z","title":"Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00094,"kevAdded":null},{"id":"CVE-2026-31498","published":"2026-04-22T13:54:19.714Z","updated":"2026-05-23T16:05:11.217Z","title":"Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31497","published":"2026-04-22T13:54:19.051Z","updated":"2026-05-11T22:09:53.017Z","title":"Bluetooth: btusb: clamp SCO altsetting table indices","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31496","published":"2026-04-22T13:54:18.287Z","updated":"2026-10-15T01:16:39.082Z","title":"netfilter: nf_conntrack_expect: skip expectations in other netns via proc","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-31495","published":"2026-04-22T13:54:17.591Z","updated":"2026-10-15T01:16:37.147Z","title":"netfilter: ctnetlink: use netlink policy range checks","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31494","published":"2026-04-22T13:54:16.922Z","updated":"2026-10-15T01:16:35.429Z","title":"net: macb: use the current queue number for stats","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-31493","published":"2026-04-22T13:54:16.255Z","updated":"2026-10-21T12:39:20.213Z","title":"RDMA/efa: Fix use of completion ctx after free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-31492","published":"2026-04-22T13:54:15.581Z","updated":"2026-05-11T22:09:46.883Z","title":"RDMA/irdma: Initialize free_qp completion before using it","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31491","published":"2026-04-22T13:54:14.905Z","updated":"2026-05-11T22:09:45.736Z","title":"RDMA/irdma: Harden depth calculation functions","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31490","published":"2026-04-22T13:54:14.241Z","updated":"2026-08-05T12:23:02.564Z","title":"drm/xe/pf: Fix use-after-free in migration restore","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-31489","published":"2026-04-22T13:54:13.602Z","updated":"2026-06-19T11:57:47.642Z","title":"spi: meson-spicc: Fix double-put in remove path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31488","published":"2026-04-22T13:54:12.963Z","updated":"2026-10-19T18:45:53.635Z","title":"drm/amd/display: Do not skip unrelated mode changes in DSC validation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2026-31487","published":"2026-04-22T13:54:12.290Z","updated":"2026-10-21T12:39:19.125Z","title":"spi: use generic driver_override infrastructure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-31486","published":"2026-04-22T13:54:11.594Z","updated":"2026-10-30T12:24:16.113Z","title":"hwmon: (pmbus/core) Protect regulator operations with mutex","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-31485","published":"2026-04-22T13:54:10.892Z","updated":"2026-10-15T01:16:32.240Z","title":"spi: spi-fsl-lpspi: fix teardown order issue (UAF)","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-31484","published":"2026-04-22T13:54:10.223Z","updated":"2026-08-05T12:22:59.333Z","title":"io_uring/fdinfo: fix OOB read in SQE_MIXED wrap check","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-31483","published":"2026-04-22T13:54:09.561Z","updated":"2026-05-11T22:09:36.271Z","title":"s390/syscalls: Add spectre boundary for syscall dispatch table","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31482","published":"2026-04-22T13:54:08.888Z","updated":"2026-05-11T22:09:35.182Z","title":"s390/entry: Scrub r12 register on kernel entry","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31481","published":"2026-04-22T13:54:08.236Z","updated":"2026-05-11T22:09:34.083Z","title":"tracing: Drain deferred trigger frees if kthread creation fails","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-31480","published":"2026-04-22T13:54:07.566Z","updated":"2026-05-11T22:09:32.978Z","title":"tracing: Fix potential deadlock in cpu hotplug with osnoise","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-31479","published":"2026-04-22T13:54:06.880Z","updated":"2026-10-19T18:45:53.310Z","title":"drm/xe: always keep track of remap prev/next","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31478","published":"2026-04-22T13:54:06.157Z","updated":"2026-10-19T18:45:53.152Z","title":"ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00502,"kevAdded":null},{"id":"CVE-2026-31477","published":"2026-04-22T13:54:05.470Z","updated":"2026-08-05T12:22:56.049Z","title":"ksmbd: fix memory leaks and NULL deref in smb2_lock()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-31476","published":"2026-04-22T13:54:04.779Z","updated":"2026-08-05T12:22:55.000Z","title":"ksmbd: do not expire session on binding failure","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2026-31475","published":"2026-04-22T13:54:04.113Z","updated":"2026-08-05T12:22:53.935Z","title":"ASoC: sma1307: fix double free of devm_kzalloc() memory","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-31474","published":"2026-04-22T13:54:03.100Z","updated":"2026-10-19T18:35:50.370Z","title":"can: isotp: fix tx.buf use-after-free in isotp_sendmsg()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00104,"kevAdded":null},{"id":"CVE-2026-31473","published":"2026-04-22T13:54:00.970Z","updated":"2026-10-19T18:35:50.197Z","title":"media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00097,"kevAdded":null},{"id":"CVE-2026-31472","published":"2026-04-22T13:54:00.281Z","updated":"2026-05-11T22:09:23.766Z","title":"xfrm: iptfs: validate inner IPv4 header length in IPTFS payload","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31471","published":"2026-04-22T13:53:59.595Z","updated":"2026-08-05T12:22:50.697Z","title":"xfrm: iptfs: only publish mode_data after clone setup","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-31470","published":"2026-04-22T13:53:58.925Z","updated":"2026-10-19T18:35:50.013Z","title":"virt: tdx-guest: Fix handling of host controlled 'quote' buffer length","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-31469","published":"2026-04-22T13:53:58.266Z","updated":"2026-10-19T18:35:49.842Z","title":"virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-31468","published":"2026-04-22T13:53:57.583Z","updated":"2026-10-19T18:35:49.671Z","title":"vfio/pci: Fix double free in dma-buf feature","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31467","published":"2026-04-22T13:53:56.910Z","updated":"2026-08-05T12:22:46.421Z","title":"erofs: add GFP_NOIO in the bio completion if needed","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00378,"kevAdded":null},{"id":"CVE-2026-31466","published":"2026-04-22T13:53:56.259Z","updated":"2026-10-15T01:16:28.626Z","title":"mm/huge_memory: fix folio isn't locked in softleaf_to_folio()","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00094,"kevAdded":null},{"id":"CVE-2026-31465","published":"2026-04-22T13:53:55.614Z","updated":"2026-05-11T22:09:15.426Z","title":"writeback: don't block sync for filesystems with no data integrity guarantees","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31464","published":"2026-04-22T13:53:54.970Z","updated":"2026-10-19T18:35:49.523Z","title":"scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2026-31463","published":"2026-04-22T13:53:54.224Z","updated":"2026-08-05T12:22:44.255Z","title":"iomap: fix invalid folio access when i_blkbits differs from I/O granularity","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00379,"kevAdded":null},{"id":"CVE-2026-31462","published":"2026-04-22T13:53:53.542Z","updated":"2026-10-30T12:24:15.053Z","title":"drm/amdgpu: prevent immediate PASID reuse case","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-31461","published":"2026-04-22T13:53:52.875Z","updated":"2026-05-11T22:09:10.427Z","title":"drm/amd/display: Fix drm_edid leak in amdgpu_dm","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31460","published":"2026-04-22T13:53:52.202Z","updated":"2026-05-11T22:09:09.275Z","title":"drm/amd/display: check if ext_caps is valid in BL setup","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-31459","published":"2026-04-22T13:53:51.554Z","updated":"2026-05-23T16:05:06.874Z","title":"mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31458","published":"2026-04-22T13:53:50.883Z","updated":"2026-05-11T22:09:07.003Z","title":"mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31457","published":"2026-04-22T13:53:50.220Z","updated":"2026-05-11T22:09:05.878Z","title":"mm/damon/sysfs: check contexts->nr in repeat_call_fn","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31456","published":"2026-04-22T13:53:49.568Z","updated":"2026-06-17T13:44:31.920Z","title":"mm/pagewalk: fix race between concurrent split and refault","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00089,"kevAdded":null},{"id":"CVE-2026-31455","published":"2026-04-22T13:53:48.914Z","updated":"2026-05-11T22:09:03.235Z","title":"xfs: stop reclaim before pushing AIL during unmount","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-31454","published":"2026-04-22T13:53:48.242Z","updated":"2026-10-19T18:35:49.366Z","title":"xfs: save ailp before dropping the AIL lock in push callbacks","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-31453","published":"2026-04-22T13:53:47.577Z","updated":"2026-10-19T18:35:49.200Z","title":"xfs: avoid dereferencing log items after push callbacks","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-31452","published":"2026-04-22T13:53:46.917Z","updated":"2026-10-15T01:16:26.796Z","title":"ext4: convert inline data to extents when truncate exceeds inline size","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-31451","published":"2026-04-22T13:53:46.243Z","updated":"2026-10-15T01:16:25.058Z","title":"ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31450","published":"2026-04-22T13:53:45.532Z","updated":"2026-10-19T18:35:49.024Z","title":"ext4: publish jinode after initialization","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00412,"kevAdded":null},{"id":"CVE-2026-31449","published":"2026-04-22T13:53:44.777Z","updated":"2026-10-19T18:35:48.867Z","title":"ext4: validate p_idx bounds in ext4_ext_correct_indexes","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-31448","published":"2026-04-22T13:53:44.129Z","updated":"2026-10-19T18:35:48.686Z","title":"ext4: avoid infinite loops caused by residual data","severity":"CRITICAL","score":9.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2026-31447","published":"2026-04-22T13:53:43.467Z","updated":"2026-10-19T18:35:48.523Z","title":"ext4: reject mount if bigalloc with s_first_data_block != 0","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-31446","published":"2026-04-22T13:53:42.751Z","updated":"2026-10-19T18:35:48.381Z","title":"ext4: fix use-after-free in update_super_work when racing with umount","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-31445","published":"2026-04-22T13:53:42.090Z","updated":"2026-05-11T22:08:50.744Z","title":"mm/damon/core: avoid use of half-online-committed context","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31444","published":"2026-04-22T13:53:41.351Z","updated":"2026-08-05T12:22:35.585Z","title":"ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0045,"kevAdded":null},{"id":"CVE-2026-31443","published":"2026-04-22T13:53:40.616Z","updated":"2026-05-11T22:08:48.361Z","title":"dmaengine: idxd: Fix crash when the event log is disabled","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31442","published":"2026-04-22T13:53:39.895Z","updated":"2026-10-19T18:35:48.223Z","title":"dmaengine: idxd: Fix possible invalid memory access after FLR","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-31441","published":"2026-04-22T13:53:39.055Z","updated":"2026-10-15T01:16:14.763Z","title":"dmaengine: idxd: Fix memory leak when a wq is reset","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-31440","published":"2026-04-22T13:53:38.388Z","updated":"2026-05-17T15:21:26.990Z","title":"dmaengine: idxd: Fix leaking event log memory","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31439","published":"2026-04-22T13:53:37.754Z","updated":"2026-05-11T22:08:43.715Z","title":"dmaengine: xilinx: xdma: Fix regmap init error handling","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31438","published":"2026-04-22T13:53:37.053Z","updated":"2026-05-11T22:08:42.611Z","title":"netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31437","published":"2026-04-22T13:53:36.361Z","updated":"2026-05-11T22:08:41.432Z","title":"netfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31436","published":"2026-04-22T13:53:35.693Z","updated":"2026-10-19T18:35:48.060Z","title":"dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00457,"kevAdded":null},{"id":"CVE-2026-31435","published":"2026-04-22T13:53:35.032Z","updated":"2026-10-19T18:35:47.887Z","title":"netfs: Fix read abandonment during retry","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-31434","published":"2026-04-22T13:53:34.357Z","updated":"2026-05-23T16:05:03.539Z","title":"btrfs: fix leak of kobject name for sub-group space_info","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31433","published":"2026-04-22T08:15:11.719Z","updated":"2026-08-05T12:22:27.773Z","title":"ksmbd: fix potencial OOB in get_file_all_info() for compound requests","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.006,"kevAdded":null},{"id":"CVE-2026-31432","published":"2026-04-22T08:15:10.873Z","updated":"2026-10-30T12:24:13.087Z","title":"ksmbd: fix OOB write in QUERY_INFO for compound requests","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00546,"kevAdded":null},{"id":"CVE-2026-31431","published":"2026-04-22T08:15:10.123Z","updated":"2026-10-15T01:16:12.771Z","title":"crypto: algif_aead - Revert to operating out-of-place","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":true,"epss":0.98114,"kevAdded":"2026-05-01"},{"id":"CVE-2026-31430","published":"2026-04-20T09:43:03.919Z","updated":"2026-05-11T22:08:33.502Z","title":"X.509: Fix out-of-bounds access when parsing extensions","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00081,"kevAdded":null},{"id":"CVE-2026-31429","published":"2026-04-20T09:43:03.194Z","updated":"2026-05-11T22:08:32.321Z","title":"net: skb: fix cross-cache free of KFENCE-allocated skb head","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2026-31428","published":"2026-04-13T13:40:30.987Z","updated":"2026-10-15T01:16:10.258Z","title":"netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-31427","published":"2026-04-13T13:40:30.280Z","updated":"2026-10-15T01:16:08.245Z","title":"netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-31426","published":"2026-04-13T13:40:29.635Z","updated":"2026-10-19T18:35:47.727Z","title":"ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2026-31425","published":"2026-04-13T13:40:28.911Z","updated":"2026-05-11T22:08:27.602Z","title":"rds: ib: reject FRMR registration before IB connection is established","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-31424","published":"2026-04-13T13:40:27.957Z","updated":"2026-10-15T01:16:06.312Z","title":"netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31423","published":"2026-04-13T13:40:26.567Z","updated":"2026-10-15T01:16:04.497Z","title":"net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-31422","published":"2026-04-13T13:40:25.911Z","updated":"2026-10-15T01:16:02.769Z","title":"net/sched: cls_flow: fix NULL pointer dereference on shared blocks","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31421","published":"2026-04-13T13:40:25.278Z","updated":"2026-10-15T01:16:00.824Z","title":"net/sched: cls_fw: fix NULL pointer dereference on shared blocks","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-31420","published":"2026-04-13T13:40:24.594Z","updated":"2026-09-14T11:58:16.075Z","title":"bridge: mrp: reject zero test interval to avoid OOM panic","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00091,"kevAdded":null},{"id":"CVE-2026-31419","published":"2026-04-13T13:40:23.279Z","updated":"2026-10-30T12:24:11.929Z","title":"net: bonding: fix use-after-free in bond_xmit_broadcast()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-31418","published":"2026-04-13T13:21:05.316Z","updated":"2026-10-15T01:15:59.026Z","title":"netfilter: ipset: drop logically empty buckets in mtype_del","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-31417","published":"2026-04-13T13:21:04.638Z","updated":"2026-10-15T01:15:55.479Z","title":"net/x25: Fix overflow when accumulating packets","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00449,"kevAdded":null},{"id":"CVE-2026-31416","published":"2026-04-13T13:21:03.974Z","updated":"2026-10-15T01:15:53.738Z","title":"netfilter: nfnetlink_log: account for netlink header size","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-31415","published":"2026-04-13T13:21:03.284Z","updated":"2026-10-15T01:15:51.840Z","title":"ipv6: avoid overflows in ip6_datagram_send_ctl()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-31414","published":"2026-04-13T13:21:02.592Z","updated":"2026-10-19T18:35:47.389Z","title":"netfilter: nf_conntrack_expect: use expect->helper","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00559,"kevAdded":null},{"id":"CVE-2026-31413","published":"2026-04-12T05:36:14.632Z","updated":"2026-08-05T12:22:19.762Z","title":"bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2026-31412","published":"2026-04-10T10:35:05.796Z","updated":"2026-05-11T22:08:12.685Z","title":"usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-31411","published":"2026-04-08T13:06:17.800Z","updated":"2026-10-15T01:15:48.319Z","title":"net: atm: fix crash due to unvalidated vcc pointer in sigd_send()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-31410","published":"2026-04-06T07:38:21.876Z","updated":"2026-10-30T12:24:10.863Z","title":"ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-31409","published":"2026-04-06T07:38:21.223Z","updated":"2026-08-05T12:22:18.697Z","title":"ksmbd: unset conn->binding on failed binding request","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00462,"kevAdded":null},{"id":"CVE-2026-31408","published":"2026-04-06T07:38:20.533Z","updated":"2026-10-19T18:35:47.242Z","title":"Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2026-31407","published":"2026-04-06T07:38:19.712Z","updated":"2026-10-19T18:35:47.097Z","title":"netfilter: conntrack: add missing netlink policy validations","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-31406","published":"2026-04-06T07:38:18.840Z","updated":"2026-08-05T12:22:15.395Z","title":"xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-31405","published":"2026-04-06T07:33:00.544Z","updated":"2026-08-05T12:22:14.323Z","title":"media: dvb-net: fix OOB access in ULE extension header tables","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0056,"kevAdded":null},{"id":"CVE-2026-31403","published":"2026-04-03T15:16:06.444Z","updated":"2026-10-19T18:35:46.952Z","title":"NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-31402","published":"2026-04-03T15:16:05.724Z","updated":"2026-10-19T18:35:46.793Z","title":"nfsd: fix heap overflow in NFSv4.0 LOCK replay cache","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.01219,"kevAdded":null},{"id":"CVE-2026-31401","published":"2026-04-03T15:16:04.903Z","updated":"2026-10-19T18:35:46.408Z","title":"HID: bpf: prevent buffer overflow in hid_hw_request","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-31400","published":"2026-04-03T15:16:03.906Z","updated":"2026-05-11T22:07:57.975Z","title":"sunrpc: fix cache_request leak in cache_release","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-31399","published":"2026-04-03T15:16:03.246Z","updated":"2026-05-23T16:04:55.198Z","title":"nvdimm/bus: Fix potential use after free in asynchronous initialization","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-31398","published":"2026-04-03T15:16:02.334Z","updated":"2026-08-05T12:22:08.041Z","title":"mm/rmap: fix incorrect pte restoration for lazyfree folios","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31397","published":"2026-04-03T15:16:01.427Z","updated":"2026-08-05T12:22:06.974Z","title":"mm/huge_memory: fix use of NULL folio in move_pages_huge_pmd()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-31396","published":"2026-04-03T15:16:00.579Z","updated":"2026-10-15T01:15:41.367Z","title":"net: macb: fix use-after-free access to PTP clock","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-31395","published":"2026-04-03T15:15:59.590Z","updated":"2026-05-11T22:07:52.201Z","title":"bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-31394","published":"2026-04-03T15:15:58.806Z","updated":"2026-05-11T22:07:51.015Z","title":"mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2026-31393","published":"2026-04-03T15:15:58.142Z","updated":"2026-10-19T18:35:46.203Z","title":"Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2026-31392","published":"2026-04-03T15:15:57.491Z","updated":"2026-10-19T18:35:46.023Z","title":"smb: client: fix krb5 mount with username option","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-31391","published":"2026-04-03T15:15:56.789Z","updated":"2026-10-15T01:15:39.392Z","title":"crypto: atmel-sha204a - Fix OOM ->tfm_count leak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-31390","published":"2026-04-03T15:15:56.035Z","updated":"2026-05-11T22:07:46.445Z","title":"drm/xe: Fix memory leak in xe_vm_madvise_ioctl","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-31389","published":"2026-04-03T15:15:55.068Z","updated":"2026-10-19T18:35:45.869Z","title":"spi: fix use-after-free on controller registration failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-23475","published":"2026-04-03T15:15:54.211Z","updated":"2026-10-15T01:15:27.585Z","title":"spi: fix statistics allocation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-23474","published":"2026-04-03T15:15:53.406Z","updated":"2026-10-15T01:15:25.838Z","title":"mtd: Avoid boot crash in RedBoot partition table parser","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2026-23472","published":"2026-04-03T15:15:51.209Z","updated":"2026-10-30T12:24:09.804Z","title":"serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-23470","published":"2026-04-03T15:15:49.507Z","updated":"2026-05-11T22:07:40.188Z","title":"drm/imagination: Fix deadlock in soft reset sequence","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00098,"kevAdded":null},{"id":"CVE-2026-23469","published":"2026-04-03T15:15:48.599Z","updated":"2026-06-01T16:11:19.052Z","title":"drm/imagination: Synchronize interrupts before suspending the GPU","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00093,"kevAdded":null},{"id":"CVE-2026-23468","published":"2026-04-03T15:15:47.207Z","updated":"2026-06-01T16:11:15.659Z","title":"drm/amdgpu: Limit BO list entry count to prevent resource exhaustion","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-23467","published":"2026-04-03T15:15:46.483Z","updated":"2026-05-11T22:07:33.221Z","title":"drm/i915/dmc: Fix an unlikely NULL pointer deference at probe","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-23466","published":"2026-04-03T15:15:45.754Z","updated":"2026-10-19T18:35:45.710Z","title":"drm/xe: Open-code GGTT MMIO access protection","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00104,"kevAdded":null},{"id":"CVE-2026-23465","published":"2026-04-03T15:15:44.862Z","updated":"2026-10-30T12:24:08.733Z","title":"btrfs: log new dentries when logging parent dir of a conflicting inode","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-23464","published":"2026-04-03T15:15:43.137Z","updated":"2026-05-11T22:07:29.791Z","title":"soc: microchip: mpfs: Fix memory leak in mpfs_sys_controller_probe()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-23463","published":"2026-04-03T15:15:42.411Z","updated":"2026-10-15T01:15:23.918Z","title":"soc: fsl: qbman: fix race condition in qman_destroy_fq","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00098,"kevAdded":null},{"id":"CVE-2026-23462","published":"2026-04-03T15:15:41.718Z","updated":"2026-10-19T18:35:45.529Z","title":"Bluetooth: HIDP: Fix possible UAF","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2026-23461","published":"2026-04-03T15:15:41.051Z","updated":"2026-10-19T18:35:45.372Z","title":"Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-23460","published":"2026-04-03T15:15:40.364Z","updated":"2026-05-11T22:07:24.969Z","title":"net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-23459","published":"2026-04-03T15:15:39.665Z","updated":"2026-10-21T12:39:14.669Z","title":"ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00503,"kevAdded":null},{"id":"CVE-2026-23458","published":"2026-04-03T15:15:39.041Z","updated":"2026-10-19T18:35:45.043Z","title":"netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2026-23457","published":"2026-04-03T15:15:38.193Z","updated":"2026-10-19T18:35:44.867Z","title":"netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()","severity":"HIGH","score":8.6,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0045,"kevAdded":null},{"id":"CVE-2026-23456","published":"2026-04-03T15:15:37.534Z","updated":"2026-10-19T18:35:44.721Z","title":"netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00543,"kevAdded":null},{"id":"CVE-2026-23455","published":"2026-04-03T15:15:36.869Z","updated":"2026-10-19T18:35:44.554Z","title":"netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.01587,"kevAdded":null},{"id":"CVE-2026-23454","published":"2026-04-03T15:15:36.189Z","updated":"2026-10-15T01:15:14.968Z","title":"net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-23453","published":"2026-04-03T15:15:35.549Z","updated":"2026-08-05T12:21:53.011Z","title":"net: ti: icssg-prueth: Fix memory leak in XDP_DROP for non-zero-copy mode","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-23452","published":"2026-04-03T15:15:34.680Z","updated":"2026-10-15T01:15:13.091Z","title":"PM: runtime: Fix a race condition related to device removal","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-23451","published":"2026-04-03T15:15:33.776Z","updated":"2026-10-30T12:24:07.666Z","title":"bonding: prevent potential infinite loop in bond_header_parse()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00458,"kevAdded":null},{"id":"CVE-2026-23450","published":"2026-04-03T15:15:33.144Z","updated":"2026-10-19T18:35:44.407Z","title":"net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2026-23449","published":"2026-04-03T15:15:32.150Z","updated":"2026-10-19T18:35:44.234Z","title":"net/sched: teql: Fix double-free in teql_master_xmit","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2026-23448","published":"2026-04-03T15:15:31.488Z","updated":"2026-09-14T11:58:15.009Z","title":"net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23447","published":"2026-04-03T15:15:30.495Z","updated":"2026-09-14T11:58:13.940Z","title":"net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23446","published":"2026-04-03T15:15:29.863Z","updated":"2026-10-15T01:15:07.658Z","title":"net: usb: aqc111: Do not perform PM inside suspend callback","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23445","published":"2026-04-03T15:15:29.194Z","updated":"2026-10-19T18:35:44.084Z","title":"igc: fix page fault in XDP TX timestamps handling","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23444","published":"2026-04-03T15:15:28.464Z","updated":"2026-10-19T18:35:43.925Z","title":"wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2026-23443","published":"2026-04-03T15:15:27.698Z","updated":"2026-05-11T22:07:00.396Z","title":"ACPI: processor: Fix previous acpi_processor_errata_piix4() fix","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-23442","published":"2026-04-03T15:15:26.851Z","updated":"2026-10-15T01:15:04.465Z","title":"ipv6: add NULL checks for idev in SRv6 paths","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23441","published":"2026-04-03T15:15:25.380Z","updated":"2026-05-11T22:06:58.123Z","title":"net/mlx5e: Prevent concurrent access to IPSec ASO context","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00092,"kevAdded":null},{"id":"CVE-2026-23440","published":"2026-04-03T15:15:24.596Z","updated":"2026-10-19T18:35:43.781Z","title":"net/mlx5e: Fix race condition during IPSec ESN update","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-23439","published":"2026-04-03T15:15:23.734Z","updated":"2026-10-15T01:15:01.223Z","title":"udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23438","published":"2026-04-03T15:15:22.701Z","updated":"2026-10-15T01:14:58.956Z","title":"net: mvpp2: guard flow control update with global_tx_fc in buffer switching","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23437","published":"2026-04-03T15:15:22.048Z","updated":"2026-10-19T18:35:43.629Z","title":"net: shaper: protect late read accesses to the hierarchy","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-23436","published":"2026-04-03T15:15:21.280Z","updated":"2026-05-11T22:06:52.320Z","title":"net: shaper: protect from late creation of hierarchy","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-23435","published":"2026-04-03T15:15:20.465Z","updated":"2026-05-23T16:04:50.015Z","title":"perf/x86: Move event pointer setup earlier in x86_pmu_enable()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-23434","published":"2026-04-03T15:15:19.450Z","updated":"2026-10-19T18:35:43.464Z","title":"mtd: rawnand: serialize lock/unlock against other NAND operations","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0011,"kevAdded":null},{"id":"CVE-2026-23433","published":"2026-04-03T15:15:18.757Z","updated":"2026-05-11T22:06:48.863Z","title":"arm_mpam: Fix null pointer dereference when restoring bandwidth counters","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00111,"kevAdded":null},{"id":"CVE-2026-23432","published":"2026-04-03T15:15:18.061Z","updated":"2026-08-05T12:21:43.430Z","title":"mshv: Fix use-after-free in mshv_map_user_memory error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-23431","published":"2026-04-03T15:15:17.355Z","updated":"2026-05-11T22:06:46.501Z","title":"spi: amlogic-spisg: Fix memory leak in aml_spisg_probe()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-23430","published":"2026-04-03T15:15:16.687Z","updated":"2026-05-11T22:06:45.354Z","title":"drm/vmwgfx: Don't overwrite KMS surface dirty tracker","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-23429","published":"2026-04-03T15:15:15.856Z","updated":"2026-08-05T12:21:42.311Z","title":"iommu/sva: Fix crash in iommu_sva_unbind_device()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-23428","published":"2026-04-03T15:15:14.981Z","updated":"2026-10-19T18:35:43.298Z","title":"ksmbd: fix use-after-free of share_conf in compound request","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2026-23427","published":"2026-04-03T15:15:14.183Z","updated":"2026-08-05T12:21:40.186Z","title":"ksmbd: fix use-after-free in durable v2 replay of active file handles","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2026-23426","published":"2026-04-03T13:24:34.276Z","updated":"2026-05-11T22:06:40.703Z","title":"drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-23425","published":"2026-04-03T13:24:33.384Z","updated":"2026-08-05T12:21:39.120Z","title":"KVM: arm64: Fix ID register initialization for non-protected pKVM guests","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-23424","published":"2026-04-03T13:24:32.622Z","updated":"2026-08-05T12:21:38.064Z","title":"accel/amdxdna: Validate command buffer payload count","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-23423","published":"2026-04-03T13:24:31.966Z","updated":"2026-05-11T22:06:37.271Z","title":"btrfs: free pages on error in btrfs_uring_read_extent()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-23422","published":"2026-04-03T13:24:31.281Z","updated":"2026-10-15T01:14:55.238Z","title":"dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-23421","published":"2026-04-03T13:24:30.548Z","updated":"2026-05-11T22:06:34.919Z","title":"drm/xe/configfs: Free ctx_restore_mid_bb in release","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-23420","published":"2026-04-03T13:24:29.681Z","updated":"2026-05-11T22:06:33.758Z","title":"wifi: wlcore: Fix a locking bug","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-23419","published":"2026-04-03T13:24:23.958Z","updated":"2026-10-30T12:24:06.599Z","title":"net/rds: Fix circular locking dependency in rds_tcp_tune","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2026-23418","published":"2026-04-03T13:24:22.572Z","updated":"2026-05-11T22:06:31.439Z","title":"drm/xe/reg_sr: Fix leak on xa_store failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-23417","published":"2026-04-02T11:40:57.837Z","updated":"2026-05-11T22:06:30.275Z","title":"bpf: Fix constant blinding for PROBE_MEM32 stores","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-23416","published":"2026-04-02T11:40:57.158Z","updated":"2026-05-11T22:06:29.099Z","title":"mm/mseal: update VMA end correctly on merge","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2026-23415","published":"2026-04-02T11:40:56.476Z","updated":"2026-10-19T18:35:43.155Z","title":"futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-23414","published":"2026-04-02T11:40:55.746Z","updated":"2026-10-19T18:35:42.998Z","title":"tls: Purge async_hold in tls_decrypt_async_wait()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2026-23413","published":"2026-04-02T11:40:54.384Z","updated":"2026-10-19T18:35:42.855Z","title":"clsact: Fix use-after-free in init/destroy rollback asymmetry","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-23412","published":"2026-04-02T11:40:53.528Z","updated":"2026-10-19T18:35:42.715Z","title":"netfilter: bpf: defer hook memory release until rcu readers are done","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-23411","published":"2026-04-01T08:36:39.819Z","updated":"2026-08-05T12:21:31.465Z","title":"apparmor: fix race between freeing data and fs accessing it","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-23410","published":"2026-04-01T08:36:39.202Z","updated":"2026-08-05T12:21:30.404Z","title":"apparmor: fix race on rawdata dereference","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-23409","published":"2026-04-01T08:36:38.516Z","updated":"2026-05-11T22:06:21.118Z","title":"apparmor: fix differential encoding verification","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-23408","published":"2026-04-01T08:36:37.873Z","updated":"2026-08-05T12:21:29.316Z","title":"apparmor: Fix double free of ns_name in aa_replace_profiles()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-23407","published":"2026-04-01T08:36:37.197Z","updated":"2026-08-05T12:21:28.162Z","title":"apparmor: fix missing bounds check on DEFAULT table in verify_dfa()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-23406","published":"2026-04-01T08:36:36.460Z","updated":"2026-08-05T12:21:26.927Z","title":"apparmor: fix side-effect bug in match_char() macro usage","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-23405","published":"2026-04-01T08:36:35.697Z","updated":"2026-05-11T22:06:16.436Z","title":"apparmor: fix: limit the number of levels of policy namespaces","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-23404","published":"2026-04-01T08:36:35.032Z","updated":"2026-05-11T22:06:15.286Z","title":"apparmor: replace recursive profile removal with iterative approach","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-23403","published":"2026-04-01T08:36:34.269Z","updated":"2026-05-11T22:06:14.098Z","title":"apparmor: fix memory leak in verify_header","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-23402","published":"2026-04-01T08:36:33.366Z","updated":"2026-05-11T22:06:12.992Z","title":"KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-23401","published":"2026-04-01T08:36:32.367Z","updated":"2026-07-15T01:18:42.620Z","title":"KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-23400","published":"2026-03-29T12:55:50.660Z","updated":"2026-05-11T22:06:10.668Z","title":"rust_binder: call set_notification_done() without proc lock","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00094,"kevAdded":null},{"id":"CVE-2026-23399","published":"2026-03-28T07:16:09.888Z","updated":"2026-10-15T01:14:51.696Z","title":"nf_tables: nft_dynset: fix possible stateful expression memleak in error path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-23398","published":"2026-03-26T10:22:50.606Z","updated":"2026-10-15T01:14:50.052Z","title":"icmp: fix NULL pointer dereference in icmp_tag_validation()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-23397","published":"2026-03-26T10:22:49.954Z","updated":"2026-10-15T01:14:48.282Z","title":"nfnetlink_osf: validate individual option lengths in fingerprints","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-23396","published":"2026-03-26T10:22:49.287Z","updated":"2026-10-15T01:14:46.530Z","title":"wifi: mac80211: fix NULL deref in mesh_matches_local()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-23395","published":"2026-03-25T10:33:18.936Z","updated":"2026-10-19T18:35:42.470Z","title":"Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2026-23394","published":"2026-03-25T10:33:18.180Z","updated":"2026-08-19T16:27:54.571Z","title":"af_unix: Give up GC if MSG_PEEK intervened.","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00095,"kevAdded":null},{"id":"CVE-2026-23393","published":"2026-03-25T10:33:17.407Z","updated":"2026-08-05T12:21:24.386Z","title":"bridge: cfm: Fix race condition in peer_mep deletion","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00101,"kevAdded":null},{"id":"CVE-2026-23392","published":"2026-03-25T10:33:16.647Z","updated":"2026-10-30T12:24:05.531Z","title":"netfilter: nf_tables: release flowtable after rcu grace period on error","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-23391","published":"2026-03-25T10:33:15.677Z","updated":"2026-10-19T18:35:42.172Z","title":"netfilter: xt_CT: drop pending enqueued packets on template removal","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-23390","published":"2026-03-25T10:29:02.768Z","updated":"2026-05-11T22:05:57.103Z","title":"tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-23389","published":"2026-03-25T10:28:06.991Z","updated":"2026-10-15T01:14:40.268Z","title":"ice: Fix memory leak in ice_set_ringparam()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-23388","published":"2026-03-25T10:28:06.224Z","updated":"2026-10-15T01:14:38.860Z","title":"Squashfs: check metadata block offset is within range","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-23387","published":"2026-03-25T10:28:05.031Z","updated":"2026-05-23T16:04:40.817Z","title":"pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-23386","published":"2026-03-25T10:28:04.118Z","updated":"2026-05-11T22:05:52.379Z","title":"gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-23385","published":"2026-03-25T10:28:03.460Z","updated":"2026-10-30T12:24:04.463Z","title":"netfilter: nf_tables: clone set on flush only","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-23384","published":"2026-03-25T10:28:02.818Z","updated":"2026-05-11T22:05:50.100Z","title":"RDMA/ionic: Fix kernel stack leak in ionic_create_cq()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-23383","published":"2026-03-25T10:28:02.126Z","updated":"2026-10-30T12:24:03.405Z","title":"bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-23382","published":"2026-03-25T10:28:01.040Z","updated":"2026-10-15T01:14:37.641Z","title":"HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2026-23381","published":"2026-03-25T10:28:00.416Z","updated":"2026-10-15T01:14:36.427Z","title":"net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-23380","published":"2026-03-25T10:27:59.682Z","updated":"2026-05-11T22:05:45.422Z","title":"tracing: Fix WARN_ON in tracing_buffers_mmap_close","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2026-23379","published":"2026-03-25T10:27:58.659Z","updated":"2026-10-15T01:14:34.669Z","title":"net/sched: ets: fix divide by zero in the offload path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-23378","published":"2026-03-25T10:27:57.986Z","updated":"2026-10-15T01:14:32.734Z","title":"net/sched: act_ife: Fix metalist update behavior","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2026-23377","published":"2026-03-25T10:27:57.338Z","updated":"2026-10-30T12:24:02.338Z","title":"ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-23376","published":"2026-03-25T10:27:56.458Z","updated":"2026-05-23T16:04:39.819Z","title":"nvmet-fcloop: Check remoteport port_state before calling done callback","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-23375","published":"2026-03-25T10:27:55.754Z","updated":"2026-05-11T22:05:39.614Z","title":"mm: thp: deny THP for files on anonymous inodes","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-23374","published":"2026-03-25T10:27:55.117Z","updated":"2026-10-30T12:24:01.278Z","title":"blktrace: fix __this_cpu_read/write in preemptible context","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-23373","published":"2026-03-25T10:27:54.155Z","updated":"2026-05-11T22:05:37.258Z","title":"wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2026-23372","published":"2026-03-25T10:27:53.308Z","updated":"2026-10-15T01:14:30.909Z","title":"nfc: rawsock: cancel tx_work before socket teardown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2026-23371","published":"2026-03-25T10:27:52.158Z","updated":"2026-10-30T12:24:00.218Z","title":"sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-23370","published":"2026-03-25T10:27:51.370Z","updated":"2026-10-15T01:14:29.707Z","title":"platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23369","published":"2026-03-25T10:27:50.705Z","updated":"2026-05-11T22:05:32.733Z","title":"i2c: i801: Revert \"i2c: i801: replace acpi_lock with I2C bus lock\"","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-23368","published":"2026-03-25T10:27:49.889Z","updated":"2026-10-15T01:14:27.887Z","title":"net: phy: register phy led_triggers during probe to avoid AB-BA deadlock","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00103,"kevAdded":null},{"id":"CVE-2026-23367","published":"2026-03-25T10:27:49.068Z","updated":"2026-10-15T01:14:25.958Z","title":"wifi: radiotap: reject radiotap with unknown bits","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-23366","published":"2026-03-25T10:27:48.311Z","updated":"2026-05-11T22:05:28.991Z","title":"drm/client: Do not destroy NULL modes","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-23365","published":"2026-03-25T10:27:47.609Z","updated":"2026-10-15T01:14:24.758Z","title":"net: usb: kalmia: validate USB endpoints","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23364","published":"2026-03-25T10:27:46.960Z","updated":"2026-10-15T01:14:22.928Z","title":"ksmbd: Compare MACs in constant time","severity":"HIGH","score":7.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-23363","published":"2026-03-25T10:27:46.204Z","updated":"2026-05-11T22:05:25.399Z","title":"wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-23362","published":"2026-03-25T10:27:45.476Z","updated":"2026-05-23T16:04:37.669Z","title":"can: bcm: fix locking for bcm_op runtime updates","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00098,"kevAdded":null},{"id":"CVE-2026-23361","published":"2026-03-25T10:27:44.750Z","updated":"2026-10-30T12:23:59.146Z","title":"PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-23360","published":"2026-03-25T10:27:43.892Z","updated":"2026-05-23T16:04:36.667Z","title":"nvme: fix admin queue leak on controller reset","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-23359","published":"2026-03-25T10:27:43.070Z","updated":"2026-10-15T01:14:21.697Z","title":"bpf: Fix stack-out-of-bounds write in devmap","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2026-23358","published":"2026-03-25T10:27:42.327Z","updated":"2026-05-11T22:05:19.301Z","title":"drm/amdgpu: Fix error handling in slot reset","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-23357","published":"2026-03-25T10:27:41.299Z","updated":"2026-10-15T01:14:19.571Z","title":"can: mcp251x: fix deadlock in error path of mcp251x_open","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00105,"kevAdded":null},{"id":"CVE-2026-23356","published":"2026-03-25T10:27:40.454Z","updated":"2026-10-15T01:14:18.241Z","title":"drbd: fix \"LOGIC BUG\" in drbd_al_begin_io_nonblock()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-23355","published":"2026-03-25T10:27:39.514Z","updated":"2026-10-30T12:23:58.074Z","title":"ata: libata: cancel pending work after clearing deferred_qc","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-23354","published":"2026-03-25T10:27:38.825Z","updated":"2026-05-11T22:05:14.621Z","title":"x86/fred: Correct speculative safety in fred_extint()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23353","published":"2026-03-25T10:27:38.167Z","updated":"2026-10-26T15:12:55.677Z","title":"ice: fix crash in ethtool offline loopback test","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-23352","published":"2026-03-25T10:27:37.500Z","updated":"2026-10-15T01:14:17.020Z","title":"x86/efi: defer freeing of boot services memory","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23351","published":"2026-03-25T10:27:36.854Z","updated":"2026-10-19T18:35:42.025Z","title":"netfilter: nft_set_pipapo: split gc into unlink and reclaim phase","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23350","published":"2026-03-25T10:27:36.182Z","updated":"2026-08-05T12:21:15.714Z","title":"drm/xe/queue: Call fini on exec queue creation fail","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23349","published":"2026-03-25T10:27:35.443Z","updated":"2026-05-11T22:05:08.782Z","title":"HID: pidff: Fix condition effect bit clearing","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-23348","published":"2026-03-25T10:27:34.462Z","updated":"2026-05-11T22:05:07.592Z","title":"cxl: Fix race of nvdimm_bus object when creating nvdimm objects","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00091,"kevAdded":null},{"id":"CVE-2026-23347","published":"2026-03-25T10:27:33.753Z","updated":"2026-05-11T22:05:06.123Z","title":"can: usb: f81604: correctly anchor the urb in the read bulk callback","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-23346","published":"2026-03-25T10:27:33.133Z","updated":"2026-06-19T11:57:35.219Z","title":"arm64: io: Extract user memory type in ioremap_prot()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-23345","published":"2026-03-25T10:27:32.432Z","updated":"2026-05-11T22:05:02.929Z","title":"arm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-23344","published":"2026-03-25T10:27:31.795Z","updated":"2026-05-11T22:05:01.536Z","title":"crypto: ccp - Fix use-after-free on error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-23343","published":"2026-03-25T10:27:31.130Z","updated":"2026-10-15T01:14:14.064Z","title":"xdp: produce a warning when calculated tailroom is negative","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2026-23342","published":"2026-03-25T10:27:30.285Z","updated":"2026-05-11T22:04:59.186Z","title":"bpf: Fix race in cpumap on PREEMPT_RT","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00091,"kevAdded":null},{"id":"CVE-2026-23341","published":"2026-03-25T10:27:29.438Z","updated":"2026-10-15T10:06:58.305Z","title":"accel/amdxdna: Fix crash when destroying a suspended hardware context","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-23340","published":"2026-03-25T10:27:28.728Z","updated":"2026-10-19T18:35:41.889Z","title":"net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-23339","published":"2026-03-25T10:27:28.073Z","updated":"2026-10-15T01:14:10.367Z","title":"nfc: nci: free skb on nci_transceive early error paths","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-23338","published":"2026-03-25T10:27:27.377Z","updated":"2026-05-11T22:04:54.623Z","title":"drm/amdgpu/userq: Do not allow userspace to trivially triger kernel warnings","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-23337","published":"2026-03-25T10:27:26.720Z","updated":"2026-05-11T22:04:53.467Z","title":"pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-23336","published":"2026-03-25T10:27:26.061Z","updated":"2026-10-19T18:35:41.752Z","title":"wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-23335","published":"2026-03-25T10:27:25.418Z","updated":"2026-10-15T01:14:06.028Z","title":"RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23334","published":"2026-03-25T10:27:24.664Z","updated":"2026-05-11T22:04:49.994Z","title":"can: usb: f81604: handle short interrupt urb messages properly","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-23332","published":"2026-03-25T10:27:23.193Z","updated":"2026-05-11T22:04:48.876Z","title":"cpufreq: intel_pstate: Fix crash during turbo disable","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-23331","published":"2026-03-25T10:27:22.526Z","updated":"2026-05-11T22:04:47.743Z","title":"udp: Unhash auto-bound connected sk from 4-tuple hash table when disconnected.","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-23330","published":"2026-03-25T10:27:21.871Z","updated":"2026-10-30T12:23:57.014Z","title":"nfc: nci: complete pending data exchange on device close","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-23329","published":"2026-03-25T10:27:21.212Z","updated":"2026-05-11T22:04:45.405Z","title":"libie: don't unroll if fwlog isn't supported","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-23328","published":"2026-03-25T10:27:20.559Z","updated":"2026-10-15T10:06:57.247Z","title":"accel/amdxdna: Fix NULL pointer dereference of mgmt_chann","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-23327","published":"2026-03-25T10:27:19.815Z","updated":"2026-10-30T12:23:55.930Z","title":"cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-23326","published":"2026-03-25T10:27:19.021Z","updated":"2026-05-11T22:04:42.016Z","title":"xsk: Fix fragment node deletion to prevent buffer leak","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23325","published":"2026-03-25T10:27:18.204Z","updated":"2026-05-11T22:04:40.848Z","title":"wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-23324","published":"2026-03-25T10:27:17.476Z","updated":"2026-05-11T22:04:39.706Z","title":"can: usb: etas_es58x: correctly anchor the urb in the read bulk callback","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-23323","published":"2026-03-25T10:27:16.697Z","updated":"2026-05-11T22:04:38.583Z","title":"hwmon: (macsmc) Fix regressions in Apple Silicon SMC hwmon driver","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-23322","published":"2026-03-25T10:27:15.954Z","updated":"2026-05-11T22:04:37.458Z","title":"ipmi: Fix use-after-free and list corruption on sender error","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-23321","published":"2026-03-25T10:27:15.125Z","updated":"2026-10-15T01:14:04.247Z","title":"mptcp: pm: in-kernel: always mark signal+subflow endp as used","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23319","published":"2026-03-25T10:27:13.678Z","updated":"2026-10-15T01:14:02.294Z","title":"bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-23318","published":"2026-03-25T10:27:12.884Z","updated":"2026-10-15T01:14:00.531Z","title":"ALSA: usb-audio: Use correct version for UAC3 header validation","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-23317","published":"2026-03-25T10:27:11.884Z","updated":"2026-10-19T18:35:41.612Z","title":"drm/vmwgfx: Return the correct value in vmw_translate_ptr functions","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-23316","published":"2026-03-25T10:27:11.028Z","updated":"2026-05-11T22:04:31.681Z","title":"net: ipv4: fix ARM64 alignment fault in multipath hash seed","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-23315","published":"2026-03-25T10:27:10.115Z","updated":"2026-10-15T01:13:58.125Z","title":"wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-23314","published":"2026-03-25T10:27:09.383Z","updated":"2026-05-11T22:04:29.413Z","title":"regulator: bq257xx: Fix device node reference leak in bq257xx_reg_dt_parse_gpio()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-23313","published":"2026-03-25T10:27:08.686Z","updated":"2026-05-11T22:04:28.296Z","title":"i40e: Fix preempt count leak in napi poll tracepoint","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-23312","published":"2026-03-25T10:27:07.916Z","updated":"2026-10-15T01:13:56.754Z","title":"net: usb: kaweth: validate USB endpoints","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-23311","published":"2026-03-25T10:27:06.915Z","updated":"2026-05-11T22:04:25.774Z","title":"perf/core: Fix invalid wait context in ctx_sched_in()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00097,"kevAdded":null},{"id":"CVE-2026-23310","published":"2026-03-25T10:27:05.943Z","updated":"2026-10-15T01:13:55.557Z","title":"bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-23309","published":"2026-03-25T10:27:04.828Z","updated":"2026-05-11T22:04:23.455Z","title":"tracing: Add NULL pointer check to trigger_data_free()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-23308","published":"2026-03-25T10:27:03.536Z","updated":"2026-05-11T22:04:22.327Z","title":"pinctrl: equilibrium: fix warning trace on load","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-23307","published":"2026-03-25T10:27:02.746Z","updated":"2026-05-11T22:04:21.150Z","title":"can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-23306","published":"2026-03-25T10:27:01.719Z","updated":"2026-08-05T12:21:11.431Z","title":"scsi: pm8001: Fix use-after-free in pm8001_queue_command()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-23305","published":"2026-03-25T10:27:00.612Z","updated":"2026-05-11T22:04:18.823Z","title":"accel/rocket: fix unwinding in error path in rocket_probe","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-23304","published":"2026-03-25T10:26:59.015Z","updated":"2026-10-15T01:13:54.349Z","title":"ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23303","published":"2026-03-25T10:26:58.166Z","updated":"2026-10-15T01:13:52.569Z","title":"smb: client: Don't log plaintext credentials in cifs_set_cifscreds","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-23302","published":"2026-03-25T10:26:57.470Z","updated":"2026-10-15T01:13:51.391Z","title":"net: annotate data-races around sk->sk_{data_ready,write_space}","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00093,"kevAdded":null},{"id":"CVE-2026-23301","published":"2026-03-25T10:26:56.830Z","updated":"2026-05-11T22:04:14.186Z","title":"ASoC: SDCA: Add allocation failure check for Entity name","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00111,"kevAdded":null},{"id":"CVE-2026-23300","published":"2026-03-25T10:26:56.138Z","updated":"2026-10-15T01:13:50.190Z","title":"net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23299","published":"2026-03-25T10:26:55.481Z","updated":"2026-05-11T22:04:11.865Z","title":"Bluetooth: purge error queues in socket destructors","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-23298","published":"2026-03-25T10:26:54.830Z","updated":"2026-05-11T22:04:10.668Z","title":"can: ucan: Fix infinite loop from zero-length messages","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-23297","published":"2026-03-25T10:26:54.156Z","updated":"2026-05-11T22:04:09.525Z","title":"nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-23296","published":"2026-03-25T10:26:53.509Z","updated":"2026-10-15T01:13:48.273Z","title":"scsi: core: Fix refcount leak for tagset_refcnt","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-23295","published":"2026-03-25T10:26:52.789Z","updated":"2026-10-15T10:06:56.177Z","title":"accel/amdxdna: Fix dead lock for suspend and resume","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0009,"kevAdded":null},{"id":"CVE-2026-23294","published":"2026-03-25T10:26:51.946Z","updated":"2026-08-05T12:21:10.341Z","title":"bpf: Fix race in devmap on PREEMPT_RT","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00094,"kevAdded":null},{"id":"CVE-2026-23293","published":"2026-03-25T10:26:51.160Z","updated":"2026-10-15T01:13:47.078Z","title":"net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23292","published":"2026-03-25T10:26:50.408Z","updated":"2026-10-15T01:13:45.389Z","title":"scsi: target: Fix recursive locking in __configfs_open_file()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-23291","published":"2026-03-25T10:26:49.634Z","updated":"2026-10-15T01:13:44.177Z","title":"nfc: pn533: properly drop the usb interface reference on disconnect","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-23290","published":"2026-03-25T10:26:48.886Z","updated":"2026-10-15T01:13:42.962Z","title":"net: usb: pegasus: validate USB endpoints","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23289","published":"2026-03-25T10:26:48.207Z","updated":"2026-05-11T22:03:59.470Z","title":"IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-23288","published":"2026-03-25T10:26:47.458Z","updated":"2026-08-05T12:21:09.253Z","title":"accel/amdxdna: Fix out-of-bounds memset in command slot handling","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-23287","published":"2026-03-25T10:26:46.363Z","updated":"2026-10-15T01:13:40.969Z","title":"irqchip/sifive-plic: Fix frozen interrupt due to affinity setting","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-23286","published":"2026-03-25T10:26:45.531Z","updated":"2026-05-11T22:03:55.973Z","title":"atm: lec: fix null-ptr-deref in lec_arp_clear_vccs","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-23285","published":"2026-03-25T10:26:44.698Z","updated":"2026-05-11T22:03:54.818Z","title":"drbd: fix null-pointer dereference on local read error","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-23284","published":"2026-03-25T10:26:44.036Z","updated":"2026-10-15T01:13:39.308Z","title":"net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-23283","published":"2026-03-25T10:26:43.316Z","updated":"2026-05-11T22:03:52.480Z","title":"regulator: fp9931: Fix PM runtime reference leak in fp9931_hwmon_read()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-23282","published":"2026-03-25T10:26:42.495Z","updated":"2026-05-11T22:03:51.018Z","title":"smb: client: fix oops due to uninitialised var in smb2_unlink()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-23281","published":"2026-03-25T10:26:41.844Z","updated":"2026-10-15T01:13:37.602Z","title":"wifi: libertas: fix use-after-free in lbs_free_adapter()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-23280","published":"2026-03-25T10:26:41.088Z","updated":"2026-08-05T12:21:08.197Z","title":"accel/amdxdna: Prevent ubuf size overflow","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-23279","published":"2026-03-25T10:26:39.994Z","updated":"2026-10-15T01:13:36.414Z","title":"wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-31788","published":"2026-03-25T10:25:05.542Z","updated":"2026-10-19T19:06:08.991Z","title":"xen/privcmd: restrict usage in unprivileged domU","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2026-23278","published":"2026-03-20T08:08:58.566Z","updated":"2026-10-30T12:23:54.849Z","title":"netfilter: nf_tables: always walk all pending catchall elements","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-23277","published":"2026-03-20T08:08:57.394Z","updated":"2026-10-15T01:13:33.847Z","title":"net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-23276","published":"2026-03-20T08:08:56.575Z","updated":"2026-10-21T12:39:04.913Z","title":"net: add xmit recursion limit to tunnel xmit functions","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-23275","published":"2026-03-20T08:08:55.857Z","updated":"2026-10-19T18:35:41.307Z","title":"io_uring: ensure ctx->rings is stable for task work flags manipulation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00099,"kevAdded":null},{"id":"CVE-2026-23274","published":"2026-03-20T08:08:54.918Z","updated":"2026-10-19T18:35:41.155Z","title":"netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-23273","published":"2026-03-20T08:08:54.111Z","updated":"2026-10-19T18:35:41.003Z","title":"macvlan: observe an RCU grace period in macvlan_common_newlink() error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-23272","published":"2026-03-20T08:08:52.946Z","updated":"2026-10-30T12:23:53.783Z","title":"netfilter: nf_tables: unconditionally bump set->nelems before insertion","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-23271","published":"2026-03-20T08:08:46.711Z","updated":"2026-10-19T18:35:40.719Z","title":"perf: Fix __perf_event_overflow() vs perf_remove_from_context() race","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00108,"kevAdded":null},{"id":"CVE-2026-23270","published":"2026-03-18T17:54:43.803Z","updated":"2026-10-19T18:35:40.580Z","title":"net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23269","published":"2026-03-18T17:54:42.988Z","updated":"2026-08-05T12:20:59.546Z","title":"apparmor: validate DFA start states are in bounds in unpack_pdb","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-23268","published":"2026-03-18T17:54:41.974Z","updated":"2026-08-05T12:20:58.461Z","title":"apparmor: fix unprivileged local user can do privileged policy management","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-23267","published":"2026-03-18T17:46:09.116Z","updated":"2026-05-11T22:03:33.438Z","title":"f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-23266","published":"2026-03-18T17:44:48.715Z","updated":"2026-05-11T22:03:32.226Z","title":"fbdev: rivafb: fix divide error in nv3_arb()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-23265","published":"2026-03-18T17:44:48.031Z","updated":"2026-05-11T22:03:31.038Z","title":"f2fs: fix to do sanity check on node footer in {read,write}_end_io","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-23264","published":"2026-03-18T17:41:10.208Z","updated":"2026-05-23T16:04:24.012Z","title":"Revert \"drm/amd: Check if ASPM is enabled from PCIe subsystem\"","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2026-23263","published":"2026-03-18T17:41:09.330Z","updated":"2026-05-11T22:03:28.689Z","title":"io_uring/zcrx: fix page array leak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00104,"kevAdded":null},{"id":"CVE-2026-23262","published":"2026-03-18T17:41:08.380Z","updated":"2026-05-11T22:03:27.465Z","title":"gve: Fix stats report corruption on queue count change","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2026-23261","published":"2026-03-18T17:41:07.478Z","updated":"2026-05-23T16:04:22.947Z","title":"nvme-fc: release admin tagset if init fails","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2026-23260","published":"2026-03-18T17:41:06.738Z","updated":"2026-05-11T22:03:25.152Z","title":"regmap: maple: free entry on mas_store_gfp() failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2026-23259","published":"2026-03-18T17:41:05.827Z","updated":"2026-10-21T12:39:03.826Z","title":"io_uring/rw: free potentially allocated iovec on cache put failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-23258","published":"2026-03-18T17:41:05.080Z","updated":"2026-05-11T22:03:22.860Z","title":"net: liquidio: Initialize netdev pointer before queue setup","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-23257","published":"2026-03-18T17:41:04.078Z","updated":"2026-05-11T22:03:21.725Z","title":"net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-23256","published":"2026-03-18T17:41:02.964Z","updated":"2026-05-11T22:03:20.564Z","title":"net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-23255","published":"2026-03-18T17:41:01.445Z","updated":"2026-10-15T01:13:23.448Z","title":"net: add proper RCU protection to /proc/net/ptype","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-23254","published":"2026-03-18T17:41:00.591Z","updated":"2026-05-23T16:04:21.918Z","title":"net: gro: fix outer network offset","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2025-71270","published":"2026-03-18T17:40:59.838Z","updated":"2026-05-11T21:57:08.956Z","title":"LoongArch: Enable exception fixup for specific ADE subcode","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00125,"kevAdded":null},{"id":"CVE-2025-71269","published":"2026-03-18T17:40:58.949Z","updated":"2026-10-19T18:25:25.160Z","title":"btrfs: do not free data reservation in fallback from inline due to -ENOSPC","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-71268","published":"2026-03-18T17:40:58.080Z","updated":"2026-10-19T18:25:25.013Z","title":"btrfs: fix reservation leak in some error paths when inserting inline extent","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00319,"kevAdded":null},{"id":"CVE-2026-23253","published":"2026-03-18T17:01:44.126Z","updated":"2026-10-19T18:35:40.421Z","title":"media: dvb-core: fix wrong reinitialization of ringbuffer on reopen","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-23252","published":"2026-03-18T17:01:43.223Z","updated":"2026-05-11T22:03:15.907Z","title":"xfs: get rid of the xchk_xfile_*_descr calls","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-23251","published":"2026-03-18T17:01:42.483Z","updated":"2026-05-11T22:03:14.783Z","title":"xfs: only call xf{array,blob}_destroy if we have a valid pointer","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-23250","published":"2026-03-18T17:01:41.563Z","updated":"2026-05-11T22:03:13.623Z","title":"xfs: check return value of xchk_scrub_create_subord","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-23249","published":"2026-03-18T17:01:40.653Z","updated":"2026-05-11T22:03:12.432Z","title":"xfs: check for deleted cursors when revalidating two btrees","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-23248","published":"2026-03-18T10:05:10.070Z","updated":"2026-10-19T18:35:40.258Z","title":"perf/core: Fix refcount bug and potential UAF in perf_mmap","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-23247","published":"2026-03-18T10:05:09.353Z","updated":"2026-10-30T12:23:52.715Z","title":"tcp: secure_seq: add back ports to TS offset","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-23246","published":"2026-03-18T10:05:08.312Z","updated":"2026-08-05T12:20:55.228Z","title":"wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-23245","published":"2026-03-18T10:05:07.406Z","updated":"2026-10-15T01:13:20.381Z","title":"net/sched: act_gate: snapshot parameters with RCU on replace","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-23244","published":"2026-03-18T10:05:06.534Z","updated":"2026-05-11T22:03:06.676Z","title":"nvme: fix memory allocation in nvme_pr_read_keys()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-23243","published":"2026-03-18T10:05:05.826Z","updated":"2026-10-19T18:35:40.101Z","title":"RDMA/umad: Reject negative data_len in ib_umad_write","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-23242","published":"2026-03-18T10:05:05.108Z","updated":"2026-10-19T18:35:39.941Z","title":"RDMA/siw: Fix potential NULL pointer dereference in header processing","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00614,"kevAdded":null},{"id":"CVE-2025-71267","published":"2026-03-18T10:05:04.008Z","updated":"2026-10-15T01:11:22.354Z","title":"fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2025-71266","published":"2026-03-18T10:05:02.997Z","updated":"2026-10-15T01:11:20.615Z","title":"fs: ntfs3: check return value of indx_find to avoid infinite loop","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2025-71265","published":"2026-03-18T10:05:01.779Z","updated":"2026-10-15T01:11:16.636Z","title":"fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-23241","published":"2026-03-17T09:11:04.913Z","updated":"2026-05-11T22:03:03.259Z","title":"audit: add missing syscalls to read class","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2025-71239","published":"2026-03-17T09:11:03.386Z","updated":"2026-05-11T21:57:01.981Z","title":"audit: add fchmodat2() to change attributes class","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-23240","published":"2026-03-10T17:28:27.371Z","updated":"2026-10-19T18:35:39.775Z","title":"tls: Fix race condition in tls_sw_cancel_work_tx()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00521,"kevAdded":null},{"id":"CVE-2026-23239","published":"2026-03-10T17:28:26.190Z","updated":"2026-10-19T18:35:39.619Z","title":"espintcp: Fix race condition in espintcp_close()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2024-14027","published":"2026-03-09T15:51:12.634Z","updated":"2026-05-23T15:35:40.032Z","title":"xattr: switch to CLASS(fd)","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2026-23238","published":"2026-03-04T14:38:42.477Z","updated":"2026-06-02T13:01:09.124Z","title":"romfs: check sb_set_blocksize() return value","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-23237","published":"2026-03-04T14:38:41.815Z","updated":"2026-05-11T22:02:58.604Z","title":"platform/x86: classmate-laptop: Add missing NULL pointer checks","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-23236","published":"2026-03-04T14:36:40.162Z","updated":"2026-08-05T12:20:48.788Z","title":"fbdev: smscufx: properly copy ioctl memory to kernelspace","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-23235","published":"2026-03-04T14:36:39.537Z","updated":"2026-05-11T22:02:56.280Z","title":"f2fs: fix out-of-bounds access in sysfs attribute read/write","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-23234","published":"2026-03-04T14:36:38.843Z","updated":"2026-05-11T22:02:55.136Z","title":"f2fs: fix to avoid UAF in f2fs_write_end_io()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2026-23233","published":"2026-03-04T14:36:38.076Z","updated":"2026-05-23T16:04:19.799Z","title":"f2fs: fix to avoid mapping wrong physical block for swapfile","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-23232","published":"2026-03-04T14:36:37.323Z","updated":"2026-05-11T22:02:52.855Z","title":"Revert \"f2fs: block cache/dio write during f2fs_enable_checkpoint()\"","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2025-71238","published":"2026-03-04T14:36:36.579Z","updated":"2026-10-19T18:25:24.871Z","title":"scsi: qla2xxx: Fix bsg_done() causing double free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-23231","published":"2026-03-04T12:58:42.029Z","updated":"2026-10-19T18:35:39.463Z","title":"netfilter: nf_tables: fix use-after-free in nf_tables_addchain()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.01045,"kevAdded":null},{"id":"CVE-2026-23230","published":"2026-02-18T14:53:34.078Z","updated":"2026-10-19T18:35:39.300Z","title":"smb: client: split cached_fid bitfields to avoid shared-byte RMW races","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-23229","published":"2026-02-18T14:53:33.015Z","updated":"2026-06-02T13:01:04.602Z","title":"crypto: virtio - Add spinlock protection with virtqueue notification","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-23228","published":"2026-02-18T14:53:31.882Z","updated":"2026-06-02T13:01:03.442Z","title":"smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-23227","published":"2026-02-18T14:53:30.784Z","updated":"2026-08-05T12:20:45.582Z","title":"drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-23226","published":"2026-02-18T14:53:29.562Z","updated":"2026-10-30T12:23:51.650Z","title":"ksmbd: add chann_lock to protect ksmbd_chann_list xarray","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00505,"kevAdded":null},{"id":"CVE-2026-23225","published":"2026-02-18T14:53:28.387Z","updated":"2026-08-05T12:20:43.404Z","title":"sched/mmcid: Don't assume CID is CPU owned on mode switch","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-23224","published":"2026-02-18T14:53:27.462Z","updated":"2026-08-05T12:20:42.343Z","title":"erofs: fix UAF issue for file-backed mounts w/ directio option","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2026-23223","published":"2026-02-18T14:53:26.603Z","updated":"2026-05-11T22:02:42.267Z","title":"xfs: fix UAF in xchk_btree_check_block_owner","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2026-23222","published":"2026-02-18T14:53:25.504Z","updated":"2026-08-05T12:20:41.276Z","title":"crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2026-23221","published":"2026-02-18T14:53:24.391Z","updated":"2026-05-11T22:02:39.852Z","title":"bus: fsl-mc: fix use-after-free in driver_override_show()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-23220","published":"2026-02-18T14:53:23.376Z","updated":"2026-06-02T13:01:00.611Z","title":"ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2025-71237","published":"2026-02-18T14:53:22.436Z","updated":"2026-05-11T21:56:59.574Z","title":"nilfs2: Fix potential block overflow that cause system hang","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2025-71236","published":"2026-02-18T14:53:21.339Z","updated":"2026-10-19T18:25:24.730Z","title":"scsi: qla2xxx: Validate sp before freeing associated memory","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00379,"kevAdded":null},{"id":"CVE-2025-71235","published":"2026-02-18T14:53:20.222Z","updated":"2026-10-19T18:25:24.584Z","title":"scsi: qla2xxx: Delay module unload while fabric scan in progress","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-71234","published":"2026-02-18T14:53:18.893Z","updated":"2026-10-19T18:25:24.435Z","title":"wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-71233","published":"2026-02-18T14:53:17.926Z","updated":"2026-05-11T21:56:54.929Z","title":"PCI: endpoint: Avoid creating sub-groups asynchronously","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2025-71232","published":"2026-02-18T14:53:16.709Z","updated":"2026-10-19T18:25:24.277Z","title":"scsi: qla2xxx: Free sp in error path to fix system crash","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2025-71231","published":"2026-02-18T14:53:15.668Z","updated":"2026-05-11T21:56:52.247Z","title":"crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2025-71230","published":"2026-02-18T14:53:14.519Z","updated":"2026-05-11T21:56:51.030Z","title":"hfs: ensure sb->s_fs_info is always cleaned up","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2025-71229","published":"2026-02-18T14:53:13.412Z","updated":"2026-05-11T21:56:49.865Z","title":"wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-23219","published":"2026-02-18T14:21:57.049Z","updated":"2026-05-11T22:02:37.509Z","title":"mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-23218","published":"2026-02-18T14:21:55.906Z","updated":"2026-05-11T22:02:36.315Z","title":"gpio: loongson-64bit: Fix incorrect NULL check after devm_kcalloc()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2026-23217","published":"2026-02-18T14:21:54.878Z","updated":"2026-10-21T12:39:00.498Z","title":"riscv: trace: fix snapshot deadlock with sbi ecall","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2026-23216","published":"2026-02-18T14:21:53.699Z","updated":"2026-10-19T18:35:39.164Z","title":"scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-23215","published":"2026-02-18T14:21:52.515Z","updated":"2026-05-11T22:02:32.925Z","title":"x86/vmware: Fix hypercall clobbers","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-23214","published":"2026-02-18T14:21:51.507Z","updated":"2026-10-30T12:23:50.576Z","title":"btrfs: reject new transactions if the fs is fully read-only","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-23213","published":"2026-02-18T14:21:50.637Z","updated":"2026-10-30T12:23:49.510Z","title":"drm/amd/pm: Disable MMIO access during SMU Mode 1 reset","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2025-71227","published":"2026-02-18T14:21:48.422Z","updated":"2026-10-30T12:23:33.421Z","title":"wifi: mac80211: don't WARN for connections on invalid channels","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2025-71225","published":"2026-02-18T14:21:46.249Z","updated":"2026-10-21T12:38:36.561Z","title":"md: suspend array while updating raid_disks via sysfs","severity":"MEDIUM","score":5.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-23212","published":"2026-02-18T14:16:28.104Z","updated":"2026-10-19T18:35:39.012Z","title":"bonding: annotate data-races around slave->last_rx","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00102,"kevAdded":null},{"id":"CVE-2026-23211","published":"2026-02-18T14:16:27.015Z","updated":"2026-05-11T22:02:28.280Z","title":"mm, swap: restore swap_space attr aviod kernel panic","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2026-23210","published":"2026-02-14T16:27:31.892Z","updated":"2026-10-19T18:35:38.869Z","title":"ice: Fix PTP NULL pointer dereference during VSI rebuild","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00097,"kevAdded":null},{"id":"CVE-2026-23209","published":"2026-02-14T16:27:31.175Z","updated":"2026-10-19T18:35:38.702Z","title":"macvlan: fix error recovery in macvlan_common_newlink()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-23208","published":"2026-02-14T16:27:30.441Z","updated":"2026-10-30T12:23:48.451Z","title":"ALSA: usb-audio: Prevent excessive number of frames","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-23207","published":"2026-02-14T16:27:29.762Z","updated":"2026-10-30T12:23:47.371Z","title":"spi: tegra210-quad: Protect curr_xfer check in IRQ handler","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-23206","published":"2026-02-14T16:27:29.095Z","updated":"2026-05-11T22:02:22.500Z","title":"dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23205","published":"2026-02-14T16:27:28.409Z","updated":"2026-05-23T16:04:10.175Z","title":"smb/client: fix memory leak in smb2_open_file()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-23204","published":"2026-02-14T16:27:27.708Z","updated":"2026-10-19T18:35:38.542Z","title":"net/sched: cls_u32: use skb_header_pointer_careful()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-23203","published":"2026-02-14T16:27:27.048Z","updated":"2026-05-11T22:02:19.074Z","title":"net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2026-23202","published":"2026-02-14T16:27:26.365Z","updated":"2026-10-19T18:35:38.384Z","title":"spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00102,"kevAdded":null},{"id":"CVE-2026-23201","published":"2026-02-14T16:27:25.693Z","updated":"2026-09-14T11:58:12.875Z","title":"ceph: fix oops due to invalid pointer for kfree() in parse_longname()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-23200","published":"2026-02-14T16:27:25.025Z","updated":"2026-05-23T16:04:06.072Z","title":"ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-23199","published":"2026-02-14T16:27:24.326Z","updated":"2026-05-11T22:02:14.489Z","title":"procfs: avoid fetching build ID while holding VMA lock","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00103,"kevAdded":null},{"id":"CVE-2026-23198","published":"2026-02-14T16:27:23.621Z","updated":"2026-10-19T18:25:35.016Z","title":"KVM: Don't clobber irqfd routing type when deassigning irqfd","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-23197","published":"2026-02-14T16:27:22.919Z","updated":"2026-05-11T22:02:12.157Z","title":"i2c: imx: preserve error state in block data length handler","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2026-23196","published":"2026-02-14T16:27:22.264Z","updated":"2026-05-11T22:02:10.967Z","title":"HID: Intel-thc-hid: Intel-thc: Add safety check for reading DMA buffer","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-23195","published":"2026-02-14T16:27:21.621Z","updated":"2026-08-05T12:20:36.969Z","title":"cgroup/dmem: avoid pool UAF","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-23194","published":"2026-02-14T16:27:20.944Z","updated":"2026-05-11T22:02:08.665Z","title":"rust_binder: correctly handle FDA objects of length zero","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-23193","published":"2026-02-14T16:27:20.251Z","updated":"2026-10-19T18:25:34.873Z","title":"scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00363,"kevAdded":null},{"id":"CVE-2026-23192","published":"2026-02-14T16:27:19.557Z","updated":"2026-08-05T12:20:34.811Z","title":"linkwatch: use __dev_put() in callers to prevent UAF","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-23191","published":"2026-02-14T16:27:18.882Z","updated":"2026-10-19T18:25:34.731Z","title":"ALSA: aloop: Fix racy access at PCM trigger","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-23190","published":"2026-02-14T16:27:18.203Z","updated":"2026-05-11T22:02:04.082Z","title":"ASoC: amd: fix memory leak in acp3x pdm dma ops","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23189","published":"2026-02-14T16:27:17.549Z","updated":"2026-05-23T16:04:05.037Z","title":"ceph: fix NULL pointer dereference in ceph_mds_auth_match()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-23188","published":"2026-02-14T16:27:16.869Z","updated":"2026-05-11T22:02:01.716Z","title":"net: usb: r8152: fix resume reset deadlock","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00102,"kevAdded":null},{"id":"CVE-2026-23187","published":"2026-02-14T16:27:16.200Z","updated":"2026-05-11T22:02:00.524Z","title":"pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-23186","published":"2026-02-14T16:27:15.505Z","updated":"2026-05-11T22:01:59.107Z","title":"hwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-23185","published":"2026-02-14T16:27:14.815Z","updated":"2026-10-19T18:25:34.589Z","title":"wifi: iwlwifi: mld: cancel mlo_scan_start_wk","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2026-23184","published":"2026-02-14T16:27:14.167Z","updated":"2026-08-05T12:20:31.428Z","title":"binder: fix UAF in binder_netlink_report()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2026-23183","published":"2026-02-14T16:27:13.482Z","updated":"2026-05-11T22:01:55.689Z","title":"cgroup/dmem: fix NULL pointer dereference when setting max","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-23182","published":"2026-02-14T16:27:12.806Z","updated":"2026-05-23T16:04:03.906Z","title":"spi: tegra: Fix a memory leak in tegra_slink_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-23181","published":"2026-02-14T16:27:12.137Z","updated":"2026-05-11T22:01:53.361Z","title":"btrfs: sync read disk super and set block size","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-23180","published":"2026-02-14T16:27:11.463Z","updated":"2026-10-19T18:25:34.438Z","title":"dpaa2-switch: add bounds check for if_id in IRQ handler","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-23179","published":"2026-02-14T16:27:10.778Z","updated":"2026-05-11T22:01:51.043Z","title":"nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-23178","published":"2026-02-14T16:27:10.108Z","updated":"2026-10-19T18:25:34.295Z","title":"HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2026-23177","published":"2026-02-14T16:27:09.429Z","updated":"2026-05-11T22:01:48.769Z","title":"mm, shmem: prevent infinite loop on truncate race","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2026-23176","published":"2026-02-14T16:27:08.764Z","updated":"2026-05-11T22:01:47.639Z","title":"platform/x86: toshiba_haps: Fix memory leaks in add/remove routines","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-23175","published":"2026-02-14T16:27:08.104Z","updated":"2026-08-05T12:20:28.160Z","title":"net: cpsw: Execute ndo_set_rx_mode callback in a work queue","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-23174","published":"2026-02-14T16:27:07.421Z","updated":"2026-05-11T22:01:45.336Z","title":"nvme-pci: handle changing device dma map requirements","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-71224","published":"2026-02-14T16:27:06.752Z","updated":"2026-05-11T21:56:46.366Z","title":"wifi: mac80211: ocb: skip rx_no_sta when interface is not joined","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2025-71223","published":"2026-02-14T16:27:06.060Z","updated":"2026-05-23T16:03:32.409Z","title":"smb/server: fix refcount leak in smb2_open()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2025-71222","published":"2026-02-14T16:27:05.363Z","updated":"2026-05-11T21:56:44.056Z","title":"wifi: wlcore: ensure skb headroom before skb_push","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-71221","published":"2026-02-14T16:27:04.631Z","updated":"2026-10-15T01:11:14.914Z","title":"dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2025-71220","published":"2026-02-14T16:27:03.946Z","updated":"2026-05-23T16:03:31.433Z","title":"smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-71204","published":"2026-02-14T16:27:03.252Z","updated":"2026-08-05T12:12:32.645Z","title":"smb/server: fix refcount leak in parse_durable_handle_context()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2025-71203","published":"2026-02-14T16:27:02.513Z","updated":"2026-05-11T21:56:39.295Z","title":"riscv: Sanitize syscall table indexing under speculation","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2026-23173","published":"2026-02-14T16:01:34.842Z","updated":"2026-05-11T22:01:44.197Z","title":"net/mlx5e: TC, delete flows only for existing peers","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23172","published":"2026-02-14T16:01:34.165Z","updated":"2026-10-19T18:25:34.153Z","title":"net: wwan: t7xx: fix potential skb->frags overflow in RX path","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2026-23171","published":"2026-02-14T16:01:33.489Z","updated":"2026-10-30T12:23:46.313Z","title":"bonding: fix use-after-free due to enslave fail after slave array update","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-23170","published":"2026-02-14T16:01:32.833Z","updated":"2026-05-11T22:01:40.668Z","title":"drm/imx/tve: fix probe device leak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23169","published":"2026-02-14T16:01:32.139Z","updated":"2026-08-05T12:20:24.946Z","title":"mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2026-23168","published":"2026-02-14T16:01:31.465Z","updated":"2026-05-11T22:01:38.422Z","title":"flex_proportions: make fprop_new_period() hardirq safe","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23167","published":"2026-02-14T16:01:30.755Z","updated":"2026-05-11T22:01:37.240Z","title":"nfc: nci: Fix race between rfkill and nci_unregister_device().","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00099,"kevAdded":null},{"id":"CVE-2026-23166","published":"2026-02-14T16:01:30.059Z","updated":"2026-05-23T16:04:02.615Z","title":"ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-23165","published":"2026-02-14T16:01:29.336Z","updated":"2026-05-11T22:01:34.933Z","title":"sfc: fix deadlock in RSS config read","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00092,"kevAdded":null},{"id":"CVE-2026-23164","published":"2026-02-14T16:01:28.624Z","updated":"2026-10-19T18:25:33.850Z","title":"rocker: fix memory leak in rocker_world_port_post_fini()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-23163","published":"2026-02-14T16:01:27.912Z","updated":"2026-05-11T22:01:25.841Z","title":"drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23162","published":"2026-02-14T16:01:27.243Z","updated":"2026-05-11T22:01:24.681Z","title":"drm/xe/nvm: Fix double-free on aux add failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-23161","published":"2026-02-14T16:01:26.569Z","updated":"2026-08-05T12:20:23.871Z","title":"mm/shmem, swap: fix race of truncate and swap entry split","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00103,"kevAdded":null},{"id":"CVE-2026-23160","published":"2026-02-14T16:01:25.900Z","updated":"2026-05-11T22:01:22.444Z","title":"octeon_ep: Fix memory leak in octep_device_setup()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23159","published":"2026-02-14T16:01:25.229Z","updated":"2026-05-23T16:04:01.503Z","title":"perf: sched: Fix perf crash with new is_user_task() helper","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23158","published":"2026-02-14T16:01:24.568Z","updated":"2026-05-11T22:01:20.155Z","title":"gpio: virtuser: fix UAF in configfs release path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-23157","published":"2026-02-14T16:01:23.874Z","updated":"2026-10-15T01:13:11.080Z","title":"btrfs: do not strictly require dirty metadata threshold for metadata writepages","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-23156","published":"2026-02-14T16:01:23.215Z","updated":"2026-05-11T22:01:17.796Z","title":"efivarfs: fix error propagation in efivar_entry_get()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2026-23155","published":"2026-02-14T16:01:22.429Z","updated":"2026-05-11T22:01:16.668Z","title":"can: gs_usb: gs_usb_receive_bulk_callback(): fix error message","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23154","published":"2026-02-14T16:01:21.758Z","updated":"2026-10-19T18:25:33.706Z","title":"net: fix segmentation of forwarding fraglist GRO","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-23153","published":"2026-02-14T16:01:21.077Z","updated":"2026-05-11T22:01:14.351Z","title":"firewire: core: fix race condition against transaction list","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00085,"kevAdded":null},{"id":"CVE-2026-23152","published":"2026-02-14T16:01:20.379Z","updated":"2026-05-11T22:01:13.150Z","title":"wifi: mac80211: correctly decode TTLM with default link map","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2026-23151","published":"2026-02-14T16:01:19.663Z","updated":"2026-05-23T16:04:00.411Z","title":"Bluetooth: MGMT: Fix memory leak in set_ssp_complete","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23150","published":"2026-02-14T16:01:18.968Z","updated":"2026-05-11T22:01:10.727Z","title":"nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23149","published":"2026-02-14T16:01:18.281Z","updated":"2026-05-11T22:01:09.528Z","title":"drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2026-23148","published":"2026-02-14T16:01:17.575Z","updated":"2026-10-19T18:25:33.568Z","title":"nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2026-23147","published":"2026-02-14T16:01:16.917Z","updated":"2026-05-11T22:01:07.231Z","title":"btrfs: zlib: fix the folio leak on S390 hardware acceleration","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-23146","published":"2026-02-14T16:01:16.169Z","updated":"2026-10-19T18:25:33.428Z","title":"Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23145","published":"2026-02-14T15:36:10.207Z","updated":"2026-10-19T18:25:33.284Z","title":"ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2026-23144","published":"2026-02-14T15:36:09.518Z","updated":"2026-10-19T18:25:33.137Z","title":"mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-23143","published":"2026-02-14T15:36:08.834Z","updated":"2026-10-21T12:38:54.971Z","title":"virtio_net: Fix misalignment bug in struct virtnet_info","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-23142","published":"2026-02-14T15:36:08.147Z","updated":"2026-05-11T22:00:56.683Z","title":"mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-23141","published":"2026-02-14T15:36:07.417Z","updated":"2026-10-15T01:13:08.163Z","title":"btrfs: send: check for inline extents in range_is_hole_in_parent()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2025-71202","published":"2026-02-14T15:36:06.588Z","updated":"2026-10-19T18:25:23.994Z","title":"iommu/sva: invalidate stale IOTLB entries for kernel address space","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-23140","published":"2026-02-14T15:22:24.727Z","updated":"2026-05-11T22:00:54.453Z","title":"bpf, test_run: Subtract size of xdp_frame from allowed metadata size","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-23139","published":"2026-02-14T15:22:24.059Z","updated":"2026-08-05T12:20:21.709Z","title":"netfilter: nf_conncount: update last_gc only when GC has been performed","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-23138","published":"2026-02-14T15:22:23.385Z","updated":"2026-10-30T12:23:45.218Z","title":"tracing: Add recursion protection in kernel stack trace recording","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-23137","published":"2026-02-14T15:22:22.690Z","updated":"2026-10-30T12:23:44.164Z","title":"of: unittest: Fix memory leak in unittest_data_add()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-23136","published":"2026-02-14T15:22:21.952Z","updated":"2026-10-19T18:25:32.994Z","title":"libceph: reset sparse-read state in osd_fault()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2025-71201","published":"2026-02-14T15:22:21.233Z","updated":"2026-08-05T12:12:30.514Z","title":"netfs: Fix early read unlock of page with EOF in middle","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2026-23135","published":"2026-02-14T15:14:34.473Z","updated":"2026-05-11T22:00:48.767Z","title":"wifi: ath12k: fix dma_free_coherent() pointer","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-23134","published":"2026-02-14T15:14:33.806Z","updated":"2026-05-11T22:00:47.654Z","title":"slab: fix kmalloc_nolock() context check for PREEMPT_RT","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-23133","published":"2026-02-14T15:14:33.102Z","updated":"2026-10-19T18:25:32.854Z","title":"wifi: ath10k: fix dma_free_coherent() pointer","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2026-23132","published":"2026-02-14T15:14:32.334Z","updated":"2026-05-11T22:00:45.341Z","title":"drm/bridge: synopsys: dw-dp: fix error paths of dw_dp_bind","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-23131","published":"2026-02-14T15:09:58.916Z","updated":"2026-05-11T22:00:43.817Z","title":"platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-23130","published":"2026-02-14T15:09:58.239Z","updated":"2026-05-11T22:00:42.629Z","title":"wifi: ath12k: fix dead lock while flushing management frames","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00092,"kevAdded":null},{"id":"CVE-2026-23129","published":"2026-02-14T15:09:57.574Z","updated":"2026-05-11T22:00:41.442Z","title":"dpll: Prevent duplicate registrations","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23128","published":"2026-02-14T15:09:56.916Z","updated":"2026-10-19T18:25:32.703Z","title":"arm64: Set __nocfi on swsusp_arch_resume()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-23127","published":"2026-02-14T15:09:56.237Z","updated":"2026-05-11T22:00:39.060Z","title":"perf: Fix refcount warning on event->mmap_count increment","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-23126","published":"2026-02-14T15:09:55.552Z","updated":"2026-10-19T18:25:32.555Z","title":"netdevsim: fix a race issue related to the operation on bpf_bound_progs list","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00099,"kevAdded":null},{"id":"CVE-2026-23125","published":"2026-02-14T15:09:54.756Z","updated":"2026-10-19T18:25:32.393Z","title":"sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23124","published":"2026-02-14T15:09:54.043Z","updated":"2026-10-19T18:25:32.245Z","title":"ipv6: annotate data-race in ndisc_router_discovery()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00105,"kevAdded":null},{"id":"CVE-2026-23123","published":"2026-02-14T15:09:53.369Z","updated":"2026-05-11T22:00:34.413Z","title":"interconnect: debugfs: initialize src_node and dst_node to empty strings","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2026-23122","published":"2026-02-14T15:09:52.592Z","updated":"2026-05-11T22:00:33.309Z","title":"igc: Reduce TSN TX packet buffer from 7KB to 5KB per queue","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-23121","published":"2026-02-14T15:09:51.912Z","updated":"2026-10-19T18:25:32.103Z","title":"mISDN: annotate data-race around dev->work","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0011,"kevAdded":null},{"id":"CVE-2026-23120","published":"2026-02-14T15:09:51.223Z","updated":"2026-10-19T18:25:31.962Z","title":"l2tp: avoid one data-race in l2tp_tunnel_del_work()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00105,"kevAdded":null},{"id":"CVE-2026-23119","published":"2026-02-14T15:09:50.517Z","updated":"2026-10-19T18:25:31.818Z","title":"bonding: provide a net pointer to __skb_flow_dissect()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-23118","published":"2026-02-14T15:09:49.845Z","updated":"2026-10-30T12:23:43.092Z","title":"rxrpc: Fix data-race warning and potential load/store tearing","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00098,"kevAdded":null},{"id":"CVE-2026-23117","published":"2026-02-14T15:09:49.188Z","updated":"2026-05-11T22:00:27.366Z","title":"ice: add missing ice_deinit_hw() in devlink reinit path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2026-23116","published":"2026-02-14T15:09:48.511Z","updated":"2026-05-11T22:00:26.074Z","title":"pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-23115","published":"2026-02-14T15:09:47.826Z","updated":"2026-05-11T22:00:24.910Z","title":"serial: Fix not set tty->port race condition","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00085,"kevAdded":null},{"id":"CVE-2026-23114","published":"2026-02-14T15:09:47.048Z","updated":"2026-05-11T22:00:23.756Z","title":"arm64/fpsimd: ptrace: Fix SVE writes on !SME systems","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-23113","published":"2026-02-14T15:09:46.379Z","updated":"2026-10-15T01:13:06.978Z","title":"io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-71200","published":"2026-02-14T15:09:45.689Z","updated":"2026-05-11T21:56:35.824Z","title":"mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-23112","published":"2026-02-13T13:29:56.724Z","updated":"2026-10-19T18:25:31.675Z","title":"nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-23111","published":"2026-02-13T13:29:55.895Z","updated":"2026-10-15T01:13:04.873Z","title":"netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00519,"kevAdded":null},{"id":"CVE-2026-23110","published":"2026-02-04T16:08:30.158Z","updated":"2026-10-19T18:25:31.536Z","title":"scsi: core: Wake up the error handler when final completions race against each other","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00113,"kevAdded":null},{"id":"CVE-2026-23109","published":"2026-02-04T16:08:29.468Z","updated":"2026-05-11T22:00:17.858Z","title":"fs/writeback: skip AS_NO_DATA_INTEGRITY mappings in wait_sb_inodes()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-23108","published":"2026-02-04T16:08:28.650Z","updated":"2026-10-19T18:25:31.374Z","title":"can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2026-23107","published":"2026-02-04T16:08:27.755Z","updated":"2026-05-11T22:00:15.573Z","title":"arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2026-23106","published":"2026-02-04T16:08:27.046Z","updated":"2026-05-11T22:00:14.456Z","title":"timekeeping: Adjust the leap state for the correct auxiliary timekeeper","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-23105","published":"2026-02-04T16:08:26.376Z","updated":"2026-10-19T18:25:31.225Z","title":"net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-23104","published":"2026-02-04T16:08:25.604Z","updated":"2026-05-11T22:00:11.918Z","title":"ice: fix devlink reload call trace","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-23103","published":"2026-02-04T16:08:24.771Z","updated":"2026-10-19T18:25:31.077Z","title":"ipvlan: Make the addrs_lock be per port","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-23102","published":"2026-02-04T16:08:24.034Z","updated":"2026-05-11T22:00:09.528Z","title":"arm64/fpsimd: signal: Fix restoration of SVE context","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2026-23101","published":"2026-02-04T16:08:23.329Z","updated":"2026-10-19T18:25:30.935Z","title":"leds: led-class: Only Add LED to leds_list when it is fully ready","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00113,"kevAdded":null},{"id":"CVE-2026-23100","published":"2026-02-04T16:08:22.592Z","updated":"2026-10-15T01:12:59.628Z","title":"mm/hugetlb: fix hugetlb_pmd_shared()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-23099","published":"2026-02-04T16:08:21.601Z","updated":"2026-10-19T18:25:30.792Z","title":"bonding: limit BOND_MODE_8023AD to Ethernet devices","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-23098","published":"2026-02-04T16:08:20.692Z","updated":"2026-08-05T12:20:15.261Z","title":"netrom: fix double-free in nr_route_frame()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-23097","published":"2026-02-04T16:08:19.815Z","updated":"2026-10-19T18:25:30.652Z","title":"migrate: correct lock ordering for hugetlb file folios","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2026-23096","published":"2026-02-04T16:08:18.785Z","updated":"2026-05-11T21:59:55.485Z","title":"uacce: fix cdev handling in the cleanup path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2026-23095","published":"2026-02-04T16:08:17.990Z","updated":"2026-10-19T18:25:30.509Z","title":"gue: Fix skb memleak with inner IP protocol 0.","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2026-23094","published":"2026-02-04T16:08:17.061Z","updated":"2026-05-11T21:59:53.127Z","title":"uacce: fix isolate sysfs check condition","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-23093","published":"2026-02-04T16:08:16.159Z","updated":"2026-05-11T21:59:51.936Z","title":"ksmbd: smbd: fix dma_unmap_sg() nents","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-23092","published":"2026-02-04T16:08:15.203Z","updated":"2026-05-11T21:59:50.750Z","title":"iio: dac: ad3552r-hs: fix out-of-bound write in ad3552r_hs_write_data_source","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2026-23091","published":"2026-02-04T16:08:14.295Z","updated":"2026-10-19T18:25:30.355Z","title":"intel_th: fix device leak on output open()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-23090","published":"2026-02-04T16:08:13.438Z","updated":"2026-05-11T21:59:48.426Z","title":"slimbus: core: fix device reference leak on report present","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-23089","published":"2026-02-04T16:08:12.575Z","updated":"2026-10-19T18:25:30.214Z","title":"ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-23088","published":"2026-02-04T16:08:11.717Z","updated":"2026-05-23T16:03:48.056Z","title":"tracing: Fix crash on synthetic stacktrace field usage","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-23087","published":"2026-02-04T16:08:10.941Z","updated":"2026-10-15T01:12:56.045Z","title":"scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2026-23086","published":"2026-02-04T16:08:10.047Z","updated":"2026-10-19T18:25:30.062Z","title":"vsock/virtio: cap TX credit to local buffer size","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-23085","published":"2026-02-04T16:08:09.368Z","updated":"2026-10-19T18:25:29.916Z","title":"irqchip/gic-v3-its: Avoid truncating memory addresses","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-23084","published":"2026-02-04T16:08:08.456Z","updated":"2026-10-19T18:25:29.777Z","title":"be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2026-23083","published":"2026-02-04T16:08:07.561Z","updated":"2026-10-19T18:25:29.638Z","title":"fou: Don't allow 0 for FOU_ATTR_IPPROTO.","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2026-23082","published":"2026-02-04T16:08:06.731Z","updated":"2026-05-11T21:59:39.102Z","title":"can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-23081","published":"2026-02-04T16:08:05.822Z","updated":"2026-05-11T21:59:37.954Z","title":"net: phy: intel-xway: fix OF node refcount leakage","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-23080","published":"2026-02-04T16:08:04.982Z","updated":"2026-05-11T21:59:36.827Z","title":"can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-23079","published":"2026-02-04T16:08:04.190Z","updated":"2026-05-23T16:03:46.174Z","title":"gpio: cdev: Fix resource leaks on errors in lineinfo_changed_notify()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-23078","published":"2026-02-04T16:08:03.283Z","updated":"2026-05-11T21:59:34.569Z","title":"ALSA: scarlett2: Fix buffer overflow in config retrieval","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-23077","published":"2026-02-04T16:08:02.274Z","updated":"2026-08-05T12:20:13.107Z","title":"mm/vma: fix anon_vma UAF on mremap() faulted, unfaulted merge","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-23076","published":"2026-02-04T16:08:01.204Z","updated":"2026-10-19T18:25:29.498Z","title":"ALSA: ctxfi: Fix potential OOB access in audio mixer handling","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-23075","published":"2026-02-04T16:08:00.169Z","updated":"2026-05-11T21:59:31.107Z","title":"can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-23074","published":"2026-02-04T16:07:59.379Z","updated":"2026-10-19T18:25:29.342Z","title":"net/sched: Enforce that teql can only be used as root qdisc","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-23073","published":"2026-02-04T16:07:53.527Z","updated":"2026-10-19T18:25:29.189Z","title":"wifi: rsi: Fix memory corruption due to not set vif driver data size","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-23072","published":"2026-02-04T16:07:52.790Z","updated":"2026-05-11T21:59:27.431Z","title":"l2tp: Fix memleak in l2tp_udp_encap_recv().","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-23071","published":"2026-02-04T16:07:51.603Z","updated":"2026-10-19T18:25:29.039Z","title":"regmap: Fix race condition in hwspinlock irqsave routine","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-23070","published":"2026-02-04T16:07:50.675Z","updated":"2026-05-11T21:59:25.131Z","title":"Octeontx2-af: Add proper checks for fwdata","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-23069","published":"2026-02-04T16:07:49.911Z","updated":"2026-10-19T18:25:28.890Z","title":"vsock/virtio: fix potential underflow in virtio_transport_get_credit()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-23068","published":"2026-02-04T16:07:49.119Z","updated":"2026-05-11T21:59:22.846Z","title":"spi: spi-sprd-adi: Fix double free in probe error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-23067","published":"2026-02-04T16:07:48.457Z","updated":"2026-05-11T21:59:21.632Z","title":"iommu/io-pgtable-arm: fix size_t signedness bug in unmap path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-23066","published":"2026-02-04T16:07:47.764Z","updated":"2026-10-19T18:25:28.734Z","title":"rxrpc: Fix recvmsg() unconditional requeue","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-23065","published":"2026-02-04T16:07:47.077Z","updated":"2026-05-11T21:59:19.347Z","title":"platform/x86/amd: Fix memory leak in wbrf_record()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-23064","published":"2026-02-04T16:07:46.329Z","updated":"2026-05-11T21:59:18.219Z","title":"net/sched: act_ife: avoid possible NULL deref","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-23063","published":"2026-02-04T16:07:45.426Z","updated":"2026-05-11T21:59:17.047Z","title":"uacce: ensure safe queue release with state management","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-23062","published":"2026-02-04T16:07:44.420Z","updated":"2026-05-11T21:59:15.864Z","title":"platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-23061","published":"2026-02-04T16:07:43.626Z","updated":"2026-10-19T18:25:28.589Z","title":"can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-23060","published":"2026-02-04T16:07:42.860Z","updated":"2026-10-19T18:25:28.430Z","title":"crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-23059","published":"2026-02-04T16:07:42.150Z","updated":"2026-05-11T21:59:12.428Z","title":"scsi: qla2xxx: Sanitize payload size to prevent member overflow","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-23058","published":"2026-02-04T16:07:41.337Z","updated":"2026-05-11T21:59:11.271Z","title":"can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-23057","published":"2026-02-04T16:07:40.550Z","updated":"2026-05-11T21:59:10.131Z","title":"vsock/virtio: Coalesce only linear skb","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2026-23056","published":"2026-02-04T16:07:34.787Z","updated":"2026-05-11T21:59:08.964Z","title":"uacce: implement mremap in uacce_vm_ops to return -EPERM","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-71199","published":"2026-02-04T16:07:34.062Z","updated":"2026-05-11T21:56:34.681Z","title":"iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-71198","published":"2026-02-04T16:07:33.154Z","updated":"2026-10-30T12:23:32.365Z","title":"iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2025-71197","published":"2026-02-04T16:07:32.198Z","updated":"2026-10-15T01:11:13.156Z","title":"w1: therm: Fix off-by-one buffer overflow in alarms_store","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2026-23055","published":"2026-02-04T16:04:24.190Z","updated":"2026-05-11T21:59:07.846Z","title":"i2c: riic: Move suspend handling to NOIRQ phase","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2026-23054","published":"2026-02-04T16:04:23.396Z","updated":"2026-10-15T01:12:44.784Z","title":"net: hv_netvsc: reject RSS hash key programming without RX indirection table","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-23053","published":"2026-02-04T16:04:22.574Z","updated":"2026-05-11T21:59:05.561Z","title":"NFS: Fix a deadlock involving nfs_release_folio()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-23052","published":"2026-02-04T16:04:21.739Z","updated":"2026-07-04T11:50:25.608Z","title":"ftrace: Do not over-allocate ftrace memory","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-23051","published":"2026-02-04T16:04:20.777Z","updated":"2026-05-11T21:59:03.286Z","title":"drm/amdgpu: fix drm panic null pointer when driver not support atomic","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-23050","published":"2026-02-04T16:04:19.279Z","updated":"2026-10-30T12:23:41.926Z","title":"pNFS: Fix a deadlock when returning a delegation during open()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-23049","published":"2026-02-04T16:04:18.076Z","updated":"2026-05-11T21:59:00.872Z","title":"drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-71196","published":"2026-02-04T16:04:17.141Z","updated":"2026-05-11T21:56:31.172Z","title":"phy: stm32-usphyc: Fix off by one in probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-71195","published":"2026-02-04T16:04:16.323Z","updated":"2026-05-11T21:56:30.054Z","title":"dmaengine: xilinx: xdma: Fix regmap max_register","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2025-71194","published":"2026-02-04T16:04:15.389Z","updated":"2026-10-19T18:25:23.853Z","title":"btrfs: fix deadlock in wait_current_trans() due to ignored transaction type","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2025-71193","published":"2026-02-04T16:04:14.514Z","updated":"2026-10-30T12:23:31.285Z","title":"phy: qcom-qusb2: Fix NULL pointer dereference on early suspend","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-23048","published":"2026-02-04T16:00:30.232Z","updated":"2026-05-11T21:58:59.709Z","title":"udp: call skb_orphan() before skb_attempt_defer_free()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-23047","published":"2026-02-04T16:00:29.475Z","updated":"2026-05-11T21:58:58.513Z","title":"libceph: make calc_target() set t->paused, not just clear it","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2026-23046","published":"2026-02-04T16:00:28.772Z","updated":"2026-05-11T21:58:57.316Z","title":"virtio_net: fix device mismatch in devm_kzalloc/devm_kfree","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-23045","published":"2026-02-04T16:00:27.874Z","updated":"2026-05-11T21:58:56.122Z","title":"net/ena: fix missing lock when update devlink params","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-23044","published":"2026-02-04T16:00:27.153Z","updated":"2026-05-11T21:58:54.981Z","title":"PM: hibernate: Fix crash when freeing invalid crypto compressor","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-23043","published":"2026-02-04T16:00:26.353Z","updated":"2026-05-11T21:58:53.815Z","title":"btrfs: fix NULL pointer dereference in do_abort_log_replay()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-23042","published":"2026-02-04T16:00:25.466Z","updated":"2026-05-11T21:58:52.636Z","title":"idpf: fix aux device unplugging when rdma is not supported by vport","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-23041","published":"2026-02-04T16:00:24.710Z","updated":"2026-05-11T21:58:51.518Z","title":"bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2026-23040","published":"2026-02-04T16:00:23.897Z","updated":"2026-05-11T21:58:50.390Z","title":"wifi: mac80211_hwsim: fix typo in frequency notification","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-71192","published":"2026-02-04T16:00:23.044Z","updated":"2026-08-05T12:12:29.458Z","title":"ALSA: ac97: fix a double free in snd_ac97_controller_register()","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-23039","published":"2026-01-31T11:42:33.377Z","updated":"2026-05-11T21:58:49.153Z","title":"drm/gud: fix NULL fb and crtc dereferences on USB disconnect","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-23038","published":"2026-01-31T11:42:32.599Z","updated":"2026-10-19T18:25:28.264Z","title":"pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2026-23037","published":"2026-01-31T11:42:31.689Z","updated":"2026-06-02T13:00:55.620Z","title":"can: etas_es58x: allow partial RX URB allocation to succeed","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-23036","published":"2026-01-31T11:42:30.782Z","updated":"2026-05-11T21:58:45.739Z","title":"btrfs: release path before iget_failed() in btrfs_read_locked_inode()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-23035","published":"2026-01-31T11:42:29.960Z","updated":"2026-10-21T12:38:52.789Z","title":"net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2026-23034","published":"2026-01-31T11:42:29.137Z","updated":"2026-05-11T21:58:43.438Z","title":"drm/amdgpu/userq: Fix fence reference leak on queue teardown v2","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2026-23033","published":"2026-01-31T11:42:28.352Z","updated":"2026-06-02T13:00:54.479Z","title":"dmaengine: omap-dma: fix dma_pool resource leak in error paths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2026-23032","published":"2026-01-31T11:42:11.640Z","updated":"2026-06-02T13:00:53.339Z","title":"null_blk: fix kmemleak by releasing references to fault configfs items","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-23031","published":"2026-01-31T11:42:09.276Z","updated":"2026-06-02T13:00:52.214Z","title":"can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-23030","published":"2026-01-31T11:42:08.525Z","updated":"2026-06-02T13:00:51.068Z","title":"phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-23029","published":"2026-01-31T11:42:07.750Z","updated":"2026-05-11T21:58:37.718Z","title":"LoongArch: KVM: Fix kvm_device leak in kvm_eiointc_destroy()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-23028","published":"2026-01-31T11:42:06.984Z","updated":"2026-05-11T21:58:36.566Z","title":"LoongArch: KVM: Fix kvm_device leak in kvm_ipi_destroy()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-23027","published":"2026-01-31T11:42:06.183Z","updated":"2026-05-11T21:58:35.391Z","title":"LoongArch: KVM: Fix kvm_device leak in kvm_pch_pic_destroy()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-23026","published":"2026-01-31T11:42:05.185Z","updated":"2026-10-15T01:12:41.525Z","title":"dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-23025","published":"2026-01-31T11:42:04.426Z","updated":"2026-06-02T13:00:48.791Z","title":"mm/page_alloc: prevent pcp corruption with SMP=n","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2025-71191","published":"2026-01-31T11:42:03.545Z","updated":"2026-10-15T01:11:11.432Z","title":"dmaengine: at_hdmac: fix device leak on of_dma_xlate()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-71190","published":"2026-01-31T11:42:01.092Z","updated":"2026-10-19T18:15:16.829Z","title":"dmaengine: bcm-sba-raid: fix device leak on probe","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-71189","published":"2026-01-31T11:42:00.345Z","updated":"2026-10-15T01:11:08.066Z","title":"dmaengine: dw: dmamux: fix OF node leak on route allocation failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-71188","published":"2026-01-31T11:41:59.624Z","updated":"2026-06-02T13:00:36.620Z","title":"dmaengine: lpc18xx-dmamux: fix device leak on route allocation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-71187","published":"2026-01-31T11:41:58.816Z","updated":"2026-05-11T21:56:20.913Z","title":"dmaengine: sh: rz-dmac: fix device leak on probe failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2025-71186","published":"2026-01-31T11:41:57.921Z","updated":"2026-10-15T01:11:06.390Z","title":"dmaengine: stm32: dmamux: fix device leak on route allocation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-71185","published":"2026-01-31T11:41:57.082Z","updated":"2026-10-15T01:11:04.698Z","title":"dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-23024","published":"2026-01-31T11:39:07.604Z","updated":"2026-05-11T21:58:31.817Z","title":"idpf: fix memory leak of flow steer list on rmmod","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2026-23023","published":"2026-01-31T11:39:06.718Z","updated":"2026-05-11T21:58:30.691Z","title":"idpf: fix memory leak in idpf_vport_rel()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-23022","published":"2026-01-31T11:39:05.973Z","updated":"2026-05-11T21:58:29.545Z","title":"idpf: fix memory leak in idpf_vc_core_deinit()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-23021","published":"2026-01-31T11:39:05.152Z","updated":"2026-10-19T18:25:28.106Z","title":"net: usb: pegasus: fix memory leak in update_eth_regs_async()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-23020","published":"2026-01-31T11:39:04.023Z","updated":"2026-05-23T16:03:43.973Z","title":"net: 3com: 3c59x: fix possible null dereference in vortex_probe1()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2026-23019","published":"2026-01-31T11:39:03.179Z","updated":"2026-10-15T01:12:39.774Z","title":"net: marvell: prestera: fix NULL dereference on devlink_alloc() failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2026-23018","published":"2026-01-31T11:39:02.330Z","updated":"2026-05-23T16:03:42.961Z","title":"btrfs: release path before initializing extent tree in btrfs_read_locked_inode()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-23017","published":"2026-01-31T11:39:01.204Z","updated":"2026-10-21T12:38:51.705Z","title":"idpf: fix error handling in the init_task on load","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-23016","published":"2026-01-31T11:38:59.578Z","updated":"2026-05-11T21:58:22.462Z","title":"inet: frags: drop fraglist conntrack references","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-23015","published":"2026-01-31T11:38:57.983Z","updated":"2026-05-11T21:58:21.315Z","title":"gpio: mpsse: fix reference leak in gpio_mpsse_probe() error paths","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-71184","published":"2026-01-31T11:38:57.171Z","updated":"2026-10-30T12:23:30.217Z","title":"btrfs: fix NULL dereference on root when tracing inode eviction","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2025-71183","published":"2026-01-31T11:38:56.067Z","updated":"2026-10-19T18:15:16.685Z","title":"btrfs: always detect conflicting inodes when logging inode refs","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00316,"kevAdded":null},{"id":"CVE-2025-71182","published":"2026-01-31T11:38:55.157Z","updated":"2026-10-19T18:15:16.548Z","title":"can: j1939: make j1939_session_activate() fail if device is no longer registered","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2025-71181","published":"2026-01-31T11:38:54.221Z","updated":"2026-05-11T21:56:13.676Z","title":"rust_binder: remove spin_lock() in rust_shrink_free_page()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2025-71180","published":"2026-01-31T11:38:52.481Z","updated":"2026-05-11T21:56:12.391Z","title":"counter: interrupt-cnt: Drop IRQF_NO_THREAD flag","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-23014","published":"2026-01-28T14:24:44.189Z","updated":"2026-08-05T12:20:09.884Z","title":"perf: Ensure swevent hrtimer is properly destroyed","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-23013","published":"2026-01-25T14:36:26.208Z","updated":"2026-10-19T18:25:27.965Z","title":"net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-23012","published":"2026-01-25T14:36:25.187Z","updated":"2026-05-11T21:58:17.877Z","title":"mm/damon/core: remove call_control in inactive contexts","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-23011","published":"2026-01-25T14:36:24.455Z","updated":"2026-10-19T18:25:27.814Z","title":"ipv4: ip_gre: make ipgre_header() robust","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-23010","published":"2026-01-25T14:36:23.593Z","updated":"2026-10-15T01:12:36.399Z","title":"ipv6: Fix use-after-free in inet6_addr_del().","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-23009","published":"2026-01-25T14:36:22.817Z","updated":"2026-05-11T21:58:14.378Z","title":"xhci: sideband: don't dereference freed ring when removing sideband endpoint","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2026-23008","published":"2026-01-25T14:36:21.933Z","updated":"2026-05-11T21:58:13.228Z","title":"drm/vmwgfx: Fix KMS with 3D on HW version 10","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2026-23007","published":"2026-01-25T14:36:20.731Z","updated":"2026-10-21T12:38:50.601Z","title":"block: zero non-PI portion of auto integrity buffer","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-23006","published":"2026-01-25T14:36:19.819Z","updated":"2026-05-11T21:58:10.936Z","title":"ASoC: tlv320adcx140: fix null pointer","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2026-23005","published":"2026-01-25T14:36:19.021Z","updated":"2026-10-19T18:25:27.665Z","title":"x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2026-23004","published":"2026-01-25T14:36:18.233Z","updated":"2026-10-30T12:23:40.865Z","title":"dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-23003","published":"2026-01-25T14:36:17.491Z","updated":"2026-10-19T18:25:27.372Z","title":"ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00547,"kevAdded":null},{"id":"CVE-2026-23002","published":"2026-01-25T14:36:16.713Z","updated":"2026-05-11T21:58:06.332Z","title":"lib/buildid: use __kernel_read() for sleepable context","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-23001","published":"2026-01-25T14:36:15.790Z","updated":"2026-10-19T18:25:27.213Z","title":"macvlan: fix possible UAF in macvlan_forward_source()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-23000","published":"2026-01-25T14:36:14.854Z","updated":"2026-05-11T21:58:04.055Z","title":"net/mlx5e: Fix crash on profile change rollback failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-22999","published":"2026-01-25T14:36:13.909Z","updated":"2026-10-19T18:25:27.014Z","title":"net/sched: sch_qfq: do not free existing class in qfq_change_class()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2026-22998","published":"2026-01-25T14:36:12.935Z","updated":"2026-10-19T18:25:26.863Z","title":"nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00778,"kevAdded":null},{"id":"CVE-2026-22997","published":"2026-01-25T14:36:12.053Z","updated":"2026-10-19T18:25:26.725Z","title":"net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00465,"kevAdded":null},{"id":"CVE-2026-22996","published":"2026-01-25T14:36:11.195Z","updated":"2026-10-21T12:38:49.505Z","title":"net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-71163","published":"2026-01-25T14:36:10.142Z","updated":"2026-10-15T01:11:02.981Z","title":"dmaengine: idxd: fix device leaks on compat bind and unbind","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-71162","published":"2026-01-25T14:36:09.029Z","updated":"2026-10-15T01:11:01.219Z","title":"dmaengine: tegra-adma: Fix use-after-free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-22995","published":"2026-01-23T15:24:15.684Z","updated":"2026-05-11T21:57:58.095Z","title":"ublk: fix use-after-free in ublk_partition_scan_work","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-22994","published":"2026-01-23T15:24:14.749Z","updated":"2026-10-15T01:12:31.365Z","title":"bpf: Fix reference count leak in bpf_prog_test_run_xdp()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2026-22993","published":"2026-01-23T15:24:13.790Z","updated":"2026-05-11T21:57:55.772Z","title":"idpf: Fix RSS LUT NULL ptr issue after soft reset","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-22992","published":"2026-01-23T15:24:12.993Z","updated":"2026-10-19T18:25:26.583Z","title":"libceph: return the handler error from mon_handle_auth_done()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00449,"kevAdded":null},{"id":"CVE-2026-22991","published":"2026-01-23T15:24:12.191Z","updated":"2026-10-19T18:25:26.442Z","title":"libceph: make free_choose_arg_map() resilient to partial allocation","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2026-22990","published":"2026-01-23T15:24:11.332Z","updated":"2026-10-19T18:25:26.297Z","title":"libceph: replace overzealous BUG_ON in osdmap_apply_incremental()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2026-22989","published":"2026-01-23T15:24:10.523Z","updated":"2026-05-11T21:57:50.971Z","title":"nfsd: check that server is running in unlock_filesystem","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-22988","published":"2026-01-23T15:24:09.756Z","updated":"2026-08-05T12:19:56.911Z","title":"arp: do not assume dev_hard_header() does not change skb->head","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-22987","published":"2026-01-23T15:24:08.865Z","updated":"2026-05-11T21:57:48.634Z","title":"net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2026-22986","published":"2026-01-23T15:24:07.932Z","updated":"2026-05-11T21:57:47.442Z","title":"gpiolib: fix race condition for gdev->srcu","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.001,"kevAdded":null},{"id":"CVE-2026-22985","published":"2026-01-23T15:24:07.133Z","updated":"2026-05-11T21:57:46.297Z","title":"idpf: Fix RSS LUT NULL pointer crash on early ethtool operations","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-22984","published":"2026-01-23T15:24:06.245Z","updated":"2026-10-19T18:25:26.154Z","title":"libceph: prevent potential out-of-bounds reads in handle_auth_done()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2026-22983","published":"2026-01-23T15:24:05.394Z","updated":"2026-05-11T21:57:43.918Z","title":"net: do not write to msg_get_inq in callee","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2026-22982","published":"2026-01-23T15:24:04.556Z","updated":"2026-10-15T01:12:28.072Z","title":"net: mscc: ocelot: Fix crash when adding interface under a lag","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-22981","published":"2026-01-23T15:24:03.772Z","updated":"2026-05-11T21:57:41.446Z","title":"idpf: detach and close netdevs while handling a reset","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-22980","published":"2026-01-23T15:24:02.924Z","updated":"2026-10-19T18:25:26.011Z","title":"nfsd: provide locking for v4_end_grace","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-22979","published":"2026-01-23T15:24:01.340Z","updated":"2026-10-15T01:12:24.721Z","title":"net: fix memory leak in skb_segment_list for GRO packets","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-22978","published":"2026-01-23T15:24:00.482Z","updated":"2026-05-11T21:57:37.849Z","title":"wifi: avoid kernel-infoleak from struct iw_point","severity":"LOW","score":3.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2025-71161","published":"2026-01-23T15:23:59.464Z","updated":"2026-10-19T18:15:16.401Z","title":"dm-verity: disable recursive forward error correction","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00468,"kevAdded":null},{"id":"CVE-2025-71160","published":"2026-01-23T15:23:58.652Z","updated":"2026-05-11T21:56:07.768Z","title":"netfilter: nf_tables: avoid chain re-validation if possible","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2025-71159","published":"2026-01-23T15:23:57.824Z","updated":"2026-08-05T12:12:25.188Z","title":"btrfs: fix use-after-free warning in btrfs_get_or_create_delayed_node()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2025-71158","published":"2026-01-23T15:23:57.016Z","updated":"2026-08-05T12:12:24.125Z","title":"gpio: mpsse: ensure worker is torn down","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2025-71157","published":"2026-01-23T14:25:56.458Z","updated":"2026-05-11T21:56:04.334Z","title":"RDMA/core: always drop device refcount in ib_del_sub_device_and_put()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-71156","published":"2026-01-23T14:25:55.456Z","updated":"2026-05-11T21:56:02.812Z","title":"gve: defer interrupt enabling until NAPI registration","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-71155","published":"2026-01-23T14:25:54.663Z","updated":"2026-08-05T12:12:23.055Z","title":"KVM: s390: Fix gmap_helper_zap_one_page() again","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2025-71154","published":"2026-01-23T14:25:53.818Z","updated":"2026-10-19T18:15:16.242Z","title":"net: usb: rtl8150: fix memory leak on usb_submit_urb() failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-71153","published":"2026-01-23T14:25:52.988Z","updated":"2026-05-23T16:03:27.184Z","title":"ksmbd: Fix memory leak in get_file_all_info()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2025-71152","published":"2026-01-23T14:25:52.022Z","updated":"2026-10-30T12:23:29.156Z","title":"net: dsa: properly keep track of conduit reference","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-71151","published":"2026-01-23T14:15:17.916Z","updated":"2026-05-23T16:03:26.099Z","title":"cifs: Fix memory and information leak in smb3_reconfigure()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2025-71150","published":"2026-01-23T14:15:16.898Z","updated":"2026-08-05T12:12:21.985Z","title":"ksmbd: Fix refcount leak when invalid session is found on session lookup","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2025-71148","published":"2026-01-23T14:15:14.963Z","updated":"2026-05-11T21:55:54.574Z","title":"net/handshake: restore destructor on submit failure","severity":"LOW","score":3.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2025-71147","published":"2026-01-23T14:15:13.945Z","updated":"2026-10-19T18:15:16.099Z","title":"KEYS: trusted: Fix a memory leak in tpm2_load_cmd","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-71146","published":"2026-01-23T14:15:12.998Z","updated":"2026-08-05T12:12:20.914Z","title":"netfilter: nf_conncount: fix leaked ct in error paths","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00286,"kevAdded":null},{"id":"CVE-2025-71145","published":"2026-01-23T13:39:17.857Z","updated":"2026-08-05T12:12:19.804Z","title":"usb: phy: isp1301: fix non-OF device reference imbalance","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-22977","published":"2026-01-21T13:08:54.858Z","updated":"2026-10-19T18:25:25.873Z","title":"net: sock: fix hardened usercopy panic in sock_recv_errqueue","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-22976","published":"2026-01-21T06:57:23.939Z","updated":"2026-10-19T18:25:25.738Z","title":"net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-71144","published":"2026-01-14T15:08:56.700Z","updated":"2026-05-23T16:03:21.988Z","title":"mptcp: ensure context reset on disconnect()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2025-71143","published":"2026-01-14T15:07:55.828Z","updated":"2026-05-11T21:55:48.662Z","title":"clk: samsung: exynos-clkout: Assign .num before accessing .hws","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-71142","published":"2026-01-14T15:07:55.145Z","updated":"2026-09-14T11:58:09.697Z","title":"cpuset: fix warning when disabling remote partition","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2025-71141","published":"2026-01-14T15:07:54.456Z","updated":"2026-10-21T12:38:35.452Z","title":"drm/tilcdc: Fix removal actions in case of failed probe","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-71140","published":"2026-01-14T15:07:53.581Z","updated":"2026-05-27T09:28:15.646Z","title":"media: mediatek: vcodec: Use spinlock for context list protection lock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2025-71139","published":"2026-01-14T15:07:52.658Z","updated":"2026-05-11T21:55:43.988Z","title":"kernel/kexec: fix IMA when allocation happens in CMA area","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00119,"kevAdded":null},{"id":"CVE-2025-71138","published":"2026-01-14T15:07:51.943Z","updated":"2026-10-30T12:23:28.092Z","title":"drm/msm/dpu: Add missing NULL pointer check for pingpong interface","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2025-71137","published":"2026-01-14T15:07:51.264Z","updated":"2026-05-11T21:55:41.659Z","title":"octeontx2-pf: fix \"UBSAN: shift-out-of-bounds error\"","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-71136","published":"2026-01-14T15:07:50.568Z","updated":"2026-08-05T12:12:18.759Z","title":"media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-71135","published":"2026-01-14T15:07:49.891Z","updated":"2026-05-23T16:03:18.862Z","title":"md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2025-71134","published":"2026-01-14T15:07:49.200Z","updated":"2026-05-11T21:55:38.095Z","title":"mm/page_alloc: change all pageblocks migrate type on coalescing","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2025-71133","published":"2026-01-14T15:07:48.524Z","updated":"2026-10-19T18:15:15.941Z","title":"RDMA/irdma: avoid invalid read in irdma_net_event","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-71132","published":"2026-01-14T15:07:47.860Z","updated":"2026-10-19T18:15:15.774Z","title":"smc91x: fix broken irq-context in PREEMPT_RT","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-71131","published":"2026-01-14T15:07:47.194Z","updated":"2026-10-19T18:15:15.635Z","title":"crypto: seqiv - Do not use req->iv after crypto_aead_encrypt","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2025-71130","published":"2026-01-14T15:07:46.508Z","updated":"2026-10-19T18:15:15.481Z","title":"drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-71129","published":"2026-01-14T15:07:45.786Z","updated":"2026-05-11T21:55:32.205Z","title":"LoongArch: BPF: Sign extend kfunc call arguments","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2025-71128","published":"2026-01-14T15:07:44.941Z","updated":"2026-10-19T18:15:15.302Z","title":"erspan: Initialize options_len before referencing options.","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00309,"kevAdded":null},{"id":"CVE-2025-71127","published":"2026-01-14T15:07:44.218Z","updated":"2026-10-19T18:15:15.125Z","title":"wifi: mac80211: Discard Beacon frames to non-broadcast address","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2025-71126","published":"2026-01-14T15:06:11.417Z","updated":"2026-10-19T18:15:14.953Z","title":"mptcp: avoid deadlock on fallback while reinjecting","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2025-71125","published":"2026-01-14T15:06:10.662Z","updated":"2026-10-19T18:15:14.780Z","title":"tracing: Do not register unsupported perf events","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2025-71124","published":"2026-01-14T15:06:09.927Z","updated":"2026-05-11T21:55:26.339Z","title":"drm/msm/a6xx: move preempt_prepare_postamble after error check","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2025-71123","published":"2026-01-14T15:06:09.246Z","updated":"2026-10-15T01:10:55.773Z","title":"ext4: fix string copying in parse_apply_sb_mount_options()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2025-71122","published":"2026-01-14T15:06:08.556Z","updated":"2026-05-11T21:55:23.921Z","title":"iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2025-71121","published":"2026-01-14T15:06:07.871Z","updated":"2026-05-23T16:03:15.859Z","title":"parisc: Do not reprogram affinitiy on ASP chip","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2025-71120","published":"2026-01-14T15:06:07.194Z","updated":"2026-10-19T18:15:14.623Z","title":"SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00529,"kevAdded":null},{"id":"CVE-2025-71119","published":"2026-01-14T15:06:06.536Z","updated":"2026-05-23T16:03:13.930Z","title":"powerpc/kexec: Enable SMT before waking offline CPUs","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2025-71118","published":"2026-01-14T15:06:05.861Z","updated":"2026-10-19T18:15:14.450Z","title":"ACPICA: Avoid walking the Namespace if start_node is NULL","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-71117","published":"2026-01-14T15:06:05.161Z","updated":"2026-05-11T21:55:11.731Z","title":"block: Remove queue freezing from several sysfs store callbacks","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00098,"kevAdded":null},{"id":"CVE-2025-71116","published":"2026-01-14T15:06:04.476Z","updated":"2026-10-19T18:15:14.284Z","title":"libceph: make decode_pool() more resilient against corrupted osdmaps","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00458,"kevAdded":null},{"id":"CVE-2025-71115","published":"2026-01-14T15:06:02.428Z","updated":"2026-05-11T21:55:09.414Z","title":"um: init cpu_tasks[] earlier","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2025-71114","published":"2026-01-14T15:06:00.848Z","updated":"2026-10-19T18:15:14.113Z","title":"via_wdt: fix critical boot hang due to unnamed resource allocation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-71113","published":"2026-01-14T15:05:59.992Z","updated":"2026-10-19T18:15:13.938Z","title":"crypto: af_alg - zero initialize memory allocated via sock_kmalloc","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-71112","published":"2026-01-14T15:05:59.308Z","updated":"2026-10-19T18:15:13.783Z","title":"net: hns3: add VLAN id validation before using","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2025-71111","published":"2026-01-14T15:05:58.649Z","updated":"2026-10-19T18:15:13.644Z","title":"hwmon: (w83791d) Convert macros to functions to avoid TOCTOU","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00105,"kevAdded":null},{"id":"CVE-2025-71110","published":"2026-01-14T15:05:57.952Z","updated":"2026-05-11T21:55:00.734Z","title":"mm/slub: reset KASAN tag in defer_free() before accessing freed memory","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2025-71109","published":"2026-01-14T15:05:57.236Z","updated":"2026-10-30T12:23:27.020Z","title":"MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2025-71108","published":"2026-01-14T15:05:56.553Z","updated":"2026-10-19T18:15:13.504Z","title":"usb: typec: ucsi: Handle incorrect num_connectors capability","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2025-71107","published":"2026-01-14T15:05:55.878Z","updated":"2026-05-23T16:03:12.935Z","title":"f2fs: ensure node page reads complete before f2fs_put_super() finishes","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2025-71106","published":"2026-01-14T15:05:55.192Z","updated":"2026-05-11T21:54:56.035Z","title":"fs: PM: Fix reverse check in filesystems_freeze_callback()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2025-71105","published":"2026-01-14T15:05:54.510Z","updated":"2026-05-11T21:54:54.803Z","title":"f2fs: use global inline_xattr_slab instead of per-sb slab cache","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2025-71104","published":"2026-01-14T15:05:53.802Z","updated":"2026-10-19T18:15:13.366Z","title":"KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2025-71103","published":"2026-01-14T15:05:53.116Z","updated":"2026-05-11T21:54:48.387Z","title":"drm/msm: adreno: fix deferencing ifpc_reglist when not declared","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2025-71102","published":"2026-01-14T15:05:52.389Z","updated":"2026-05-11T21:54:47.227Z","title":"scs: fix a wrong parameter in __scs_magic","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2025-71101","published":"2026-01-13T15:34:59.717Z","updated":"2026-08-05T12:12:06.814Z","title":"platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-71100","published":"2026-01-13T15:34:59.039Z","updated":"2026-10-19T18:15:13.194Z","title":"wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()","severity":"HIGH","score":7.6,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2025-71099","published":"2026-01-13T15:34:58.359Z","updated":"2026-10-19T18:15:13.054Z","title":"drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2025-71098","published":"2026-01-13T15:34:57.536Z","updated":"2026-10-19T18:15:12.910Z","title":"ip6_gre: make ip6gre_header() robust","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-71097","published":"2026-01-13T15:34:56.814Z","updated":"2026-10-19T18:15:12.771Z","title":"ipv4: Fix reference count leak when using error routes with nexthop objects","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-71096","published":"2026-01-13T15:34:56.118Z","updated":"2026-10-19T18:15:12.624Z","title":"RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2025-71095","published":"2026-01-13T15:34:55.392Z","updated":"2026-10-15T01:10:42.317Z","title":"net: stmmac: fix the crash issue for zero copy XDP_TX action","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-71094","published":"2026-01-13T15:34:54.669Z","updated":"2026-10-19T18:15:12.474Z","title":"net: usb: asix: validate PHY address before use","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2025-71093","published":"2026-01-13T15:34:53.803Z","updated":"2026-10-19T18:15:12.319Z","title":"e1000: fix OOB in e1000_tbi_should_accept()","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-71092","published":"2026-01-13T15:34:53.110Z","updated":"2026-08-05T12:12:00.926Z","title":"RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2025-71091","published":"2026-01-13T15:34:52.431Z","updated":"2026-10-19T18:15:12.168Z","title":"team: fix check for port enabled in team_queue_override_port_prio_changed()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2025-71090","published":"2026-01-13T15:34:51.777Z","updated":"2026-08-05T12:11:59.817Z","title":"nfsd: fix nfsd_file reference leak in nfsd4_add_rdaccess_to_wrdeleg()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2025-71089","published":"2026-01-13T15:34:51.079Z","updated":"2026-10-30T12:23:25.735Z","title":"iommu: disable SVA when CONFIG_X86 is set","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2025-71088","published":"2026-01-13T15:34:50.377Z","updated":"2026-10-15T01:10:40.597Z","title":"mptcp: fallback earlier on simult connection","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2025-71087","published":"2026-01-13T15:34:49.691Z","updated":"2026-10-19T18:15:11.876Z","title":"iavf: fix off-by-one issues in iavf_config_rss_reg()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2025-71086","published":"2026-01-13T15:34:49.007Z","updated":"2026-10-15T01:10:38.955Z","title":"net: rose: fix invalid array index in rose_kill_by_device()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2025-71085","published":"2026-01-13T15:34:48.324Z","updated":"2026-10-19T18:15:11.736Z","title":"ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2025-71084","published":"2026-01-13T15:34:47.665Z","updated":"2026-10-19T18:15:11.601Z","title":"RDMA/cm: Fix leaking the multicast GID table reference","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2025-71083","published":"2026-01-13T15:34:46.974Z","updated":"2026-10-19T18:15:11.431Z","title":"drm/ttm: Avoid NULL pointer deref for evicted BOs","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2025-71082","published":"2026-01-13T15:34:46.301Z","updated":"2026-10-19T18:15:11.277Z","title":"Bluetooth: btusb: revert use of devm_kzalloc in btusb","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2025-71081","published":"2026-01-13T15:34:45.503Z","updated":"2026-05-11T21:54:22.607Z","title":"ASoC: stm32: sai: fix OF node leak on probe","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2025-71080","published":"2026-01-13T15:34:44.832Z","updated":"2026-08-05T12:11:55.485Z","title":"ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2025-71079","published":"2026-01-13T15:34:44.136Z","updated":"2026-10-15T01:10:35.498Z","title":"net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00106,"kevAdded":null},{"id":"CVE-2025-71078","published":"2026-01-13T15:34:43.437Z","updated":"2026-10-19T18:15:11.106Z","title":"powerpc/64s/slb: Fix SLB multihit issue during SLB preload","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00113,"kevAdded":null},{"id":"CVE-2025-71077","published":"2026-01-13T15:31:29.435Z","updated":"2026-10-19T18:15:10.933Z","title":"tpm: Cap the number of PCR banks","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2025-71076","published":"2026-01-13T15:31:28.759Z","updated":"2026-05-23T16:03:05.766Z","title":"drm/xe/oa: Limit num_syncs to prevent oversized allocations","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2025-71075","published":"2026-01-13T15:31:28.075Z","updated":"2026-10-19T18:15:10.785Z","title":"scsi: aic94xx: fix use-after-free in device removal path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-71074","published":"2026-01-13T15:31:27.413Z","updated":"2026-10-30T12:23:24.377Z","title":"functionfs: fix the open/removal races","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2025-71073","published":"2026-01-13T15:31:26.771Z","updated":"2026-10-30T12:23:23.317Z","title":"Input: lkkbd - disable pending work before freeing device","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-71072","published":"2026-01-13T15:31:26.089Z","updated":"2026-10-21T12:38:31.063Z","title":"shmem: fix recovery on rename failures","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2025-71071","published":"2026-01-13T15:31:25.400Z","updated":"2026-05-23T16:03:04.559Z","title":"iommu/mediatek: fix use-after-free on probe deferral","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-71070","published":"2026-01-13T15:31:24.709Z","updated":"2026-08-05T12:11:51.227Z","title":"ublk: clean up user copy references on ublk server exit","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-71069","published":"2026-01-13T15:31:23.948Z","updated":"2026-05-11T21:54:08.205Z","title":"f2fs: invalidate dentry cache on failed whiteout creation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-71068","published":"2026-01-13T15:31:23.283Z","updated":"2026-10-30T12:23:22.239Z","title":"svcrdma: bound check rq_pages index in inline path","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0038,"kevAdded":null},{"id":"CVE-2025-71067","published":"2026-01-13T15:31:22.585Z","updated":"2026-05-11T21:54:05.851Z","title":"ntfs: set dummy blocksize to read boot_block when mounting","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-71066","published":"2026-01-13T15:31:21.931Z","updated":"2026-08-05T12:11:49.113Z","title":"net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-71065","published":"2026-01-13T15:31:21.235Z","updated":"2026-05-11T21:54:03.528Z","title":"f2fs: fix to avoid potential deadlock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2025-71064","published":"2026-01-13T15:31:20.503Z","updated":"2026-10-15T01:10:32.127Z","title":"net: hns3: using the num_tqps in the vf driver to apply for resources","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2025-68823","published":"2026-01-13T15:29:25.392Z","updated":"2026-06-01T16:05:45.871Z","title":"ublk: fix deadlock when reading partition table","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2025-68822","published":"2026-01-13T15:29:24.703Z","updated":"2026-10-30T12:23:21.175Z","title":"Input: alps - fix use-after-free bugs caused by dev3_register_work","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-68821","published":"2026-01-13T15:29:24.014Z","updated":"2026-05-23T16:03:00.860Z","title":"fuse: fix readahead reclaim deadlock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-68820","published":"2026-01-13T15:29:23.351Z","updated":"2026-10-19T18:15:10.329Z","title":"ext4: xattr: fix null pointer deref in ext4_raw_inode()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-68819","published":"2026-01-13T15:29:22.695Z","updated":"2026-10-19T18:15:10.171Z","title":"media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2025-68818","published":"2026-01-13T15:29:22.018Z","updated":"2026-10-19T18:05:54.727Z","title":"scsi: Revert \"scsi: qla2xxx: Perform lockless command completion in abort path\"","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2025-68817","published":"2026-01-13T15:29:21.210Z","updated":"2026-08-05T12:11:44.783Z","title":"ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00448,"kevAdded":null},{"id":"CVE-2025-68816","published":"2026-01-13T15:29:20.464Z","updated":"2026-10-19T18:05:08.694Z","title":"net/mlx5: fw_tracer, Validate format string parameters","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-68815","published":"2026-01-13T15:29:19.789Z","updated":"2026-10-19T18:05:08.556Z","title":"net/sched: ets: Remove drr class from the active list if it changes to strict","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2025-68814","published":"2026-01-13T15:29:19.129Z","updated":"2026-10-15T01:10:19.160Z","title":"io_uring: fix filename leak in __io_openat_prep()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-68813","published":"2026-01-13T15:29:18.483Z","updated":"2026-10-19T18:05:08.415Z","title":"ipvs: fix ipv4 null-ptr-deref in route error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-68811","published":"2026-01-13T15:29:17.128Z","updated":"2026-10-19T18:05:08.265Z","title":"svcrdma: use rc_pageoff for memcpy byte offset","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0053,"kevAdded":null},{"id":"CVE-2025-68810","published":"2026-01-13T15:29:16.475Z","updated":"2026-08-05T12:11:41.602Z","title":"KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2025-68809","published":"2026-01-13T15:29:15.817Z","updated":"2026-10-30T12:23:20.102Z","title":"ksmbd: vfs: fix race on m_flags in vfs_cache","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00528,"kevAdded":null},{"id":"CVE-2025-68808","published":"2026-01-13T15:29:15.164Z","updated":"2026-08-05T12:11:39.465Z","title":"media: vidtv: initialize local pointers upon transfer of memory ownership","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-68807","published":"2026-01-13T15:29:14.483Z","updated":"2026-05-11T21:53:43.171Z","title":"block: fix race between wbt_enable_default and IO submission","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2025-68806","published":"2026-01-13T15:29:13.797Z","updated":"2026-08-05T12:11:38.392Z","title":"ksmbd: fix buffer validation by including null terminator size in EA length","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00447,"kevAdded":null},{"id":"CVE-2025-68805","published":"2026-01-13T15:29:13.119Z","updated":"2026-08-05T12:11:37.322Z","title":"fuse: fix io-uring list corruption for terminated non-committed requests","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-68804","published":"2026-01-13T15:29:12.418Z","updated":"2026-05-11T21:53:39.669Z","title":"platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-68803","published":"2026-01-13T15:29:11.732Z","updated":"2026-10-19T18:05:08.117Z","title":"NFSD: NFSv4 file creation neglects setting ACL","severity":"HIGH","score":8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00448,"kevAdded":null},{"id":"CVE-2025-68802","published":"2026-01-13T15:29:11.079Z","updated":"2026-05-11T21:53:37.315Z","title":"drm/xe: Limit num_syncs to prevent oversized allocations","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-68801","published":"2026-01-13T15:29:10.349Z","updated":"2026-10-19T18:05:07.969Z","title":"mlxsw: spectrum_router: Fix neighbour use-after-free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-68800","published":"2026-01-13T15:29:09.688Z","updated":"2026-10-19T18:05:07.829Z","title":"mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-68799","published":"2026-01-13T15:29:09.012Z","updated":"2026-08-05T12:11:33.021Z","title":"caif: fix integer underflow in cffrml_receive()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2025-68798","published":"2026-01-13T15:29:08.329Z","updated":"2026-10-15T01:10:15.720Z","title":"perf/x86/amd: Check event before enable to avoid GPF","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-68797","published":"2026-01-13T15:29:07.575Z","updated":"2026-05-11T21:53:31.417Z","title":"char: applicom: fix NULL pointer dereference in ac_ioctl","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-68796","published":"2026-01-13T15:29:06.892Z","updated":"2026-05-11T21:53:30.248Z","title":"f2fs: fix to avoid updating zero-sized extent in extent cache","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-68795","published":"2026-01-13T15:29:06.217Z","updated":"2026-10-19T18:05:07.686Z","title":"ethtool: Avoid overflowing userspace buffer on stats query","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2025-68794","published":"2026-01-13T15:29:05.553Z","updated":"2026-10-19T18:05:07.542Z","title":"iomap: adjust read range correctly for non-block-aligned positions","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00686,"kevAdded":null},{"id":"CVE-2025-68793","published":"2026-01-13T15:29:04.877Z","updated":"2026-10-19T18:05:07.405Z","title":"drm/amdgpu: fix a job->pasid access race in gpu recovery","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2025-68792","published":"2026-01-13T15:29:04.226Z","updated":"2026-08-05T12:11:28.554Z","title":"tpm2-sessions: Fix out of range indexing in name_size","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-68791","published":"2026-01-13T15:29:03.553Z","updated":"2026-05-11T21:53:24.493Z","title":"fuse: missing copy_finish in fuse-over-io-uring argument copies","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2025-68790","published":"2026-01-13T15:29:02.907Z","updated":"2026-05-11T21:53:23.333Z","title":"net/mlx5: Fix double unregister of HCA_PORTS component","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2025-68788","published":"2026-01-13T15:29:01.270Z","updated":"2026-10-19T18:05:07.258Z","title":"fsnotify: do not generate ACCESS/MODIFY events on child for special files","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2025-68787","published":"2026-01-13T15:29:00.344Z","updated":"2026-10-15T01:10:11.911Z","title":"netrom: Fix memory leak in nr_sendmsg()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2025-68786","published":"2026-01-13T15:28:59.578Z","updated":"2026-05-11T21:53:19.839Z","title":"ksmbd: skip lock-range check on equal size to avoid size==0 underflow","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-68785","published":"2026-01-13T15:28:58.930Z","updated":"2026-10-19T18:05:07.113Z","title":"net: openvswitch: fix middle attribute validation in push_nsh() action","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2025-68784","published":"2026-01-13T15:28:58.255Z","updated":"2026-05-11T21:53:17.447Z","title":"xfs: fix a UAF problem in xattr repair","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-68783","published":"2026-01-13T15:28:57.609Z","updated":"2026-05-11T21:53:16.125Z","title":"ALSA: usb-mixer: us16x08: validate meter packet indices","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-68782","published":"2026-01-13T15:28:56.929Z","updated":"2026-10-19T18:05:06.972Z","title":"scsi: target: Reset t_task_cdb pointer in error case","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00693,"kevAdded":null},{"id":"CVE-2025-68781","published":"2026-01-13T15:28:56.261Z","updated":"2026-09-02T12:49:30.176Z","title":"usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-68780","published":"2026-01-13T15:28:55.483Z","updated":"2026-05-11T21:53:12.601Z","title":"sched/deadline: only set free_cpus for online runqueues","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-68779","published":"2026-01-13T15:28:54.795Z","updated":"2026-05-11T21:53:11.439Z","title":"net/mlx5e: Avoid unregistering PSP twice","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2025-68778","published":"2026-01-13T15:28:54.107Z","updated":"2026-05-11T21:53:10.295Z","title":"btrfs: don't log conflicting inode if it's a dir moved in the current transaction","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-68777","published":"2026-01-13T15:28:53.416Z","updated":"2026-05-11T21:53:09.176Z","title":"Input: ti_am335x_tsc - fix off-by-one error in wire_order validation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-68776","published":"2026-01-13T15:28:52.766Z","updated":"2026-10-15T01:10:08.179Z","title":"net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2025-68775","published":"2026-01-13T15:28:52.069Z","updated":"2026-10-19T18:05:06.829Z","title":"net/handshake: duplicate handshake cancellations leak socket","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00548,"kevAdded":null},{"id":"CVE-2025-68774","published":"2026-01-13T15:28:51.379Z","updated":"2026-08-05T12:11:24.278Z","title":"hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00587,"kevAdded":null},{"id":"CVE-2025-68773","published":"2026-01-13T15:28:50.686Z","updated":"2026-10-15T01:10:06.465Z","title":"spi: fsl-cpm: Check length parity before switching to 16 bit mode","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2025-68772","published":"2026-01-13T15:28:49.924Z","updated":"2026-05-11T21:53:03.304Z","title":"f2fs: fix to avoid updating compression context during writeback","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2025-68771","published":"2026-01-13T15:28:49.272Z","updated":"2026-05-11T21:53:02.168Z","title":"ocfs2: fix kernel BUG in ocfs2_find_victim_chain","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-68770","published":"2026-01-13T15:28:48.604Z","updated":"2026-10-19T18:05:06.691Z","title":"bnxt_en: Fix XDP_TX path","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00387,"kevAdded":null},{"id":"CVE-2025-68769","published":"2026-01-13T15:28:47.798Z","updated":"2026-05-23T16:02:51.005Z","title":"f2fs: fix return value of f2fs_recover_fsync_data()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-68768","published":"2026-01-13T15:28:47.106Z","updated":"2026-06-19T11:57:29.047Z","title":"inet: frags: flush pending skbs in fqdir_pre_exit()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2025-68767","published":"2026-01-13T15:28:46.382Z","updated":"2026-05-11T21:52:57.433Z","title":"hfsplus: Verify inode mode when loading from disk","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-68766","published":"2026-01-05T09:44:13.935Z","updated":"2026-05-11T21:52:56.285Z","title":"irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-68765","published":"2026-01-05T09:44:13.242Z","updated":"2026-05-11T21:52:55.118Z","title":"mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-68764","published":"2026-01-05T09:44:12.518Z","updated":"2026-10-19T18:05:06.551Z","title":"NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2025-68763","published":"2026-01-05T09:32:35.678Z","updated":"2026-05-11T21:52:52.779Z","title":"crypto: starfive - Correctly handle return of sg_nents_for_len","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2025-68762","published":"2026-01-05T09:32:34.743Z","updated":"2026-05-11T21:52:51.655Z","title":"net: netpoll: initialize work queue before error checks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-68761","published":"2026-01-05T09:32:33.814Z","updated":"2026-08-05T12:11:21.089Z","title":"hfs: fix potential use after free in hfs_correct_next_unused_CNID()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2025-68760","published":"2026-01-05T09:32:32.894Z","updated":"2026-05-11T21:52:49.261Z","title":"iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-68759","published":"2026-01-05T09:32:32.174Z","updated":"2026-05-11T21:52:48.124Z","title":"wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2025-68758","published":"2026-01-05T09:32:31.399Z","updated":"2026-05-11T21:52:46.981Z","title":"backlight: led-bl: Add devlink to supplier LEDs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2025-68757","published":"2026-01-05T09:32:30.496Z","updated":"2026-05-11T21:52:45.833Z","title":"drm/vgem-fence: Fix potential deadlock on release","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2025-68756","published":"2026-01-05T09:32:29.824Z","updated":"2026-05-11T21:52:44.585Z","title":"block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-68755","published":"2026-01-05T09:32:29.149Z","updated":"2026-10-30T12:23:19.033Z","title":"staging: most: remove broken i2c driver","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-68754","published":"2026-01-05T09:32:27.788Z","updated":"2026-05-11T21:52:42.282Z","title":"rtc: amlogic-a4: fix double free caused by devm","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-68753","published":"2026-01-05T09:32:27.029Z","updated":"2026-10-19T18:05:06.414Z","title":"ALSA: firewire-motu: add bounds check in put_user loop for DSP events","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2025-68752","published":"2026-01-05T09:32:26.308Z","updated":"2026-05-11T21:52:39.930Z","title":"iavf: Implement settime64 with -EOPNOTSUPP","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-68751","published":"2026-01-05T09:32:25.534Z","updated":"2026-05-11T21:52:38.615Z","title":"s390/fpu: Fix false-positive kmsan report in fpu_vstl()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2023-54326","published":"2025-12-30T12:37:09.698Z","updated":"2026-08-05T09:19:17.990Z","title":"misc: pci_endpoint_test: Free IRQs before removing the device","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2023-54325","published":"2025-12-30T12:37:09.015Z","updated":"2026-08-05T09:19:16.226Z","title":"crypto: qat - fix out-of-bounds read","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2023-54324","published":"2025-12-30T12:37:08.337Z","updated":"2026-05-11T19:59:45.963Z","title":"dm: fix a race condition in retrieve_deps","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2023-54323","published":"2025-12-30T12:37:07.656Z","updated":"2026-05-11T19:59:44.788Z","title":"cxl/pmem: Fix nvdimm registration races","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2022-50889","published":"2025-12-30T12:37:06.957Z","updated":"2026-05-11T19:27:05.858Z","title":"dm integrity: Fix UAF in dm_integrity_dtr()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2022-50888","published":"2025-12-30T12:37:06.269Z","updated":"2026-05-11T19:27:04.729Z","title":"remoteproc: qcom: q6v5: Fix potential null-ptr-deref in q6v5_wcss_init_mmio()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2022-50887","published":"2025-12-30T12:37:05.505Z","updated":"2026-05-11T19:27:03.329Z","title":"regulator: core: fix unbalanced of node refcount in regulator_dev_lookup()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2023-54322","published":"2025-12-30T12:34:15.446Z","updated":"2026-06-01T16:04:28.197Z","title":"arm64: set __exception_irq_entry with __irq_entry as a default","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2023-54321","published":"2025-12-30T12:34:14.793Z","updated":"2026-05-11T19:59:42.500Z","title":"driver core: fix potential null-ptr-deref in device_add()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2023-54320","published":"2025-12-30T12:34:14.133Z","updated":"2026-05-11T19:59:41.337Z","title":"platform/x86/amd: pmc: Fix memory leak in amd_pmc_stb_debugfs_open_v2()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2023-54319","published":"2025-12-30T12:34:13.468Z","updated":"2026-05-11T19:59:40.207Z","title":"pinctrl: at91-pio4: check return value of devm_kasprintf()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2022-50886","published":"2025-12-30T12:34:12.782Z","updated":"2026-05-11T19:27:02.120Z","title":"mmc: toshsd: fix return value check of mmc_add_host()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2022-50885","published":"2025-12-30T12:34:12.093Z","updated":"2026-10-15T21:41:24.572Z","title":"RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.006,"kevAdded":null},{"id":"CVE-2022-50884","published":"2025-12-30T12:34:11.390Z","updated":"2026-05-11T19:26:59.632Z","title":"drm: Prevent drm_copy_field() to attempt copying a NULL pointer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2023-54318","published":"2025-12-30T12:23:48.134Z","updated":"2026-10-15T21:41:44.789Z","title":"net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2023-54317","published":"2025-12-30T12:23:47.232Z","updated":"2026-10-15T21:41:44.644Z","title":"dm flakey: don't corrupt the zero page","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2023-54316","published":"2025-12-30T12:23:46.526Z","updated":"2026-05-11T19:59:36.681Z","title":"refscale: Fix uninitalized use of wait_queue_head_t","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2023-54315","published":"2025-12-30T12:23:45.858Z","updated":"2026-05-11T19:59:35.468Z","title":"powerpc/powernv/sriov: perform null check on iov before dereferencing iov","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2023-54314","published":"2025-12-30T12:23:45.179Z","updated":"2026-05-11T19:59:34.318Z","title":"media: af9005: Fix null-ptr-deref in af9005_i2c_xfer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2023-54313","published":"2025-12-30T12:23:44.484Z","updated":"2026-05-11T19:59:33.173Z","title":"ovl: fix null pointer dereference in ovl_get_acl_rcu()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2023-54312","published":"2025-12-30T12:23:43.828Z","updated":"2026-05-11T19:59:32.024Z","title":"samples/bpf: Fix buffer overflow in tcp_basertt","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2023-54311","published":"2025-12-30T12:23:43.174Z","updated":"2026-05-11T19:59:30.869Z","title":"ext4: fix deadlock when converting an inline directory in nojournal mode","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2023-54310","published":"2025-12-30T12:23:42.509Z","updated":"2026-08-05T09:19:10.783Z","title":"scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2023-54309","published":"2025-12-30T12:23:41.834Z","updated":"2026-05-11T19:59:28.525Z","title":"tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2023-54308","published":"2025-12-30T12:23:41.163Z","updated":"2026-10-15T21:41:44.493Z","title":"ALSA: ymfpci: Create card with device-managed snd_devm_card_new()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2023-54307","published":"2025-12-30T12:23:40.491Z","updated":"2026-05-11T19:59:26.208Z","title":"ptp_qoriq: fix memory leak in probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-54306","published":"2025-12-30T12:23:39.833Z","updated":"2026-10-15T21:41:44.334Z","title":"net: tls: avoid hanging tasks on the tx_lock","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00599,"kevAdded":null},{"id":"CVE-2023-54305","published":"2025-12-30T12:23:39.163Z","updated":"2026-05-11T19:59:23.898Z","title":"ext4: refuse to create ea block when umounted","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2023-54304","published":"2025-12-30T12:23:38.495Z","updated":"2026-05-11T19:59:22.677Z","title":"firmware: meson_sm: fix to avoid potential NULL pointer dereference","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-54303","published":"2025-12-30T12:23:37.827Z","updated":"2026-08-05T09:19:03.573Z","title":"bpf: Disable preemption in bpf_perf_event_output","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2023-54302","published":"2025-12-30T12:23:37.165Z","updated":"2026-05-11T19:59:20.335Z","title":"RDMA/irdma: Fix data race on CQP completion stats","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54301","published":"2025-12-30T12:23:36.502Z","updated":"2026-05-11T19:59:19.078Z","title":"serial: 8250_bcm7271: fix leak in `brcmuart_probe`","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54300","published":"2025-12-30T12:23:35.819Z","updated":"2026-05-11T19:59:17.912Z","title":"wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2023-54299","published":"2025-12-30T12:23:35.146Z","updated":"2026-05-11T19:59:16.752Z","title":"usb: typec: bus: verify partner exists in typec_altmode_attention","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2023-54298","published":"2025-12-30T12:23:34.503Z","updated":"2026-05-11T19:59:15.568Z","title":"thermal: intel: quark_dts: fix error pointer dereference","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2023-54297","published":"2025-12-30T12:23:33.834Z","updated":"2026-05-11T19:59:14.323Z","title":"btrfs: zoned: fix memory leak after finding block group with super blocks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2023-54296","published":"2025-12-30T12:23:33.141Z","updated":"2026-05-23T15:35:26.532Z","title":"KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54295","published":"2025-12-30T12:23:32.458Z","updated":"2026-05-11T19:59:11.974Z","title":"mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2023-54294","published":"2025-12-30T12:23:31.778Z","updated":"2026-05-11T19:59:10.829Z","title":"md/raid10: fix memleak of md thread","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2023-54293","published":"2025-12-30T12:23:31.111Z","updated":"2026-05-11T19:59:09.658Z","title":"bcache: fixup btree_cache_wait list damage","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2023-54292","published":"2025-12-30T12:23:30.419Z","updated":"2026-10-15T21:41:44.172Z","title":"RDMA/irdma: Fix data race on CQP request done","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00548,"kevAdded":null},{"id":"CVE-2023-54291","published":"2025-12-30T12:23:29.754Z","updated":"2026-05-11T19:59:07.275Z","title":"vduse: fix NULL pointer dereference","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2023-54289","published":"2025-12-30T12:23:28.430Z","updated":"2026-05-11T19:59:06.048Z","title":"scsi: qedf: Fix NULL dereference in error handling","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-54288","published":"2025-12-30T12:23:27.765Z","updated":"2026-05-23T15:35:20.917Z","title":"wifi: mac80211: fortify the spinlock against deadlock by interrupt","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2023-54287","published":"2025-12-30T12:23:27.076Z","updated":"2026-05-11T19:59:03.643Z","title":"tty: serial: imx: disable Ageing Timer interrupt request irq","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54286","published":"2025-12-30T12:23:26.421Z","updated":"2026-08-05T09:18:59.341Z","title":"wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace","severity":"HIGH","score":7.6,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2023-54285","published":"2025-12-30T12:23:25.770Z","updated":"2026-10-15T21:41:44.022Z","title":"iomap: Fix possible overflow condition in iomap_write_delalloc_scan","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2023-54284","published":"2025-12-30T12:23:25.116Z","updated":"2026-08-05T09:18:55.094Z","title":"media: av7110: prevent underflow in write_ts_to_decoder()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2023-54283","published":"2025-12-30T12:23:24.460Z","updated":"2026-05-11T19:58:58.681Z","title":"bpf: Address KCSAN report on bpf_lru_list","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2023-54282","published":"2025-12-30T12:23:23.792Z","updated":"2026-05-11T19:58:57.532Z","title":"media: tuners: qt1010: replace BUG_ON with a regular error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2023-54281","published":"2025-12-30T12:23:23.122Z","updated":"2026-05-11T19:58:56.391Z","title":"btrfs: release path before inode lookup during the ino lookup ioctl","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54280","published":"2025-12-30T12:23:22.335Z","updated":"2026-10-15T21:41:43.877Z","title":"cifs: fix potential race when tree connecting ipc","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00515,"kevAdded":null},{"id":"CVE-2022-50883","published":"2025-12-30T12:23:21.675Z","updated":"2026-05-11T19:26:58.510Z","title":"bpf: Prevent decl_tag from being referenced in func_proto arg","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2022-50882","published":"2025-12-30T12:23:21.019Z","updated":"2026-05-11T19:26:57.345Z","title":"media: uvcvideo: Fix memory leak in uvc_gpio_parse","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2022-50881","published":"2025-12-30T12:23:20.343Z","updated":"2026-05-23T15:25:24.938Z","title":"wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2022-50880","published":"2025-12-30T12:23:19.551Z","updated":"2026-10-15T21:41:24.432Z","title":"wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2022-50879","published":"2025-12-30T12:23:18.858Z","updated":"2026-05-23T15:25:23.270Z","title":"objtool: Fix SEGFAULT","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2022-50878","published":"2025-12-30T12:23:18.173Z","updated":"2026-05-11T19:26:52.621Z","title":"gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2022-50877","published":"2025-12-30T12:23:17.466Z","updated":"2026-05-11T19:26:51.390Z","title":"net: broadcom: bcm4908_enet: update TX stats after actual transmission","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2022-50876","published":"2025-12-30T12:23:16.790Z","updated":"2026-05-11T19:26:50.207Z","title":"usb: musb: Fix musb_gadget.c rxstate overflow bug","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2022-50875","published":"2025-12-30T12:23:16.108Z","updated":"2026-05-11T19:26:49.069Z","title":"of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2022-50874","published":"2025-12-30T12:23:15.388Z","updated":"2026-05-11T19:26:47.947Z","title":"RDMA/erdma: Fix refcount leak in erdma_mmap","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2023-54279","published":"2025-12-30T12:16:07.018Z","updated":"2026-05-11T19:58:54.080Z","title":"MIPS: fw: Allow firmware to pass a empty env","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2023-54278","published":"2025-12-30T12:16:06.350Z","updated":"2026-05-11T19:58:52.943Z","title":"s390/vmem: split pages when debug pagealloc is enabled","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2023-54277","published":"2025-12-30T12:16:05.690Z","updated":"2026-05-23T15:35:03.102Z","title":"fbdev: udlfb: Fix endpoint check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-54276","published":"2025-12-30T12:16:05.020Z","updated":"2026-05-11T19:58:50.629Z","title":"nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54275","published":"2025-12-30T12:16:04.380Z","updated":"2026-05-11T19:58:49.503Z","title":"wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54274","published":"2025-12-30T12:16:03.696Z","updated":"2026-05-11T19:58:48.284Z","title":"RDMA/srpt: Add a check for valid 'mad_agent' pointer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2023-54273","published":"2025-12-30T12:16:02.992Z","updated":"2026-05-11T19:58:47.184Z","title":"xfrm: Fix leak of dev tracker","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2023-54272","published":"2025-12-30T12:16:02.335Z","updated":"2026-05-11T19:58:46.004Z","title":"fs/ntfs3: Fix a possible null-pointer dereference in ni_clear()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2023-54271","published":"2025-12-30T12:16:01.672Z","updated":"2026-10-15T00:17:14.068Z","title":"blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2023-54270","published":"2025-12-30T12:16:00.990Z","updated":"2026-05-11T19:58:43.613Z","title":"media: usb: siano: Fix use after free bugs caused by do_submit_urb","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2023-54269","published":"2025-12-30T12:16:00.317Z","updated":"2026-10-15T21:41:43.730Z","title":"SUNRPC: double free xprt_ctxt while still in use","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00548,"kevAdded":null},{"id":"CVE-2023-54268","published":"2025-12-30T12:15:59.598Z","updated":"2026-05-11T19:58:41.304Z","title":"debugobjects: Don't wake up kswapd from fill_pool()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-54267","published":"2025-12-30T12:15:58.914Z","updated":"2026-05-11T19:58:40.112Z","title":"powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2023-54266","published":"2025-12-30T12:15:58.235Z","updated":"2026-05-23T15:34:53.986Z","title":"media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2023-54265","published":"2025-12-30T12:15:57.557Z","updated":"2026-05-11T19:58:37.830Z","title":"ipv6: Fix an uninit variable access bug in __ip6_make_skb()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2023-54264","published":"2025-12-30T12:15:56.893Z","updated":"2026-05-11T19:58:36.713Z","title":"fs/sysv: Null check to prevent null-ptr-deref bug","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2023-54263","published":"2025-12-30T12:15:56.231Z","updated":"2026-09-02T12:49:09.821Z","title":"drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2023-54262","published":"2025-12-30T12:15:55.556Z","updated":"2026-10-15T21:41:43.589Z","title":"net/mlx5e: Don't clone flow post action attributes second time","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2023-54261","published":"2025-12-30T12:15:54.870Z","updated":"2026-05-11T19:58:33.188Z","title":"drm/amdkfd: Add missing gfx11 MQD manager callbacks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2023-54260","published":"2025-12-30T12:15:54.205Z","updated":"2026-05-11T19:58:32.061Z","title":"cifs: Fix lost destroy smbd connection when MR allocate failed","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-54259","published":"2025-12-30T12:15:53.540Z","updated":"2026-05-11T19:58:30.911Z","title":"soundwire: bus: Fix unbalanced pm_runtime_put() causing usage count underflow","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2023-54258","published":"2025-12-30T12:15:52.855Z","updated":"2026-10-15T21:41:43.411Z","title":"cifs: fix potential oops in cifs_oplock_break","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00555,"kevAdded":null},{"id":"CVE-2023-54257","published":"2025-12-30T12:15:52.186Z","updated":"2026-08-05T09:18:30.100Z","title":"net: macb: fix a memory corruption in extended buffer descriptor mode","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00616,"kevAdded":null},{"id":"CVE-2023-54255","published":"2025-12-30T12:15:50.822Z","updated":"2026-05-11T19:58:27.430Z","title":"sh: dma: Fix DMA channel offset calculation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2023-54254","published":"2025-12-30T12:15:50.163Z","updated":"2026-10-15T21:41:43.208Z","title":"drm/ttm: Don't leak a resource on eviction error","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2023-54253","published":"2025-12-30T12:15:49.460Z","updated":"2026-05-11T19:58:25.144Z","title":"btrfs: set page extent mapped after read_folio in relocate_one_page","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2023-54252","published":"2025-12-30T12:15:48.796Z","updated":"2026-05-11T19:58:24.014Z","title":"platform/x86: think-lmi: Fix memory leaks when parsing ThinkStation WMI strings","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54251","published":"2025-12-30T12:15:48.145Z","updated":"2026-05-11T19:58:22.891Z","title":"net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX.","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54250","published":"2025-12-30T12:15:47.467Z","updated":"2026-08-05T09:18:25.471Z","title":"ksmbd: avoid out of bounds access in decode_preauth_ctxt()","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2023-54249","published":"2025-12-30T12:15:46.798Z","updated":"2026-05-11T19:58:20.603Z","title":"bus: mhi: ep: Only send -ENOTCONN status if client driver is available","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2023-54248","published":"2025-12-30T12:15:46.091Z","updated":"2026-05-11T19:58:19.363Z","title":"fs/ntfs3: Add check for kmemdup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54247","published":"2025-12-30T12:15:45.395Z","updated":"2026-05-11T19:58:18.212Z","title":"bpf: Silence a warning in btf_type_id_size()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2023-54246","published":"2025-12-30T12:15:44.729Z","updated":"2026-05-11T19:58:17.052Z","title":"rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2023-54245","published":"2025-12-30T12:15:44.060Z","updated":"2026-05-11T19:58:15.830Z","title":"ASoC: codecs: tx-macro: Fix for KASAN: slab-out-of-bounds","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2023-54244","published":"2025-12-30T12:15:43.397Z","updated":"2026-05-23T15:34:41.468Z","title":"ACPI: EC: Fix oops when removing custom query handlers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2022-50873","published":"2025-12-30T12:15:42.705Z","updated":"2026-05-11T19:26:46.591Z","title":"vdpa/vp_vdpa: fix kfree a wrong pointer in vp_vdpa_remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2022-50872","published":"2025-12-30T12:15:42.035Z","updated":"2026-05-11T19:26:45.434Z","title":"ARM: OMAP2+: Fix memory leak in realtime_counter_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2022-50871","published":"2025-12-30T12:15:41.372Z","updated":"2026-10-15T21:41:24.297Z","title":"wifi: ath11k: Fix qmi_msg_handler data structure initialization","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2022-50870","published":"2025-12-30T12:15:40.718Z","updated":"2026-05-11T19:26:43.134Z","title":"powerpc/rtas: avoid device tree lookups in rtas_os_term()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2022-50869","published":"2025-12-30T12:15:39.879Z","updated":"2026-08-05T08:59:54.196Z","title":"fs/ntfs3: Fix slab-out-of-bounds in r_page","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2022-50868","published":"2025-12-30T12:15:39.211Z","updated":"2026-05-11T19:26:40.801Z","title":"hwrng: amd - Fix PCI device refcount leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2022-50867","published":"2025-12-30T12:15:38.520Z","updated":"2026-08-05T08:59:53.122Z","title":"drm/msm/a6xx: Fix kvzalloc vs state_kcalloc usage","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2022-50866","published":"2025-12-30T12:15:37.827Z","updated":"2026-05-11T19:26:38.291Z","title":"ASoC: pxa: fix null-pointer dereference in filter()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2022-50865","published":"2025-12-30T12:15:37.150Z","updated":"2026-08-05T08:59:52.038Z","title":"tcp: fix a signed-integer-overflow bug in tcp_add_backlog()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00528,"kevAdded":null},{"id":"CVE-2022-50864","published":"2025-12-30T12:15:36.489Z","updated":"2026-05-11T19:26:35.896Z","title":"nilfs2: fix shift-out-of-bounds due to too large exponent of block size","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2022-50863","published":"2025-12-30T12:15:35.834Z","updated":"2026-05-11T19:26:34.757Z","title":"wifi: rtw89: free unused skb to prevent memory leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2022-50862","published":"2025-12-30T12:15:35.177Z","updated":"2026-05-11T19:26:33.642Z","title":"bpf: prevent decl_tag from being referenced in func_proto","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2022-50861","published":"2025-12-30T12:15:34.511Z","updated":"2026-08-05T08:59:50.963Z","title":"NFSD: Finish converting the NFSv2 GETACL result encoder","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00584,"kevAdded":null},{"id":"CVE-2022-50860","published":"2025-12-30T12:15:33.859Z","updated":"2026-08-05T08:59:49.893Z","title":"apparmor: Fix memleak in alloc_ns()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2022-50859","published":"2025-12-30T12:15:33.198Z","updated":"2026-05-11T19:26:30.131Z","title":"cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2022-50858","published":"2025-12-30T12:15:32.534Z","updated":"2026-05-11T19:26:29.001Z","title":"mmc: alcor: fix return value check of mmc_add_host()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2022-50857","published":"2025-12-30T12:15:31.873Z","updated":"2026-05-11T19:26:27.847Z","title":"rapidio: rio: fix possible name leak in rio_register_mport()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2022-50856","published":"2025-12-30T12:15:31.193Z","updated":"2026-05-11T19:26:26.616Z","title":"cifs: Fix xid leak in cifs_ses_add_channel()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2022-50855","published":"2025-12-30T12:15:30.481Z","updated":"2026-05-11T19:26:25.459Z","title":"bpf: prevent leak of lsm program after failed attach","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2022-50854","published":"2025-12-30T12:15:29.792Z","updated":"2026-05-11T19:26:24.301Z","title":"nfc: virtual_ncidev: Fix memory leak in virtual_nci_send()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2022-50853","published":"2025-12-30T12:15:29.104Z","updated":"2026-05-23T15:25:21.472Z","title":"NFSv4: Fix a credential leak in _nfs4_discover_trunking()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2022-50852","published":"2025-12-30T12:15:28.444Z","updated":"2026-05-11T19:26:22.017Z","title":"wifi: mt76: mt7921: fix use after free in mt7921_acpi_read()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2022-50851","published":"2025-12-30T12:15:27.765Z","updated":"2026-05-11T19:26:20.767Z","title":"vhost_vdpa: fix the crash in unmap a large memory","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2022-50850","published":"2025-12-30T12:15:27.089Z","updated":"2026-05-11T19:26:19.596Z","title":"scsi: ipr: Fix WARNING in ipr_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2022-50849","published":"2025-12-30T12:15:26.431Z","updated":"2026-05-11T19:26:18.385Z","title":"pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2022-50848","published":"2025-12-30T12:15:25.776Z","updated":"2026-05-11T19:26:17.227Z","title":"drivers: dio: fix possible memory leak in dio_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2023-54243","published":"2025-12-30T12:11:31.180Z","updated":"2026-10-15T21:41:43.012Z","title":"netfilter: ebtables: fix table blob use-after-free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2023-54242","published":"2025-12-30T12:11:30.503Z","updated":"2026-05-11T19:58:12.120Z","title":"block, bfq: Fix division by zero error on zero wsum","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2023-54241","published":"2025-12-30T12:11:29.726Z","updated":"2026-05-11T19:58:10.970Z","title":"MIPS: KVM: Fix NULL pointer dereference","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54240","published":"2025-12-30T12:11:29.039Z","updated":"2026-05-11T19:58:09.830Z","title":"net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2023-54239","published":"2025-12-30T12:11:28.378Z","updated":"2026-05-11T19:58:08.672Z","title":"iommufd: Check for uptr overflow","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2023-54238","published":"2025-12-30T12:11:27.702Z","updated":"2026-10-15T21:41:42.874Z","title":"mlx5: fix skb leak while fifo resync and push","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2023-54237","published":"2025-12-30T12:11:27.028Z","updated":"2026-10-15T21:41:42.738Z","title":"net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00555,"kevAdded":null},{"id":"CVE-2023-54236","published":"2025-12-30T12:11:26.373Z","updated":"2026-05-11T19:58:05.217Z","title":"net/net_failover: fix txq exceeding warning","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2023-54235","published":"2025-12-30T12:11:25.688Z","updated":"2026-05-23T15:34:30.766Z","title":"PCI/DOE: Fix destroy_work_on_stack() race","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54234","published":"2025-12-30T12:11:25.021Z","updated":"2026-10-15T21:41:42.603Z","title":"scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2023-54233","published":"2025-12-30T12:11:24.361Z","updated":"2026-10-03T10:55:06.498Z","title":"ASoC: SOF: avoid a NULL dereference with unsupported widgets","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2023-54232","published":"2025-12-30T12:11:23.565Z","updated":"2026-05-11T19:58:00.368Z","title":"m68k: Only force 030 bus error if PC not in exception table","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2023-54231","published":"2025-12-30T12:11:22.892Z","updated":"2026-05-11T19:57:59.168Z","title":"net: libwx: fix memory leak in wx_setup_rx_resources","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2023-54230","published":"2025-12-30T12:11:22.230Z","updated":"2026-05-11T19:57:58.007Z","title":"amba: bus: fix refcount leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2023-54229","published":"2025-12-30T12:11:21.549Z","updated":"2026-05-11T19:57:56.875Z","title":"wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2023-54228","published":"2025-12-30T12:11:20.884Z","updated":"2026-05-11T19:57:55.682Z","title":"regulator: raa215300: Fix resource leak in case of error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2023-54227","published":"2025-12-30T12:11:20.207Z","updated":"2026-10-15T21:41:42.461Z","title":"blk-mq: fix tags leak when shrink nr_hw_queues","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2023-54226","published":"2025-12-30T12:11:19.522Z","updated":"2026-05-11T19:57:53.270Z","title":"af_unix: Fix data races around sk->sk_shutdown.","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-54225","published":"2025-12-30T12:11:18.839Z","updated":"2026-05-11T19:57:52.130Z","title":"net: ipa: only reset hashed tables when supported","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2023-54224","published":"2025-12-30T12:11:18.076Z","updated":"2026-05-11T19:57:50.965Z","title":"btrfs: fix lockdep splat and potential deadlock after failure running delayed items","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2023-54223","published":"2025-12-30T12:11:17.389Z","updated":"2026-10-15T21:41:42.328Z","title":"net/mlx5e: xsk: Fix invalid buffer access for legacy rq","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00454,"kevAdded":null},{"id":"CVE-2023-54222","published":"2025-12-30T12:11:16.724Z","updated":"2026-05-11T19:57:48.682Z","title":"hte: tegra-194: Fix off by one in tegra_hte_map_to_line_id()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54221","published":"2025-12-30T12:11:16.053Z","updated":"2026-05-11T19:57:47.547Z","title":"clk: imx93: fix memory leak and missing unwind goto in imx93_clocks_probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54220","published":"2025-12-30T12:11:15.385Z","updated":"2026-10-15T21:41:42.172Z","title":"serial: 8250: Fix oops for port->pm on uart_change_pm()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2023-54219","published":"2025-12-30T12:11:14.720Z","updated":"2026-08-05T09:18:08.934Z","title":"Revert \"IB/isert: Fix incorrect release of isert connection\"","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00693,"kevAdded":null},{"id":"CVE-2023-54218","published":"2025-12-30T12:11:14.059Z","updated":"2026-05-11T19:57:44.055Z","title":"net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs().","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2023-54217","published":"2025-12-30T12:11:13.390Z","updated":"2026-05-11T19:57:42.906Z","title":"Revert \"drm/msm: Add missing check and destroy for alloc_ordered_workqueue\"","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2023-54216","published":"2025-12-30T12:11:12.730Z","updated":"2026-08-05T09:18:07.580Z","title":"net/mlx5e: TC, Fix using eswitch mapping in nic mode","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2023-54215","published":"2025-12-30T12:11:12.063Z","updated":"2026-05-11T19:57:40.559Z","title":"virtio-vdpa: Fix cpumask memory leak in virtio_vdpa_find_vqs()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2023-54214","published":"2025-12-30T12:11:11.383Z","updated":"2026-10-15T21:41:41.834Z","title":"Bluetooth: L2CAP: Fix potential user-after-free","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2023-54213","published":"2025-12-30T12:11:10.702Z","updated":"2026-05-11T19:57:38.230Z","title":"USB: sisusbvga: Add endpoint checks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2023-54211","published":"2025-12-30T12:11:09.356Z","updated":"2026-05-11T19:57:37.075Z","title":"tracing: Fix warning in trace_buffered_event_disable()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2023-54210","published":"2025-12-30T12:11:08.682Z","updated":"2026-10-15T21:41:41.692Z","title":"Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2023-54209","published":"2025-12-30T12:11:08.027Z","updated":"2026-05-11T19:57:34.725Z","title":"block: fix blktrace debugfs entries leakage","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54208","published":"2025-12-30T12:11:07.336Z","updated":"2026-05-11T19:57:33.588Z","title":"media: ov5675: Fix memleak in ov5675_init_controls()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-54207","published":"2025-12-30T12:11:06.643Z","updated":"2026-06-11T18:44:16.426Z","title":"HID: uclogic: Correct devm device reference for hidinput input_dev name","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2023-54206","published":"2025-12-30T12:11:05.945Z","updated":"2026-10-15T21:41:41.534Z","title":"net/sched: flower: fix filter idr initialization","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2023-54205","published":"2025-12-30T12:11:05.295Z","updated":"2026-05-11T19:57:30.110Z","title":"pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-54204","published":"2025-12-30T12:11:04.622Z","updated":"2026-05-11T19:57:28.938Z","title":"mmc: sunplus: fix return value check of mmc_add_host()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2022-50847","published":"2025-12-30T12:11:03.949Z","updated":"2026-05-11T19:26:16.039Z","title":"drm/bridge: it6505: Initialize AUX channel in it6505_i2c_probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2022-50846","published":"2025-12-30T12:11:03.286Z","updated":"2026-05-11T19:26:14.924Z","title":"mmc: via-sdmmc: fix return value check of mmc_add_host()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2022-50845","published":"2025-12-30T12:11:02.615Z","updated":"2026-05-11T19:26:13.671Z","title":"ext4: fix inode leak in ext4_xattr_inode_create() on an error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2022-50844","published":"2025-12-30T12:11:01.928Z","updated":"2026-05-11T19:26:12.450Z","title":"drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2022-50843","published":"2025-12-30T12:11:01.130Z","updated":"2026-05-11T19:26:11.293Z","title":"dm clone: Fix UAF in clone_dtr()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2022-50842","published":"2025-12-30T12:11:00.439Z","updated":"2026-05-11T19:26:10.144Z","title":"drm/virtio: Check whether transferred 2D BO is shmem","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2022-50841","published":"2025-12-30T12:10:59.743Z","updated":"2026-08-05T08:59:48.817Z","title":"fs/ntfs3: Add overflow check for attribute size","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2022-50840","published":"2025-12-30T12:10:59.066Z","updated":"2026-05-11T19:26:07.823Z","title":"scsi: snic: Fix possible UAF in snic_tgt_create()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2022-50839","published":"2025-12-30T12:10:58.406Z","updated":"2026-05-11T19:26:06.678Z","title":"jbd2: fix potential buffer head reference count leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2022-50838","published":"2025-12-30T12:10:57.721Z","updated":"2026-05-23T15:25:19.909Z","title":"net: stream: purge sk_error_queue in sk_stream_kill_queues()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2022-50837","published":"2025-12-30T12:10:57.049Z","updated":"2026-05-11T19:26:04.353Z","title":"net: dsa: tag_8021q: avoid leaking ctx on dsa_tag_8021q_register() error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2022-50836","published":"2025-12-30T12:10:56.394Z","updated":"2026-05-11T19:26:03.012Z","title":"remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2022-50835","published":"2025-12-30T12:10:55.715Z","updated":"2026-05-11T19:26:01.589Z","title":"jbd2: add miss release buffer head in fc_do_one_pass()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2022-50834","published":"2025-12-30T12:10:55.025Z","updated":"2026-05-11T19:26:00.365Z","title":"nfc: Fix potential resource leaks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2022-50833","published":"2025-12-30T12:10:54.342Z","updated":"2026-05-23T15:25:18.248Z","title":"Bluetooth: use hdev->workqueue when queuing hdev->{cmd,ncmd}_timer works","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2022-50832","published":"2025-12-30T12:10:53.601Z","updated":"2026-05-11T19:25:57.719Z","title":"wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2022-50830","published":"2025-12-30T12:10:52.099Z","updated":"2026-05-11T19:25:56.572Z","title":"auxdisplay: hd44780: Fix potential memory leak in hd44780_remove()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2022-50829","published":"2025-12-30T12:10:51.434Z","updated":"2026-05-11T19:25:55.400Z","title":"wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2022-50828","published":"2025-12-30T12:10:50.757Z","updated":"2026-05-11T19:25:54.242Z","title":"clk: zynqmp: Fix stack-out-of-bounds in strncpy`","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2023-54203","published":"2025-12-30T12:09:07.538Z","updated":"2026-08-05T09:18:01.954Z","title":"ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00548,"kevAdded":null},{"id":"CVE-2023-54202","published":"2025-12-30T12:09:06.872Z","updated":"2026-10-15T21:41:41.415Z","title":"drm/i915: fix race condition UAF in i915_perf_add_config_ioctl","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2023-54201","published":"2025-12-30T12:09:06.211Z","updated":"2026-08-05T09:17:59.823Z","title":"RDMA/efa: Fix wrong resources deallocation order","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2023-54200","published":"2025-12-30T12:09:05.538Z","updated":"2026-10-15T21:41:41.271Z","title":"netfilter: nf_tables: always release netdev hooks from notifier","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2023-54199","published":"2025-12-30T12:09:04.886Z","updated":"2026-05-11T19:57:23.246Z","title":"drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-54198","published":"2025-12-30T12:09:04.229Z","updated":"2026-10-15T21:41:41.131Z","title":"tty: fix out-of-bounds access in tty_driver_lookup_tty()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2023-54197","published":"2025-12-30T12:09:03.472Z","updated":"2026-05-23T15:34:08.958Z","title":"Revert \"Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work\"","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2023-54196","published":"2025-12-30T12:09:02.801Z","updated":"2026-05-11T19:57:19.624Z","title":"fs/ntfs3: Fix NULL pointer dereference in 'ni_write_inode'","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54195","published":"2025-12-30T12:09:02.123Z","updated":"2026-05-11T19:57:18.436Z","title":"rxrpc: Fix timeout of a call that hasn't yet been granted a channel","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2023-54194","published":"2025-12-30T12:09:01.436Z","updated":"2026-05-11T19:57:17.280Z","title":"exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2023-54193","published":"2025-12-30T12:09:00.738Z","updated":"2026-10-15T21:41:40.994Z","title":"net/sched: cls_api: remove block_cb from driver_list before freeing","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2023-54192","published":"2025-12-30T12:08:59.989Z","updated":"2026-05-23T15:34:04.551Z","title":"f2fs: fix null pointer panic in tracepoint in __replace_atomic_write_block","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2023-54191","published":"2025-12-30T12:08:59.304Z","updated":"2026-05-11T19:57:13.641Z","title":"wifi: mt76: mt7996: fix memory leak in mt7996_mcu_exit","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2023-54190","published":"2025-12-30T12:08:58.605Z","updated":"2026-05-11T19:57:12.488Z","title":"leds: led-core: Fix refcount leak in of_led_get()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54189","published":"2025-12-30T12:08:57.915Z","updated":"2026-05-23T15:34:00.398Z","title":"pstore/ram: Add check for kstrdup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-54188","published":"2025-12-30T12:08:57.226Z","updated":"2026-05-11T19:57:10.116Z","title":"dmaengine: apple-admac: Fix 'current_tx' not getting freed","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2023-54187","published":"2025-12-30T12:08:56.562Z","updated":"2026-08-05T09:17:54.804Z","title":"f2fs: fix potential corruption when moving a directory","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2023-54186","published":"2025-12-30T12:08:55.882Z","updated":"2026-08-05T09:17:53.517Z","title":"usb: typec: altmodes/displayport: fix pin_assignment_show","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2023-54185","published":"2025-12-30T12:08:55.218Z","updated":"2026-05-11T19:57:06.627Z","title":"btrfs: remove BUG_ON()'s in add_new_free_space()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2023-54184","published":"2025-12-30T12:08:54.528Z","updated":"2026-08-05T09:17:52.229Z","title":"scsi: target: iscsit: Free cmds before session free","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00572,"kevAdded":null},{"id":"CVE-2023-54183","published":"2025-12-30T12:08:53.888Z","updated":"2026-05-11T19:57:04.159Z","title":"media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2023-54182","published":"2025-12-30T12:08:53.092Z","updated":"2026-08-05T09:17:51.173Z","title":"f2fs: fix to check readonly condition correctly","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2023-54181","published":"2025-12-30T12:08:52.376Z","updated":"2026-05-11T19:57:01.011Z","title":"bpf: Fix issue in verifying allow_ptr_leaks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54180","published":"2025-12-30T12:08:51.727Z","updated":"2026-05-11T19:56:59.896Z","title":"btrfs: handle case when repair happens with dev-replace","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2023-54179","published":"2025-12-30T12:08:51.065Z","updated":"2026-05-11T19:56:58.726Z","title":"scsi: qla2xxx: Array index may go out of bound","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-54178","published":"2025-12-30T12:08:50.324Z","updated":"2026-05-11T19:56:57.606Z","title":"of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2023-54177","published":"2025-12-30T12:08:49.588Z","updated":"2026-05-23T15:33:55.130Z","title":"quota: fix warning in dqgrab()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2023-54176","published":"2025-12-30T12:08:48.915Z","updated":"2026-05-11T19:56:55.238Z","title":"mptcp: stricter state check in mptcp_worker","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54175","published":"2025-12-30T12:08:48.231Z","updated":"2026-05-11T19:56:54.083Z","title":"i2c: xiic: xiic_xfer(): Fix runtime PM leak on error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-54174","published":"2025-12-30T12:08:47.527Z","updated":"2026-05-11T19:56:52.938Z","title":"vfio: Fix NULL pointer dereference caused by uninitialized group->iommufd","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2023-54173","published":"2025-12-30T12:08:46.842Z","updated":"2026-10-15T21:41:40.859Z","title":"bpf: Disable preemption in bpf_event_output","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2023-54172","published":"2025-12-30T12:08:46.146Z","updated":"2026-05-11T19:56:50.532Z","title":"x86/hyperv: Disable IBT when hypercall page lacks ENDBR instruction","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2023-54171","published":"2025-12-30T12:08:45.441Z","updated":"2026-05-11T19:56:49.388Z","title":"tracing: Fix memory leak of iter->temp when reading trace_pipe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54170","published":"2025-12-30T12:08:44.763Z","updated":"2026-05-11T19:56:48.287Z","title":"keys: Fix linking a duplicate key to a keyring's assoc_array","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-54169","published":"2025-12-30T12:08:44.089Z","updated":"2026-05-11T19:56:47.153Z","title":"net/mlx5e: fix memory leak in mlx5e_ptp_open","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54168","published":"2025-12-30T12:08:43.394Z","updated":"2026-10-15T21:41:40.726Z","title":"RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2023-54167","published":"2025-12-30T12:08:42.705Z","updated":"2026-05-11T19:56:44.783Z","title":"m68k: mm: Move initrd phys_to_virt handling after paging_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2023-54166","published":"2025-12-30T12:08:41.832Z","updated":"2026-08-05T09:17:47.971Z","title":"igc: Fix Kernel Panic during ndo_tx_timeout callback","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2023-54165","published":"2025-12-30T12:08:41.019Z","updated":"2026-08-05T09:17:46.890Z","title":"zsmalloc: move LRU update from zs_map_object() to zs_malloc()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2023-54164","published":"2025-12-30T12:08:40.357Z","updated":"2026-10-15T21:41:40.592Z","title":"Bluetooth: ISO: fix iso_conn related locking and validity issues","severity":"HIGH","score":8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2022-50827","published":"2025-12-30T12:08:39.669Z","updated":"2026-05-11T19:25:53.091Z","title":"scsi: lpfc: Fix memory leak in lpfc_create_port()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2022-50826","published":"2025-12-30T12:08:38.950Z","updated":"2026-05-11T19:25:51.929Z","title":"ipu3-imgu: Fix NULL pointer dereference in imgu_subdev_set_selection()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2022-50825","published":"2025-12-30T12:08:38.249Z","updated":"2026-05-11T19:25:50.808Z","title":"usb: typec: wusb3801: fix fwnode refcount leak in wusb3801_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00275,"kevAdded":null},{"id":"CVE-2022-50824","published":"2025-12-30T12:08:37.580Z","updated":"2026-05-11T19:25:49.624Z","title":"tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2022-50823","published":"2025-12-30T12:08:36.911Z","updated":"2026-05-11T19:25:48.476Z","title":"clk: tegra: Fix refcount leak in tegra114_clock_init","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2022-50822","published":"2025-12-30T12:08:36.228Z","updated":"2026-10-15T21:41:24.165Z","title":"RDMA/restrack: Release MR restrack when delete","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2022-50821","published":"2025-12-30T12:08:35.564Z","updated":"2026-05-11T19:25:46.202Z","title":"SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2022-50820","published":"2025-12-30T12:08:34.894Z","updated":"2026-05-11T19:25:45.031Z","title":"perf/arm_dmc620: Fix hotplug callback leak in dmc620_pmu_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2022-50819","published":"2025-12-30T12:08:34.225Z","updated":"2026-05-11T19:25:43.872Z","title":"udmabuf: Set ubuf->sg = NULL if the creation of sg table fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2022-50818","published":"2025-12-30T12:08:33.548Z","updated":"2026-05-11T19:25:42.709Z","title":"scsi: pm8001: Fix running_req for internal abort commands","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2022-50817","published":"2025-12-30T12:08:32.866Z","updated":"2026-05-11T19:25:41.586Z","title":"net: hsr: avoid possible NULL deref in skb_clone()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2022-50816","published":"2025-12-30T12:08:32.215Z","updated":"2026-05-11T19:25:40.382Z","title":"ipv6: ensure sane device mtu in tunnels","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2022-50815","published":"2025-12-30T12:08:31.554Z","updated":"2026-05-11T19:25:39.257Z","title":"ext2: Add sanity checks for group and filesystem size","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2022-50814","published":"2025-12-30T12:08:30.862Z","updated":"2026-05-11T19:25:38.090Z","title":"crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2022-50813","published":"2025-12-30T12:08:30.164Z","updated":"2026-05-11T19:25:36.947Z","title":"drivers: mcb: fix resource leak in mcb_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2022-50812","published":"2025-12-30T12:08:29.434Z","updated":"2026-05-11T19:25:35.722Z","title":"security: Restrict CONFIG_ZERO_CALL_USED_REGS to gcc or clang > 15.0.6","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2022-50811","published":"2025-12-30T12:08:28.719Z","updated":"2026-05-11T19:25:34.584Z","title":"erofs: fix missing unmap if z_erofs_get_extent_compressedlen() fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2022-50810","published":"2025-12-30T12:08:27.924Z","updated":"2026-05-11T19:25:33.405Z","title":"rapidio: devices: fix missing put_device in mport_cdev_open","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2022-50809","published":"2025-12-30T12:08:27.242Z","updated":"2026-05-23T15:25:16.272Z","title":"xhci: dbc: Fix memory leak in xhci_alloc_dbc()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2023-54162","published":"2025-12-30T12:03:23.583Z","updated":"2026-08-05T09:17:44.673Z","title":"ksmbd: fix possible memory leak in smb2_lock()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0039,"kevAdded":null},{"id":"CVE-2022-50786","published":"2025-12-30T12:03:22.909Z","updated":"2026-05-11T19:25:31.010Z","title":"media: s5p-mfc: Clear workbit to handle error condition","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2022-50785","published":"2025-12-30T12:03:22.224Z","updated":"2026-08-05T08:59:46.661Z","title":"fsi: occ: Prevent use after free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2022-50784","published":"2025-12-30T12:03:21.544Z","updated":"2026-05-11T19:25:28.745Z","title":"wifi: iwlwifi: mei: fix potential NULL-ptr deref after clone","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-68750","published":"2025-12-24T15:51:03.141Z","updated":"2026-05-11T21:52:37.371Z","title":"usb: potential integer overflow in usbg_make_tpg()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2023-54160","published":"2025-12-24T13:07:08.883Z","updated":"2026-05-11T19:56:38.986Z","title":"firmware: arm_sdei: Fix sleep from invalid context BUG","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-54159","published":"2025-12-24T13:07:08.207Z","updated":"2026-05-11T19:56:37.853Z","title":"usb: mtu3: fix kernel panic at qmu transfer done irq handler","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-54158","published":"2025-12-24T13:07:07.438Z","updated":"2026-05-11T19:56:36.669Z","title":"btrfs: don't free qgroup space unless specified","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2023-54157","published":"2025-12-24T13:07:06.764Z","updated":"2026-08-05T09:17:43.435Z","title":"binder: fix UAF of alloc->vma in race with munmap()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2023-54156","published":"2025-12-24T13:07:06.043Z","updated":"2026-10-15T21:41:40.463Z","title":"sfc: fix crash when reading stats while NIC is resetting","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2023-54155","published":"2025-12-24T13:07:05.385Z","updated":"2026-05-11T19:56:33.077Z","title":"net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54154","published":"2025-12-24T13:07:04.721Z","updated":"2026-05-23T15:33:43.772Z","title":"scsi: target: core: Fix target_cmd_counter leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2023-54153","published":"2025-12-24T13:07:04.007Z","updated":"2026-08-05T09:17:40.749Z","title":"ext4: turn quotas off if mount failed after enabling quotas","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2023-54152","published":"2025-12-24T13:07:03.310Z","updated":"2026-05-11T19:56:29.583Z","title":"can: j1939: prevent deadlock by moving j1939_sk_errqueue()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54151","published":"2025-12-24T13:07:02.600Z","updated":"2026-08-05T09:17:39.424Z","title":"f2fs: Fix system crash due to lack of free space in LFS","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2023-54150","published":"2025-12-24T13:07:01.754Z","updated":"2026-05-11T19:56:27.275Z","title":"drm/amd: Fix an out of bounds error in BIOS parser","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54149","published":"2025-12-24T13:07:00.977Z","updated":"2026-08-05T09:17:38.014Z","title":"net: dsa: avoid suspicious RCU usage for synced VLAN-aware MAC addresses","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2023-54148","published":"2025-12-24T13:07:00.260Z","updated":"2026-05-23T15:33:19.751Z","title":"net/mlx5e: Move representor neigh cleanup to profile cleanup_tx","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2023-54147","published":"2025-12-24T13:06:59.566Z","updated":"2026-05-11T19:56:23.810Z","title":"media: platform: mtk-mdp3: Add missing check and free for ida_alloc","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54146","published":"2025-12-24T13:06:58.904Z","updated":"2026-05-23T15:33:14.821Z","title":"x86/kexec: Fix double-free of elf header buffer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54145","published":"2025-12-24T13:06:58.227Z","updated":"2026-05-11T19:56:21.424Z","title":"bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2023-54144","published":"2025-12-24T13:06:57.546Z","updated":"2026-05-11T19:56:20.267Z","title":"drm/amdkfd: Fix kernel warning during topology setup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2023-54143","published":"2025-12-24T13:06:56.869Z","updated":"2026-05-11T19:56:19.068Z","title":"media: mediatek: vcodec: fix resource leaks in vdec_msg_queue_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54142","published":"2025-12-24T13:06:56.204Z","updated":"2026-08-05T09:17:36.638Z","title":"gtp: Fix use-after-free in __gtp_encap_destroy().","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2023-54141","published":"2025-12-24T13:06:55.468Z","updated":"2026-09-02T12:49:08.767Z","title":"wifi: ath11k: Add missing hw_ops->get_ring_selector() for IPQ5018","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2023-54140","published":"2025-12-24T13:06:54.784Z","updated":"2026-08-05T09:17:35.344Z","title":"nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2023-54139","published":"2025-12-24T13:06:54.094Z","updated":"2026-08-05T09:17:34.267Z","title":"tracing/user_events: Ensure write index cannot be negative","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2023-54138","published":"2025-12-24T13:06:53.365Z","updated":"2026-05-11T19:56:13.226Z","title":"drm/msm: fix NULL-deref on irq uninstall","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2023-54137","published":"2025-12-24T13:06:52.689Z","updated":"2026-05-11T19:56:12.086Z","title":"vfio/type1: fix cap_migration information leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2023-54136","published":"2025-12-24T13:06:51.989Z","updated":"2026-05-11T19:56:10.923Z","title":"serial: sprd: Fix DMA buffer leak issue","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-54135","published":"2025-12-24T13:06:51.329Z","updated":"2026-08-05T09:17:33.212Z","title":"maple_tree: fix potential out-of-bounds access in mas_wr_end_piv()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2023-54134","published":"2025-12-24T13:06:50.627Z","updated":"2026-05-11T19:56:08.647Z","title":"autofs: fix memory leak of waitqueues in autofs_catatonic_mode","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2023-54133","published":"2025-12-24T13:06:49.919Z","updated":"2026-05-11T19:56:07.492Z","title":"nfp: clean mc addresses in application firmware when closing port","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2023-54132","published":"2025-12-24T13:06:49.030Z","updated":"2026-08-05T09:17:32.148Z","title":"erofs: stop parsing non-compact HEAD index if clusterofs is invalid","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2023-54131","published":"2025-12-24T13:06:48.227Z","updated":"2026-05-11T19:56:05.152Z","title":"wifi: rt2x00: Fix memory leak when handling surveys","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2023-54130","published":"2025-12-24T13:06:47.502Z","updated":"2026-08-05T09:17:31.074Z","title":"hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2023-54129","published":"2025-12-24T13:06:46.817Z","updated":"2026-08-05T09:17:30.008Z","title":"octeontx2-af: Add validation for lmac type","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2023-54128","published":"2025-12-24T13:06:46.056Z","updated":"2026-10-15T21:41:40.328Z","title":"fs: drop peer group ids under namespace lock","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2023-54127","published":"2025-12-24T13:06:45.380Z","updated":"2026-08-05T09:17:27.521Z","title":"fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2023-54126","published":"2025-12-24T13:06:44.687Z","updated":"2026-05-11T19:55:59.015Z","title":"crypto: safexcel - Cleanup ring IRQ workqueues on load failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2023-54125","published":"2025-12-24T13:06:43.977Z","updated":"2026-08-05T09:17:26.458Z","title":"fs/ntfs3: Return error for inconsistent extended attributes","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2023-54124","published":"2025-12-24T13:06:43.290Z","updated":"2026-08-05T09:17:25.391Z","title":"f2fs: fix to drop all dirty pages during umount() if cp_error is set","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2023-54123","published":"2025-12-24T13:06:42.588Z","updated":"2026-05-11T19:55:55.488Z","title":"md/raid10: fix memleak for 'conf->bio_split'","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2023-54122","published":"2025-12-24T13:06:41.900Z","updated":"2026-05-11T19:55:54.315Z","title":"drm/msm/dpu: Add check for cstate","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2023-54121","published":"2025-12-24T13:06:41.185Z","updated":"2026-08-05T09:17:24.043Z","title":"btrfs: fix incorrect splitting in btrfs_drop_extent_map_range","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2023-54120","published":"2025-12-24T13:06:40.420Z","updated":"2026-10-15T21:41:40.191Z","title":"Bluetooth: Fix race condition in hidp_session_thread","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2023-54119","published":"2025-12-24T13:06:39.692Z","updated":"2026-05-11T19:55:50.727Z","title":"inotify: Avoid reporting event with invalid wd","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2023-54118","published":"2025-12-24T13:06:38.998Z","updated":"2026-05-11T19:55:49.586Z","title":"serial: sc16is7xx: setup GPIO controller later in probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2023-54117","published":"2025-12-24T13:06:38.311Z","updated":"2026-05-11T19:55:48.438Z","title":"s390/dcssblk: fix kernel crash with list_add corruption","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2023-54116","published":"2025-12-24T13:06:37.591Z","updated":"2026-10-15T21:41:40.047Z","title":"drm/fbdev-generic: prohibit potential out-of-bounds access","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2023-54115","published":"2025-12-24T13:06:36.892Z","updated":"2026-05-11T19:55:46.032Z","title":"pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2023-54114","published":"2025-12-24T13:06:36.214Z","updated":"2026-05-11T19:55:44.834Z","title":"net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2023-54113","published":"2025-12-24T13:06:35.514Z","updated":"2026-05-11T19:55:43.650Z","title":"rcu: dump vmalloc memory info safely","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54112","published":"2025-12-24T13:06:34.854Z","updated":"2026-05-11T19:55:42.470Z","title":"kcm: Fix memory leak in error path of kcm_sendmsg()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2023-54111","published":"2025-12-24T13:06:34.187Z","updated":"2026-05-11T19:55:41.312Z","title":"pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2023-54110","published":"2025-12-24T13:06:33.495Z","updated":"2026-05-11T19:55:40.163Z","title":"usb: rndis_host: Secure rndis_query check against int overflow","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2023-54109","published":"2025-12-24T13:06:32.836Z","updated":"2026-05-11T19:55:39.017Z","title":"media: rcar_fdp1: Fix refcount leak in probe and remove function","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2023-54108","published":"2025-12-24T13:06:32.184Z","updated":"2026-05-23T15:32:46.827Z","title":"scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2023-54107","published":"2025-12-24T13:06:31.505Z","updated":"2026-10-30T12:17:40.061Z","title":"blk-cgroup: dropping parent refcount after pd_free_fn() is done","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2023-54106","published":"2025-12-24T13:06:30.829Z","updated":"2026-05-11T19:55:35.382Z","title":"net/mlx5: fix potential memory leak in mlx5e_init_rep_rx","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2023-54105","published":"2025-12-24T13:06:30.053Z","updated":"2026-05-11T19:55:34.267Z","title":"can: isotp: check CAN address family in isotp_bind()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2023-54104","published":"2025-12-24T13:06:29.354Z","updated":"2026-08-05T09:17:18.597Z","title":"mtd: rawnand: fsl_upm: Fix an off-by one test in fun_exec_op()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2023-54102","published":"2025-12-24T13:06:27.915Z","updated":"2026-05-11T19:55:31.921Z","title":"scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2023-54101","published":"2025-12-24T13:06:27.234Z","updated":"2026-05-11T19:55:30.807Z","title":"driver: soc: xilinx: use _safe loop iterator to avoid a use after free","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2023-54100","published":"2025-12-24T13:06:26.560Z","updated":"2026-08-05T09:17:17.178Z","title":"scsi: qedi: Fix use after free bug in qedi_remove()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2023-54099","published":"2025-12-24T13:06:25.895Z","updated":"2026-05-11T19:55:28.442Z","title":"fs: Protect reconfiguration of sb read-write from racing writes","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2023-54098","published":"2025-12-24T13:06:25.197Z","updated":"2026-10-15T21:41:39.789Z","title":"drm/i915/gvt: fix gvt debugfs destroy","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2023-54097","published":"2025-12-24T13:06:24.519Z","updated":"2026-05-11T19:55:25.909Z","title":"regulator: stm32-pwr: fix of_iomap leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2023-54096","published":"2025-12-24T13:06:23.828Z","updated":"2026-08-05T09:17:14.522Z","title":"soundwire: fix enumeration completion","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2023-54095","published":"2025-12-24T13:06:23.157Z","updated":"2026-10-15T21:41:39.654Z","title":"powerpc/iommu: Fix notifiers being shared by PCI and VIO buses","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2023-54094","published":"2025-12-24T13:06:22.446Z","updated":"2026-10-15T21:41:39.521Z","title":"net: prevent skb corruption on frag list segmentation","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00548,"kevAdded":null},{"id":"CVE-2023-54093","published":"2025-12-24T13:06:21.774Z","updated":"2026-05-11T19:55:21.360Z","title":"media: anysee: fix null-ptr-deref in anysee_master_xfer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2023-54092","published":"2025-12-24T13:06:21.092Z","updated":"2026-10-15T21:41:39.384Z","title":"KVM: s390: pv: fix index value of replaced ASCE","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2023-54091","published":"2025-12-24T13:06:20.376Z","updated":"2026-05-11T19:55:19.060Z","title":"drm/client: Fix memory leak in drm_client_target_cloned","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2023-54090","published":"2025-12-24T13:06:19.666Z","updated":"2026-08-05T09:17:08.999Z","title":"ixgbe: Fix panic during XDP_TX with > 64 CPUs","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00588,"kevAdded":null},{"id":"CVE-2023-54089","published":"2025-12-24T13:06:18.904Z","updated":"2026-05-11T19:55:16.792Z","title":"virtio_pmem: add the missing REQ_OP_WRITE for flush bio","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2023-54088","published":"2025-12-24T13:06:18.216Z","updated":"2026-10-15T21:41:39.244Z","title":"blk-cgroup: hold queue_lock when removing blkg->q_node","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2023-54087","published":"2025-12-24T13:06:17.555Z","updated":"2026-05-11T19:55:14.333Z","title":"ubi: Fix possible null-ptr-deref in ubi_free_volume()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2023-54086","published":"2025-12-24T13:06:16.857Z","updated":"2026-05-23T15:32:32.011Z","title":"bpf: Add preempt_count_{sub,add} into btf id deny list","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2023-54085","published":"2025-12-24T13:06:16.161Z","updated":"2026-10-15T21:41:39.088Z","title":"mptcp: fix NULL pointer dereference on fastopen early fallback","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2023-54084","published":"2025-12-24T13:06:15.460Z","updated":"2026-05-11T19:55:10.897Z","title":"ALSA: firewire-digi00x: prevent potential use after free","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2023-54083","published":"2025-12-24T13:06:14.771Z","updated":"2026-08-05T09:17:04.479Z","title":"phy: tegra: xusb: Clear the driver reference in usb-phy dev","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2023-54081","published":"2025-12-24T13:06:13.316Z","updated":"2026-05-11T19:55:08.574Z","title":"xen: speed up grant-table reclaim","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2023-54080","published":"2025-12-24T13:06:12.625Z","updated":"2026-05-11T19:55:07.368Z","title":"btrfs: zoned: skip splitting and logical rewriting on pre-alloc write","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2023-54079","published":"2025-12-24T13:06:11.956Z","updated":"2026-08-05T09:17:02.722Z","title":"power: supply: bq27xxx: Fix poll_interval handling and races on remove","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2023-54078","published":"2025-12-24T13:06:11.282Z","updated":"2026-05-11T19:55:04.588Z","title":"media: max9286: Free control handler","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2022-50783","published":"2025-12-24T13:06:10.602Z","updated":"2026-05-11T19:25:27.610Z","title":"mptcp: use proper req destructor for IPv6","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2022-50782","published":"2025-12-24T13:06:09.914Z","updated":"2026-05-11T19:25:26.436Z","title":"ext4: fix bug_on in __es_tree_search caused by bad quota inode","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2022-50781","published":"2025-12-24T13:06:09.238Z","updated":"2026-05-11T19:25:25.274Z","title":"amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2022-50780","published":"2025-12-24T13:06:08.552Z","updated":"2026-10-15T21:41:24.033Z","title":"net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2022-50779","published":"2025-12-24T13:06:07.873Z","updated":"2026-05-11T19:25:22.956Z","title":"orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2022-50778","published":"2025-12-24T13:06:07.182Z","updated":"2026-05-11T19:25:21.810Z","title":"fortify: Fix __compiletime_strlen() under UBSAN_BOUNDS_LOCAL","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2022-50777","published":"2025-12-24T13:06:06.511Z","updated":"2026-05-23T15:25:12.859Z","title":"net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2022-50776","published":"2025-12-24T13:06:05.804Z","updated":"2026-05-11T19:25:19.470Z","title":"clk: st: Fix memory leak in st_of_quadfs_setup()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2022-50775","published":"2025-12-24T13:06:05.074Z","updated":"2026-05-11T19:25:18.333Z","title":"RDMA/hns: Fix refcount leak in hns_roce_mmap","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2022-50774","published":"2025-12-24T13:06:04.391Z","updated":"2026-05-11T19:25:17.195Z","title":"crypto: qat - fix DMA transfer direction","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2022-50773","published":"2025-12-24T13:06:03.533Z","updated":"2026-05-11T19:25:15.871Z","title":"ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2022-50772","published":"2025-12-24T13:06:01.170Z","updated":"2026-05-11T19:25:14.704Z","title":"netdevsim: fix memory leak in nsim_bus_dev_new()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2022-50771","published":"2025-12-24T13:06:00.412Z","updated":"2026-05-11T19:25:13.504Z","title":"rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2022-50770","published":"2025-12-24T13:05:59.700Z","updated":"2026-05-11T19:25:12.344Z","title":"ocfs2: fix memory leak in ocfs2_mount_volume()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2022-50769","published":"2025-12-24T13:05:58.994Z","updated":"2026-05-11T19:25:11.217Z","title":"mmc: mxcmmc: fix return value check of mmc_add_host()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2022-50768","published":"2025-12-24T13:05:58.304Z","updated":"2026-05-11T19:25:10.049Z","title":"scsi: smartpqi: Correct device removal for multi-actuator devices","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2022-50767","published":"2025-12-24T13:05:57.569Z","updated":"2026-05-11T19:25:08.910Z","title":"fbdev: smscufx: Fix several use-after-free bugs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2022-50766","published":"2025-12-24T13:05:56.873Z","updated":"2026-05-11T19:25:07.774Z","title":"btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2022-50765","published":"2025-12-24T13:05:56.123Z","updated":"2026-05-11T19:25:06.575Z","title":"RISC-V: kexec: Fix memory leak of elf header buffer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2022-50764","published":"2025-12-24T13:05:55.423Z","updated":"2026-05-11T19:25:05.410Z","title":"ipv6/sit: use DEV_STATS_INC() to avoid data-races","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2022-50763","published":"2025-12-24T13:05:54.704Z","updated":"2026-05-11T19:25:03.878Z","title":"crypto: marvell/octeontx - prevent integer overflows","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2022-50762","published":"2025-12-24T13:05:54.020Z","updated":"2026-05-23T15:25:09.298Z","title":"fs/ntfs3: Avoid UBSAN error on true_sectors_per_clst()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2022-50761","published":"2025-12-24T13:05:53.312Z","updated":"2026-05-11T19:25:00.739Z","title":"x86/xen: Fix memory leak in xen_init_lock_cpu()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2022-50760","published":"2025-12-24T13:05:52.582Z","updated":"2026-05-11T19:24:59.375Z","title":"drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2022-50759","published":"2025-12-24T13:05:51.895Z","updated":"2026-05-11T19:24:58.263Z","title":"media: i2c: ov5648: Free V4L2 fwnode data on unbind","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2022-50758","published":"2025-12-24T13:05:51.159Z","updated":"2026-08-05T08:59:44.493Z","title":"staging: vt6655: fix potential memory leak","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2022-50757","published":"2025-12-24T13:05:50.399Z","updated":"2026-08-05T08:59:43.420Z","title":"media: camss: Clean up received buffers on failed start of streaming","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2022-50756","published":"2025-12-24T13:05:49.635Z","updated":"2026-10-15T21:41:23.908Z","title":"nvme-pci: fix mempool alloc size","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2022-50755","published":"2025-12-24T13:05:48.928Z","updated":"2026-10-15T21:41:23.768Z","title":"udf: Avoid double brelse() in udf_rename()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2022-50754","published":"2025-12-24T13:05:48.245Z","updated":"2026-05-11T19:24:52.463Z","title":"apparmor: fix a memleak in multi_transaction_new()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2022-50753","published":"2025-12-24T13:05:47.559Z","updated":"2026-08-05T08:59:40.190Z","title":"f2fs: fix to do sanity check on summary info","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2022-50752","published":"2025-12-24T13:05:46.881Z","updated":"2026-08-05T08:59:39.128Z","title":"md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2022-50751","published":"2025-12-24T13:05:46.159Z","updated":"2026-05-11T19:24:49.023Z","title":"configfs: fix possible memory leak in configfs_create_dir()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2022-50750","published":"2025-12-24T13:05:45.447Z","updated":"2026-10-15T21:41:23.597Z","title":"drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2022-50749","published":"2025-12-24T13:05:44.734Z","updated":"2026-05-11T19:24:46.724Z","title":"acct: fix potential integer overflow in encode_comp_t()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2022-50748","published":"2025-12-24T13:05:44.045Z","updated":"2026-05-11T19:24:45.516Z","title":"ipc: mqueue: fix possible memory leak in init_mqueue_fs()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2022-50747","published":"2025-12-24T13:05:43.347Z","updated":"2026-08-05T08:59:36.990Z","title":"hfs: Fix OOB Write in hfs_asc2mac","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2022-50746","published":"2025-12-24T13:05:42.628Z","updated":"2026-10-15T21:41:23.468Z","title":"erofs: validate the extent length for uncompressed pclusters","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2022-50745","published":"2025-12-24T13:05:41.858Z","updated":"2026-08-05T08:59:34.782Z","title":"staging: media: tegra-video: fix device_node use after free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2022-50744","published":"2025-12-24T13:05:41.138Z","updated":"2026-05-23T15:25:06.550Z","title":"scsi: lpfc: Fix hard lockup when reading the rx_monitor from debugfs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2022-50743","published":"2025-12-24T13:05:40.297Z","updated":"2026-05-11T19:24:39.573Z","title":"erofs: Fix pcluster memleak when its block address is zero","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2022-50742","published":"2025-12-24T13:05:39.566Z","updated":"2026-05-11T19:24:38.399Z","title":"misc: ocxl: fix possible refcount leak in afu_ioctl()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2022-50741","published":"2025-12-24T13:05:38.846Z","updated":"2026-05-11T19:24:37.230Z","title":"media: imx-jpeg: Disable useless interrupt to avoid kernel panic","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2022-50740","published":"2025-12-24T13:05:38.150Z","updated":"2026-05-23T15:25:05.028Z","title":"wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2022-50739","published":"2025-12-24T13:05:37.468Z","updated":"2026-05-11T19:24:34.879Z","title":"fs/ntfs3: Add null pointer check for inode operations","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2022-50738","published":"2025-12-24T13:05:36.801Z","updated":"2026-05-11T19:24:33.729Z","title":"vhost-vdpa: fix an iotlb memory leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2022-50737","published":"2025-12-24T13:05:36.025Z","updated":"2026-08-05T08:59:33.688Z","title":"fs/ntfs3: Validate index root when initialize NTFS security","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-54077","published":"2025-12-24T13:03:25.790Z","updated":"2026-08-05T09:17:01.351Z","title":"fs/ntfs3: Fix memory leak if ntfs_read_mft failed","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2023-54076","published":"2025-12-24T12:23:18.330Z","updated":"2026-08-05T09:16:59.986Z","title":"smb: client: fix missed ses refcounting","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2023-54075","published":"2025-12-24T12:23:17.622Z","updated":"2026-05-11T19:54:59.480Z","title":"ASoC: mediatek: common: Fix refcount leak in parse_dai_link_info","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2023-54074","published":"2025-12-24T12:23:16.920Z","updated":"2026-08-05T09:16:58.648Z","title":"net/mlx5e: Use correct encap attribute during invalidation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2023-54073","published":"2025-12-24T12:23:16.237Z","updated":"2026-05-11T19:54:57.166Z","title":"tpm: Add !tpm_amd_is_rng_defective() to the hwrng_unregister() call site","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54072","published":"2025-12-24T12:23:15.552Z","updated":"2026-05-11T19:54:55.996Z","title":"ALSA: pcm: Fix potential data race at PCM memory allocation helpers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-54071","published":"2025-12-24T12:23:14.874Z","updated":"2026-10-15T21:41:38.954Z","title":"wifi: rtw88: use work to update rate to avoid RCU warning","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2023-54070","published":"2025-12-24T12:23:14.182Z","updated":"2026-05-11T19:54:53.709Z","title":"igb: clean up in all error paths when enabling SR-IOV","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2023-54069","published":"2025-12-24T12:23:13.504Z","updated":"2026-05-23T15:32:21.855Z","title":"ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2023-54068","published":"2025-12-24T12:23:12.818Z","updated":"2026-08-05T09:16:55.942Z","title":"f2fs: compress: fix to call f2fs_wait_on_page_writeback() in f2fs_write_raw_pages()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2023-54067","published":"2025-12-24T12:23:12.109Z","updated":"2026-08-05T09:16:54.578Z","title":"btrfs: fix race when deleting free space root from the dirty cow roots list","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2023-54066","published":"2025-12-24T12:23:11.431Z","updated":"2026-05-11T19:54:49.186Z","title":"media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-54065","published":"2025-12-24T12:23:10.745Z","updated":"2026-08-05T09:16:53.228Z","title":"net: dsa: realtek: fix out-of-bounds access","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2023-54064","published":"2025-12-24T12:23:10.051Z","updated":"2026-05-11T19:54:46.883Z","title":"ipmi:ssif: Fix a memory leak when scanning for an adapter","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-54063","published":"2025-12-24T12:23:09.346Z","updated":"2026-08-05T09:16:51.916Z","title":"fs/ntfs3: Fix OOB read in indx_insert_into_buffer","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2023-54062","published":"2025-12-24T12:23:08.649Z","updated":"2026-10-15T21:41:38.822Z","title":"ext4: fix invalid free tracking in ext4_xattr_move_to_block()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2023-54060","published":"2025-12-24T12:23:07.276Z","updated":"2026-08-05T09:16:49.139Z","title":"iommufd: Set end correctly when doing batch carry","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2023-54059","published":"2025-12-24T12:23:06.574Z","updated":"2026-05-11T19:54:42.309Z","title":"soc: mediatek: mtk-svs: Enable the IRQ later","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2023-54058","published":"2025-12-24T12:23:05.899Z","updated":"2026-05-23T15:32:13.461Z","title":"firmware: arm_ffa: Check if ffa_driver remove is present before executing","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2023-54057","published":"2025-12-24T12:23:05.208Z","updated":"2026-05-11T19:54:39.901Z","title":"iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2023-54056","published":"2025-12-24T12:23:04.559Z","updated":"2026-05-11T19:54:38.759Z","title":"kheaders: Use array declaration instead of char","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2023-54055","published":"2025-12-24T12:23:03.872Z","updated":"2026-05-11T19:54:37.635Z","title":"RDMA/irdma: Fix memory leak of PBLE objects","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2023-54053","published":"2025-12-24T12:23:02.498Z","updated":"2026-05-11T19:54:36.476Z","title":"wifi: iwlwifi: pcie: fix possible NULL pointer dereference","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2023-54052","published":"2025-12-24T12:23:01.797Z","updated":"2026-05-11T19:54:35.332Z","title":"wifi: mt76: mt7921: fix skb leak by txs missing in AMSDU","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2023-54051","published":"2025-12-24T12:23:01.043Z","updated":"2026-05-11T19:54:34.189Z","title":"net: do not allow gso_size to be set to GSO_BY_FRAGS","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2023-54050","published":"2025-12-24T12:23:00.366Z","updated":"2026-08-05T09:16:47.787Z","title":"ubifs: Fix memleak when insert_old_idx() failed","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2023-54049","published":"2025-12-24T12:22:59.585Z","updated":"2026-05-11T19:54:31.858Z","title":"rpmsg: glink: Add check for kstrdup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2023-54048","published":"2025-12-24T12:22:58.910Z","updated":"2026-10-15T21:41:38.679Z","title":"RDMA/bnxt_re: Prevent handling any completions after qp destroy","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2023-54047","published":"2025-12-24T12:22:58.218Z","updated":"2026-05-11T19:54:29.600Z","title":"drm/rockchip: dw_hdmi: cleanup drm encoder during unbind","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2023-54046","published":"2025-12-24T12:22:57.416Z","updated":"2026-10-15T21:41:38.544Z","title":"crypto: essiv - Handle EBUSY correctly","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2023-54045","published":"2025-12-24T12:22:56.742Z","updated":"2026-05-11T19:54:27.312Z","title":"audit: fix possible soft lockup in __audit_inode_child()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2023-54044","published":"2025-12-24T12:22:56.072Z","updated":"2026-05-11T19:54:26.074Z","title":"spmi: Add a check for remove callback when removing a SPMI driver","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2023-54043","published":"2025-12-24T12:22:55.392Z","updated":"2026-10-15T21:41:38.411Z","title":"iommufd: Do not add the same hwpt to the ioas->hwpt_list twice","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2022-50736","published":"2025-12-24T12:22:54.695Z","updated":"2026-08-05T08:59:32.604Z","title":"RDMA/siw: Fix immediate work request flush to completion queue","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2022-50735","published":"2025-12-24T12:22:54.004Z","updated":"2026-05-11T19:24:30.166Z","title":"wifi: mt76: do not run mt76u_status_worker if the device is not running","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2022-50734","published":"2025-12-24T12:22:53.333Z","updated":"2026-05-23T15:25:01.557Z","title":"nvmem: core: Fix memleak in nvmem_register()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2022-50733","published":"2025-12-24T12:22:52.651Z","updated":"2026-05-11T19:24:27.914Z","title":"usb: idmouse: fix an uninit-value in idmouse_open","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2022-50732","published":"2025-12-24T12:22:51.933Z","updated":"2026-08-05T08:59:31.519Z","title":"staging: rtl8192u: Fix use after free in ieee80211_rx()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00422,"kevAdded":null},{"id":"CVE-2022-50731","published":"2025-12-24T12:22:51.122Z","updated":"2026-05-11T19:24:25.645Z","title":"crypto: akcipher - default implementation for setting a private key","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2022-50730","published":"2025-12-24T12:22:50.416Z","updated":"2026-05-11T19:24:24.473Z","title":"ext4: silence the warning when evicting inode with dioread_nolock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2022-50729","published":"2025-12-24T12:22:49.717Z","updated":"2026-05-11T19:24:23.325Z","title":"ksmbd: Fix resource leak in ksmbd_session_rpc_open()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2022-50728","published":"2025-12-24T12:22:49.001Z","updated":"2026-05-11T19:24:22.183Z","title":"s390/lcs: Fix return type of lcs_start_xmit()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2022-50727","published":"2025-12-24T12:22:48.315Z","updated":"2026-05-11T19:24:21.040Z","title":"scsi: efct: Fix possible memleak in efct_device_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2022-50726","published":"2025-12-24T12:22:47.625Z","updated":"2026-08-05T08:59:30.034Z","title":"net/mlx5: Fix possible use-after-free in async command interface","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2022-50725","published":"2025-12-24T12:22:46.939Z","updated":"2026-05-11T19:24:18.626Z","title":"media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2022-50724","published":"2025-12-24T12:22:46.251Z","updated":"2026-05-23T15:24:58.423Z","title":"regulator: core: fix resource leak in regulator_register()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2022-50723","published":"2025-12-24T12:22:45.480Z","updated":"2026-05-11T19:24:16.304Z","title":"bnxt_en: fix memory leak in bnxt_nvm_test()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2022-50722","published":"2025-12-24T12:22:44.765Z","updated":"2026-05-11T19:24:15.181Z","title":"media: ipu3-imgu: Fix NULL pointer dereference in active selection access","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2022-50721","published":"2025-12-24T12:22:44.080Z","updated":"2026-05-11T19:24:13.986Z","title":"dmaengine: qcom-adm: fix wrong calling convention for prep_slave_sg","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2022-50720","published":"2025-12-24T12:22:43.396Z","updated":"2026-05-11T19:24:12.854Z","title":"x86/apic: Don't disable x2APIC if locked","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2022-50719","published":"2025-12-24T12:22:42.697Z","updated":"2026-10-15T21:41:23.334Z","title":"ALSA: line6: fix stack overflow in line6_midi_transmit","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2022-50718","published":"2025-12-24T12:22:41.971Z","updated":"2026-05-11T19:24:10.575Z","title":"drm/amdgpu: fix pci device refcount leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2022-50717","published":"2025-12-24T12:22:41.269Z","updated":"2026-08-05T08:59:27.894Z","title":"nvmet-tcp: add bounds check on Transfer Tag","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00817,"kevAdded":null},{"id":"CVE-2022-50716","published":"2025-12-24T12:22:40.461Z","updated":"2026-05-11T19:24:08.284Z","title":"wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2022-50715","published":"2025-12-24T12:22:39.763Z","updated":"2026-05-23T15:24:55.242Z","title":"md/raid1: stop mdx_raid1 thread when raid1 array run failed","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2022-50714","published":"2025-12-24T12:22:39.059Z","updated":"2026-05-11T19:24:05.961Z","title":"wifi: mt76: mt7921e: fix rmmod crash in driver reload test","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2022-50713","published":"2025-12-24T12:22:38.387Z","updated":"2026-05-11T19:24:04.841Z","title":"clk: visconti: Fix memory leak in visconti_register_pll()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2022-50712","published":"2025-12-24T12:22:37.676Z","updated":"2026-05-11T19:24:03.573Z","title":"devlink: hold region lock when flushing snapshots","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-68749","published":"2025-12-24T12:09:44.301Z","updated":"2026-08-05T12:11:18.953Z","title":"accel/ivpu: Fix race condition when unbinding BOs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2025-68748","published":"2025-12-24T12:09:43.620Z","updated":"2026-08-05T12:11:17.874Z","title":"drm/panthor: Fix UAF race between device unplug and FW event processing","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-68747","published":"2025-12-24T12:09:42.925Z","updated":"2026-08-05T12:11:16.791Z","title":"drm/panthor: Fix UAF on kernel BO VA nodes","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-68746","published":"2025-12-24T12:09:42.213Z","updated":"2026-10-16T15:09:44.157Z","title":"spi: tegra210-quad: Fix timeout handling","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-68745","published":"2025-12-24T12:09:41.517Z","updated":"2026-10-30T12:23:17.973Z","title":"scsi: qla2xxx: Clear cmds after chip reset","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-68744","published":"2025-12-24T12:09:40.839Z","updated":"2026-05-11T21:52:30.476Z","title":"bpf: Free special fields when update [lru_,]percpu_hash maps","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2025-68743","published":"2025-12-24T12:09:40.148Z","updated":"2026-05-11T21:52:29.313Z","title":"mshv: Fix create memory region overlap check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-68742","published":"2025-12-24T12:09:39.341Z","updated":"2026-10-15T01:10:02.989Z","title":"bpf: Fix invalid prog->stats access when update_effective_progs fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-68741","published":"2025-12-24T12:09:38.655Z","updated":"2026-08-05T12:11:13.586Z","title":"scsi: qla2xxx: Fix improper freeing of purex item","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2025-68740","published":"2025-12-24T12:09:37.971Z","updated":"2026-06-16T19:20:31.026Z","title":"ima: Handle error code returned by ima_filter_rule_match()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-68739","published":"2025-12-24T12:09:37.270Z","updated":"2026-05-11T21:52:24.655Z","title":"PM / devfreq: hisi: Fix potential UAF in OPP handling","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-68738","published":"2025-12-24T12:09:36.449Z","updated":"2026-05-11T21:52:23.494Z","title":"wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-68737","published":"2025-12-24T12:09:35.773Z","updated":"2026-05-11T21:52:22.300Z","title":"arm64/pageattr: Propagate return value from __change_memory_common","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-68736","published":"2025-12-24T12:09:35.081Z","updated":"2026-10-16T15:09:43.754Z","title":"landlock: Fix handling of disconnected directories","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-68735","published":"2025-12-24T12:09:34.364Z","updated":"2026-10-21T12:38:25.918Z","title":"drm/panthor: Prevent potential UAF in group creation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-68734","published":"2025-12-24T10:58:49.938Z","updated":"2026-05-11T21:52:18.618Z","title":"isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2023-54042","published":"2025-12-24T10:56:07.565Z","updated":"2026-10-15T21:41:38.268Z","title":"powerpc/64s: Fix VAS mm use after free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2023-54041","published":"2025-12-24T10:56:06.858Z","updated":"2026-05-11T19:54:17.138Z","title":"io_uring: fix memory leak when removing provided buffers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2023-54040","published":"2025-12-24T10:56:06.094Z","updated":"2026-10-15T21:41:38.132Z","title":"ice: fix wrong fallback logic for FDIR","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2023-54039","published":"2025-12-24T10:56:05.365Z","updated":"2026-05-11T19:54:14.838Z","title":"can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2023-54038","published":"2025-12-24T10:56:04.623Z","updated":"2026-05-23T15:32:08.724Z","title":"Bluetooth: hci_conn: return ERR_PTR instead of NULL when there is no link","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2023-54037","published":"2025-12-24T10:56:03.906Z","updated":"2026-05-11T19:54:12.409Z","title":"ice: prevent NULL pointer deref during reload","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2023-54036","published":"2025-12-24T10:56:03.215Z","updated":"2026-05-11T19:54:11.279Z","title":"wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2023-54035","published":"2025-12-24T10:56:02.358Z","updated":"2026-08-05T09:16:39.727Z","title":"netfilter: nf_tables: fix underflow in chain reference counter","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2023-54034","published":"2025-12-24T10:56:01.509Z","updated":"2026-05-11T19:54:09.017Z","title":"iommufd: Make sure to zero vfio_iommu_type1_info before copying to user","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2023-54033","published":"2025-12-24T10:56:00.579Z","updated":"2026-05-11T19:54:07.901Z","title":"bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2023-54032","published":"2025-12-24T10:55:59.609Z","updated":"2026-05-11T19:54:06.750Z","title":"btrfs: fix race when deleting quota root from the dirty cow roots list","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-54031","published":"2025-12-24T10:55:58.885Z","updated":"2026-05-11T19:54:05.604Z","title":"vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2023-54030","published":"2025-12-24T10:55:58.124Z","updated":"2026-05-11T19:54:04.456Z","title":"io_uring/net: don't overflow multishot recv","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2023-54028","published":"2025-12-24T10:55:56.619Z","updated":"2026-05-11T19:54:03.277Z","title":"RDMA/rxe: Fix the error \"trying to register non-static key in rxe_cleanup_task\"","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2023-54027","published":"2025-12-24T10:55:55.890Z","updated":"2026-05-11T19:54:00.880Z","title":"iio: core: Prevent invalid memory access when there is no parent","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2023-54026","published":"2025-12-24T10:55:55.182Z","updated":"2026-08-05T09:16:38.468Z","title":"opp: Fix use-after-free in lazy_opp_tables after probe deferral","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2023-54025","published":"2025-12-24T10:55:54.440Z","updated":"2026-05-11T19:53:58.606Z","title":"wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2023-54024","published":"2025-12-24T10:55:53.718Z","updated":"2026-05-23T15:32:02.641Z","title":"KVM: Destroy target device if coalesced MMIO unregistration fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2023-54023","published":"2025-12-24T10:55:52.835Z","updated":"2026-05-11T19:53:49.237Z","title":"btrfs: fix race between balance and cancel/pause","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2023-54022","published":"2025-12-24T10:55:52.045Z","updated":"2026-05-11T19:53:46.898Z","title":"ALSA: usb-audio: Fix potential memory leaks at error path for UMP open","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2023-54021","published":"2025-12-24T10:55:51.373Z","updated":"2026-05-11T19:53:45.739Z","title":"ext4: set goal start correctly in ext4_mb_normalize_request","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2023-54020","published":"2025-12-24T10:55:50.583Z","updated":"2026-05-23T15:31:58.250Z","title":"dmaengine: sf-pdma: pdma_desc memory leak fix","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2023-54019","published":"2025-12-24T10:55:49.840Z","updated":"2026-10-15T21:41:37.993Z","title":"sched/psi: use kernfs polling functions for PSI trigger polling","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2023-54018","published":"2025-12-24T10:55:49.081Z","updated":"2026-05-11T19:53:42.124Z","title":"drm/msm/hdmi: Add missing check for alloc_ordered_workqueue","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2023-54017","published":"2025-12-24T10:55:48.364Z","updated":"2026-05-11T19:53:40.938Z","title":"powerpc/pseries: fix possible memory leak in ibmebus_bus_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2023-54016","published":"2025-12-24T10:55:47.691Z","updated":"2026-05-11T19:53:39.798Z","title":"wifi: ath12k: Fix memory leak in rx_desc and tx_desc","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2023-54015","published":"2025-12-24T10:55:47.030Z","updated":"2026-05-11T19:53:38.638Z","title":"net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2023-54014","published":"2025-12-24T10:55:46.255Z","updated":"2026-05-11T19:53:37.436Z","title":"scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2023-54013","published":"2025-12-24T10:55:45.518Z","updated":"2026-10-30T12:17:39.012Z","title":"interconnect: Fix locking for runpm vs reclaim","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2023-54012","published":"2025-12-24T10:55:44.835Z","updated":"2026-10-15T21:41:37.849Z","title":"net: fix stack overflow when LRO is disabled for virtual interfaces","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2023-54011","published":"2025-12-24T10:55:44.063Z","updated":"2026-05-11T19:53:34.046Z","title":"scsi: mpi3mr: Fix an issue found by KASAN","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2023-54010","published":"2025-12-24T10:55:43.386Z","updated":"2026-05-11T19:53:32.764Z","title":"ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2023-54009","published":"2025-12-24T10:55:42.679Z","updated":"2026-05-11T19:53:31.591Z","title":"i2c: cadence: cdns_i2c_master_xfer(): Fix runtime PM leak on error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2023-54008","published":"2025-12-24T10:55:41.982Z","updated":"2026-05-11T19:53:30.458Z","title":"virtio_vdpa: build affinity masks conditionally","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2023-54007","published":"2025-12-24T10:55:41.281Z","updated":"2026-05-11T19:53:29.294Z","title":"vmci_host: fix a race condition in vmci_host_poll() causing GPF","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2023-54006","published":"2025-12-24T10:55:40.534Z","updated":"2026-05-11T19:53:28.121Z","title":"af_unix: Fix data-race around unix_tot_inflight.","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2023-54005","published":"2025-12-24T10:55:39.826Z","updated":"2026-05-11T19:53:26.996Z","title":"binder: fix memory leak in binder_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2023-54004","published":"2025-12-24T10:55:39.149Z","updated":"2026-10-15T21:41:37.709Z","title":"udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated().","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00587,"kevAdded":null},{"id":"CVE-2023-54003","published":"2025-12-24T10:55:38.425Z","updated":"2026-05-11T19:53:24.591Z","title":"RDMA/core: Fix GID entry ref leak when create_ah fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2023-54002","published":"2025-12-24T10:55:37.699Z","updated":"2026-05-11T19:53:23.434Z","title":"btrfs: fix assertion of exclop condition when starting balance","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2023-54001","published":"2025-12-24T10:55:36.991Z","updated":"2026-05-11T19:53:22.247Z","title":"staging: r8712: Fix memory leak in _r8712_init_xmit_priv()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2023-54000","published":"2025-12-24T10:55:36.216Z","updated":"2026-05-11T19:53:21.021Z","title":"net: hns3: fix deadlock issue when externel_lb and reset are executed together","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2023-53999","published":"2025-12-24T10:55:35.523Z","updated":"2026-10-03T10:55:04.323Z","title":"net/mlx5e: TC, Fix internal port memory leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2023-53998","published":"2025-12-24T10:55:34.856Z","updated":"2026-05-11T19:53:18.694Z","title":"hwrng: virtio - Fix race on data_avail and actual data","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2023-53997","published":"2025-12-24T10:55:34.077Z","updated":"2026-08-05T09:16:34.123Z","title":"thermal: of: fix double-free on unregistration","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2023-53996","published":"2025-12-24T10:55:33.402Z","updated":"2026-08-05T09:16:33.065Z","title":"x86/sev: Make enc_dec_hypercall() accept a size instead of npages","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0011,"kevAdded":null},{"id":"CVE-2023-53995","published":"2025-12-24T10:55:32.713Z","updated":"2026-05-11T19:53:15.262Z","title":"net: ipv4: fix one memleak in __inet_del_ifa()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2023-53994","published":"2025-12-24T10:55:32.024Z","updated":"2026-05-11T19:53:14.102Z","title":"ionic: remove WARN_ON to prevent panic_on_warn","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2023-53993","published":"2025-12-24T10:55:31.344Z","updated":"2026-05-11T19:53:12.982Z","title":"PCI/DOE: Fix memory leak with CONFIG_DEBUG_OBJECTS=y","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2023-53992","published":"2025-12-24T10:55:30.549Z","updated":"2026-05-11T19:53:11.861Z","title":"wifi: cfg80211: ocb: don't leave if not joined","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2023-53991","published":"2025-12-24T10:55:29.833Z","updated":"2026-05-11T19:53:10.724Z","title":"drm/msm/dpu: Disallow unallocated resources to be returned","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2023-53990","published":"2025-12-24T10:55:29.156Z","updated":"2026-08-05T09:16:31.988Z","title":"SMB3: Add missing locks to protect deferred close file list","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2023-53989","published":"2025-12-24T10:55:28.461Z","updated":"2026-06-01T16:04:24.944Z","title":"arm64: mm: fix VA-range sanity check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2023-53988","published":"2025-12-24T10:55:27.762Z","updated":"2026-08-05T09:16:30.837Z","title":"fs/ntfs3: Fix slab-out-of-bounds read in hdr_delete_de()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2023-53987","published":"2025-12-24T10:55:27.032Z","updated":"2026-05-23T15:31:43.935Z","title":"ping: Fix potentail NULL deref for /proc/net/icmp.","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2023-53986","published":"2025-12-24T10:55:26.282Z","updated":"2026-08-05T09:16:29.747Z","title":"mips: bmips: BCM6358: disable RAC flush for TP1","severity":"HIGH","score":8.6,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00439,"kevAdded":null},{"id":"CVE-2023-53867","published":"2025-12-24T10:55:25.430Z","updated":"2026-10-15T21:41:37.567Z","title":"ceph: fix potential use-after-free bug when trimming caps","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00532,"kevAdded":null},{"id":"CVE-2022-50711","published":"2025-12-24T10:55:24.689Z","updated":"2026-05-11T19:24:01.112Z","title":"net: ethernet: mtk_eth_soc: fix possible memory leak in mtk_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2022-50710","published":"2025-12-24T10:55:23.918Z","updated":"2026-05-11T19:23:59.988Z","title":"ice: set tx_tstamps when creating new Tx rings via ethtool","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2022-50709","published":"2025-12-24T10:55:23.194Z","updated":"2026-05-11T19:23:58.844Z","title":"wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2022-50708","published":"2025-12-24T10:55:22.234Z","updated":"2026-05-11T19:23:57.688Z","title":"HSI: ssi_protocol: fix potential resource leak in ssip_pn_open()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2022-50707","published":"2025-12-24T10:55:21.547Z","updated":"2026-05-11T19:23:56.488Z","title":"virtio-crypto: fix memory leak in virtio_crypto_alg_skcipher_close_session()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2022-50706","published":"2025-12-24T10:55:20.835Z","updated":"2026-05-23T15:24:53.997Z","title":"net/ieee802154: don't warn zero-sized raw_sendmsg()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2022-50705","published":"2025-12-24T10:55:20.020Z","updated":"2026-05-23T15:24:52.616Z","title":"io_uring/rw: defer fsnotify calls to task context","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2022-50704","published":"2025-12-24T10:55:19.295Z","updated":"2026-05-11T19:23:52.960Z","title":"USB: gadget: Fix use-after-free during usb config switch","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2022-50703","published":"2025-12-24T10:55:18.548Z","updated":"2026-05-11T19:23:51.817Z","title":"soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2022-50702","published":"2025-12-24T10:55:17.831Z","updated":"2026-05-11T19:23:50.676Z","title":"vdpa_sim: fix possible memory leak in vdpasim_net_init() and vdpasim_blk_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2022-50701","published":"2025-12-24T10:55:17.090Z","updated":"2026-10-15T21:41:23.201Z","title":"wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2022-50700","published":"2025-12-24T10:55:16.257Z","updated":"2026-10-15T21:41:23.069Z","title":"wifi: ath10k: Delay the unmapping of the buffer","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2022-50699","published":"2025-12-24T10:55:15.468Z","updated":"2026-05-11T19:23:44.480Z","title":"selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2022-50698","published":"2025-12-24T10:55:14.740Z","updated":"2026-05-11T19:23:43.293Z","title":"ASoC: da7219: Fix an error handling path in da7219_register_dai_clks()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2022-50697","published":"2025-12-24T10:55:13.762Z","updated":"2026-10-15T21:41:22.920Z","title":"mrp: introduce active flags to prevent UAF when applicant uninit","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2025-68733","published":"2025-12-24T10:33:15.347Z","updated":"2026-05-11T21:52:17.465Z","title":"smack: fix bug: unprivileged task can create labels","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2025-68732","published":"2025-12-24T10:33:14.664Z","updated":"2026-05-11T21:52:16.287Z","title":"gpu: host1x: Fix race in syncpt alloc/free","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-68731","published":"2025-12-24T10:33:13.964Z","updated":"2026-05-11T21:52:15.119Z","title":"accel/amdxdna: Fix an integer overflow in aie2_query_ctx_status_array()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2025-68730","published":"2025-12-24T10:33:13.236Z","updated":"2026-10-21T12:38:24.802Z","title":"accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2025-68729","published":"2025-12-24T10:33:12.515Z","updated":"2026-10-21T12:38:23.713Z","title":"wifi: ath12k: Fix MSDU buffer types handling in RX error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-68728","published":"2025-12-24T10:33:11.847Z","updated":"2026-05-11T21:52:11.623Z","title":"ntfs3: fix uninit memory after failed mi_read in mi_format_new","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-68727","published":"2025-12-24T10:33:11.085Z","updated":"2026-05-11T21:52:10.402Z","title":"ntfs3: Fix uninit buffer allocated by __getname()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-68726","published":"2025-12-24T10:33:10.364Z","updated":"2026-08-05T12:11:09.299Z","title":"crypto: aead - Fix reqsize handling","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00413,"kevAdded":null},{"id":"CVE-2025-68725","published":"2025-12-24T10:33:09.610Z","updated":"2026-10-15T01:10:01.204Z","title":"bpf: Do not let BPF test infra emit invalid GSO types to stack","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-68724","published":"2025-12-24T10:33:08.932Z","updated":"2026-10-15T01:09:59.479Z","title":"crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-68380","published":"2025-12-24T10:33:08.266Z","updated":"2026-05-11T21:52:05.766Z","title":"wifi: ath11k: fix peer HE MCS assignment","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-68379","published":"2025-12-24T10:33:07.538Z","updated":"2026-10-30T12:23:16.904Z","title":"RDMA/rxe: Fix null deref on srq->rq.queue after resize failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2025-68378","published":"2025-12-24T10:33:06.859Z","updated":"2026-10-30T12:23:15.844Z","title":"bpf: Fix stackmap overflow check in __bpf_get_stackid()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-68377","published":"2025-12-24T10:33:06.174Z","updated":"2026-05-11T21:52:01.948Z","title":"ns: initialize ns_list_node for initial namespaces","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2025-68376","published":"2025-12-24T10:33:05.503Z","updated":"2026-10-21T12:38:21.502Z","title":"coresight: ETR: Fix ETR buffer use-after-free issue","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-68375","published":"2025-12-24T10:33:04.819Z","updated":"2026-05-11T21:51:59.533Z","title":"perf/x86: Fix NULL event access and potential PEBS record loss","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-68374","published":"2025-12-24T10:33:04.046Z","updated":"2026-10-21T12:38:20.382Z","title":"md: fix rcu protection in md_wakeup_thread","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-68373","published":"2025-12-24T10:33:03.375Z","updated":"2026-05-11T21:51:57.240Z","title":"md: avoid repeated calls to del_gendisk","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2025-68372","published":"2025-12-24T10:33:02.679Z","updated":"2026-06-16T19:28:42.649Z","title":"nbd: defer config put in recv_work","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2025-68371","published":"2025-12-24T10:33:01.896Z","updated":"2026-10-15T01:09:57.741Z","title":"scsi: smartpqi: Fix device resources accessed after device removal","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2025-68370","published":"2025-12-24T10:32:56.149Z","updated":"2026-08-05T12:11:06.086Z","title":"coresight: tmc: add the handle of the event to the path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2025-68369","published":"2025-12-24T10:32:55.440Z","updated":"2026-08-05T12:11:05.018Z","title":"ntfs3: init run lock for extend inode","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2025-68368","published":"2025-12-24T10:32:54.765Z","updated":"2026-10-21T12:38:19.281Z","title":"md: init bioset in mddev_init","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-68367","published":"2025-12-24T10:32:54.084Z","updated":"2026-05-11T21:51:50.117Z","title":"macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2025-68366","published":"2025-12-24T10:32:53.399Z","updated":"2026-06-16T19:12:35.384Z","title":"nbd: defer config unlock in nbd_genl_connect","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2025-68365","published":"2025-12-24T10:32:52.728Z","updated":"2026-08-05T12:11:03.953Z","title":"fs/ntfs3: Initialize allocated memory before use","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00412,"kevAdded":null},{"id":"CVE-2025-68364","published":"2025-12-24T10:32:51.922Z","updated":"2026-05-11T21:51:46.671Z","title":"ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-68363","published":"2025-12-24T10:32:51.236Z","updated":"2026-10-15T01:09:55.986Z","title":"bpf: Check skb->transport_header is set in bpf_skb_check_mtu","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-68362","published":"2025-12-24T10:32:50.492Z","updated":"2026-05-11T21:51:44.272Z","title":"wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-68361","published":"2025-12-24T10:32:49.792Z","updated":"2026-05-11T21:51:43.040Z","title":"erofs: limit the level of fs stacking for file-backed mounts","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-68360","published":"2025-12-24T10:32:49.121Z","updated":"2026-10-21T12:38:18.199Z","title":"wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2025-68359","published":"2025-12-24T10:32:48.456Z","updated":"2026-10-21T12:38:17.109Z","title":"btrfs: fix double free of qgroup record after failure to add delayed ref head","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00625,"kevAdded":null},{"id":"CVE-2025-68358","published":"2025-12-24T10:32:47.692Z","updated":"2026-05-11T21:51:39.547Z","title":"btrfs: fix racy bitfield write in btrfs_clear_space_info_full()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2025-68357","published":"2025-12-24T10:32:46.974Z","updated":"2026-05-23T16:02:44.515Z","title":"iomap: allocate s_dio_done_wq for async reads as well","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2025-68356","published":"2025-12-24T10:32:46.275Z","updated":"2026-10-21T12:38:16.003Z","title":"gfs2: Prevent recursive memory reclaim","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-68355","published":"2025-12-24T10:32:45.505Z","updated":"2026-05-11T21:51:36.018Z","title":"bpf: Fix exclusive map memory leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2025-68354","published":"2025-12-24T10:32:44.840Z","updated":"2026-05-11T21:51:34.856Z","title":"regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-68353","published":"2025-12-24T10:32:44.068Z","updated":"2026-10-21T12:38:14.894Z","title":"net: vxlan: prevent NULL deref in vxlan_xmit_one","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-68352","published":"2025-12-24T10:32:43.366Z","updated":"2026-08-05T12:11:00.772Z","title":"spi: ch341: fix out-of-bounds memory access in ch341_transfer_one","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2025-68351","published":"2025-12-24T10:32:42.683Z","updated":"2026-05-27T09:28:13.537Z","title":"exfat: fix refcount leak in exfat_find","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2025-68350","published":"2025-12-24T10:32:41.931Z","updated":"2026-05-11T21:51:30.130Z","title":"exfat: fix divide-by-zero in exfat_allocate_bitmap","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-68349","published":"2025-12-24T10:32:41.253Z","updated":"2026-10-15T01:09:54.275Z","title":"NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00712,"kevAdded":null},{"id":"CVE-2025-68348","published":"2025-12-24T10:32:40.561Z","updated":"2026-05-11T21:51:27.551Z","title":"block: fix memory leak in __blkdev_issue_zero_pages","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-68347","published":"2025-12-24T10:32:39.804Z","updated":"2026-10-16T15:09:43.312Z","title":"ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2025-68346","published":"2025-12-24T10:32:39.101Z","updated":"2026-05-11T21:51:25.174Z","title":"ALSA: dice: fix buffer overflow in detect_stream_formats()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2025-68345","published":"2025-12-24T10:32:38.378Z","updated":"2026-05-11T21:51:24.058Z","title":"ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2025-68344","published":"2025-12-24T10:32:37.615Z","updated":"2026-05-11T21:51:22.916Z","title":"ALSA: wavefront: Fix integer overflow in sample size validation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-68343","published":"2025-12-23T13:58:28.411Z","updated":"2026-05-11T21:51:21.788Z","title":"can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2025-68342","published":"2025-12-23T13:58:27.579Z","updated":"2026-10-30T12:23:14.781Z","title":"can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2025-68341","published":"2025-12-23T13:58:26.749Z","updated":"2026-08-05T12:10:57.506Z","title":"veth: reduce XDP no_direct return section to fix race","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0044,"kevAdded":null},{"id":"CVE-2025-68340","published":"2025-12-23T13:58:25.841Z","updated":"2026-10-16T15:09:43.166Z","title":"team: Move team device type change at the end of team_port_add","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-68339","published":"2025-12-23T13:58:24.955Z","updated":"2026-05-11T21:51:16.850Z","title":"atm/fore200e: Fix possible data race in fore200e_open()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2025-68338","published":"2025-12-23T13:58:24.121Z","updated":"2026-05-11T21:51:15.675Z","title":"net: dsa: microchip: Don't free uninitialized ksz_irq","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-68337","published":"2025-12-22T16:14:14.145Z","updated":"2026-10-15T01:09:52.527Z","title":"jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00552,"kevAdded":null},{"id":"CVE-2025-68336","published":"2025-12-22T16:14:13.425Z","updated":"2026-10-16T15:09:43.012Z","title":"locking/spinlock/debug: Fix data-race in do_raw_write_lock","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00466,"kevAdded":null},{"id":"CVE-2025-68335","published":"2025-12-22T16:14:12.614Z","updated":"2026-05-11T21:51:12.073Z","title":"comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-68334","published":"2025-12-22T16:14:11.815Z","updated":"2026-05-11T21:51:10.818Z","title":"platform/x86/amd/pmc: Add support for Van Gogh SoC","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2025-68333","published":"2025-12-22T16:14:11.081Z","updated":"2026-05-11T21:51:09.677Z","title":"sched_ext: Fix possible deadlock in the deferred_irq_workfn()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00106,"kevAdded":null},{"id":"CVE-2025-68332","published":"2025-12-22T16:14:10.146Z","updated":"2026-05-11T21:51:08.512Z","title":"comedi: c6xdigio: Fix invalid PNP driver unregistration","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-68331","published":"2025-12-22T16:12:24.607Z","updated":"2026-05-11T21:51:07.296Z","title":"usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-68330","published":"2025-12-22T16:12:23.864Z","updated":"2026-05-11T21:51:06.153Z","title":"iio: accel: bmc150: Fix irq assumption regression","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2025-68329","published":"2025-12-22T16:12:23.133Z","updated":"2026-05-11T21:51:04.994Z","title":"tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-68328","published":"2025-12-22T16:12:22.218Z","updated":"2026-05-11T21:51:03.881Z","title":"firmware: stratix10-svc: fix bug in saving controller data","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2025-68327","published":"2025-12-22T16:12:21.402Z","updated":"2026-05-11T21:51:02.064Z","title":"usb: renesas_usbhs: Fix synchronous external abort on unbind","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2025-68326","published":"2025-12-22T16:12:15.664Z","updated":"2026-05-11T21:51:00.787Z","title":"drm/xe/guc: Fix stack_depot usage","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2025-68325","published":"2025-12-18T15:02:50.214Z","updated":"2026-05-23T16:02:41.295Z","title":"net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2025-68324","published":"2025-12-18T15:02:49.230Z","updated":"2026-10-30T12:23:13.712Z","title":"scsi: imm: Fix use-after-free bug caused by unfinished delayed work","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2025-68323","published":"2025-12-18T15:02:48.403Z","updated":"2026-05-11T21:50:57.181Z","title":"usb: typec: ucsi: fix use-after-free caused by uec->work","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-68322","published":"2025-12-16T15:44:19.850Z","updated":"2026-05-11T21:50:55.903Z","title":"parisc: Avoid crash due to unaligned access in unwinder","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-68321","published":"2025-12-16T15:44:19.066Z","updated":"2026-10-30T12:23:12.656Z","title":"page_pool: always add GFP_NOWARN for ATOMIC allocations","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00451,"kevAdded":null},{"id":"CVE-2025-68320","published":"2025-12-16T15:44:18.217Z","updated":"2026-10-30T12:23:11.604Z","title":"lan966x: Fix sleeping in atomic context","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00414,"kevAdded":null},{"id":"CVE-2025-68319","published":"2025-12-16T15:39:48.903Z","updated":"2026-10-21T12:38:12.214Z","title":"netconsole: Acquire su_mutex before navigating configs hierarchy","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-68318","published":"2025-12-16T15:39:47.965Z","updated":"2026-10-21T12:38:11.106Z","title":"clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-68317","published":"2025-12-16T15:39:47.159Z","updated":"2026-10-15T22:02:49.138Z","title":"io_uring/zctx: check chained notif contexts","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-68316","published":"2025-12-16T15:39:46.434Z","updated":"2026-05-11T21:50:49.031Z","title":"scsi: ufs: core: Fix invalid probe error return value","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2025-68315","published":"2025-12-16T15:39:45.716Z","updated":"2026-08-05T12:10:49.846Z","title":"f2fs: fix to detect potential corrupted nid in free_nid_list","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2025-68314","published":"2025-12-16T15:39:44.791Z","updated":"2026-08-05T12:10:48.766Z","title":"drm/msm: make sure last_fence is always updated","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2025-68313","published":"2025-12-16T15:39:43.972Z","updated":"2026-10-15T22:02:49.013Z","title":"x86/CPU/AMD: Add RDSEED fix for Zen5","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2025-68312","published":"2025-12-16T15:39:43.174Z","updated":"2026-06-16T16:26:09.604Z","title":"usbnet: Prevents free active kevent","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2025-68311","published":"2025-12-16T15:39:42.445Z","updated":"2026-10-21T12:38:10.030Z","title":"tty: serial: ip22zilog: Use platform device for probing","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-68310","published":"2025-12-16T15:39:41.652Z","updated":"2026-05-11T21:50:41.874Z","title":"s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2025-68309","published":"2025-12-16T15:39:40.757Z","updated":"2026-05-11T21:50:40.708Z","title":"PCI/AER: Fix NULL pointer access by aer_info","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2025-68308","published":"2025-12-16T15:06:25.081Z","updated":"2026-05-11T21:50:39.573Z","title":"can: kvaser_usb: leaf: Fix potential infinite loop in command parsers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2025-68307","published":"2025-12-16T15:06:24.271Z","updated":"2026-06-01T16:05:42.572Z","title":"can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-68306","published":"2025-12-16T15:06:23.486Z","updated":"2026-05-11T21:50:37.297Z","title":"Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2025-68305","published":"2025-12-16T15:06:22.812Z","updated":"2026-08-23T12:45:27.050Z","title":"Bluetooth: hci_sock: Prevent race in socket write iter and sock bind","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2025-68304","published":"2025-12-16T15:06:21.887Z","updated":"2026-10-15T22:02:48.882Z","title":"Bluetooth: hci_core: lookup hci_conn on RX path on protocol side","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-68303","published":"2025-12-16T15:06:21.208Z","updated":"2026-08-05T12:10:44.469Z","title":"platform/x86: intel: punit_ipc: fix memory corruption","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-68302","published":"2025-12-16T15:06:20.420Z","updated":"2026-08-05T12:10:43.401Z","title":"net: sxgbe: fix potential NULL dereference in sxgbe_rx()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2025-68301","published":"2025-12-16T15:06:19.688Z","updated":"2026-08-05T12:10:42.337Z","title":"net: atlantic: fix fragment overflow handling in RX path","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2025-68300","published":"2025-12-16T15:06:18.941Z","updated":"2026-05-11T21:50:30.188Z","title":"fs/namespace: fix reference leak in grab_requested_mnt_ns","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-68299","published":"2025-12-16T15:06:18.246Z","updated":"2026-08-03T09:32:28.315Z","title":"afs: Fix delayed allocation of a cell's anonymous key","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2025-68298","published":"2025-12-16T15:06:17.526Z","updated":"2026-05-23T16:02:35.979Z","title":"Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-68297","published":"2025-12-16T15:06:16.756Z","updated":"2026-05-23T16:02:34.931Z","title":"ceph: fix crash in process_v2_sparse_read() for encrypted directories","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-68296","published":"2025-12-16T15:06:15.797Z","updated":"2026-06-19T11:57:24.114Z","title":"drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-68295","published":"2025-12-16T15:06:14.977Z","updated":"2026-06-16T16:54:20.236Z","title":"smb: client: fix memory leak in cifs_construct_tcon()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-68294","published":"2025-12-16T15:06:14.177Z","updated":"2026-08-05T12:10:41.250Z","title":"io_uring/net: ensure vectored buffer node import is tied to notification","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-68293","published":"2025-12-16T15:06:13.428Z","updated":"2026-05-11T21:50:21.654Z","title":"mm/huge_memory: fix NULL pointer deference when splitting folio","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2025-68292","published":"2025-12-16T15:06:12.772Z","updated":"2026-05-11T21:50:20.450Z","title":"mm/memfd: fix information leak in hugetlb folios","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-68291","published":"2025-12-16T15:06:12.095Z","updated":"2026-10-15T01:09:50.833Z","title":"mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose().","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-68290","published":"2025-12-16T15:06:11.202Z","updated":"2026-05-11T21:50:18.148Z","title":"most: usb: fix double free on late probe failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-68289","published":"2025-12-16T15:06:10.450Z","updated":"2026-05-23T16:02:32.799Z","title":"usb: gadget: f_eem: Fix memory leak in eem_unwrap","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-68288","published":"2025-12-16T15:06:09.654Z","updated":"2026-05-23T16:02:31.659Z","title":"usb: storage: Fix memory leak in USB bulk transport","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-68287","published":"2025-12-16T15:06:08.711Z","updated":"2026-06-16T19:14:09.159Z","title":"usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2025-68286","published":"2025-12-16T15:06:07.838Z","updated":"2026-08-05T12:10:40.179Z","title":"drm/amd/display: Check NULL before accessing","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2025-68285","published":"2025-12-16T15:06:07.078Z","updated":"2026-08-05T12:10:39.092Z","title":"libceph: fix potential use-after-free in have_mon_and_osd_map()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00585,"kevAdded":null},{"id":"CVE-2025-68284","published":"2025-12-16T15:06:06.235Z","updated":"2026-10-15T22:02:48.751Z","title":"libceph: prevent potential out-of-bounds writes in handle_auth_session_key()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00588,"kevAdded":null},{"id":"CVE-2025-68283","published":"2025-12-16T15:06:05.355Z","updated":"2026-10-15T22:02:48.629Z","title":"libceph: replace BUG_ON with bounds check for map->max_osd","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00528,"kevAdded":null},{"id":"CVE-2025-68282","published":"2025-12-16T15:06:04.332Z","updated":"2026-05-11T21:50:08.718Z","title":"usb: gadget: udc: fix use-after-free in usb_gadget_state_work","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-68281","published":"2025-12-16T14:48:37.765Z","updated":"2026-05-11T21:50:07.538Z","title":"ASoC: SDCA: bug fix while parsing mipi-sdca-control-cn-list","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2025-68266","published":"2025-12-16T14:47:06.240Z","updated":"2026-10-15T01:09:48.894Z","title":"bfs: Reconstruct file type when loading from disk","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-68265","published":"2025-12-16T14:47:05.303Z","updated":"2026-10-15T22:02:48.507Z","title":"nvme: fix admin request_queue lifetime","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2025-68264","published":"2025-12-16T14:45:06.268Z","updated":"2026-10-15T01:09:44.093Z","title":"ext4: refresh inline data size before write operations","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-68263","published":"2025-12-16T14:45:05.218Z","updated":"2026-10-15T22:02:48.374Z","title":"ksmbd: ipc: fix use-after-free in ipc_msg_send_request","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00444,"kevAdded":null},{"id":"CVE-2025-68262","published":"2025-12-16T14:45:04.198Z","updated":"2026-05-11T21:49:58.343Z","title":"crypto: zstd - fix double-free in per-CPU stream cleanup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-68261","published":"2025-12-16T14:45:03.252Z","updated":"2026-10-15T01:09:42.357Z","title":"ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00552,"kevAdded":null},{"id":"CVE-2025-68260","published":"2025-12-16T14:45:02.499Z","updated":"2026-08-05T12:10:32.401Z","title":"rust_binder: fix race condition on death_list","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2025-68259","published":"2025-12-16T14:45:01.753Z","updated":"2026-05-11T21:49:54.834Z","title":"KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-68258","published":"2025-12-16T14:45:00.920Z","updated":"2026-05-11T21:49:53.691Z","title":"comedi: multiq3: sanitize config options in multiq3_attach()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-68257","published":"2025-12-16T14:44:59.535Z","updated":"2026-05-11T21:49:52.497Z","title":"comedi: check device's attached status in compat ioctls","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-68256","published":"2025-12-16T14:44:58.829Z","updated":"2026-08-05T12:10:31.326Z","title":"staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2025-68255","published":"2025-12-16T14:44:58.031Z","updated":"2026-08-05T12:10:30.152Z","title":"staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00369,"kevAdded":null},{"id":"CVE-2025-68254","published":"2025-12-16T14:44:57.204Z","updated":"2026-08-05T12:10:29.074Z","title":"staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-68253","published":"2025-12-16T14:32:19.546Z","updated":"2026-05-11T21:49:47.693Z","title":"mm: don't spin in add_stack_record when gfp flags don't allow","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2025-68252","published":"2025-12-16T14:32:18.819Z","updated":"2026-05-11T21:49:46.501Z","title":"misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2025-68251","published":"2025-12-16T14:32:17.979Z","updated":"2026-10-21T12:38:08.014Z","title":"erofs: avoid infinite loops due to corrupted subpage compact indexes","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-68250","published":"2025-12-16T14:32:17.173Z","updated":"2026-08-05T12:10:27.999Z","title":"hung_task: fix warnings caused by unaligned lock pointers","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00307,"kevAdded":null},{"id":"CVE-2025-68249","published":"2025-12-16T14:32:16.370Z","updated":"2026-05-11T21:49:43.047Z","title":"most: usb: hdm_probe: Fix calling put_device() before device initialization","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2025-68248","published":"2025-12-16T14:32:15.430Z","updated":"2026-05-11T21:49:41.900Z","title":"vmw_balloon: indicate success when effectively deflating during migration","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2025-68247","published":"2025-12-16T14:21:24.359Z","updated":"2026-05-11T21:49:40.740Z","title":"posix-timers: Plug potential memory leak in do_timer_create()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2025-68246","published":"2025-12-16T14:21:23.551Z","updated":"2026-08-05T12:10:26.942Z","title":"ksmbd: close accepted socket when per-IP limit rejects connection","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00414,"kevAdded":null},{"id":"CVE-2025-68245","published":"2025-12-16T14:21:22.348Z","updated":"2026-05-11T21:49:38.460Z","title":"net: netpoll: fix incorrect refcount handling causing incorrect cleanup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2025-68244","published":"2025-12-16T14:21:21.277Z","updated":"2026-05-11T21:49:37.318Z","title":"drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2025-68243","published":"2025-12-16T14:21:20.421Z","updated":"2026-08-05T12:10:25.864Z","title":"NFS: Check the TLS certificate fields in nfs_match_client()","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00079,"kevAdded":null},{"id":"CVE-2025-68242","published":"2025-12-16T14:21:19.558Z","updated":"2026-05-11T21:49:34.952Z","title":"NFS: Fix LTP test failures when timestamps are delegated","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-68241","published":"2025-12-16T14:21:18.682Z","updated":"2026-08-05T12:10:24.792Z","title":"ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00466,"kevAdded":null},{"id":"CVE-2025-68240","published":"2025-12-16T14:21:17.710Z","updated":"2026-05-11T21:49:32.618Z","title":"nilfs2: avoid having an active sc_timer before freeing sci","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-68239","published":"2025-12-16T14:21:16.889Z","updated":"2026-10-15T01:09:40.623Z","title":"binfmt_misc: restore write access before closing files opened by open_exec()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-68238","published":"2025-12-16T14:08:31.672Z","updated":"2026-05-23T16:02:26.527Z","title":"mtd: rawnand: cadence: fix DMA device NULL pointer dereference","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2025-68237","published":"2025-12-16T14:08:30.940Z","updated":"2026-05-11T21:49:29.135Z","title":"mtdchar: fix integer overflow in read/write ioctls","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2025-68236","published":"2025-12-16T14:08:30.224Z","updated":"2026-10-30T12:23:10.538Z","title":"scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-68235","published":"2025-12-16T14:08:29.396Z","updated":"2026-05-11T21:49:26.626Z","title":"nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2025-68234","published":"2025-12-16T14:04:14.300Z","updated":"2026-08-05T12:10:23.703Z","title":"io_uring/cmd_net: fix wrong argument types for skb_queue_splice()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2025-68233","published":"2025-12-16T14:04:13.490Z","updated":"2026-05-11T21:49:24.334Z","title":"drm/tegra: Add call to put_pid()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2025-68232","published":"2025-12-16T14:04:12.624Z","updated":"2026-08-05T12:10:19.353Z","title":"veth: more robust handing of race to avoid txq getting stuck","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00401,"kevAdded":null},{"id":"CVE-2025-68231","published":"2025-12-16T13:57:23.712Z","updated":"2026-05-11T21:49:21.992Z","title":"mm/mempool: fix poisoning order>0 pages with HIGHMEM","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2025-68230","published":"2025-12-16T13:57:22.787Z","updated":"2026-10-21T12:38:05.802Z","title":"drm/amdgpu: fix gpu page fault after hibernation on PF passthrough","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-68229","published":"2025-12-16T13:57:21.835Z","updated":"2026-06-16T16:20:56.408Z","title":"scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2025-68228","published":"2025-12-16T13:57:21.011Z","updated":"2026-05-11T21:49:18.458Z","title":"drm/plane: Fix create_in_format_blob() return value","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-68227","published":"2025-12-16T13:57:20.027Z","updated":"2026-05-11T21:49:17.263Z","title":"mptcp: Fix proto fallback detection with BPF","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-68226","published":"2025-12-16T13:57:19.268Z","updated":"2026-10-15T22:02:48.233Z","title":"smb: client: fix incomplete backport in cfids_invalidation_worker()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00351,"kevAdded":null},{"id":"CVE-2025-68225","published":"2025-12-16T13:57:18.346Z","updated":"2026-05-11T21:49:11.783Z","title":"lib/test_kho: check if KHO is enabled","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-68223","published":"2025-12-16T13:57:16.764Z","updated":"2026-05-11T21:49:06.756Z","title":"drm/radeon: delete radeon_fence_process in is_signaled, no deadlock","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2025-68222","published":"2025-12-16T13:57:15.832Z","updated":"2026-05-11T21:49:05.252Z","title":"pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2025-68221","published":"2025-12-16T13:57:14.836Z","updated":"2026-05-11T21:49:04.080Z","title":"mptcp: fix address removal logic in mptcp_pm_nl_rm_addr","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-68220","published":"2025-12-16T13:57:14.142Z","updated":"2026-05-11T21:49:02.647Z","title":"net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-68219","published":"2025-12-16T13:57:13.461Z","updated":"2026-10-30T12:23:09.486Z","title":"cifs: fix memory leak in smb3_fs_context_parse_param error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-68218","published":"2025-12-16T13:57:12.733Z","updated":"2026-10-15T22:02:48.088Z","title":"nvme-multipath: fix lockdep WARN due to partition scan work","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00528,"kevAdded":null},{"id":"CVE-2025-68217","published":"2025-12-16T13:57:12.011Z","updated":"2026-05-11T21:48:59.173Z","title":"Input: pegasus-notetaker - fix potential out-of-bounds access","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-68216","published":"2025-12-16T13:57:11.303Z","updated":"2026-05-11T21:48:58.041Z","title":"LoongArch: BPF: Disable trampoline for kernel module function trace","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-68215","published":"2025-12-16T13:57:10.576Z","updated":"2026-10-15T22:02:47.952Z","title":"ice: fix PTP cleanup on driver removal in error path","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-68214","published":"2025-12-16T13:57:09.728Z","updated":"2026-05-23T16:02:22.475Z","title":"timers: Fix NULL function pointer race in timer_shutdown_sync()","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2025-68213","published":"2025-12-16T13:57:09.046Z","updated":"2026-05-23T16:02:21.425Z","title":"idpf: fix possible vport_config NULL pointer deref in remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2025-68212","published":"2025-12-16T13:57:08.327Z","updated":"2026-08-05T12:10:14.921Z","title":"fs: Fix uninitialized 'offp' in statmount_string()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-68211","published":"2025-12-16T13:48:37.959Z","updated":"2026-06-11T18:44:19.687Z","title":"ksm: use range-walk function to jump over holes in scan_get_next_rmap_item","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2025-68210","published":"2025-12-16T13:48:37.072Z","updated":"2026-05-11T21:48:50.848Z","title":"erofs: avoid infinite loop due to incomplete zstd-compressed data","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-68209","published":"2025-12-16T13:48:36.098Z","updated":"2026-10-30T12:23:08.429Z","title":"mlx5: Fix default values in create CQ","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-68208","published":"2025-12-16T13:48:35.298Z","updated":"2026-10-15T22:02:47.833Z","title":"bpf: account for current allocated stack depth in widen_imprecise_scalars()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-68207","published":"2025-12-16T13:48:34.574Z","updated":"2026-10-15T22:02:47.710Z","title":"drm/xe/guc: Synchronize Dead CT worker with unbind","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-68206","published":"2025-12-16T13:48:33.763Z","updated":"2026-10-15T22:02:47.582Z","title":"netfilter: nft_ct: add seqadj extension for natted connections","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00712,"kevAdded":null},{"id":"CVE-2025-68205","published":"2025-12-16T13:48:32.888Z","updated":"2026-05-11T21:48:44.906Z","title":"ALSA: hda/hdmi: Fix breakage at probing nvhdmi-mcp driver","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-68204","published":"2025-12-16T13:48:31.850Z","updated":"2026-05-11T21:48:43.753Z","title":"pmdomain: arm: scmi: Fix genpd leak on provider registration failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-68202","published":"2025-12-16T13:48:30.376Z","updated":"2026-05-11T21:48:42.294Z","title":"sched_ext: Fix unsafe locking in the scx_dump_state()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-68201","published":"2025-12-16T13:48:29.708Z","updated":"2026-10-21T12:38:03.607Z","title":"drm/amdgpu: remove two invalid BUG_ON()s","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-68200","published":"2025-12-16T13:48:28.793Z","updated":"2026-05-23T16:02:18.253Z","title":"bpf: Add bpf_prog_run_data_pointers()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-68199","published":"2025-12-16T13:48:27.813Z","updated":"2026-05-11T21:48:34.800Z","title":"codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-68198","published":"2025-12-16T13:48:26.998Z","updated":"2026-05-11T21:48:33.671Z","title":"crash: fix crashkernel resource shrink","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-68197","published":"2025-12-16T13:43:23.269Z","updated":"2026-05-11T21:48:32.536Z","title":"bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-68196","published":"2025-12-16T13:43:22.553Z","updated":"2026-05-11T21:48:31.295Z","title":"drm/amd/display: Cache streams targeting link when performing LT automation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-68194","published":"2025-12-16T13:43:20.525Z","updated":"2026-05-11T21:48:28.934Z","title":"media: imon: make send_packet() more robust","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-68193","published":"2025-12-16T13:43:19.702Z","updated":"2026-10-21T12:38:02.508Z","title":"drm/xe/guc: Add devm release action to safely tear down CT","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-68192","published":"2025-12-16T13:43:18.858Z","updated":"2026-10-15T22:02:47.413Z","title":"net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00611,"kevAdded":null},{"id":"CVE-2025-68191","published":"2025-12-16T13:43:13.146Z","updated":"2026-05-11T21:48:25.272Z","title":"udp_tunnel: use netdev_warn() instead of netdev_WARN()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-68190","published":"2025-12-16T13:43:12.297Z","updated":"2026-10-03T10:55:29.539Z","title":"drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-68189","published":"2025-12-16T13:43:11.507Z","updated":"2026-08-05T12:10:08.528Z","title":"drm/msm: Fix GEM free for imported dma-bufs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2025-68188","published":"2025-12-16T13:43:10.680Z","updated":"2026-10-30T12:23:07.375Z","title":"tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-68187","published":"2025-12-16T13:43:04.691Z","updated":"2026-05-11T21:48:20.681Z","title":"net: mdio: Check regmap pointer returned by device_node_to_regmap()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-68186","published":"2025-12-16T13:43:03.814Z","updated":"2026-05-11T21:48:19.480Z","title":"ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-68185","published":"2025-12-16T13:43:02.894Z","updated":"2026-06-16T19:21:22.682Z","title":"nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-68184","published":"2025-12-16T13:43:02.010Z","updated":"2026-08-05T12:10:07.452Z","title":"drm/mediatek: Disable AFBC support on Mediatek DRM driver","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-68183","published":"2025-12-16T13:43:01.178Z","updated":"2026-10-30T12:23:06.322Z","title":"ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-68182","published":"2025-12-16T13:43:00.435Z","updated":"2026-10-15T22:02:47.125Z","title":"wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-68181","published":"2025-12-16T13:42:59.600Z","updated":"2026-10-15T22:02:46.996Z","title":"drm/radeon: Remove calls to drm_put_dev()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2025-68180","published":"2025-12-16T13:42:58.687Z","updated":"2026-05-11T21:48:12.480Z","title":"drm/amd/display: Fix NULL deref in debugfs odm_combine_segments","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-68179","published":"2025-12-16T13:42:57.817Z","updated":"2026-08-05T12:10:03.176Z","title":"s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-68178","published":"2025-12-16T13:42:57.148Z","updated":"2026-10-30T12:23:05.241Z","title":"blk-cgroup: fix possible deadlock while configuring policy","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2025-68177","published":"2025-12-16T13:42:56.336Z","updated":"2026-05-11T21:48:09.012Z","title":"cpufreq/longhaul: handle NULL policy in longhaul_exit","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-68176","published":"2025-12-16T13:42:55.616Z","updated":"2026-05-11T21:48:07.844Z","title":"PCI: cadence: Check for the existence of cdns_pcie::ops before using it","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-68175","published":"2025-12-16T13:42:54.913Z","updated":"2026-10-21T12:38:00.438Z","title":"media: nxp: imx8-isi: Fix streaming cleanup on release","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2025-68174","published":"2025-12-16T13:42:53.891Z","updated":"2026-10-21T12:37:59.297Z","title":"amd/amdkfd: enhance kfd process check in switch partition","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-68173","published":"2025-12-16T13:42:53.106Z","updated":"2026-05-11T21:48:04.420Z","title":"ftrace: Fix softlockup in ftrace_module_enable","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2025-68172","published":"2025-12-16T13:42:52.141Z","updated":"2026-05-11T21:48:03.150Z","title":"crypto: aspeed - fix double free caused by devm","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2025-68171","published":"2025-12-16T13:42:51.121Z","updated":"2026-10-15T22:02:46.869Z","title":"x86/fpu: Ensure XFD state on signal delivery","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-68170","published":"2025-12-16T13:42:50.201Z","updated":"2026-10-15T22:02:46.741Z","title":"drm/radeon: Do not kfree() devres managed rdev","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-68169","published":"2025-12-16T13:42:49.270Z","updated":"2026-05-11T21:47:58.964Z","title":"netpoll: Fix deadlock in memory allocation under spinlock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2025-68168","published":"2025-12-16T13:42:48.350Z","updated":"2026-08-05T12:09:57.842Z","title":"jfs: fix uninitialized waitqueue in transaction manager","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2025-68167","published":"2025-12-16T13:42:47.480Z","updated":"2026-08-05T12:09:56.647Z","title":"gpiolib: fix invalid pointer access in debugfs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-40363","published":"2025-12-16T13:40:03.265Z","updated":"2026-06-16T19:57:11.691Z","title":"net: ipv6: fix field-spanning memcpy warning in AH output","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-40362","published":"2025-12-16T13:40:02.467Z","updated":"2026-10-15T22:02:46.619Z","title":"ceph: fix multifs mds auth caps issue","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2025-40360","published":"2025-12-16T13:39:59.490Z","updated":"2026-05-11T21:47:51.912Z","title":"drm/sysfb: Do not dereference NULL pointer in plane reset","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-40359","published":"2025-12-16T13:39:58.778Z","updated":"2026-05-11T21:47:50.767Z","title":"perf/x86/intel: Fix KASAN global-out-of-bounds warning","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-40358","published":"2025-12-16T13:39:57.847Z","updated":"2026-08-05T12:09:53.455Z","title":"riscv: stacktrace: Disable KASAN checks for non-current tasks","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-40357","published":"2025-12-16T13:30:29.758Z","updated":"2026-05-11T21:47:48.416Z","title":"net/smc: fix general protection fault in __smc_diag_dump","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-40356","published":"2025-12-16T13:30:28.913Z","updated":"2026-08-05T12:09:52.400Z","title":"spi: rockchip-sfc: Fix DMA-API usage","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-40355","published":"2025-12-16T13:30:28.017Z","updated":"2026-10-21T12:37:58.178Z","title":"sysfs: check visibility before changing group attribute ownership","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-40354","published":"2025-12-16T13:30:27.082Z","updated":"2026-08-05T12:09:51.348Z","title":"drm/amd/display: increase max link count and fix link->enc NULL pointer access","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-40353","published":"2025-12-16T13:30:26.273Z","updated":"2026-05-11T21:47:43.712Z","title":"arm64: mte: Do not warn if the page is already tagged in copy_highpage()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-40352","published":"2025-12-16T13:30:25.536Z","updated":"2026-05-11T21:47:42.581Z","title":"platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-40351","published":"2025-12-16T13:30:24.764Z","updated":"2026-05-11T21:47:41.349Z","title":"hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-40350","published":"2025-12-16T13:30:23.896Z","updated":"2026-08-05T12:09:50.275Z","title":"net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00548,"kevAdded":null},{"id":"CVE-2025-40349","published":"2025-12-16T13:30:23.092Z","updated":"2026-08-05T12:09:49.208Z","title":"hfs: validate record offset in hfsplus_bmap_alloc","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2025-40348","published":"2025-12-16T13:30:22.368Z","updated":"2026-05-11T21:47:37.835Z","title":"slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-40347","published":"2025-12-16T13:30:21.539Z","updated":"2026-08-05T12:09:48.141Z","title":"net: enetc: fix the deadlock of enetc_mdio_lock","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00528,"kevAdded":null},{"id":"CVE-2025-40346","published":"2025-12-16T13:30:20.395Z","updated":"2026-05-11T21:47:35.335Z","title":"arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-40345","published":"2025-12-12T17:53:06.853Z","updated":"2026-06-02T13:00:22.057Z","title":"usb: storage: sddr55: Reject out-of-bound new_pba","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-40344","published":"2025-12-09T04:10:03.253Z","updated":"2026-10-15T22:02:46.492Z","title":"ASoC: Intel: avs: Disable periods-elapsed work when closing PCM","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2025-40343","published":"2025-12-09T04:10:00.973Z","updated":"2026-10-15T22:02:46.366Z","title":"nvmet-fc: avoid scheduling association deletion twice","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00651,"kevAdded":null},{"id":"CVE-2025-40342","published":"2025-12-09T04:09:59.673Z","updated":"2026-08-05T12:09:44.878Z","title":"nvme-fc: use lock accessing port_state and rport state","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2025-40341","published":"2025-12-09T04:09:58.392Z","updated":"2026-05-11T21:47:29.607Z","title":"futex: Don't leak robust_list pointer on exec race","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2025-40340","published":"2025-12-09T04:09:57.059Z","updated":"2026-05-11T21:47:28.456Z","title":"drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-40339","published":"2025-12-09T04:09:55.697Z","updated":"2026-05-11T21:47:27.313Z","title":"drm/amdgpu: fix nullptr err of vm_handle_moved","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-40338","published":"2025-12-09T04:09:54.753Z","updated":"2026-10-30T12:23:04.192Z","title":"ASoC: Intel: avs: Do not share the name pointer between components","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2025-40337","published":"2025-12-09T04:09:53.808Z","updated":"2026-10-30T12:23:03.136Z","title":"net: stmmac: Correctly handle Rx checksum offload errors","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00481,"kevAdded":null},{"id":"CVE-2025-40336","published":"2025-12-09T04:09:52.845Z","updated":"2026-10-15T22:02:46.189Z","title":"drm/gpusvm: fix hmm_pfn_to_map_order() usage","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2025-40335","published":"2025-12-09T04:09:51.937Z","updated":"2026-05-11T21:47:22.770Z","title":"drm/amdgpu: validate userq input args","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-40334","published":"2025-12-09T04:09:51.022Z","updated":"2026-08-05T12:09:41.567Z","title":"drm/amdgpu: validate userq buffer virtual address and size","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-40333","published":"2025-12-09T04:09:50.051Z","updated":"2026-05-11T21:47:20.505Z","title":"f2fs: fix infinite loop in __insert_extent_tree()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2025-40332","published":"2025-12-09T04:09:49.164Z","updated":"2026-05-23T16:02:11.553Z","title":"drm/amdkfd: Fix mmap write lock not release","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2025-40331","published":"2025-12-09T04:09:48.196Z","updated":"2026-08-05T12:09:40.498Z","title":"sctp: Prevent TOCTOU out-of-bounds write","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-40330","published":"2025-12-09T04:09:47.251Z","updated":"2026-05-11T21:47:16.941Z","title":"bnxt_en: Shutdown FW DMA in bnxt_shutdown()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2025-40329","published":"2025-12-09T04:09:46.156Z","updated":"2026-05-11T21:47:15.504Z","title":"drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2025-40328","published":"2025-12-09T04:09:44.876Z","updated":"2026-10-30T12:23:02.073Z","title":"smb: client: fix potential UAF in smb2_close_cached_fid()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2025-40327","published":"2025-12-09T04:09:43.522Z","updated":"2026-05-23T16:02:10.552Z","title":"perf/core: Fix system hang caused by cpu-clock usage","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2023-53866","published":"2025-12-09T01:30:35.817Z","updated":"2026-10-15T21:41:37.435Z","title":"ASoC: soc-compress: Reposition and add pcm_mutex","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2023-53865","published":"2025-12-09T01:30:34.588Z","updated":"2026-05-23T15:31:37.051Z","title":"btrfs: fix warning when putting transaction with qgroups enabled after abort","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2023-53864","published":"2025-12-09T01:30:33.263Z","updated":"2026-05-11T19:52:59.870Z","title":"drm/mxsfb: Disable overlay plane in mxsfb_plane_overlay_atomic_disable()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2023-53863","published":"2025-12-09T01:30:32.109Z","updated":"2026-05-11T19:52:58.716Z","title":"netlink: do not hard code device address lenth in fdb dumps","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2023-53862","published":"2025-12-09T01:30:30.902Z","updated":"2026-08-05T09:16:26.547Z","title":"hfs: fix missing hfs_bnode_get() in __hfs_bnode_create","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2023-53861","published":"2025-12-09T01:30:29.423Z","updated":"2026-05-23T15:31:31.661Z","title":"ext4: correct grp validation in ext4_mb_good_group","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2023-53860","published":"2025-12-09T01:30:27.903Z","updated":"2026-08-05T09:16:25.476Z","title":"dm: don't attempt to queue IO under RCU protection","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2023-53859","published":"2025-12-09T01:30:26.351Z","updated":"2026-05-23T15:31:27.524Z","title":"s390/idle: mark arch_cpu_idle() noinstr","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2023-53858","published":"2025-12-09T01:30:24.886Z","updated":"2026-05-11T19:52:52.944Z","title":"tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2023-53857","published":"2025-12-09T01:30:23.593Z","updated":"2026-10-03T10:55:03.225Z","title":"bpf: bpf_sk_storage: Fix invalid wait context lockdep report","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2023-53856","published":"2025-12-09T01:30:22.012Z","updated":"2026-05-11T19:52:50.630Z","title":"of: overlay: Call of_changeset_init() early","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2023-53855","published":"2025-12-09T01:30:20.864Z","updated":"2026-05-11T19:52:49.268Z","title":"net: dsa: ocelot: call dsa_tag_8021q_unregister() under rtnl_lock() on driver remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2023-53854","published":"2025-12-09T01:30:19.746Z","updated":"2026-05-11T19:52:48.131Z","title":"ASoC: mediatek: mt8186: Fix use-after-free in driver remove path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2023-53853","published":"2025-12-09T01:30:18.628Z","updated":"2026-05-11T19:52:47.011Z","title":"netlink: annotate accesses to nlk->cb_running","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2023-53852","published":"2025-12-09T01:30:17.449Z","updated":"2026-05-11T19:52:45.826Z","title":"nvme-core: fix memory leak in dhchap_secret_store","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2023-53851","published":"2025-12-09T01:30:16.081Z","updated":"2026-10-03T10:55:02.147Z","title":"drm/msm/dp: Drop aux devices together with DP controller","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2023-53850","published":"2025-12-09T01:30:14.740Z","updated":"2026-05-11T19:52:43.492Z","title":"iavf: use internal state to free traffic IRQs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2023-53849","published":"2025-12-09T01:30:13.402Z","updated":"2026-05-23T15:31:20.400Z","title":"drm/msm: fix workqueue leak on bind errors","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2023-53848","published":"2025-12-09T01:30:11.895Z","updated":"2026-05-11T19:52:41.221Z","title":"md/raid5-cache: fix a deadlock in r5l_exit_log()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2023-53847","published":"2025-12-09T01:30:10.344Z","updated":"2026-05-11T19:52:40.071Z","title":"usb-storage: alauda: Fix uninit-value in alauda_check_media()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2023-53846","published":"2025-12-09T01:30:09.202Z","updated":"2026-10-30T12:17:37.942Z","title":"f2fs: fix to do sanity check on direct node in truncate_dnode()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2023-53845","published":"2025-12-09T01:30:08.016Z","updated":"2026-05-11T19:52:37.795Z","title":"nilfs2: fix infinite loop in nilfs_mdt_get_block()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2023-53844","published":"2025-12-09T01:30:06.863Z","updated":"2026-08-05T09:16:22.259Z","title":"drm/ttm: Don't leak a resource on swapout move error","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2023-53843","published":"2025-12-09T01:30:05.698Z","updated":"2026-05-11T19:52:35.532Z","title":"net: openvswitch: reject negative ifindex","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2023-53842","published":"2025-12-09T01:30:04.183Z","updated":"2026-05-11T19:52:34.375Z","title":"ASoC: codecs: wcd-mbhc-v2: fix resource leaks on component remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2023-53841","published":"2025-12-09T01:29:58.448Z","updated":"2026-05-11T19:52:33.197Z","title":"devlink: report devlink_port_type_warn source device","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2023-53840","published":"2025-12-09T01:29:56.848Z","updated":"2026-05-11T19:52:32.046Z","title":"usb: early: xhci-dbc: Fix a potential out-of-bound memory access","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2023-53839","published":"2025-12-09T01:29:55.540Z","updated":"2026-05-11T19:52:30.888Z","title":"dccp: fix data-race around dp->dccps_mss_cache","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2023-53838","published":"2025-12-09T01:29:54.419Z","updated":"2026-08-05T09:16:21.177Z","title":"f2fs: synchronize atomic write aborts","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2023-53837","published":"2025-12-09T01:29:53.194Z","updated":"2026-05-11T19:52:28.605Z","title":"drm/msm: fix NULL-deref on snapshot tear down","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2023-53836","published":"2025-12-09T01:29:52.004Z","updated":"2026-10-15T21:41:37.285Z","title":"bpf, sockmap: Fix skb refcnt race after locking changes","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2023-53834","published":"2025-12-09T01:29:49.742Z","updated":"2026-05-11T19:52:26.261Z","title":"iio: adc: ina2xx: avoid NULL pointer dereference on OF device match","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2023-53833","published":"2025-12-09T01:29:48.637Z","updated":"2026-05-11T19:52:25.114Z","title":"drm/i915: Fix NULL ptr deref by checking new_crtc_state","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2023-53832","published":"2025-12-09T01:29:47.513Z","updated":"2026-05-11T19:52:23.953Z","title":"md/raid10: fix null-ptr-deref in raid10_sync_request","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2023-53831","published":"2025-12-09T01:29:46.374Z","updated":"2026-05-11T19:52:22.798Z","title":"net: read sk->sk_family once in sk_mc_loop()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2023-53830","published":"2025-12-09T01:29:44.966Z","updated":"2026-05-11T19:52:21.629Z","title":"platform/x86: think-lmi: Fix memory leak when showing current settings","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2023-53829","published":"2025-12-09T01:29:43.645Z","updated":"2026-08-05T09:16:19.040Z","title":"f2fs: flush inode if atomic file is aborted","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2023-53828","published":"2025-12-09T01:29:42.166Z","updated":"2026-10-15T21:41:37.140Z","title":"Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2023-53827","published":"2025-12-09T01:29:40.794Z","updated":"2026-10-15T21:41:37.002Z","title":"Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00391,"kevAdded":null},{"id":"CVE-2023-53826","published":"2025-12-09T01:29:39.679Z","updated":"2026-05-11T19:52:16.903Z","title":"ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2023-53825","published":"2025-12-09T01:29:38.539Z","updated":"2026-05-11T19:52:15.748Z","title":"kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2023-53824","published":"2025-12-09T01:29:37.432Z","updated":"2026-10-15T21:41:36.860Z","title":"netlink: annotate lockless accesses to nlk->max_recvmsg_len","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2023-53823","published":"2025-12-09T01:29:36.343Z","updated":"2026-10-30T12:17:36.868Z","title":"block/rq_qos: protect rq_qos apis with a new lock","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2023-53822","published":"2025-12-09T01:29:35.206Z","updated":"2026-10-15T21:41:36.712Z","title":"wifi: ath11k: Ignore frags from uninitialized peer in dp.","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00356,"kevAdded":null},{"id":"CVE-2023-53821","published":"2025-12-09T01:29:34.073Z","updated":"2026-05-11T19:52:11.135Z","title":"ip6_vti: fix slab-use-after-free in decode_session6","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2022-50679","published":"2025-12-09T01:29:32.925Z","updated":"2026-05-11T19:23:41.023Z","title":"i40e: Fix DMA mappings leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2022-50678","published":"2025-12-09T01:29:31.739Z","updated":"2026-05-11T19:23:39.772Z","title":"wifi: brcmfmac: fix invalid address access when enabling SCAN log level","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2022-50677","published":"2025-12-09T01:29:30.418Z","updated":"2026-10-15T21:41:22.782Z","title":"ipmi: fix use after free in _ipmi_destroy_user()","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2022-50676","published":"2025-12-09T01:29:29.166Z","updated":"2026-08-05T08:59:22.454Z","title":"net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00954,"kevAdded":null},{"id":"CVE-2022-50675","published":"2025-12-09T01:29:27.926Z","updated":"2026-05-11T19:23:36.334Z","title":"arm64: mte: Avoid setting PG_mte_tagged if no tags cleared or restored","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2022-50674","published":"2025-12-09T01:29:26.600Z","updated":"2026-05-11T19:23:35.166Z","title":"riscv: vdso: fix NULL deference in vdso_join_timens() when vfork","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2022-50673","published":"2025-12-09T01:29:25.220Z","updated":"2026-08-05T08:59:21.383Z","title":"ext4: fix use-after-free in ext4_orphan_cleanup","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2022-50672","published":"2025-12-09T01:29:24.072Z","updated":"2026-05-11T19:23:27.715Z","title":"mailbox: zynq-ipi: fix error handling while device_register() fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2022-50671","published":"2025-12-09T01:29:22.950Z","updated":"2026-10-15T21:41:22.558Z","title":"RDMA/rxe: Fix \"kernel NULL pointer dereference\" error","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00954,"kevAdded":null},{"id":"CVE-2022-50670","published":"2025-12-09T01:29:21.864Z","updated":"2026-05-11T19:23:21.367Z","title":"mmc: omap_hsmmc: fix return value check of mmc_add_host()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2022-50669","published":"2025-12-09T01:29:20.745Z","updated":"2026-05-11T19:23:20.227Z","title":"misc: ocxl: fix possible name leak in ocxl_file_register_afu()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2022-50668","published":"2025-12-09T01:29:19.526Z","updated":"2026-08-05T08:59:19.230Z","title":"ext4: fix deadlock due to mbcache entry corruption","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00808,"kevAdded":null},{"id":"CVE-2022-50667","published":"2025-12-09T01:29:17.925Z","updated":"2026-05-11T19:23:17.946Z","title":"drm/vmwgfx: Fix memory leak in vmw_mksstat_add_ioctl()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2022-50666","published":"2025-12-09T01:29:16.813Z","updated":"2026-10-15T21:41:22.420Z","title":"RDMA/siw: Fix QP destroy to wait for all references dropped.","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00733,"kevAdded":null},{"id":"CVE-2022-50665","published":"2025-12-09T01:29:15.255Z","updated":"2026-10-15T21:41:22.267Z","title":"wifi: ath11k: fix failed to find the peer with peer_id 0 when disconnected","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00326,"kevAdded":null},{"id":"CVE-2022-50664","published":"2025-12-09T01:29:13.652Z","updated":"2026-05-11T19:23:14.488Z","title":"media: dvb-frontends: fix leak of memory fw","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2022-50663","published":"2025-12-09T01:29:12.392Z","updated":"2026-05-11T19:23:13.338Z","title":"net: stmmac: fix possible memory leak in stmmac_dvr_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2022-50662","published":"2025-12-09T01:29:10.614Z","updated":"2026-05-11T19:23:12.225Z","title":"RDMA/hns: fix memory leak in hns_roce_alloc_mr()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2022-50661","published":"2025-12-09T01:29:09.498Z","updated":"2026-05-11T19:23:11.092Z","title":"seccomp: Move copy_seccomp() to no failure path.","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2022-50660","published":"2025-12-09T01:29:08.387Z","updated":"2026-05-11T19:23:09.957Z","title":"wifi: ipw2200: fix memory leak in ipw_wdev_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2022-50659","published":"2025-12-09T01:29:07.236Z","updated":"2026-05-11T19:23:08.807Z","title":"hwrng: geode - Fix PCI device refcount leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2022-50658","published":"2025-12-09T01:29:06.106Z","updated":"2026-05-11T19:23:07.654Z","title":"cpufreq: qcom: fix memory leak in error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2022-50657","published":"2025-12-09T01:29:04.968Z","updated":"2026-05-11T19:23:06.462Z","title":"riscv: mm: add missing memcpy in kasan_init","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2023-53820","published":"2025-12-09T01:24:29.417Z","updated":"2026-05-23T15:31:11.178Z","title":"loop: loop_set_status_from_info() check before assignment","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2023-53819","published":"2025-12-09T00:01:17.936Z","updated":"2026-08-05T09:16:12.588Z","title":"amdgpu: validate offset_in_bo of drm_amdgpu_gem_va","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2023-53818","published":"2025-12-09T00:01:16.630Z","updated":"2026-05-11T19:52:07.693Z","title":"ARM: zynq: Fix refcount leak in zynq_early_slcr_init","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2023-53817","published":"2025-12-09T00:01:15.411Z","updated":"2026-08-05T09:16:11.527Z","title":"crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00508,"kevAdded":null},{"id":"CVE-2023-53816","published":"2025-12-09T00:01:14.166Z","updated":"2026-10-15T21:41:36.576Z","title":"drm/amdkfd: fix potential kgd_mem UAFs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2023-53815","published":"2025-12-09T00:01:12.832Z","updated":"2026-05-11T19:52:03.416Z","title":"posix-timers: Prevent RT livelock in itimer_delete()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2023-53814","published":"2025-12-09T00:01:11.827Z","updated":"2026-05-11T19:52:01.494Z","title":"PCI: Fix dropping valid root bus resources with .end = zero","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2023-53813","published":"2025-12-09T00:01:10.886Z","updated":"2026-05-11T19:52:00.335Z","title":"ext4: fix rbtree traversal bug in ext4_mb_use_preallocated","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2023-53812","published":"2025-12-09T00:01:09.906Z","updated":"2026-05-11T19:51:59.231Z","title":"media: mediatek: vcodec: fix decoder disable pm crash","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2023-53811","published":"2025-12-09T00:01:09.005Z","updated":"2026-05-11T19:51:58.073Z","title":"RDMA/irdma: Cap MSIX used to online CPUs + 1","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2023-53810","published":"2025-12-09T00:01:08.062Z","updated":"2026-08-05T09:16:09.388Z","title":"blk-mq: release crypto keyslot before reporting I/O complete","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2023-53809","published":"2025-12-09T00:01:07.120Z","updated":"2026-05-23T15:31:07.089Z","title":"l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2023-53808","published":"2025-12-09T00:01:06.210Z","updated":"2026-05-11T19:51:54.609Z","title":"wifi: mwifiex: fix memory leak in mwifiex_histogram_read()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2023-53807","published":"2025-12-09T00:01:05.301Z","updated":"2026-05-11T19:51:53.450Z","title":"clk: clocking-wizard: Fix Oops in clk_wzrd_register_divider()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2023-53806","published":"2025-12-09T00:01:04.413Z","updated":"2026-08-05T09:16:08.328Z","title":"drm/amd/display: populate subvp cmd info only for the top pipe","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2023-53804","published":"2025-12-09T00:01:01.787Z","updated":"2026-08-05T09:16:07.269Z","title":"nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2023-53803","published":"2025-12-09T00:00:59.913Z","updated":"2026-10-15T21:41:36.435Z","title":"scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2023-53802","published":"2025-12-09T00:00:58.582Z","updated":"2026-05-11T19:51:48.668Z","title":"wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2023-53801","published":"2025-12-09T00:00:57.388Z","updated":"2026-05-11T19:51:47.481Z","title":"iommu/sprd: Release dma buffer to avoid memory leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2023-53800","published":"2025-12-09T00:00:56.507Z","updated":"2026-10-15T21:41:36.295Z","title":"ubi: Fix use-after-free when volume resizing failed","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2023-53799","published":"2025-12-09T00:00:55.629Z","updated":"2026-05-11T19:51:45.162Z","title":"crypto: api - Use work queue in crypto_destroy_instance","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-53798","published":"2025-12-09T00:00:54.769Z","updated":"2026-05-11T19:51:43.856Z","title":"ethtool: Fix uninitialized number of lanes","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2023-53797","published":"2025-12-09T00:00:53.868Z","updated":"2026-08-05T09:16:04.053Z","title":"HID: wacom: Use ktime_t rather than int when dealing with timestamps","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2023-53796","published":"2025-12-09T00:00:52.919Z","updated":"2026-05-11T19:51:41.550Z","title":"f2fs: fix information leak in f2fs_move_inline_dirents()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2023-53795","published":"2025-12-09T00:00:51.992Z","updated":"2026-08-05T09:16:02.978Z","title":"iommufd: IOMMUFD_DESTROY should not increase the refcount","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2023-53794","published":"2025-12-09T00:00:51.061Z","updated":"2026-10-15T21:41:36.158Z","title":"cifs: fix session state check in reconnect to avoid use-after-free issue","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2023-53793","published":"2025-12-09T00:00:50.132Z","updated":"2026-05-11T19:51:38.130Z","title":"perf tool x86: Fix perf_env memory leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-53792","published":"2025-12-09T00:00:49.221Z","updated":"2026-05-11T19:51:37.011Z","title":"nvme-core: fix memory leak in dhchap_ctrl_secret","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-53791","published":"2025-12-09T00:00:48.301Z","updated":"2026-05-11T19:51:35.874Z","title":"md: fix warning for holder mismatch from export_rdev()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2023-53790","published":"2025-12-09T00:00:47.025Z","updated":"2026-10-15T21:41:36.027Z","title":"bpf: Zeroing allocated object from slab in bpf memory allocator","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2023-53789","published":"2025-12-09T00:00:45.461Z","updated":"2026-05-11T19:51:33.622Z","title":"iommu/amd: Improve page fault error reporting","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2023-53788","published":"2025-12-09T00:00:43.777Z","updated":"2026-05-11T19:51:32.435Z","title":"ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2023-53787","published":"2025-12-09T00:00:42.334Z","updated":"2026-05-11T19:51:31.286Z","title":"regulator: da9063: fix null pointer deref with partial DT config","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2023-53786","published":"2025-12-09T00:00:41.426Z","updated":"2026-05-11T19:51:30.126Z","title":"dm flakey: fix a crash with invalid table line","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2023-53785","published":"2025-12-09T00:00:40.505Z","updated":"2026-10-15T21:41:35.893Z","title":"mt76: mt7921: don't assume adequate headroom for SDIO headers","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2023-53784","published":"2025-12-09T00:00:39.591Z","updated":"2026-05-11T19:51:27.807Z","title":"drm: bridge: dw_hdmi: fix connector access for scdc","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2023-53783","published":"2025-12-09T00:00:38.679Z","updated":"2026-05-11T19:51:26.633Z","title":"blk-iocost: fix divide by 0 error in calc_lcoefs()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-53782","published":"2025-12-09T00:00:37.741Z","updated":"2026-05-23T15:30:57.721Z","title":"dccp: Fix out of bounds access in DCCP error handler","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2023-53781","published":"2025-12-09T00:00:36.831Z","updated":"2026-10-30T12:17:35.780Z","title":"smc: Fix use-after-free in tcp_write_timer_handler().","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2023-53780","published":"2025-12-09T00:00:35.925Z","updated":"2026-05-11T19:51:23.114Z","title":"drm/amd/display: fix FCLK pstate change underflow","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2023-53778","published":"2025-12-09T00:00:34.074Z","updated":"2026-08-05T09:15:57.518Z","title":"accel/qaic: Clean up integer overflow checking in map_user_pages()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2023-53777","published":"2025-12-09T00:00:32.947Z","updated":"2026-05-11T19:51:20.826Z","title":"erofs: kill hooked chains to avoid loops on deduplicated compressed images","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2022-50656","published":"2025-12-09T00:00:31.691Z","updated":"2026-08-05T08:59:15.998Z","title":"nfc: pn533: Clear nfc_target before being used","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2022-50655","published":"2025-12-09T00:00:30.337Z","updated":"2026-05-11T19:23:03.144Z","title":"ppp: associate skb with a device at tx","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2022-50654","published":"2025-12-09T00:00:28.878Z","updated":"2026-05-11T19:23:01.672Z","title":"bpf: Fix panic due to wrong pageattr of im->image","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2022-50653","published":"2025-12-09T00:00:27.592Z","updated":"2026-05-11T19:23:00.471Z","title":"mmc: atmel-mci: fix return value check of mmc_add_host()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2022-50652","published":"2025-12-09T00:00:26.593Z","updated":"2026-05-23T15:24:49.933Z","title":"uio: uio_dmem_genirq: Fix missing unlock in irq configuration","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2022-50651","published":"2025-12-09T00:00:25.571Z","updated":"2026-05-11T19:22:58.144Z","title":"ethtool: eeprom: fix null-deref on genl_info in dump","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2022-50650","published":"2025-12-09T00:00:24.598Z","updated":"2026-10-15T21:41:22.127Z","title":"bpf: Fix reference state management for synchronous callbacks","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2022-50649","published":"2025-12-09T00:00:23.331Z","updated":"2026-05-11T19:22:55.869Z","title":"power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2022-50648","published":"2025-12-09T00:00:22.410Z","updated":"2026-05-11T19:22:54.742Z","title":"ftrace: Fix recursive locking direct_mutex in ftrace_modify_direct_caller","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2022-50647","published":"2025-12-09T00:00:21.501Z","updated":"2026-05-11T19:22:53.598Z","title":"RISC-V: Make port I/O string accessors actually work","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2022-50646","published":"2025-12-09T00:00:20.596Z","updated":"2026-05-23T15:24:48.629Z","title":"scsi: hpsa: Fix possible memory leak in hpsa_init_one()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2022-50645","published":"2025-12-09T00:00:19.652Z","updated":"2026-05-11T19:22:51.285Z","title":"EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2022-50644","published":"2025-12-09T00:00:18.729Z","updated":"2026-05-11T19:22:50.135Z","title":"clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2022-50643","published":"2025-12-09T00:00:17.684Z","updated":"2026-05-11T19:22:48.995Z","title":"cifs: Fix xid leak in cifs_copy_file_range()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2022-50642","published":"2025-12-09T00:00:16.490Z","updated":"2026-05-11T19:22:47.744Z","title":"platform/chrome: cros_ec_typec: zero out stale pointers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2022-50641","published":"2025-12-09T00:00:15.268Z","updated":"2026-05-11T19:22:46.571Z","title":"HSI: omap_ssi: Fix refcount leak in ssi_probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2022-50640","published":"2025-12-09T00:00:13.871Z","updated":"2026-05-11T19:22:45.426Z","title":"mmc: core: Fix kernel panic when remove non-standard SDIO card","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2022-50639","published":"2025-12-09T00:00:12.576Z","updated":"2026-05-11T19:22:44.249Z","title":"io-wq: Fix memory leak in worker creation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2022-50638","published":"2025-12-09T00:00:11.665Z","updated":"2026-05-11T19:22:43.123Z","title":"ext4: fix bug_on in __es_tree_search caused by bad boot loader inode","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2022-50637","published":"2025-12-09T00:00:10.726Z","updated":"2026-05-11T19:22:41.977Z","title":"cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2022-50636","published":"2025-12-09T00:00:09.737Z","updated":"2026-05-11T19:22:40.799Z","title":"PCI: Fix pci_device_is_present() for VFs by checking PF","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2022-50635","published":"2025-12-09T00:00:08.590Z","updated":"2026-05-11T19:22:39.662Z","title":"powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2022-50634","published":"2025-12-09T00:00:06.318Z","updated":"2026-05-11T19:22:38.474Z","title":"power: supply: cw2015: Fix potential null-ptr-deref in cw_bat_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2022-50633","published":"2025-12-09T00:00:00.771Z","updated":"2026-05-11T19:22:37.333Z","title":"usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2022-50632","published":"2025-12-08T23:59:58.587Z","updated":"2026-05-11T19:22:36.189Z","title":"drivers: perf: marvell_cn10k: Fix hotplug callback leak in tad_pmu_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2022-50631","published":"2025-12-08T23:59:57.228Z","updated":"2026-05-11T19:22:35.051Z","title":"RISC-V: kexec: Fix memory leak of fdt buffer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2023-53769","published":"2025-12-08T01:19:32.417Z","updated":"2026-08-05T09:15:56.461Z","title":"virt/coco/sev-guest: Double-buffer messages","severity":"CRITICAL","score":9.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00101,"kevAdded":null},{"id":"CVE-2023-53768","published":"2025-12-08T01:19:31.353Z","updated":"2026-08-05T09:15:55.388Z","title":"regmap-irq: Fix out-of-bounds access when allocating config buffers","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2023-53767","published":"2025-12-08T01:19:30.211Z","updated":"2026-05-11T19:51:17.323Z","title":"wifi: ath12k: fix memory leak in ath12k_qmi_driver_event_work()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2023-53766","published":"2025-12-08T01:19:28.976Z","updated":"2026-05-11T19:51:16.196Z","title":"FS: JFS: Check for read-only mounted filesystem in txBegin","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2023-53765","published":"2025-12-08T01:19:27.831Z","updated":"2026-05-11T19:51:15.067Z","title":"dm cache: free background tracker's queued work in btracker_destroy","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2023-53764","published":"2025-12-08T01:19:26.619Z","updated":"2026-10-15T21:41:35.505Z","title":"wifi: ath12k: Handle lock during peer_id find","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2023-53763","published":"2025-12-08T01:19:25.250Z","updated":"2026-08-05T09:15:53.254Z","title":"Revert \"f2fs: fix to do sanity check on extent cache correctly\"","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2023-53762","published":"2025-12-08T01:19:23.927Z","updated":"2026-10-03T10:55:01.032Z","title":"Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2023-53761","published":"2025-12-08T01:19:22.571Z","updated":"2026-05-11T19:51:10.341Z","title":"USB: usbtmc: Fix direction for 0-length ioctl control messages","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2023-53760","published":"2025-12-08T01:19:21.489Z","updated":"2026-05-11T19:51:09.191Z","title":"scsi: ufs: core: mcq: Fix &hwq->cq_lock deadlock issue","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2023-53759","published":"2025-12-08T01:19:20.432Z","updated":"2026-08-05T09:15:51.129Z","title":"HID: hidraw: fix data race on device refcount","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2023-53758","published":"2025-12-08T01:19:19.290Z","updated":"2026-05-11T19:51:06.844Z","title":"spi: atmel-quadspi: Free resources even if runtime resume failed in .remove()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2023-53757","published":"2025-12-08T01:19:18.181Z","updated":"2026-05-11T19:51:05.668Z","title":"irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2023-53756","published":"2025-12-08T01:19:17.081Z","updated":"2026-05-11T19:51:04.572Z","title":"KVM: VMX: Fix crash due to uninitialized current_vmcs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2023-53755","published":"2025-12-08T01:19:15.999Z","updated":"2026-05-11T19:51:03.420Z","title":"dmaengine: ptdma: check for null desc before calling pt_cmd_callback","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2023-53754","published":"2025-12-08T01:19:14.821Z","updated":"2026-05-11T19:51:02.258Z","title":"scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2023-53753","published":"2025-12-08T01:19:13.743Z","updated":"2026-10-15T21:41:35.356Z","title":"drm/amd/display: fix mapping to non-allocated address","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2023-53752","published":"2025-12-08T01:19:12.407Z","updated":"2026-08-05T09:15:48.993Z","title":"net: deal with integer overflows in kmalloc_reserve()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2023-53751","published":"2025-12-08T01:19:11.160Z","updated":"2026-08-05T09:15:47.928Z","title":"cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00415,"kevAdded":null},{"id":"CVE-2023-53750","published":"2025-12-08T01:19:09.919Z","updated":"2026-10-30T12:17:34.721Z","title":"pinctrl: freescale: Fix a memory out of bounds when num_configs is 1","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2023-53748","published":"2025-12-08T01:19:07.318Z","updated":"2026-08-05T09:15:46.862Z","title":"media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2023-53747","published":"2025-12-08T01:19:06.255Z","updated":"2026-10-15T21:41:35.219Z","title":"vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2023-53746","published":"2025-12-08T01:19:05.204Z","updated":"2026-05-11T19:50:54.095Z","title":"s390/vfio-ap: fix memory leak in vfio_ap device driver","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2023-53745","published":"2025-12-08T01:19:04.133Z","updated":"2026-05-11T19:50:52.985Z","title":"um: vector: Fix memory leak in vector_config","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-53744","published":"2025-12-08T01:19:02.965Z","updated":"2026-05-11T19:50:51.810Z","title":"soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-53743","published":"2025-12-08T01:19:01.868Z","updated":"2026-05-23T15:30:42.192Z","title":"PCI: Free released resource after coalescing","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-53742","published":"2025-12-08T01:19:00.778Z","updated":"2026-05-11T19:50:49.521Z","title":"kcsan: Avoid READ_ONCE() in read_instrumented_memory()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2022-50630","published":"2025-12-08T01:16:45.555Z","updated":"2026-10-15T21:41:21.996Z","title":"mm: hugetlb: fix UAF in hugetlb_handle_userfault","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2022-50629","published":"2025-12-08T01:16:44.466Z","updated":"2026-05-11T19:22:32.739Z","title":"wifi: rsi: Fix memory leak in rsi_coex_attach()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2022-50628","published":"2025-12-08T01:16:43.390Z","updated":"2026-05-11T19:22:31.598Z","title":"drm/gud: Fix UBSAN warning","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2022-50627","published":"2025-12-08T01:16:42.095Z","updated":"2026-08-15T12:23:38.456Z","title":"wifi: ath11k: fix monitor mode bringup crash","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2022-50626","published":"2025-12-08T01:16:40.754Z","updated":"2026-05-11T19:22:29.322Z","title":"media: dvb-usb: fix memory leak in dvb_usb_adapter_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2022-50625","published":"2025-12-08T01:16:39.642Z","updated":"2026-05-11T19:22:28.054Z","title":"serial: amba-pl011: avoid SBSA UART accessing DMACR register","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2022-50624","published":"2025-12-08T01:16:38.357Z","updated":"2026-05-11T19:22:26.874Z","title":"net: netsec: fix error handling in netsec_register_mdio()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2022-50623","published":"2025-12-08T01:16:37.086Z","updated":"2026-08-05T08:59:12.762Z","title":"fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2022-50622","published":"2025-12-08T01:16:35.924Z","updated":"2026-05-11T19:22:24.472Z","title":"ext4: fix potential memory leak in ext4_fc_record_modified_inode()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2022-50621","published":"2025-12-08T01:16:34.861Z","updated":"2026-05-11T19:22:23.322Z","title":"dm: verity-loadpin: Only trust verity targets with enforcement","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2022-50620","published":"2025-12-08T01:16:33.771Z","updated":"2026-05-11T19:22:22.059Z","title":"f2fs: fix to invalidate dcc->f2fs_issue_discard in error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2022-50619","published":"2025-12-08T01:16:32.726Z","updated":"2026-05-11T19:22:20.912Z","title":"drm/amdkfd: Fix memory leak in kfd_mem_dmamap_userptr()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2022-50618","published":"2025-12-08T01:16:31.649Z","updated":"2026-05-11T19:22:19.752Z","title":"mmc: meson-gx: fix return value check of mmc_add_host()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2022-50617","published":"2025-12-08T01:16:30.544Z","updated":"2026-05-11T19:22:18.587Z","title":"drm/amdgpu/powerplay/psm: Fix memory leak in power state init","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2022-50616","published":"2025-12-08T01:16:29.407Z","updated":"2026-05-11T19:22:17.348Z","title":"regulator: core: Use different devices for resource allocation and DT lookup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2022-50615","published":"2025-12-08T01:16:28.314Z","updated":"2026-05-11T19:22:16.225Z","title":"perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2022-50614","published":"2025-12-08T01:16:26.689Z","updated":"2026-05-11T19:22:15.058Z","title":"misc: pci_endpoint_test: Fix pci_endpoint_test_{copy,write,read}() panic","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2022-50583","published":"2025-12-08T01:12:18.853Z","updated":"2026-05-11T19:22:13.874Z","title":"md/raid0, raid10: Don't set discard sectors for request queue","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-40326","published":"2025-12-08T00:46:53.212Z","updated":"2026-08-05T12:09:38.372Z","title":"NFSD: Define actions for the new time_deleg FATTR4 attributes","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0035,"kevAdded":null},{"id":"CVE-2025-40324","published":"2025-12-08T00:46:51.912Z","updated":"2026-10-15T22:02:45.921Z","title":"NFSD: Fix crash in nfsd4_read_release()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2025-40323","published":"2025-12-08T00:46:50.833Z","updated":"2026-10-15T22:02:45.798Z","title":"fbcon: Set fb_display[i]->mode to NULL when the mode is released","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2025-40322","published":"2025-12-08T00:46:49.773Z","updated":"2026-08-05T12:09:35.122Z","title":"fbdev: bitblit: bound-check glyph index in bit_putcs*","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2025-40321","published":"2025-12-08T00:46:48.724Z","updated":"2026-05-11T21:47:06.255Z","title":"wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2025-40320","published":"2025-12-08T00:46:47.670Z","updated":"2026-10-15T22:02:44.061Z","title":"smb: client: fix potential cfid UAF in smb2_query_info_compound","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00418,"kevAdded":null},{"id":"CVE-2025-40319","published":"2025-12-08T00:46:46.448Z","updated":"2026-10-15T22:02:43.846Z","title":"bpf: Sync pending IRQ work before freeing ring buffer","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-40318","published":"2025-12-08T00:46:45.382Z","updated":"2026-10-15T22:02:43.644Z","title":"Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2025-40317","published":"2025-12-08T00:46:44.287Z","updated":"2026-08-05T12:09:27.968Z","title":"regmap: slimbus: fix bus_context pointer in regmap init calls","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-40316","published":"2025-12-08T00:46:43.210Z","updated":"2026-05-23T16:02:05.577Z","title":"drm/mediatek: Fix device use-after-free on unbind","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2025-40315","published":"2025-12-08T00:46:41.896Z","updated":"2026-05-23T16:02:03.665Z","title":"usb: gadget: f_fs: Fix epfile null pointer access after ep enable.","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2025-40314","published":"2025-12-08T00:46:40.576Z","updated":"2026-05-11T21:46:57.519Z","title":"usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2025-40313","published":"2025-12-08T00:46:39.444Z","updated":"2026-05-11T21:46:56.353Z","title":"ntfs3: pretend $Extend records as regular files","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2025-40312","published":"2025-12-08T00:46:38.147Z","updated":"2026-05-11T21:46:55.193Z","title":"jfs: Verify inode mode when loading from disk","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-40311","published":"2025-12-08T00:46:36.903Z","updated":"2026-10-30T12:22:59.945Z","title":"accel/habanalabs: support mapping cb with vmalloc-backed coherent memory","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2025-40310","published":"2025-12-08T00:46:35.862Z","updated":"2026-05-11T21:46:52.918Z","title":"amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2025-40309","published":"2025-12-08T00:46:34.785Z","updated":"2026-10-15T22:02:43.510Z","title":"Bluetooth: SCO: Fix UAF on sco_conn_free","severity":"HIGH","score":8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2025-40308","published":"2025-12-08T00:46:33.729Z","updated":"2026-05-23T16:02:02.594Z","title":"Bluetooth: bcsp: receive data only if registered","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2025-40307","published":"2025-12-08T00:46:32.659Z","updated":"2026-10-15T22:02:43.363Z","title":"exfat: validate cluster allocation bits of the allocation bitmap","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2025-40306","published":"2025-12-08T00:46:31.514Z","updated":"2026-08-05T12:09:24.767Z","title":"orangefs: fix xattr related buffer overflow...","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2025-40305","published":"2025-12-08T00:46:30.327Z","updated":"2026-05-11T21:46:46.952Z","title":"9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2025-40304","published":"2025-12-08T00:46:29.013Z","updated":"2026-08-05T12:09:23.704Z","title":"fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-40303","published":"2025-12-08T00:46:27.820Z","updated":"2026-08-05T12:09:22.649Z","title":"btrfs: ensure no dirty metadata is written back for an fs with errors","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2025-40302","published":"2025-12-08T00:46:26.293Z","updated":"2026-10-15T22:02:43.093Z","title":"media: videobuf2: forbid remove_bufs when legacy fileio is active","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2025-40301","published":"2025-12-08T00:46:24.863Z","updated":"2026-08-05T12:09:20.526Z","title":"Bluetooth: hci_event: validate skb length for unknown CC opcode","severity":"HIGH","score":7.6,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2025-40299","published":"2025-12-08T00:46:23.626Z","updated":"2026-05-11T21:46:39.974Z","title":"gve: Implement gettimex64 with -EOPNOTSUPP","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-40298","published":"2025-12-08T00:46:22.241Z","updated":"2026-05-11T21:46:38.807Z","title":"gve: Implement settime64 with -EOPNOTSUPP","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-40297","published":"2025-12-08T00:46:21.112Z","updated":"2026-10-15T22:02:42.947Z","title":"net: bridge: fix use-after-free due to MST port state bypass","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2025-40296","published":"2025-12-08T00:46:20.017Z","updated":"2026-05-11T21:46:36.351Z","title":"platform/x86: int3472: Fix double free of GPIO device during unregister","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-40295","published":"2025-12-08T00:46:18.950Z","updated":"2026-05-11T21:46:35.245Z","title":"fscrypt: fix left shift underflow when inode->i_blkbits > PAGE_SHIFT","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-40294","published":"2025-12-08T00:46:17.899Z","updated":"2026-06-16T19:53:41.561Z","title":"Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2025-40293","published":"2025-12-08T00:46:16.850Z","updated":"2026-05-11T21:46:32.879Z","title":"iommufd: Don't overflow during division for dirty tracking","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2025-40292","published":"2025-12-08T00:46:15.761Z","updated":"2026-10-15T22:02:42.769Z","title":"virtio-net: fix received length check in big packets","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2025-40291","published":"2025-12-08T00:46:14.601Z","updated":"2026-08-05T12:09:17.336Z","title":"io_uring: fix regbuf vector size truncation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-40290","published":"2025-12-08T00:09:08.370Z","updated":"2026-08-05T12:09:16.273Z","title":"xsk: avoid data corruption on cq descriptor number","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-40289","published":"2025-12-06T21:51:15.555Z","updated":"2026-10-30T12:22:58.881Z","title":"drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-40288","published":"2025-12-06T21:51:14.440Z","updated":"2026-05-11T21:46:27.181Z","title":"drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2025-40287","published":"2025-12-06T21:51:13.328Z","updated":"2026-05-11T21:46:25.955Z","title":"exfat: fix improper check of dentry.stream.valid_size","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-40286","published":"2025-12-06T21:51:12.169Z","updated":"2026-05-11T21:46:24.832Z","title":"smb/server: fix possible memory leak in smb2_read()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2025-40285","published":"2025-12-06T21:51:09.590Z","updated":"2026-08-05T12:09:15.214Z","title":"smb/server: fix possible refcount leak in smb2_sess_setup()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00411,"kevAdded":null},{"id":"CVE-2025-40284","published":"2025-12-06T21:51:08.488Z","updated":"2026-10-15T22:02:42.643Z","title":"Bluetooth: MGMT: cancel mesh send timer when hdev removed","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2025-40283","published":"2025-12-06T21:51:07.409Z","updated":"2026-10-15T22:02:42.513Z","title":"Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-40282","published":"2025-12-06T21:51:06.287Z","updated":"2026-08-05T12:09:12.019Z","title":"Bluetooth: 6lowpan: reset link-local header on ipv6 recv path","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2025-40281","published":"2025-12-06T21:51:05.208Z","updated":"2026-06-16T19:35:40.210Z","title":"sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-40280","published":"2025-12-06T21:51:04.091Z","updated":"2026-08-05T12:09:10.959Z","title":"tipc: Fix use-after-free in tipc_mon_reinit_self().","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2025-40279","published":"2025-12-06T21:51:03.010Z","updated":"2026-05-11T21:46:16.602Z","title":"net: sched: act_connmark: initialize struct tc_ife to fix kernel leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-40278","published":"2025-12-06T21:51:01.693Z","updated":"2026-06-02T13:00:18.583Z","title":"net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-40277","published":"2025-12-06T21:51:00.437Z","updated":"2026-08-05T12:09:09.886Z","title":"drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2025-40276","published":"2025-12-06T21:50:59.035Z","updated":"2026-08-05T12:09:08.824Z","title":"drm/panthor: Flush shmem writes before mapping buffers CPU-uncached","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2025-40275","published":"2025-12-06T21:50:57.914Z","updated":"2026-05-11T21:46:11.980Z","title":"ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2025-40274","published":"2025-12-06T21:50:56.832Z","updated":"2026-08-05T12:09:07.765Z","title":"KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2025-40273","published":"2025-12-06T21:50:55.723Z","updated":"2026-10-15T22:02:42.375Z","title":"NFSD: free copynotify stateid in nfs4_free_ol_stateid()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00425,"kevAdded":null},{"id":"CVE-2025-40272","published":"2025-12-06T21:50:54.629Z","updated":"2026-10-15T22:02:42.233Z","title":"mm/secretmem: fix use-after-free race in fault handler","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-40271","published":"2025-12-06T21:50:53.266Z","updated":"2026-08-05T12:09:04.518Z","title":"fs/proc: fix uaf in proc_readdir_de()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2025-40270","published":"2025-12-06T21:50:51.639Z","updated":"2026-08-05T12:09:03.442Z","title":"mm, swap: fix potential UAF issue for VMA readahead","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2025-40269","published":"2025-12-06T21:50:50.229Z","updated":"2026-08-05T12:09:02.371Z","title":"ALSA: usb-audio: Fix potential overflow of PCM transfer buffer","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2025-40268","published":"2025-12-06T21:50:48.917Z","updated":"2026-10-30T12:22:57.829Z","title":"cifs: client: fix memory leak in smb3_fs_context_parse_param","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2025-40267","published":"2025-12-06T21:50:47.614Z","updated":"2026-05-11T21:46:02.164Z","title":"io_uring/rw: ensure allocated iovec gets cleared for early failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2025-40266","published":"2025-12-04T16:08:25.392Z","updated":"2026-08-05T12:09:01.305Z","title":"KVM: arm64: Check the untrusted offset in FF-A memory share","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2025-40265","published":"2025-12-04T16:08:24.708Z","updated":"2026-05-11T21:45:59.821Z","title":"vfat: fix missing sb_min_blocksize() return value checks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2025-40264","published":"2025-12-04T16:08:24.028Z","updated":"2026-06-02T13:00:16.227Z","title":"be2net: pass wrb_params in case of OS2BMC","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-40263","published":"2025-12-04T16:08:23.327Z","updated":"2026-06-02T13:00:15.067Z","title":"Input: cros_ec_keyb - fix an invalid memory access","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-40262","published":"2025-12-04T16:08:22.043Z","updated":"2026-08-05T12:09:00.219Z","title":"Input: imx_sc_key - fix memory corruption on unload","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-40261","published":"2025-12-04T16:08:21.345Z","updated":"2026-10-15T22:02:42.080Z","title":"nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2025-40260","published":"2025-12-04T16:08:20.590Z","updated":"2026-05-11T21:45:53.934Z","title":"sched_ext: Fix scx_enable() crash on helper kthread creation failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2025-40259","published":"2025-12-04T16:08:19.904Z","updated":"2026-06-16T19:53:02.820Z","title":"scsi: sg: Do not sleep in atomic context","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2025-40258","published":"2025-12-04T16:08:19.176Z","updated":"2026-08-05T12:08:58.094Z","title":"mptcp: fix race condition in mptcp_schedule_work()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00464,"kevAdded":null},{"id":"CVE-2025-40257","published":"2025-12-04T16:08:18.433Z","updated":"2026-08-05T12:08:57.025Z","title":"mptcp: fix a race in mptcp_pm_del_add_timer()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00464,"kevAdded":null},{"id":"CVE-2025-40256","published":"2025-12-04T16:08:17.756Z","updated":"2026-05-11T21:45:48.998Z","title":"xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-40255","published":"2025-12-04T16:08:17.023Z","updated":"2026-05-11T21:45:47.848Z","title":"net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2025-40254","published":"2025-12-04T16:08:16.305Z","updated":"2026-06-16T19:43:48.728Z","title":"net: openvswitch: remove never-working support for setting nsh fields","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2025-40253","published":"2025-12-04T16:08:15.340Z","updated":"2026-10-15T22:02:41.932Z","title":"s390/ctcm: Fix double-kfree","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2025-40252","published":"2025-12-04T16:08:14.393Z","updated":"2026-10-15T22:02:41.799Z","title":"net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00602,"kevAdded":null},{"id":"CVE-2025-40251","published":"2025-12-04T16:08:13.710Z","updated":"2026-08-05T12:08:53.761Z","title":"devlink: rate: Unset parent pointer in devl_rate_nodes_destroy","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2025-40250","published":"2025-12-04T16:08:12.984Z","updated":"2026-10-15T22:02:41.655Z","title":"net/mlx5: Clean up only new IRQ glue on request_irq() failure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2025-40249","published":"2025-12-04T16:08:12.206Z","updated":"2026-08-05T12:08:51.621Z","title":"gpio: cdev: make sure the cdev fd is still active before emitting events","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-40248","published":"2025-12-04T16:08:11.509Z","updated":"2026-08-05T12:08:50.554Z","title":"vsock: Ignore signal/timeout on connect() if already established","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2025-40247","published":"2025-12-04T16:08:10.696Z","updated":"2026-05-11T21:45:38.393Z","title":"drm/msm: Fix pgtable prealloc error path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-40246","published":"2025-12-04T16:08:09.751Z","updated":"2026-05-11T21:45:37.260Z","title":"xfs: fix out of bounds memory read error in symlink repair","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-40245","published":"2025-12-04T15:31:34.142Z","updated":"2026-08-05T12:08:49.485Z","title":"nios2: ensure that memblock.current_limit is set when setting pfn limits","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2025-40244","published":"2025-12-04T15:31:33.249Z","updated":"2026-08-05T12:08:48.412Z","title":"hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2025-40243","published":"2025-12-04T15:31:32.422Z","updated":"2026-08-05T12:08:47.346Z","title":"hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2025-40242","published":"2025-12-04T15:31:31.497Z","updated":"2026-10-15T22:02:41.268Z","title":"gfs2: Fix unlikely race in gdlm_put_lock","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2025-40241","published":"2025-12-04T15:31:30.594Z","updated":"2026-08-05T12:08:45.194Z","title":"erofs: fix crafted invalid cases for encoded extents","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2025-40240","published":"2025-12-04T15:31:29.715Z","updated":"2026-08-05T12:08:44.117Z","title":"sctp: avoid NULL dereference when chunk data buffer is missing","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.006,"kevAdded":null},{"id":"CVE-2025-40239","published":"2025-12-04T15:31:28.941Z","updated":"2026-05-11T21:45:29.000Z","title":"net: phy: micrel: always set shared->phydev for LAN8814","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-40238","published":"2025-12-04T15:31:28.243Z","updated":"2026-05-11T21:45:27.819Z","title":"net/mlx5: Fix IPsec cleanup over MPV device","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-40237","published":"2025-12-04T15:31:27.325Z","updated":"2026-05-23T16:01:45.934Z","title":"fs/notify: call exportfs_encode_fid with s_umount","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2025-40236","published":"2025-12-04T15:31:26.497Z","updated":"2026-05-11T21:45:25.578Z","title":"virtio-net: zero unused hash fields","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-40235","published":"2025-12-04T15:31:25.785Z","updated":"2026-05-11T21:45:24.427Z","title":"btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-40234","published":"2025-12-04T15:31:24.871Z","updated":"2026-05-11T21:45:23.282Z","title":"platform/x86: alienware-wmi-wmax: Fix NULL pointer dereference in sleep handlers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-40233","published":"2025-12-04T15:31:23.891Z","updated":"2026-08-05T12:08:43.055Z","title":"ocfs2: clear extent cache after moving/defragmenting extents","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2025-40232","published":"2025-12-04T15:31:23.026Z","updated":"2026-05-11T21:45:20.975Z","title":"rv: Fully convert enabled_monitors to use list_head as iterator","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-40231","published":"2025-12-04T15:31:22.199Z","updated":"2026-05-23T16:01:44.908Z","title":"vsock: fix lock inversion in vsock_assign_transport()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2025-40230","published":"2025-12-04T15:31:21.369Z","updated":"2026-05-11T21:45:18.631Z","title":"mm: prevent poison consumption when splitting THP","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-40229","published":"2025-12-04T15:31:20.548Z","updated":"2026-05-11T21:45:17.498Z","title":"mm/damon/core: fix potential memory leak by cleaning ops_filter in damon_destroy_scheme","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-40228","published":"2025-12-04T15:31:19.668Z","updated":"2026-05-11T21:45:16.363Z","title":"mm/damon/sysfs: catch commit test ctx alloc failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-40227","published":"2025-12-04T15:31:18.839Z","updated":"2026-05-11T21:45:15.231Z","title":"mm/damon/sysfs: dealloc commit test ctx always","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-40226","published":"2025-12-04T15:31:17.994Z","updated":"2026-05-23T16:01:43.841Z","title":"firmware: arm_scmi: Account for failed debug initialization","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-40225","published":"2025-12-04T15:31:17.057Z","updated":"2026-05-11T21:45:12.887Z","title":"drm/panthor: Fix kernel panic on partial unmap of a GPU VA region","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2025-40224","published":"2025-12-04T15:31:16.193Z","updated":"2026-05-11T21:45:11.677Z","title":"hwmon: (cgbc-hwmon) Add missing NULL check after devm_kzalloc()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-40223","published":"2025-12-04T15:31:15.158Z","updated":"2026-05-11T21:45:10.518Z","title":"most: usb: Fix use-after-free in hdm_disconnect","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-40222","published":"2025-12-04T15:31:14.142Z","updated":"2026-05-11T21:45:09.287Z","title":"tty: serial: sh-sci: fix RSCI FIFO overrun handling","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2025-40221","published":"2025-12-04T14:50:45.439Z","updated":"2026-05-11T21:45:07.864Z","title":"media: pci: mg4b: fix uninitialized iio scan data","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-40220","published":"2025-12-04T14:50:44.108Z","updated":"2026-05-23T16:01:42.651Z","title":"fuse: fix livelock in synchronous file put from fuseblk workers","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-40219","published":"2025-12-04T14:50:42.996Z","updated":"2026-10-15T01:09:04.855Z","title":"PCI/IOV: Fix race between SR-IOV enable/disable and hotplug","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2025-40218","published":"2025-12-04T14:50:41.873Z","updated":"2026-05-11T21:45:03.319Z","title":"mm/damon/vaddr: do not repeat pte_offset_map_lock() until success","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2025-40217","published":"2025-12-04T14:50:40.664Z","updated":"2026-05-11T21:45:02.158Z","title":"pidfs: validate extensible ioctls","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2025-40216","published":"2025-12-04T14:14:14.690Z","updated":"2026-10-15T22:02:41.119Z","title":"io_uring/rsrc: don't rely on user vaddr alignment","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2025-40215","published":"2025-12-04T12:38:32.517Z","updated":"2026-08-05T12:08:40.873Z","title":"xfrm: delete x->tunnel as we delete x","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-40214","published":"2025-12-04T12:38:31.601Z","updated":"2026-08-05T12:08:39.553Z","title":"af_unix: Initialise scc_index in unix_add_edge().","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2025-40213","published":"2025-11-24T15:59:44.000Z","updated":"2026-10-21T12:37:53.837Z","title":"Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-40212","published":"2025-11-24T13:04:20.888Z","updated":"2026-08-05T12:08:37.417Z","title":"nfsd: fix refcount leak in nfsd_set_fh_dentry()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2025-40211","published":"2025-11-21T10:21:36.438Z","updated":"2026-06-16T19:58:39.666Z","title":"ACPI: video: Fix use-after-free in acpi_video_switch_brightness()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-40210","published":"2025-11-21T10:21:35.540Z","updated":"2026-08-05T12:08:36.344Z","title":"Revert \"NFSD: Remove the cap on number of operations per NFSv4 COMPOUND\"","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2025-40209","published":"2025-11-21T10:19:44.757Z","updated":"2026-05-11T21:44:52.446Z","title":"btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-40208","published":"2025-11-12T21:56:36.261Z","updated":"2026-05-11T21:44:51.235Z","title":"media: iris: fix module removal if firmware download failed","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-40207","published":"2025-11-12T21:56:35.988Z","updated":"2026-05-11T21:44:50.064Z","title":"media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-40206","published":"2025-11-12T21:56:35.675Z","updated":"2026-10-15T22:02:40.982Z","title":"netfilter: nft_objref: validate objref and objrefmap expressions","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-40205","published":"2025-11-12T21:56:35.403Z","updated":"2026-10-15T22:02:40.845Z","title":"btrfs: avoid potential out-of-bounds in btrfs_encode_fh()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2025-40204","published":"2025-11-12T21:56:35.110Z","updated":"2026-10-15T22:02:40.705Z","title":"sctp: Fix MAC comparison to be constant-time","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2025-40203","published":"2025-11-12T21:56:34.801Z","updated":"2026-08-05T12:08:32.046Z","title":"listmount: don't call path_put() under namespace semaphore","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-40202","published":"2025-11-12T21:56:34.527Z","updated":"2026-08-05T12:08:30.982Z","title":"ipmi: Rework user message limit handling","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2025-40201","published":"2025-11-12T21:56:34.063Z","updated":"2026-10-15T22:02:40.564Z","title":"kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2025-40200","published":"2025-11-12T21:56:33.783Z","updated":"2026-05-11T21:44:41.773Z","title":"Squashfs: reject negative file sizes in squashfs_read_inode()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-40199","published":"2025-11-12T21:56:33.510Z","updated":"2026-10-15T22:02:40.424Z","title":"page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-40198","published":"2025-11-12T21:56:33.220Z","updated":"2026-10-15T22:02:40.274Z","title":"ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2025-40197","published":"2025-11-12T21:56:32.852Z","updated":"2026-05-23T16:01:38.372Z","title":"media: mc: Clear minor number before put device","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-40196","published":"2025-11-12T21:56:32.578Z","updated":"2026-10-15T01:09:02.842Z","title":"fs: quota: create dedicated workqueue for quota_release_work","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2025-40195","published":"2025-11-12T21:56:32.311Z","updated":"2026-05-11T21:44:35.867Z","title":"mount: handle NULL values in mnt_ns_release()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-40194","published":"2025-11-12T21:56:32.025Z","updated":"2026-05-11T21:44:34.728Z","title":"cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-40193","published":"2025-11-12T21:56:31.751Z","updated":"2026-05-11T21:44:33.601Z","title":"xtensa: simdisk: add input size check in proc_write_simdisk","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2025-40192","published":"2025-11-12T21:56:31.476Z","updated":"2026-05-11T21:44:32.428Z","title":"Revert \"ipmi: fix msg stack when IPMI is disconnected\"","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-40191","published":"2025-11-12T21:56:31.206Z","updated":"2026-05-11T21:44:31.297Z","title":"drm/amdkfd: Fix kfd process ref leaking when userptr unmapping","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-40190","published":"2025-11-12T21:56:30.914Z","updated":"2026-08-05T12:08:26.693Z","title":"ext4: guard against EA inode refcount underflow in xattr update","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2025-40189","published":"2025-11-12T21:56:30.575Z","updated":"2026-05-11T21:44:28.989Z","title":"net: usb: lan78xx: Fix lost EEPROM read timeout error(-ETIMEDOUT) in lan78xx_read_raw_eeprom","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2025-40188","published":"2025-11-12T21:56:30.108Z","updated":"2026-05-11T21:44:27.716Z","title":"pwm: berlin: Fix wrong register in suspend/resume","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-40187","published":"2025-11-12T21:56:29.504Z","updated":"2026-10-15T22:02:40.120Z","title":"net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00638,"kevAdded":null},{"id":"CVE-2025-40186","published":"2025-11-12T21:56:29.033Z","updated":"2026-10-15T22:02:39.982Z","title":"tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0058,"kevAdded":null},{"id":"CVE-2025-40185","published":"2025-11-12T21:56:28.561Z","updated":"2026-05-11T21:44:24.259Z","title":"ice: ice_adapter: release xa entry on adapter allocation failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-40184","published":"2025-11-12T21:56:28.044Z","updated":"2026-05-11T21:44:23.140Z","title":"KVM: arm64: Fix debug checking for np-guests using huge mappings","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2025-40183","published":"2025-11-12T21:56:27.429Z","updated":"2026-10-15T22:02:39.850Z","title":"bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00624,"kevAdded":null},{"id":"CVE-2025-40182","published":"2025-11-12T21:56:26.699Z","updated":"2026-08-05T12:08:22.418Z","title":"crypto: skcipher - Fix reqsize handling","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2025-40181","published":"2025-11-12T21:56:25.930Z","updated":"2026-05-11T21:44:19.679Z","title":"x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-40180","published":"2025-11-12T21:56:25.395Z","updated":"2026-10-30T12:22:56.755Z","title":"mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2025-40179","published":"2025-11-12T21:56:24.882Z","updated":"2026-05-11T21:44:17.422Z","title":"ext4: verify orphan file size is not too big","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-40178","published":"2025-11-12T21:56:24.051Z","updated":"2026-05-11T21:44:16.295Z","title":"pid: Add a judgment for ns null in pid_nr_ns","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-40177","published":"2025-11-12T10:53:50.737Z","updated":"2026-05-11T21:44:15.142Z","title":"accel/qaic: Fix bootlog initialization ordering","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-40176","published":"2025-11-12T10:53:50.443Z","updated":"2026-10-15T22:02:39.716Z","title":"tls: wait for pending async decryptions if tls_strp_msg_hold fails","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00487,"kevAdded":null},{"id":"CVE-2025-40175","published":"2025-11-12T10:53:50.166Z","updated":"2026-05-11T21:44:12.865Z","title":"idpf: cleanup remaining SKBs in PTP flows","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2025-40174","published":"2025-11-12T10:53:49.859Z","updated":"2026-08-05T12:08:19.978Z","title":"x86/mm: Fix SMP ordering in switch_mm_irqs_off()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2025-40173","published":"2025-11-12T10:53:49.571Z","updated":"2026-10-15T22:02:39.584Z","title":"net/ip6_tunnel: Prevent perpetual tunnel growth","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2025-40172","published":"2025-11-12T10:53:49.245Z","updated":"2026-08-05T12:08:17.861Z","title":"accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2025-40171","published":"2025-11-12T10:46:52.289Z","updated":"2026-10-15T22:02:39.456Z","title":"nvmet-fc: move lsop put work to nvmet_fc_ls_req_op","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2025-40170","published":"2025-11-12T10:46:52.014Z","updated":"2026-10-30T12:22:55.694Z","title":"net: use dst_dev_rcu() in sk_setup_caps()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-40169","published":"2025-11-12T10:46:51.736Z","updated":"2026-10-15T22:02:39.320Z","title":"bpf: Reject negative offsets for ALU ops","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2025-40168","published":"2025-11-12T10:46:51.422Z","updated":"2026-09-02T12:49:28.040Z","title":"smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0042,"kevAdded":null},{"id":"CVE-2025-40167","published":"2025-11-12T10:26:24.498Z","updated":"2026-10-15T22:02:39.184Z","title":"ext4: detect invalid INLINE_DATA + EXTENTS flag combination","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-40166","published":"2025-11-12T10:26:24.143Z","updated":"2026-08-05T12:08:11.302Z","title":"drm/xe/guc: Check GuC running state before deregistering exec queue","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2025-40165","published":"2025-11-12T10:26:23.806Z","updated":"2026-08-05T12:08:10.217Z","title":"media: nxp: imx8-isi: m2m: Fix streaming cleanup on release","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2025-40164","published":"2025-11-12T10:26:23.482Z","updated":"2026-06-19T11:57:22.439Z","title":"usbnet: Fix using smp_processor_id() in preemptible code warnings","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2025-40163","published":"2025-11-12T10:26:23.199Z","updated":"2026-06-01T16:05:34.972Z","title":"sched/deadline: Stop dl_server before CPU goes offline","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-40162","published":"2025-11-12T10:26:22.883Z","updated":"2026-05-11T21:43:56.425Z","title":"ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-40161","published":"2025-11-12T10:24:36.696Z","updated":"2026-05-11T21:43:55.108Z","title":"mailbox: zynqmp-ipi: Fix SGI cleanup on unbind","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-40160","published":"2025-11-12T10:24:36.429Z","updated":"2026-10-30T12:22:54.628Z","title":"xen/events: Return -EEXIST for bound VIRQs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2025-40159","published":"2025-11-12T10:24:36.104Z","updated":"2026-10-15T22:02:39.041Z","title":"xsk: Harden userspace-supplied xdp_desc validation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-40158","published":"2025-11-12T10:23:29.516Z","updated":"2026-10-30T12:22:53.554Z","title":"ipv6: use RCU in ip6_output()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00555,"kevAdded":null},{"id":"CVE-2025-40157","published":"2025-11-12T10:23:29.258Z","updated":"2026-05-11T21:43:50.466Z","title":"EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2025-40156","published":"2025-11-12T10:23:28.994Z","updated":"2026-05-11T21:43:49.328Z","title":"PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2025-40155","published":"2025-11-12T10:23:28.718Z","updated":"2026-08-05T12:08:07.016Z","title":"iommu/vt-d: debugfs: Fix legacy mode page table dump logic","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2025-40154","published":"2025-11-12T10:23:28.470Z","updated":"2026-06-16T19:52:33.850Z","title":"ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-40153","published":"2025-11-12T10:23:28.201Z","updated":"2026-05-11T21:43:45.768Z","title":"mm: hugetlb: avoid soft lockup when mprotect to large memory area","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-40152","published":"2025-11-12T10:23:27.925Z","updated":"2026-05-11T21:43:44.630Z","title":"drm/msm: Fix bootup splat with separate_gpu_drm modparam","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2025-40151","published":"2025-11-12T10:23:27.662Z","updated":"2026-08-05T12:08:05.901Z","title":"LoongArch: BPF: No support of struct argument in trampoline programs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2025-40150","published":"2025-11-12T10:23:27.399Z","updated":"2026-05-23T16:01:31.919Z","title":"f2fs: fix to avoid migrating empty section","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2025-40149","published":"2025-11-12T10:23:27.122Z","updated":"2026-10-15T22:02:38.910Z","title":"tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2025-40148","published":"2025-11-12T10:23:26.841Z","updated":"2026-05-11T21:43:39.984Z","title":"drm/amd/display: Add NULL pointer checks in dc_stream cursor attribute functions","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-40147","published":"2025-11-12T10:23:26.556Z","updated":"2026-05-11T21:43:38.854Z","title":"blk-throttle: fix access race during throttle policy activation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2025-40146","published":"2025-11-12T10:23:26.287Z","updated":"2026-05-11T21:43:37.672Z","title":"blk-mq: fix potential deadlock while nr_requests grown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-40145","published":"2025-11-12T10:23:26.013Z","updated":"2026-05-11T21:43:36.510Z","title":"PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-40143","published":"2025-11-12T10:23:25.489Z","updated":"2026-05-11T21:43:35.365Z","title":"bpf: dont report verifier bug for missing bpf_scc_visit on speculative path","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2025-40142","published":"2025-11-12T10:23:25.191Z","updated":"2026-05-11T21:43:34.212Z","title":"ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-40141","published":"2025-11-12T10:23:24.856Z","updated":"2026-10-15T22:02:38.774Z","title":"Bluetooth: ISO: Fix possible UAF on iso_conn_free","severity":"HIGH","score":8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2025-40140","published":"2025-11-12T10:23:24.586Z","updated":"2026-08-05T12:08:02.642Z","title":"net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00319,"kevAdded":null},{"id":"CVE-2025-40139","published":"2025-11-12T10:23:24.216Z","updated":"2026-10-15T22:02:38.627Z","title":"smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-40138","published":"2025-11-12T10:23:23.912Z","updated":"2026-05-11T21:43:29.612Z","title":"f2fs: fix to avoid NULL pointer dereference in f2fs_check_quota_consistency()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2025-40137","published":"2025-11-12T10:23:23.624Z","updated":"2026-10-30T12:22:52.489Z","title":"f2fs: fix to truncate first page in error path of f2fs_truncate()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-40136","published":"2025-11-12T10:23:23.330Z","updated":"2026-10-30T12:22:51.433Z","title":"crypto: hisilicon/qm - request reserved interrupt for virtual function","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2025-40135","published":"2025-11-12T10:23:23.051Z","updated":"2026-10-30T12:22:50.364Z","title":"ipv6: use RCU in ip6_xmit()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0071,"kevAdded":null},{"id":"CVE-2025-40134","published":"2025-11-12T10:23:22.771Z","updated":"2026-05-11T21:43:24.586Z","title":"dm: fix NULL pointer dereference in __dm_suspend()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-40133","published":"2025-11-12T10:23:22.498Z","updated":"2026-08-05T12:07:59.353Z","title":"mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2025-40132","published":"2025-11-12T10:23:22.195Z","updated":"2026-05-11T21:43:22.276Z","title":"ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-40131","published":"2025-11-12T10:23:21.879Z","updated":"2026-05-23T16:01:30.872Z","title":"wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-40130","published":"2025-11-12T10:23:21.605Z","updated":"2026-10-21T12:37:48.510Z","title":"scsi: ufs: core: Fix data race in CPU latency PM QoS request handling","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2025-40129","published":"2025-11-12T10:23:21.327Z","updated":"2026-10-15T22:02:38.502Z","title":"sunrpc: fix null pointer dereference on zero-length checksum","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00566,"kevAdded":null},{"id":"CVE-2025-40127","published":"2025-11-12T10:23:20.775Z","updated":"2026-05-11T21:43:17.660Z","title":"hwrng: ks-sa - fix division by zero in ks_sa_rng_init","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-40126","published":"2025-11-12T10:23:20.460Z","updated":"2026-05-23T16:01:29.763Z","title":"sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2025-40125","published":"2025-11-12T10:23:20.180Z","updated":"2026-05-11T21:43:15.313Z","title":"blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-40124","published":"2025-11-12T10:23:19.861Z","updated":"2026-08-05T12:07:57.197Z","title":"sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2025-40123","published":"2025-11-12T10:23:19.589Z","updated":"2026-10-15T22:02:38.256Z","title":"bpf: Enforce expected_attach_type for tailcall compatibility","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2025-40122","published":"2025-11-12T10:23:19.271Z","updated":"2026-05-11T21:43:04.796Z","title":"perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2025-40121","published":"2025-11-12T10:23:19.000Z","updated":"2026-05-11T21:43:03.663Z","title":"ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2025-40120","published":"2025-11-12T10:23:18.726Z","updated":"2026-05-11T21:43:02.326Z","title":"net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-40119","published":"2025-11-12T10:23:18.449Z","updated":"2026-05-11T21:43:01.083Z","title":"ext4: fix potential null deref in ext4_mb_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00212,"kevAdded":null},{"id":"CVE-2025-40118","published":"2025-11-12T10:23:18.179Z","updated":"2026-08-05T12:07:55.038Z","title":"scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2025-40117","published":"2025-11-12T10:23:17.851Z","updated":"2026-08-05T12:07:53.958Z","title":"misc: pci_endpoint_test: Fix array underflow in pci_endpoint_test_ioctl()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2025-40116","published":"2025-11-12T10:23:17.569Z","updated":"2026-05-11T21:42:57.610Z","title":"usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-40115","published":"2025-11-12T10:23:17.283Z","updated":"2026-05-11T21:42:56.421Z","title":"scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2025-40113","published":"2025-11-12T10:23:16.992Z","updated":"2026-10-21T12:37:47.506Z","title":"remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-40112","published":"2025-11-12T10:23:16.690Z","updated":"2026-08-05T12:07:52.886Z","title":"sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-40111","published":"2025-11-12T01:07:25.203Z","updated":"2026-10-15T22:02:38.116Z","title":"drm/vmwgfx: Fix Use-after-free in validation","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-40110","published":"2025-11-12T01:07:24.739Z","updated":"2026-05-11T21:42:50.636Z","title":"drm/vmwgfx: Fix a null-ptr access in the cursor snooper","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2025-40109","published":"2025-11-09T04:35:59.979Z","updated":"2026-05-11T21:42:45.679Z","title":"crypto: rng - Ensure set_ent is always present","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-40108","published":"2025-11-09T04:35:58.587Z","updated":"2026-05-11T21:42:40.261Z","title":"serial: qcom-geni: Fix blocked task","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-40107","published":"2025-11-03T12:15:12.587Z","updated":"2026-05-11T21:42:39.083Z","title":"can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-40106","published":"2025-10-31T09:41:46.740Z","updated":"2026-05-11T21:42:37.892Z","title":"comedi: fix divide-by-zero in comedi_buf_munge()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-40105","published":"2025-10-30T09:48:09.674Z","updated":"2026-10-15T22:02:37.993Z","title":"vfs: Don't leak disconnected dentries on umount","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2025-40104","published":"2025-10-30T09:48:09.051Z","updated":"2026-10-15T22:02:37.869Z","title":"ixgbevf: fix mailbox API compatibility by negotiating supported features","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2025-40103","published":"2025-10-30T09:48:08.421Z","updated":"2026-05-11T21:42:34.498Z","title":"smb: client: Fix refcount leak for cifs_sb_tlink","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2025-40102","published":"2025-10-30T09:48:07.790Z","updated":"2026-09-02T12:49:25.880Z","title":"KVM: arm64: Prevent access to vCPU events before init","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2025-40101","published":"2025-10-30T09:48:07.155Z","updated":"2026-05-23T16:01:25.530Z","title":"btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-40100","published":"2025-10-30T09:48:06.521Z","updated":"2026-05-11T21:42:30.966Z","title":"btrfs: do not assert we found block group item when creating free space tree","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-40099","published":"2025-10-30T09:48:05.859Z","updated":"2026-10-15T22:02:37.745Z","title":"cifs: parse_dfs_referrals: prevent oob on malformed input","severity":"CRITICAL","score":9.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00406,"kevAdded":null},{"id":"CVE-2025-40098","published":"2025-10-30T09:48:05.200Z","updated":"2026-08-03T09:32:26.104Z","title":"ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-40097","published":"2025-10-30T09:48:04.567Z","updated":"2026-10-03T10:55:28.438Z","title":"ALSA: hda: Fix missing pointer check in hda_component_manager_init function","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-40096","published":"2025-10-30T09:48:03.954Z","updated":"2026-08-05T12:07:47.604Z","title":"drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-40095","published":"2025-10-30T09:48:03.276Z","updated":"2026-08-05T12:07:46.524Z","title":"usb: gadget: f_rndis: Refactor bind path to use __free()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2025-40094","published":"2025-10-30T09:48:02.446Z","updated":"2026-08-05T12:07:45.475Z","title":"usb: gadget: f_acm: Refactor bind path to use __free()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2025-40093","published":"2025-10-30T09:48:00.807Z","updated":"2026-08-05T12:07:44.429Z","title":"usb: gadget: f_ecm: Refactor bind path to use __free()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2025-40092","published":"2025-10-30T09:47:59.910Z","updated":"2026-08-05T12:07:43.366Z","title":"usb: gadget: f_ncm: Refactor bind path to use __free()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2025-40091","published":"2025-10-30T09:47:59.253Z","updated":"2026-05-11T21:42:20.367Z","title":"ixgbe: fix too early devlink_free() in ixgbe_remove()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-40090","published":"2025-10-30T09:47:58.611Z","updated":"2026-08-05T12:07:42.312Z","title":"ksmbd: fix recursive locking in RPC handle list access","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2025-40089","published":"2025-10-30T09:47:57.990Z","updated":"2026-05-11T21:42:18.011Z","title":"cxl/features: Add check for no entries in cxl_feature_info","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-40088","published":"2025-10-30T09:47:57.333Z","updated":"2026-08-05T12:07:41.220Z","title":"hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-40087","published":"2025-10-30T09:47:56.675Z","updated":"2026-08-05T12:07:40.146Z","title":"NFSD: Define a proc_layoutcommit for the FlexFiles layout type","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2025-40086","published":"2025-10-30T09:47:56.005Z","updated":"2026-10-21T12:37:46.403Z","title":"drm/xe: Don't allow evicting of BOs in same VM in array of VM binds","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2023-7324","published":"2025-10-29T13:46:14.184Z","updated":"2026-10-15T21:41:44.925Z","title":"scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2025-40085","published":"2025-10-29T13:37:04.707Z","updated":"2026-05-23T16:01:24.342Z","title":"ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-40084","published":"2025-10-29T13:37:03.185Z","updated":"2026-08-05T12:07:38.947Z","title":"ksmbd: transport_ipc: validate payload size before reading handle","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-40083","published":"2025-10-29T13:37:01.868Z","updated":"2026-06-16T19:43:09.432Z","title":"net/sched: sch_qfq: Fix null-deref in agg_dequeue","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-40082","published":"2025-10-28T11:48:45.975Z","updated":"2026-10-15T22:02:37.613Z","title":"hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2025-40081","published":"2025-10-28T11:48:45.392Z","updated":"2026-10-15T22:02:37.490Z","title":"perf: arm_spe: Prevent overflow in PERF_IDX2OFF()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-40080","published":"2025-10-28T11:48:44.796Z","updated":"2026-10-15T01:08:55.820Z","title":"nbd: restrict sockets to TCP and UDP","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2025-40079","published":"2025-10-28T11:48:44.122Z","updated":"2026-08-05T12:07:35.719Z","title":"riscv, bpf: Sign extend struct ops return values properly","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-40078","published":"2025-10-28T11:48:43.548Z","updated":"2026-10-15T01:08:54.099Z","title":"bpf: Explicitly check accesses to bpf_sock_addr","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2025-40077","published":"2025-10-28T11:48:42.976Z","updated":"2026-10-30T12:22:49.284Z","title":"f2fs: fix to avoid overflow while left shift operation","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-40076","published":"2025-10-28T11:48:42.385Z","updated":"2026-05-11T21:42:01.057Z","title":"PCI: rcar-host: Pass proper IRQ domain to generic_handle_domain_irq()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-40075","published":"2025-10-28T11:48:41.791Z","updated":"2026-10-30T12:22:48.219Z","title":"tcp_metrics: use dst_dev_net_rcu()","severity":"HIGH","score":8.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00492,"kevAdded":null},{"id":"CVE-2025-40074","published":"2025-10-28T11:48:41.202Z","updated":"2026-10-03T10:55:27.348Z","title":"ipv4: start using dst_dev_rcu()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2025-40073","published":"2025-10-28T11:48:40.588Z","updated":"2026-05-11T21:41:57.606Z","title":"drm/msm: Do not validate SSPP when it is not ready","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-40072","published":"2025-10-28T11:48:39.999Z","updated":"2026-05-11T21:41:56.450Z","title":"fanotify: Validate the return value of mnt_ns_from_dentry() before dereferencing","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-40071","published":"2025-10-28T11:48:39.417Z","updated":"2026-10-30T12:22:47.159Z","title":"tty: n_gsm: Don't block input queue by waiting MSC","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2025-40070","published":"2025-10-28T11:48:38.838Z","updated":"2026-10-15T01:08:52.337Z","title":"pps: fix warning in pps_register_cdev when register device fail","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2025-40069","published":"2025-10-28T11:48:38.232Z","updated":"2026-08-05T12:07:32.509Z","title":"drm/msm: Fix obj leak in VM_BIND error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-40068","published":"2025-10-28T11:48:37.636Z","updated":"2026-08-05T12:07:31.436Z","title":"fs: ntfs3: Fix integer overflow in run_unpack()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2025-40067","published":"2025-10-28T11:48:37.034Z","updated":"2026-10-30T12:22:46.051Z","title":"fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2025-40066","published":"2025-10-28T11:48:36.438Z","updated":"2026-05-11T21:41:49.331Z","title":"wifi: mt76: mt7996: Check phy before init msta_link in mt7996_mac_sta_add_links()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2025-40065","published":"2025-10-28T11:48:35.785Z","updated":"2026-10-30T12:22:44.991Z","title":"RISC-V: KVM: Write hgatp register with valid mode bits","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2025-40064","published":"2025-10-28T11:48:35.155Z","updated":"2026-09-02T12:49:24.811Z","title":"smc: Fix use-after-free in __pnet_find_base_ndev().","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-40063","published":"2025-10-28T11:48:34.549Z","updated":"2026-08-05T12:07:28.106Z","title":"crypto: comp - Use same definition of context alloc and free ops","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2025-40062","published":"2025-10-28T11:48:33.961Z","updated":"2026-05-23T16:01:17.923Z","title":"crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-40061","published":"2025-10-28T11:48:33.361Z","updated":"2026-10-15T22:02:37.225Z","title":"RDMA/rxe: Fix race in do_task() when draining","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-40060","published":"2025-10-28T11:48:32.775Z","updated":"2026-05-11T21:41:42.316Z","title":"coresight: trbe: Return NULL pointer for allocation failures","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-40059","published":"2025-10-28T11:48:32.186Z","updated":"2026-05-11T21:41:41.170Z","title":"coresight: Fix incorrect handling for return value of devm_kzalloc","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-40058","published":"2025-10-28T11:48:31.567Z","updated":"2026-08-05T12:07:25.986Z","title":"iommu/vt-d: Disallow dirty tracking if incoherent page walk","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2025-40057","published":"2025-10-28T11:48:30.947Z","updated":"2026-10-30T12:22:43.923Z","title":"ptp: Add a upper bound on max_vclocks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2025-40056","published":"2025-10-28T11:48:30.249Z","updated":"2026-05-11T21:41:37.648Z","title":"vhost: vringh: Fix copy_to_iter return value check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2025-40055","published":"2025-10-28T11:48:29.665Z","updated":"2026-05-11T21:41:36.488Z","title":"ocfs2: fix double free in user_cluster_connect()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-40054","published":"2025-10-28T11:48:29.073Z","updated":"2026-08-23T12:45:24.871Z","title":"f2fs: fix UAF issue in f2fs_merge_page_bio()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2025-40053","published":"2025-10-28T11:48:28.444Z","updated":"2026-10-15T22:02:37.095Z","title":"net: dlink: handle copy_thresh allocation failure","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00629,"kevAdded":null},{"id":"CVE-2025-40052","published":"2025-10-28T11:48:27.854Z","updated":"2026-05-11T21:41:32.977Z","title":"smb: client: fix crypto buffers in non-linear memory","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-40051","published":"2025-10-28T11:48:27.279Z","updated":"2026-10-15T22:02:36.974Z","title":"vhost: vringh: Modify the return value check","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-40050","published":"2025-10-28T11:48:26.654Z","updated":"2026-05-11T21:41:30.716Z","title":"bpf: Skip scalar adjustment for BPF_NEG if dst is a pointer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-40049","published":"2025-10-28T11:48:25.862Z","updated":"2026-05-11T21:41:29.576Z","title":"Squashfs: fix uninit-value in squashfs_get_parent","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-40048","published":"2025-10-28T11:48:25.220Z","updated":"2026-10-15T22:02:36.852Z","title":"uio_hv_generic: Let userspace take care of interrupt mask","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00644,"kevAdded":null},{"id":"CVE-2025-40047","published":"2025-10-28T11:48:24.625Z","updated":"2026-08-05T12:07:20.600Z","title":"io_uring/waitid: always prune wait queue entry in io_waitid_wait()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2025-40046","published":"2025-10-28T11:48:24.022Z","updated":"2026-08-05T12:07:19.429Z","title":"io_uring/zcrx: fix overshooting recv limit","severity":"HIGH","score":8.6,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00349,"kevAdded":null},{"id":"CVE-2025-40045","published":"2025-10-28T11:48:23.431Z","updated":"2026-08-05T12:07:18.382Z","title":"ASoC: codecs: wcd937x: set the comp soundwire port correctly","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2025-40044","published":"2025-10-28T11:48:22.827Z","updated":"2026-10-15T22:02:36.730Z","title":"fs: udf: fix OOB read in lengthAllocDescs handling","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2025-40043","published":"2025-10-28T11:48:22.230Z","updated":"2026-08-05T12:07:16.234Z","title":"net: nfc: nci: Add parameter validation for packet data","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2025-40042","published":"2025-10-28T11:48:21.638Z","updated":"2026-05-11T21:41:21.533Z","title":"tracing: Fix race condition in kprobe initialization causing NULL pointer dereference","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-40041","published":"2025-10-28T11:48:21.021Z","updated":"2026-08-05T12:07:15.168Z","title":"LoongArch: BPF: Sign-extend struct ops return values properly","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-40040","published":"2025-10-28T11:48:20.395Z","updated":"2026-10-15T22:02:36.606Z","title":"mm/ksm: fix flag-dropping behavior in ksm_madvise","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00376,"kevAdded":null},{"id":"CVE-2025-40039","published":"2025-10-28T11:48:19.781Z","updated":"2026-08-05T12:07:13.052Z","title":"ksmbd: Fix race condition in RPC handle list access","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00312,"kevAdded":null},{"id":"CVE-2025-40038","published":"2025-10-28T11:48:18.889Z","updated":"2026-10-15T22:02:36.482Z","title":"KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2025-40037","published":"2025-10-28T11:48:18.274Z","updated":"2026-05-11T21:41:15.693Z","title":"fbdev: simplefb: Fix use after free in simplefb_detach_genpds()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-40036","published":"2025-10-28T11:48:17.630Z","updated":"2026-05-11T21:41:14.519Z","title":"misc: fastrpc: fix possible map leak in fastrpc_put_args","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-40035","published":"2025-10-28T11:48:17.030Z","updated":"2026-05-11T21:41:13.342Z","title":"Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2025-40034","published":"2025-10-28T11:48:16.335Z","updated":"2026-05-11T21:41:12.240Z","title":"PCI/AER: Avoid NULL pointer dereference in aer_ratelimit()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2025-40033","published":"2025-10-28T11:48:15.624Z","updated":"2026-05-11T21:41:11.164Z","title":"remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-40032","published":"2025-10-28T11:48:14.876Z","updated":"2026-05-11T21:41:10.040Z","title":"PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-40031","published":"2025-10-28T11:48:13.644Z","updated":"2026-05-11T21:41:08.887Z","title":"tee: fix register_shm_helper()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-40030","published":"2025-10-28T11:48:01.608Z","updated":"2026-05-11T21:41:07.740Z","title":"pinctrl: check the return value of pinmux_ops::get_function_name()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-40029","published":"2025-10-28T11:48:00.679Z","updated":"2026-05-11T21:41:06.594Z","title":"bus: fsl-mc: Check return value of platform_get_resource()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2025-40028","published":"2025-10-28T09:32:35.681Z","updated":"2026-08-05T12:07:10.905Z","title":"binder: fix double-free in dbitmap","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-40027","published":"2025-10-28T09:32:34.162Z","updated":"2026-08-05T12:07:09.837Z","title":"net/9p: fix double req put in p9_fd_cancelled","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2025-40026","published":"2025-10-28T09:32:33.075Z","updated":"2026-10-15T22:02:36.361Z","title":"KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O","severity":"HIGH","score":7.9,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2025-40025","published":"2025-10-28T09:32:31.806Z","updated":"2026-08-05T12:07:07.729Z","title":"f2fs: fix to do sanity check on node footer for non inode dnode","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-40024","published":"2025-10-24T12:24:59.199Z","updated":"2026-08-05T12:07:06.656Z","title":"vhost: Take a reference on the task in struct vhost_task.","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-40023","published":"2025-10-24T12:24:58.554Z","updated":"2026-05-11T21:40:59.219Z","title":"drm/xe/vf: Don't expose sysfs attributes not applicable for VFs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-40022","published":"2025-10-24T12:24:57.875Z","updated":"2026-10-15T01:08:50.599Z","title":"crypto: af_alg - Fix incorrect boolean values in af_alg_ctx","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2025-40021","published":"2025-10-24T12:24:57.107Z","updated":"2026-05-11T21:40:56.795Z","title":"tracing: dynevent: Add a missing lockdown check on dynevent","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2025-40020","published":"2025-10-24T12:24:56.311Z","updated":"2026-05-11T21:40:55.650Z","title":"can: peak_usb: fix shift-out-of-bounds issue","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2025-40019","published":"2025-10-24T11:44:29.864Z","updated":"2026-05-11T21:40:54.499Z","title":"crypto: essiv - Check ssize for decryption and in-place encryption","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2025-40018","published":"2025-10-24T11:44:28.955Z","updated":"2026-10-15T22:02:36.226Z","title":"ipvs: Defer ip_vs_ftp unregister during netns cleanup","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2023-53733","published":"2025-10-24T11:44:28.115Z","updated":"2026-10-30T12:17:33.672Z","title":"net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2023-53732","published":"2025-10-22T13:23:59.630Z","updated":"2026-05-11T19:50:47.278Z","title":"fs/ntfs3: Fix NULL dereference in ni_write_inode","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-53731","published":"2025-10-22T13:23:59.055Z","updated":"2026-05-23T15:30:38.411Z","title":"netlink: fix potential deadlock in netlink_set_err()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2023-53730","published":"2025-10-22T13:23:58.419Z","updated":"2026-05-11T19:50:44.742Z","title":"blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-53729","published":"2025-10-22T13:23:57.739Z","updated":"2026-10-15T21:41:34.911Z","title":"soc: qcom: qmi_encdec: Restrict string length in decode","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2023-53728","published":"2025-10-22T13:23:57.127Z","updated":"2026-05-11T19:50:42.429Z","title":"posix-timers: Ensure timer ID search-loop limit is valid","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2023-53727","published":"2025-10-22T13:23:56.528Z","updated":"2026-05-11T19:50:41.302Z","title":"net/sched: fq_pie: avoid stalls in fq_pie_timer()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-53726","published":"2025-10-22T13:23:55.896Z","updated":"2026-10-15T21:41:34.644Z","title":"arm64: csum: Fix OoB access in IP checksum code for negative lengths","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2023-53725","published":"2025-10-22T13:23:55.200Z","updated":"2026-05-11T19:50:38.962Z","title":"clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2023-53724","published":"2025-10-22T13:23:54.542Z","updated":"2026-05-11T19:50:37.810Z","title":"mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2023-53723","published":"2025-10-22T13:23:53.900Z","updated":"2026-05-11T19:50:36.667Z","title":"drm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspend","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2023-53722","published":"2025-10-22T13:23:53.329Z","updated":"2026-05-11T19:50:35.533Z","title":"md: raid1: fix potential OOB in raid1_remove_disk()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2023-53721","published":"2025-10-22T13:23:52.699Z","updated":"2026-05-11T19:50:34.344Z","title":"wifi: ath12k: Fix a NULL pointer dereference in ath12k_mac_op_hw_scan()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2023-53720","published":"2025-10-22T13:23:52.123Z","updated":"2026-05-11T19:50:33.183Z","title":"net/mlx5e: Release the label when replacing existing ct entry","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2023-53719","published":"2025-10-22T13:23:51.441Z","updated":"2026-05-11T19:50:32.013Z","title":"serial: arc_uart: fix of_iomap leak in `arc_serial_probe`","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2023-53718","published":"2025-10-22T13:23:50.809Z","updated":"2026-10-15T21:41:34.500Z","title":"ring-buffer: Do not swap cpu_buffer during resize process","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2023-53717","published":"2025-10-22T13:23:50.161Z","updated":"2026-05-11T19:50:29.770Z","title":"wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2023-53716","published":"2025-10-22T13:23:49.536Z","updated":"2026-05-23T15:30:33.237Z","title":"net: fix skb leak in __skb_tstamp_tx()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2023-53715","published":"2025-10-22T13:23:48.905Z","updated":"2026-05-11T19:50:27.385Z","title":"wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2023-53714","published":"2025-10-22T13:23:48.341Z","updated":"2026-05-11T19:50:26.200Z","title":"drm/stm: ltdc: fix late dereference check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2023-53713","published":"2025-10-22T13:23:47.720Z","updated":"2026-10-15T21:41:34.204Z","title":"arm64: sme: Use STR P to clear FFR context field in streaming SVE mode","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2023-53712","published":"2025-10-22T13:23:47.100Z","updated":"2026-05-11T19:50:23.920Z","title":"ARM: 9317/1: kexec: Make smp stop calls asynchronous","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2023-53711","published":"2025-10-22T13:23:46.458Z","updated":"2026-10-15T21:41:34.022Z","title":"NFS: Fix a potential data corruption","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2023-53710","published":"2025-10-22T13:23:45.785Z","updated":"2026-05-11T19:50:21.634Z","title":"wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2023-53709","published":"2025-10-22T13:23:45.155Z","updated":"2026-05-11T19:50:20.480Z","title":"ring-buffer: Handle race between rb_move_tail and rb_check_pages","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2023-53708","published":"2025-10-22T13:23:44.496Z","updated":"2026-05-11T19:50:19.097Z","title":"ACPI: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2023-53707","published":"2025-10-22T13:23:43.822Z","updated":"2026-10-03T10:54:59.930Z","title":"drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2023-53706","published":"2025-10-22T13:23:43.228Z","updated":"2026-08-23T12:45:16.955Z","title":"mm/vmemmap/devdax: fix kernel crash when probing devdax devices","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2023-53705","published":"2025-10-22T13:23:42.641Z","updated":"2026-10-15T21:41:33.892Z","title":"ipv6: Fix out-of-bounds access in ipv6_find_tlv()","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2023-53704","published":"2025-10-22T13:23:42.067Z","updated":"2026-05-11T19:50:14.396Z","title":"clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2023-53703","published":"2025-10-22T13:23:41.450Z","updated":"2026-05-11T19:50:13.248Z","title":"HID: amd_sfh: Fix for shift-out-of-bounds","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2023-53702","published":"2025-10-22T13:23:40.798Z","updated":"2026-05-11T19:50:12.084Z","title":"s390/crypto: use vector instructions only if available for ChaCha20","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2023-53700","published":"2025-10-22T13:23:39.560Z","updated":"2026-05-11T19:50:10.935Z","title":"media: max9286: Fix memleak in max9286_v4l2_register()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2023-53699","published":"2025-10-22T13:23:38.981Z","updated":"2026-05-11T19:50:09.711Z","title":"riscv: move memblock_allow_resize() after linear mapping is ready","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2023-53698","published":"2025-10-22T13:23:38.384Z","updated":"2026-10-15T21:41:33.758Z","title":"xsk: fix refcount underflow in error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2023-53697","published":"2025-10-22T13:23:37.757Z","updated":"2026-05-11T19:50:07.456Z","title":"nvdimm: Fix memleak of pmu attr_groups in unregister_nvdimm_pmu()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2023-53696","published":"2025-10-22T13:23:37.110Z","updated":"2026-05-11T19:50:06.289Z","title":"scsi: qla2xxx: Fix memory leak in qla2x00_probe_one()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2023-53695","published":"2025-10-22T13:23:36.524Z","updated":"2026-10-15T21:41:33.624Z","title":"udf: Detect system inodes linked into directory hierarchy","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2023-53694","published":"2025-10-22T13:23:35.869Z","updated":"2026-05-11T19:50:02.971Z","title":"riscv: ftrace: Fixup panic by disabling preemption","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2023-53693","published":"2025-10-22T13:23:35.280Z","updated":"2026-05-11T19:50:01.014Z","title":"USB: gadget: Fix the memory leak in raw_gadget driver","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2023-53692","published":"2025-10-22T13:23:34.702Z","updated":"2026-08-05T09:15:34.038Z","title":"ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2022-50582","published":"2025-10-22T13:23:34.037Z","updated":"2026-05-11T19:22:12.734Z","title":"regulator: core: Prevent integer underflow","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2022-50581","published":"2025-10-22T13:23:33.421Z","updated":"2026-08-05T08:59:11.666Z","title":"hfs: fix OOB Read in __hfs_brec_find","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2022-50580","published":"2025-10-22T13:23:32.808Z","updated":"2026-05-11T19:22:10.408Z","title":"blk-throttle: prevent overflow while calculating wait time","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2022-50579","published":"2025-10-22T13:23:32.242Z","updated":"2026-05-23T15:24:47.340Z","title":"arm64: ftrace: fix module PLTs with mcount","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2022-50578","published":"2025-10-22T13:23:31.565Z","updated":"2026-05-11T19:22:08.143Z","title":"class: fix possible memory leak in __class_register()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2022-50577","published":"2025-10-22T13:23:30.910Z","updated":"2026-05-11T19:22:06.984Z","title":"ima: Fix memory leak in __ima_inode_hash()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2022-50576","published":"2025-10-22T13:23:30.250Z","updated":"2026-05-11T19:22:05.824Z","title":"serial: pch: Fix PCI device refcount leak in pch_request_dma()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2022-50575","published":"2025-10-22T13:23:29.595Z","updated":"2026-05-11T19:22:04.640Z","title":"xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2022-50574","published":"2025-10-22T13:23:29.027Z","updated":"2026-05-11T19:22:03.358Z","title":"drm/omap: dss: Fix refcount leak bugs","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2022-50573","published":"2025-10-22T13:23:28.437Z","updated":"2026-05-11T19:22:02.181Z","title":"wifi: mt76: mt7915: fix mt7915_rate_txpower_get() resource leaks","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2022-50572","published":"2025-10-22T13:23:27.813Z","updated":"2026-05-11T19:22:00.929Z","title":"ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2022-50571","published":"2025-10-22T13:23:27.187Z","updated":"2026-05-11T19:21:59.799Z","title":"btrfs: call __btrfs_remove_free_space_cache_locked on cache load failure","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2022-50570","published":"2025-10-22T13:23:26.495Z","updated":"2026-08-05T08:59:10.542Z","title":"platform/chrome: fix memory corruption in ioctl","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2022-50569","published":"2025-10-22T13:23:25.810Z","updated":"2026-08-05T08:59:09.466Z","title":"xfrm: Update ipcomp_scratches with NULL when freed","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2022-50568","published":"2025-10-22T13:23:25.136Z","updated":"2026-05-11T19:21:56.354Z","title":"usb: gadget: f_hid: fix f_hidg lifetime vs cdev","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2022-50567","published":"2025-10-22T13:23:24.508Z","updated":"2026-08-05T08:59:08.386Z","title":"fs: jfs: fix shift-out-of-bounds in dbAllocAG","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2022-50566","published":"2025-10-22T13:23:23.917Z","updated":"2026-05-11T19:21:54.056Z","title":"mtd: Fix device name leak when register device failed in add_mtd_device()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2022-50565","published":"2025-10-22T13:23:23.335Z","updated":"2026-05-11T19:21:52.917Z","title":"wifi: plfxlc: fix potential memory leak in __lf_x_usb_enable_rx()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2022-50564","published":"2025-10-22T13:23:22.703Z","updated":"2026-05-11T19:21:51.788Z","title":"s390/netiucv: Fix return type of netiucv_tx()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2022-50563","published":"2025-10-22T13:23:22.080Z","updated":"2026-05-11T19:21:50.626Z","title":"dm thin: Fix UAF in run_timer_softirq()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2022-50562","published":"2025-10-22T13:23:21.421Z","updated":"2026-05-11T19:21:49.466Z","title":"tpm: acpi: Call acpi_put_table() to fix memory leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2022-50561","published":"2025-10-22T13:23:20.802Z","updated":"2026-05-11T19:21:48.314Z","title":"iio: fix memory leak in iio_device_register_eventset()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2022-50560","published":"2025-10-22T13:23:20.117Z","updated":"2026-08-15T12:23:37.387Z","title":"drm/meson: explicitly remove aggregate driver at module unload time","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2022-50559","published":"2025-10-22T13:23:19.290Z","updated":"2026-05-11T19:21:46.008Z","title":"clk: imx: scu: fix memleak on platform_device_add() fails","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2022-50558","published":"2025-10-22T13:23:18.717Z","updated":"2026-05-11T19:21:44.839Z","title":"regmap-irq: Use the new num_config_regs property in regmap_add_irq_chip_fwnode","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2022-50557","published":"2025-10-22T13:23:18.131Z","updated":"2026-05-11T19:21:43.696Z","title":"pinctrl: thunderbay: fix possible memory leak in thunderbay_build_functions()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2022-50556","published":"2025-10-22T13:23:17.527Z","updated":"2026-05-11T19:21:42.566Z","title":"drm: Fix potential null-ptr-deref due to drmm_mode_config_init()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2025-40017","published":"2025-10-20T15:30:43.085Z","updated":"2026-05-11T21:40:52.181Z","title":"media: iris: Fix memory leak by freeing untracked persist buffer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-40016","published":"2025-10-20T15:29:10.376Z","updated":"2026-05-11T21:40:51.055Z","title":"media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2025-40015","published":"2025-10-20T15:29:09.728Z","updated":"2026-05-11T21:40:49.933Z","title":"media: stm32-csi: Fix dereference before NULL check","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-40013","published":"2025-10-20T15:29:09.076Z","updated":"2026-05-11T21:40:47.674Z","title":"ASoC: qcom: audioreach: fix potential null pointer dereference","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2025-40012","published":"2025-10-20T15:26:57.214Z","updated":"2026-08-05T12:07:04.409Z","title":"net/smc: fix warning in smc_rx_splice() when calling get_page()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-40011","published":"2025-10-20T15:26:56.558Z","updated":"2026-05-11T21:40:45.348Z","title":"drm/gma500: Fix null dereference in hdmi teardown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2025-40010","published":"2025-10-20T15:26:55.874Z","updated":"2026-05-11T21:40:44.043Z","title":"afs: Fix potential null pointer dereference in afs_put_server","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2025-40009","published":"2025-10-20T15:26:55.208Z","updated":"2026-05-11T21:40:42.885Z","title":"fs/proc/task_mmu: check p->vec_buf for NULL","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2025-40008","published":"2025-10-20T15:26:54.568Z","updated":"2026-05-23T16:01:15.772Z","title":"kmsan: fix out-of-bounds access to shadow memory","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2025-40007","published":"2025-10-20T15:26:53.880Z","updated":"2026-05-23T16:01:14.674Z","title":"netfs: fix reference leak","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2025-40006","published":"2025-10-20T15:26:53.097Z","updated":"2026-08-05T12:07:03.344Z","title":"mm/hugetlb: fix folio is still mapped when deleted","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2025-40005","published":"2025-10-20T15:26:52.315Z","updated":"2026-06-01T16:05:33.466Z","title":"spi: cadence-quadspi: Implement refcount to handle unbind during busy","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2025-40004","published":"2025-10-20T05:26:08.787Z","updated":"2026-05-11T21:40:36.949Z","title":"net/9p: Fix buffer overflow in USB transport layer","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2025-40003","published":"2025-10-18T08:03:23.529Z","updated":"2026-10-30T12:22:42.773Z","title":"net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2025-40002","published":"2025-10-18T08:03:22.718Z","updated":"2026-05-11T21:40:34.575Z","title":"thunderbolt: Fix use-after-free in tb_dp_dprx_work","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2025-40001","published":"2025-10-18T08:03:21.935Z","updated":"2026-05-11T21:40:33.447Z","title":"scsi: mvsas: Fix use-after-free bugs in mvs_work_queue","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2025-40000","published":"2025-10-15T07:59:14.606Z","updated":"2026-10-15T22:02:36.100Z","title":"wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2025-39999","published":"2025-10-15T07:58:23.038Z","updated":"2026-05-23T16:01:13.466Z","title":"blk-mq: fix blk_mq_tags double free while nr_requests grown","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-39998","published":"2025-10-15T07:58:22.354Z","updated":"2026-10-15T22:02:35.977Z","title":"scsi: target: target_core_configfs: Add length check to avoid buffer overflow","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2025-39997","published":"2025-10-15T07:58:21.702Z","updated":"2026-10-15T01:08:48.788Z","title":"ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2025-39996","published":"2025-10-15T07:58:21.049Z","updated":"2026-05-11T21:40:27.487Z","title":"media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2025-39995","published":"2025-10-15T07:58:20.365Z","updated":"2026-05-11T21:40:26.312Z","title":"media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2025-39994","published":"2025-10-15T07:58:19.503Z","updated":"2026-10-15T22:02:35.851Z","title":"media: tuner: xc5000: Fix use-after-free in xc5000_release","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2025-39993","published":"2025-10-15T07:58:18.621Z","updated":"2026-08-05T12:06:58.054Z","title":"media: rc: fix races with imon_disconnect()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2025-39992","published":"2025-10-15T07:58:17.927Z","updated":"2026-05-11T21:40:22.858Z","title":"mm: swap: check for stable address space before operating on the VMA","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-39991","published":"2025-10-15T07:58:17.257Z","updated":"2026-09-14T11:58:06.488Z","title":"wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-39990","published":"2025-10-15T07:56:07.295Z","updated":"2026-10-21T12:37:41.130Z","title":"bpf: Check the helper function is valid in get_helper_proto","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-39988","published":"2025-10-15T07:56:06.601Z","updated":"2026-08-05T12:06:55.862Z","title":"can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2025-39987","published":"2025-10-15T07:56:05.878Z","updated":"2026-08-05T12:06:54.724Z","title":"can: hi311x: populate ndo_change_mtu() to prevent buffer overflow","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2025-39986","published":"2025-10-15T07:56:05.143Z","updated":"2026-08-05T12:06:53.662Z","title":"can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2025-39985","published":"2025-10-15T07:56:04.439Z","updated":"2026-08-05T12:06:52.589Z","title":"can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2025-39984","published":"2025-10-15T07:56:03.438Z","updated":"2026-05-11T21:40:13.408Z","title":"net: tun: Update napi->skb after XDP process","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-39983","published":"2025-10-15T07:56:02.752Z","updated":"2026-08-05T12:06:51.513Z","title":"Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2025-39982","published":"2025-10-15T07:56:02.024Z","updated":"2026-10-15T22:02:35.601Z","title":"Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2025-39981","published":"2025-10-15T07:56:00.959Z","updated":"2026-10-15T22:02:35.479Z","title":"Bluetooth: MGMT: Fix possible UAFs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-39980","published":"2025-10-15T07:56:00.275Z","updated":"2026-10-15T01:08:47.582Z","title":"nexthop: Forbid FDB status change while nexthop is in a group","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-39979","published":"2025-10-15T07:55:59.609Z","updated":"2026-10-15T22:02:35.358Z","title":"net/mlx5: fs, fix UAF in flow counter release","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-39978","published":"2025-10-15T07:55:58.949Z","updated":"2026-10-15T22:02:35.234Z","title":"octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-39977","published":"2025-10-15T07:55:58.283Z","updated":"2026-10-15T22:02:35.093Z","title":"futex: Prevent use-after-free during requeue-PI","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-39976","published":"2025-10-15T07:55:57.608Z","updated":"2026-08-05T12:06:45.033Z","title":"futex: Use correct exit on failure from futex_hash_allocate_default()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2025-39975","published":"2025-10-15T07:55:56.951Z","updated":"2026-08-05T12:06:43.934Z","title":"smb: client: fix wrong index reference in smb2_compound_op()","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2025-39974","published":"2025-10-15T07:55:56.275Z","updated":"2026-05-11T21:40:01.814Z","title":"tracing/osnoise: Fix slab-out-of-bounds in _parse_integer_limit()","severity":"UNKNOWN","score":null,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2025-39973","published":"2025-10-15T07:55:55.590Z","updated":"2026-10-15T22:02:34.963Z","title":"i40e: add validation for ring_len param","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-39972","published":"2025-10-15T07:55:54.929Z","updated":"2026-10-15T22:02:34.827Z","title":"i40e: fix idx validation in i40e_validate_queue_map","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-39971","published":"2025-10-15T07:55:54.270Z","updated":"2026-08-05T12:06:40.599Z","title":"i40e: fix idx validation in config queues msg","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-39970","published":"2025-10-15T07:55:53.610Z","updated":"2026-10-15T22:02:34.702Z","title":"i40e: fix input validation logic for action_meta","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-39969","published":"2025-10-15T07:55:52.948Z","updated":"2026-10-15T22:02:34.578Z","title":"i40e: fix validation of VF state in get resources","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2025-39968","published":"2025-10-15T07:55:52.272Z","updated":"2026-10-15T22:02:34.443Z","title":"i40e: add max boundary check for VF filters","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2025-39967","published":"2025-10-15T07:55:51.554Z","updated":"2026-08-05T12:06:36.336Z","title":"fbcon: fix integer overflow in fbcon_do_set_font","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-39966","published":"2025-10-15T07:55:50.843Z","updated":"2026-08-05T12:06:35.257Z","title":"iommufd: Fix race during abort for file descriptors","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2025-39965","published":"2025-10-13T13:48:31.033Z","updated":"2026-10-30T12:22:40.645Z","title":"xfrm: xfrm_alloc_spi shouldn't use 0 as SPI","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-39964","published":"2025-10-13T13:48:30.334Z","updated":"2026-10-15T01:08:42.257Z","title":"crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":true,"epss":0.01607,"kevAdded":"2026-09-18"},{"id":"CVE-2025-39963","published":"2025-10-09T12:13:23.345Z","updated":"2026-10-15T22:02:34.193Z","title":"io_uring: fix incorrect io_kiocb reference in io_link_skb","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2025-39962","published":"2025-10-09T12:13:22.684Z","updated":"2026-08-05T12:06:31.023Z","title":"rxrpc: Fix untrusted unsigned subtract","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2025-39961","published":"2025-10-09T12:13:22.029Z","updated":"2026-10-15T22:02:34.065Z","title":"iommu/amd/pgtbl: Fix possible race while increase page table level","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2025-39960","published":"2025-10-09T12:13:21.327Z","updated":"2026-08-05T12:06:28.916Z","title":"gpiolib: acpi: initialize acpi_gpio_info struct","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2025-39959","published":"2025-10-09T09:47:36.274Z","updated":"2026-05-11T21:39:44.137Z","title":"ASoC: amd: acp: Fix incorrect retrival of acp_chip_info","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2025-39958","published":"2025-10-09T09:47:35.601Z","updated":"2026-10-21T12:37:40.041Z","title":"iommu/s390: Make attach succeed when the device was surprise removed","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2025-39957","published":"2025-10-09T09:47:34.933Z","updated":"2026-10-15T22:02:33.942Z","title":"wifi: mac80211: increase scan_ies_len for S1G","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2025-39956","published":"2025-10-09T09:47:34.253Z","updated":"2026-10-15T22:02:33.822Z","title":"igc: don't fail igc_probe() on LED setup error","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-39955","published":"2025-10-09T09:47:33.556Z","updated":"2026-10-15T01:08:40.572Z","title":"tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-39954","published":"2025-10-09T09:47:32.825Z","updated":"2026-05-11T21:39:38.246Z","title":"clk: sunxi-ng: mp: Fix dual-divider clock rate readback","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2023-53687","published":"2025-10-07T15:21:39.542Z","updated":"2026-05-11T19:49:58.704Z","title":"tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2023-53686","published":"2025-10-07T15:21:38.824Z","updated":"2026-05-11T19:49:57.539Z","title":"net/handshake: fix null-ptr-deref in handshake_nl_done_doit()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2023-53685","published":"2025-10-07T15:21:38.124Z","updated":"2026-05-11T19:49:56.394Z","title":"tun: Fix memory leak for detached NAPI queue.","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2023-53684","published":"2025-10-07T15:21:37.413Z","updated":"2026-05-11T19:49:55.229Z","title":"xfrm: Zero padding when dumping algos and encap","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2023-53683","published":"2025-10-07T15:21:36.715Z","updated":"2026-08-05T09:15:32.980Z","title":"fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2023-53682","published":"2025-10-07T15:21:36.020Z","updated":"2026-05-11T19:49:52.940Z","title":"hwmon: (xgene) Fix ioremap and memremap leak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2023-53681","published":"2025-10-07T15:21:35.315Z","updated":"2026-05-11T19:49:51.739Z","title":"bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2023-53680","published":"2025-10-07T15:21:34.626Z","updated":"2026-10-15T21:41:33.489Z","title":"NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2023-53679","published":"2025-10-07T15:21:33.926Z","updated":"2026-10-15T21:41:33.346Z","title":"wifi: mt7601u: fix an integer underflow","severity":"HIGH","score":8.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2023-53678","published":"2025-10-07T15:21:33.220Z","updated":"2026-05-11T19:49:48.108Z","title":"drm/i915: Fix system suspend without fbdev being initialized","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2023-53677","published":"2025-10-07T15:21:32.551Z","updated":"2026-05-11T19:49:46.974Z","title":"drm/i915: Fix memory leaks in i915 selftests","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2023-53676","published":"2025-10-07T15:21:31.757Z","updated":"2026-10-15T21:41:33.205Z","title":"scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2023-53675","published":"2025-10-07T15:21:31.018Z","updated":"2026-10-15T21:41:33.069Z","title":"scsi: ses: Fix possible desc_ptr out-of-bounds accesses","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2023-53674","published":"2025-10-07T15:21:30.320Z","updated":"2026-08-05T09:15:27.585Z","title":"clk: Fix memory leak in devm_clk_notifier_register()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2023-53673","published":"2025-10-07T15:21:29.632Z","updated":"2026-08-05T09:15:26.514Z","title":"Bluetooth: hci_event: call disconnect callback before deleting conn","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2023-53672","published":"2025-10-07T15:21:28.975Z","updated":"2026-05-11T19:49:40.994Z","title":"btrfs: output extra debug info if we failed to find an inline backref","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2023-53671","published":"2025-10-07T15:21:28.307Z","updated":"2026-05-11T19:49:39.852Z","title":"srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2023-53670","published":"2025-10-07T15:21:27.626Z","updated":"2026-05-11T19:49:38.709Z","title":"nvme-core: fix dev_pm_qos memleak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53669","published":"2025-10-07T15:21:26.896Z","updated":"2026-10-15T21:41:32.929Z","title":"tcp: fix skb_copy_ubufs() vs BIG TCP","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2023-53668","published":"2025-10-07T15:21:26.164Z","updated":"2026-05-11T19:49:36.478Z","title":"ring-buffer: Fix deadloop issue on reading trace_pipe","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2023-53667","published":"2025-10-07T15:21:25.185Z","updated":"2026-05-11T19:49:35.341Z","title":"net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2023-53666","published":"2025-10-07T15:21:24.490Z","updated":"2026-05-11T19:49:34.183Z","title":"ASoC: codecs: wcd938x: fix missing mbhc init error handling","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2023-53665","published":"2025-10-07T15:21:23.808Z","updated":"2026-05-11T19:49:33.012Z","title":"md: don't dereference mddev after export_rdev()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2023-53664","published":"2025-10-07T15:21:23.127Z","updated":"2026-05-11T19:49:31.878Z","title":"OPP: Fix potential null ptr dereference in dev_pm_opp_get_required_pstate()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2023-53663","published":"2025-10-07T15:21:22.400Z","updated":"2026-05-11T19:49:30.729Z","title":"KVM: nSVM: Check instead of asserting on nested TSC scaling support","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2023-53662","published":"2025-10-07T15:21:21.703Z","updated":"2026-05-11T19:49:29.602Z","title":"ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup}","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53661","published":"2025-10-07T15:21:20.987Z","updated":"2026-05-11T19:49:28.442Z","title":"bnxt: avoid overflow in bnxt_get_nvram_directory()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53660","published":"2025-10-07T15:21:20.307Z","updated":"2026-08-05T09:15:24.367Z","title":"bpf, cpumap: Handle skb as well when clean up ptr_ring","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2023-53659","published":"2025-10-07T15:21:19.619Z","updated":"2026-10-15T21:41:32.791Z","title":"iavf: Fix out-of-bounds when setting channels on remove","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2023-53658","published":"2025-10-07T15:21:18.950Z","updated":"2026-05-11T19:49:24.804Z","title":"spi: bcm-qspi: return error if neither hif_mspi nor mspi is available","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2023-53657","published":"2025-10-07T15:21:18.268Z","updated":"2026-05-11T19:49:23.683Z","title":"ice: Don't tx before switchdev is fully configured","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2023-53656","published":"2025-10-07T15:21:17.572Z","updated":"2026-05-11T19:49:22.525Z","title":"drivers/perf: hisi: Don't migrate perf to the CPU going to teardown","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2023-53655","published":"2025-10-07T15:21:16.889Z","updated":"2026-05-11T19:49:21.372Z","title":"rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2022-50555","published":"2025-10-07T15:21:16.179Z","updated":"2026-08-05T08:59:07.298Z","title":"tipc: fix a null-ptr-deref in tipc_topsrv_accept","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2022-50554","published":"2025-10-07T15:21:15.438Z","updated":"2026-05-11T19:21:40.212Z","title":"blk-mq: avoid double ->queue_rq() because of early timeout","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2022-50553","published":"2025-10-07T15:21:14.729Z","updated":"2026-05-23T15:24:45.910Z","title":"tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx'","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2022-50552","published":"2025-10-07T15:21:14.060Z","updated":"2026-06-01T16:04:03.010Z","title":"blk-mq: use quiesced elevator switch when reinitializing queues","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2022-50551","published":"2025-10-07T15:21:13.391Z","updated":"2026-05-11T19:21:36.721Z","title":"wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2022-50550","published":"2025-10-07T15:21:12.689Z","updated":"2026-05-11T19:21:35.596Z","title":"blk-iolatency: Fix memory leak on add_disk() failures","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2022-50549","published":"2025-10-07T15:21:12.006Z","updated":"2026-05-11T19:21:34.417Z","title":"dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2022-50548","published":"2025-10-07T15:21:11.318Z","updated":"2026-05-11T19:21:33.266Z","title":"media: i2c: hi846: Fix memory leak in hi846_parse_dt()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2022-50547","published":"2025-10-07T15:21:10.620Z","updated":"2026-05-11T19:21:32.126Z","title":"media: solo6x10: fix possible memory leak in solo_sysfs_init()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2022-50546","published":"2025-10-07T15:21:09.963Z","updated":"2026-05-23T15:24:44.590Z","title":"ext4: fix uninititialized value in 'ext4_evict_inode'","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2022-50545","published":"2025-10-07T15:21:09.288Z","updated":"2026-05-11T19:21:29.824Z","title":"r6040: Fix kmemleak in probe and remove","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2022-50544","published":"2025-10-07T15:21:08.629Z","updated":"2026-05-11T19:21:28.669Z","title":"usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2022-50543","published":"2025-10-07T15:21:07.939Z","updated":"2026-08-05T08:59:06.203Z","title":"RDMA/rxe: Fix mr->map double free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2022-50542","published":"2025-10-07T15:21:07.236Z","updated":"2026-05-11T19:21:26.403Z","title":"media: si470x: Fix use-after-free in si470x_int_in_callback()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2022-50541","published":"2025-10-07T15:21:06.548Z","updated":"2026-05-11T19:21:25.274Z","title":"dmaengine: ti: k3-udma: Reset UDMA_CHAN_RT byte counters to prevent overflow","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2022-50540","published":"2025-10-07T15:21:05.836Z","updated":"2026-05-11T19:21:24.137Z","title":"dmaengine: qcom-adm: fix wrong sizeof config in slave_config","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2022-50539","published":"2025-10-07T15:21:05.152Z","updated":"2026-05-11T19:21:22.998Z","title":"ARM: OMAP2+: omap4-common: Fix refcount leak bug","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2022-50538","published":"2025-10-07T15:21:04.428Z","updated":"2026-05-11T19:21:21.843Z","title":"vme: Fix error not catched in fake_init()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2022-50537","published":"2025-10-07T15:21:03.749Z","updated":"2026-05-23T15:24:41.800Z","title":"firmware: raspberrypi: fix possible memory leak in rpi_firmware_probe()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2022-50536","published":"2025-10-07T15:21:03.056Z","updated":"2026-08-05T08:59:05.133Z","title":"bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2022-50535","published":"2025-10-07T15:21:02.347Z","updated":"2026-08-15T12:23:36.276Z","title":"drm/amd/display: Fix potential null-deref in dm_resume","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53654","published":"2025-10-07T15:19:49.985Z","updated":"2026-05-11T19:49:20.231Z","title":"octeontx2-af: Add validation before accessing cgx and lmac","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2023-53653","published":"2025-10-07T15:19:49.303Z","updated":"2026-05-11T19:49:19.059Z","title":"media: amphion: fix REVERSE_INULL issues reported by coverity","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2023-53652","published":"2025-10-07T15:19:48.628Z","updated":"2026-05-11T19:49:17.925Z","title":"vdpa: Add features attr to vdpa_nl_policy for nlattr length check","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2023-53651","published":"2025-10-07T15:19:47.832Z","updated":"2026-10-30T12:17:32.625Z","title":"Input: exc3000 - properly stop timer on shutdown","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2023-53650","published":"2025-10-07T15:19:47.118Z","updated":"2026-05-11T19:49:15.699Z","title":"fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2023-53649","published":"2025-10-07T15:19:46.459Z","updated":"2026-05-11T19:49:14.554Z","title":"perf trace: Really free the evsel->priv area","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2023-53648","published":"2025-10-07T15:19:45.780Z","updated":"2026-05-11T19:49:13.426Z","title":"ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2023-53647","published":"2025-10-07T15:19:45.083Z","updated":"2026-05-11T19:49:12.279Z","title":"Drivers: hv: vmbus: Don't dereference ACPI root object handle","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2023-53646","published":"2025-10-07T15:19:44.412Z","updated":"2026-08-05T09:15:21.134Z","title":"drm/i915/perf: add sentinel to xehp_oa_b_counters","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2023-53645","published":"2025-10-07T15:19:43.738Z","updated":"2026-08-05T09:15:20.081Z","title":"bpf: Make bpf_refcount_acquire fallible for non-owning refs","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2023-53644","published":"2025-10-07T15:19:43.049Z","updated":"2026-05-11T19:49:08.770Z","title":"media: radio-shark: Add endpoint checks","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53643","published":"2025-10-07T15:19:42.374Z","updated":"2026-10-15T21:41:32.662Z","title":"nvme-tcp: don't access released socket during error recovery","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2023-53642","published":"2025-10-07T15:19:41.693Z","updated":"2026-05-11T19:49:06.313Z","title":"x86: fix clear_user_rep_good() exception handling annotation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53641","published":"2025-10-07T15:19:41.028Z","updated":"2026-05-11T19:49:05.188Z","title":"wifi: ath9k: hif_usb: fix memory leak of remain_skbs","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53640","published":"2025-10-07T15:19:40.348Z","updated":"2026-08-05T09:15:17.951Z","title":"ASoC: lpass: Fix for KASAN use_after_free out of bounds","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2023-53639","published":"2025-10-07T15:19:39.664Z","updated":"2026-05-11T19:49:02.812Z","title":"wifi: ath6kl: reduce WARN to dev_dbg() in callback","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2023-53638","published":"2025-10-07T15:19:38.989Z","updated":"2026-10-15T21:41:32.530Z","title":"octeon_ep: cancel queued works in probe error path","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2023-53637","published":"2025-10-07T15:19:38.317Z","updated":"2026-05-11T19:49:00.502Z","title":"media: i2c: ov772x: Fix memleak in ov772x_probe()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2023-53636","published":"2025-10-07T15:19:37.655Z","updated":"2026-05-11T19:48:59.161Z","title":"clk: microchip: fix potential UAF in auxdev release callback","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2023-53635","published":"2025-10-07T15:19:36.973Z","updated":"2026-10-15T21:41:32.395Z","title":"netfilter: conntrack: fix wrong ct->timeout value","severity":"HIGH","score":8.2,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2023-53634","published":"2025-10-07T15:19:36.306Z","updated":"2026-05-11T19:48:56.832Z","title":"bpf, arm64: Fixed a BTI error on returning to patched function","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2023-53633","published":"2025-10-07T15:19:35.647Z","updated":"2026-05-11T19:48:55.699Z","title":"accel/qaic: Fix a leak in map_user_pages()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2023-53632","published":"2025-10-07T15:19:34.970Z","updated":"2026-05-11T19:48:54.575Z","title":"net/mlx5e: Take RTNL lock when needed before calling xdp_set_features()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2023-53631","published":"2025-10-07T15:19:34.289Z","updated":"2026-05-11T19:48:53.469Z","title":"platform/x86: dell-sysman: Fix reference leak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2023-53630","published":"2025-10-07T15:19:33.623Z","updated":"2026-08-05T09:15:14.724Z","title":"iommufd: Fix unpinning of pages when an access is present","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2023-53629","published":"2025-10-07T15:19:32.960Z","updated":"2026-10-15T21:41:32.249Z","title":"fs: dlm: fix use after free in midcomms commit","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00498,"kevAdded":null},{"id":"CVE-2023-53628","published":"2025-10-07T15:19:32.272Z","updated":"2026-05-11T19:48:50.037Z","title":"drm/amdgpu: drop gfx_v11_0_cp_ecc_error_irq_funcs","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2023-53627","published":"2025-10-07T15:19:31.591Z","updated":"2026-10-03T10:54:58.839Z","title":"scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2023-53626","published":"2025-10-07T15:19:30.895Z","updated":"2026-10-15T21:41:32.111Z","title":"ext4: fix possible double unlock when moving a directory","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2023-53625","published":"2025-10-07T15:19:30.213Z","updated":"2026-05-11T19:48:46.527Z","title":"drm/i915/gvt: fix vgpu debugfs clean in remove","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2023-53624","published":"2025-10-07T15:19:29.545Z","updated":"2026-05-11T19:48:45.406Z","title":"net/sched: sch_fq: fix integer overflow of \"credit\"","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2023-53623","published":"2025-10-07T15:19:28.834Z","updated":"2026-05-11T19:48:44.159Z","title":"mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2023-53622","published":"2025-10-07T15:19:28.146Z","updated":"2026-05-11T19:48:43.034Z","title":"gfs2: Fix possible data races in gfs2_show_options()","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2023-53621","published":"2025-10-07T15:19:27.372Z","updated":"2026-05-11T19:48:41.914Z","title":"memcontrol: ensure memcg acquired by id is properly set up","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2023-53620","published":"2025-10-07T15:19:26.686Z","updated":"2026-05-11T19:48:40.800Z","title":"md: fix soft lockup in status_resync","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2023-53619","published":"2025-10-07T15:19:26.003Z","updated":"2026-10-15T21:41:31.970Z","title":"netfilter: conntrack: Avoid nf_ct_helper_hash uses after free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2023-53618","published":"2025-10-07T15:19:25.303Z","updated":"2026-05-23T15:30:09.733Z","title":"btrfs: reject invalid reloc tree root keys with stack dump","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2023-53617","published":"2025-10-07T15:19:24.618Z","updated":"2026-05-11T19:48:37.351Z","title":"soc: aspeed: socinfo: Add kfree for kstrdup","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2022-50534","published":"2025-10-07T15:19:23.958Z","updated":"2026-05-11T19:21:17.171Z","title":"dm thin: Use last transaction's pmd->root when commit failed","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2022-50533","published":"2025-10-07T15:19:23.277Z","updated":"2026-05-11T19:21:15.984Z","title":"wifi: mac80211: mlme: fix null-ptr deref on failed assoc","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2022-50532","published":"2025-10-07T15:19:22.581Z","updated":"2026-05-11T19:21:14.851Z","title":"scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2022-50531","published":"2025-10-07T15:19:21.911Z","updated":"2026-05-11T19:21:13.642Z","title":"tipc: fix an information leak in tipc_topsrv_kern_subscr","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2022-50530","published":"2025-10-07T15:19:21.259Z","updated":"2026-05-11T19:21:12.557Z","title":"blk-mq: fix null pointer dereference in blk_mq_clear_rq_mapping()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2022-50529","published":"2025-10-07T15:19:20.581Z","updated":"2026-05-11T19:21:11.394Z","title":"test_firmware: fix memory leak in test_firmware_init()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2022-50528","published":"2025-10-07T15:19:19.909Z","updated":"2026-10-15T21:41:21.858Z","title":"drm/amdkfd: Fix memory leakage","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2022-50527","published":"2025-10-07T15:19:19.238Z","updated":"2026-08-15T12:23:35.196Z","title":"drm/amdgpu: Fix size validation for non-exclusive domains (v4)","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2022-50526","published":"2025-10-07T15:19:18.586Z","updated":"2026-05-11T19:21:07.988Z","title":"drm/msm/dp: fix memory corruption with too many bridges","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2022-50525","published":"2025-10-07T15:19:17.929Z","updated":"2026-05-11T19:21:06.848Z","title":"iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2022-50524","published":"2025-10-07T15:19:17.251Z","updated":"2026-05-11T19:21:05.702Z","title":"iommu/mediatek: Check return value after calling platform_get_resource()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2022-50523","published":"2025-10-07T15:19:16.595Z","updated":"2026-05-11T19:21:04.545Z","title":"clk: rockchip: Fix memory leak in rockchip_clk_register_pll()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2022-50522","published":"2025-10-07T15:19:15.923Z","updated":"2026-05-11T19:21:03.379Z","title":"mcb: mcb-parse: fix error handing in chameleon_parse_gdd()","severity":"LOW","score":3.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2022-50521","published":"2025-10-07T15:19:15.213Z","updated":"2026-05-11T19:21:02.240Z","title":"platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2022-50520","published":"2025-10-07T15:19:14.528Z","updated":"2026-05-23T15:24:39.058Z","title":"drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2022-50519","published":"2025-10-07T15:19:13.844Z","updated":"2026-05-11T19:20:59.965Z","title":"nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2022-50518","published":"2025-10-07T15:19:13.040Z","updated":"2026-08-05T08:59:02.991Z","title":"parisc: Fix locking in pdc_iodc_print() firmware call","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00139,"kevAdded":null},{"id":"CVE-2022-50517","published":"2025-10-07T15:19:12.344Z","updated":"2026-08-05T08:59:01.931Z","title":"mm/huge_memory: do not clobber swp_entry_t during THP split","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2022-50516","published":"2025-10-07T15:19:11.657Z","updated":"2026-05-11T19:20:56.486Z","title":"fs: dlm: fix invalid derefence of sb_lvbptr","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2022-50515","published":"2025-10-07T15:19:10.970Z","updated":"2026-05-23T15:24:36.376Z","title":"drm/amdgpu: Fix memory leak in hpd_rx_irq_create_workqueue()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2022-50514","published":"2025-10-07T15:19:10.253Z","updated":"2026-05-11T19:20:54.138Z","title":"usb: gadget: f_hid: fix refcount leak on error path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2022-50513","published":"2025-10-07T15:19:09.547Z","updated":"2026-05-11T19:20:52.983Z","title":"staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2022-50512","published":"2025-10-07T15:19:08.854Z","updated":"2026-05-11T19:20:51.832Z","title":"ext4: fix potential memory leak in ext4_fc_record_regions()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2022-50511","published":"2025-10-07T15:19:08.159Z","updated":"2026-05-11T19:20:50.723Z","title":"lib/fonts: fix undefined behavior in bit shift for get_default_font","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2022-50510","published":"2025-10-07T15:19:07.425Z","updated":"2026-05-11T19:20:49.604Z","title":"perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2022-50509","published":"2025-10-07T15:19:06.661Z","updated":"2026-05-11T19:20:48.461Z","title":"media: coda: Add check for kmalloc","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2023-53616","published":"2025-10-04T15:44:23.056Z","updated":"2026-08-05T09:15:09.391Z","title":"jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2023-53615","published":"2025-10-04T15:44:22.376Z","updated":"2026-08-05T09:15:08.308Z","title":"scsi: qla2xxx: Fix deletion race condition","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2023-53614","published":"2025-10-04T15:44:21.671Z","updated":"2026-05-11T19:48:33.960Z","title":"mm/ksm: fix race with VMA iteration and mm_struct teardown","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00108,"kevAdded":null},{"id":"CVE-2023-53613","published":"2025-10-04T15:44:20.998Z","updated":"2026-05-11T19:48:32.814Z","title":"dax: Fix dax_mapping_release() use after free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2023-53612","published":"2025-10-04T15:44:20.297Z","updated":"2026-05-11T19:48:31.527Z","title":"hwmon: (coretemp) Simplify platform device handling","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2023-53611","published":"2025-10-04T15:44:19.593Z","updated":"2026-05-11T19:48:30.412Z","title":"ipmi_si: fix a memleak in try_smi_init()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2023-53610","published":"2025-10-04T15:44:18.863Z","updated":"2026-05-11T19:48:29.261Z","title":"irqchip: Fix refcount leak in platform_irqchip_probe","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2023-53609","published":"2025-10-04T15:44:18.151Z","updated":"2026-10-15T21:41:31.827Z","title":"scsi: Revert \"scsi: core: Do not increase scsi_device's iorequest_cnt if dispatch failed\"","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2023-53608","published":"2025-10-04T15:44:17.302Z","updated":"2026-08-05T09:15:06.157Z","title":"nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2023-53607","published":"2025-10-04T15:44:16.598Z","updated":"2026-05-23T15:30:04.069Z","title":"ALSA: ymfpci: Fix BUG_ON in probe function","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2023-53606","published":"2025-10-04T15:44:15.908Z","updated":"2026-10-15T21:41:31.680Z","title":"nfsd: clean up potential nfsd_file refcount leaks in COPY codepath","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00286,"kevAdded":null},{"id":"CVE-2023-53605","published":"2025-10-04T15:44:15.231Z","updated":"2026-05-11T19:48:23.585Z","title":"drm: amd: display: Fix memory leakage","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2023-53604","published":"2025-10-04T15:44:14.568Z","updated":"2026-05-11T19:48:22.435Z","title":"dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53603","published":"2025-10-04T15:44:13.820Z","updated":"2026-05-23T15:29:59.782Z","title":"scsi: qla2xxx: Avoid fcport pointer dereference","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2023-53602","published":"2025-10-04T15:44:13.155Z","updated":"2026-05-11T19:48:20.073Z","title":"wifi: ath11k: fix memory leak in WMI firmware stats","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2023-53601","published":"2025-10-04T15:44:12.477Z","updated":"2026-05-11T19:48:18.942Z","title":"bonding: do not assume skb mac_header is set","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2023-53600","published":"2025-10-04T15:44:11.775Z","updated":"2026-10-15T21:41:31.545Z","title":"tunnels: fix kasan splat when generating ipv4 pmtu error","severity":"CRITICAL","score":9.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00297,"kevAdded":null},{"id":"CVE-2023-53599","published":"2025-10-04T15:44:11.096Z","updated":"2026-08-05T09:15:02.975Z","title":"crypto: af_alg - Fix missing initialisation affecting gcm-aes-s390","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2023-53598","published":"2025-10-04T15:44:10.380Z","updated":"2026-10-15T21:41:31.407Z","title":"bus: mhi: host: Range check CHDBOFF and ERDBOFF","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2023-53597","published":"2025-10-04T15:44:09.616Z","updated":"2026-08-05T09:15:00.757Z","title":"cifs: fix mid leak during reconnection after timeout threshold","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00286,"kevAdded":null},{"id":"CVE-2023-53596","published":"2025-10-04T15:44:08.942Z","updated":"2026-06-01T16:04:17.609Z","title":"drivers: base: Free devm resources when unregistering a device","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2023-53595","published":"2025-10-04T15:44:08.261Z","updated":"2026-05-11T19:48:11.183Z","title":"octeontx2-pf: mcs: Fix NULL pointer dereferences","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2023-53594","published":"2025-10-04T15:44:07.533Z","updated":"2026-05-23T15:29:54.504Z","title":"driver core: fix resource leak in device_add()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2023-53593","published":"2025-10-04T15:44:06.853Z","updated":"2026-05-11T19:48:06.154Z","title":"cifs: Release folio lock on fscache read hit.","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2023-53592","published":"2025-10-04T15:44:06.162Z","updated":"2026-05-11T19:48:04.965Z","title":"gpio: sifive: Fix refcount leak in sifive_gpio_probe","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2023-53591","published":"2025-10-04T15:44:05.430Z","updated":"2026-05-23T15:29:50.882Z","title":"net/mlx5e: Fix deadlock in tc route query code","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2023-53590","published":"2025-10-04T15:44:04.733Z","updated":"2026-05-23T15:29:48.061Z","title":"sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00121,"kevAdded":null},{"id":"CVE-2023-53589","published":"2025-10-04T15:44:04.047Z","updated":"2026-10-15T21:41:31.264Z","title":"wifi: iwlwifi: mvm: don't trust firmware n_channels","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2023-53588","published":"2025-10-04T15:44:03.354Z","updated":"2026-05-11T19:47:58.431Z","title":"wifi: mac80211: check for station first in client probe","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2023-53587","published":"2025-10-04T15:44:02.679Z","updated":"2026-10-15T21:41:31.118Z","title":"ring-buffer: Sync IRQ works before buffer destruction","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2023-53586","published":"2025-10-04T15:44:01.809Z","updated":"2026-08-05T09:14:57.558Z","title":"scsi: target: Fix multiple LUN_RESET handling","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00458,"kevAdded":null},{"id":"CVE-2023-53585","published":"2025-10-04T15:44:01.022Z","updated":"2026-05-11T19:47:54.787Z","title":"bpf: reject unhashed sockets in bpf_sk_assign","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53584","published":"2025-10-04T15:43:59.835Z","updated":"2026-05-11T19:47:53.655Z","title":"ubifs: ubifs_releasepage: Remove ubifs_assert(0) to valid this process","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2023-53583","published":"2025-10-04T15:43:59.154Z","updated":"2026-05-11T19:47:52.528Z","title":"perf: RISC-V: Remove PERF_HES_STOPPED flag checking in riscv_pmu_start()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2023-53582","published":"2025-10-04T15:43:58.493Z","updated":"2026-05-11T19:47:51.395Z","title":"wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53581","published":"2025-10-04T15:43:57.758Z","updated":"2026-05-11T19:47:50.214Z","title":"net/mlx5e: Check for NOT_READY flag state after locking","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2023-53580","published":"2025-10-04T15:43:57.064Z","updated":"2026-08-05T09:14:56.489Z","title":"USB: Gadget: core: Help prevent panic during UVC unconfigure","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2022-50508","published":"2025-10-04T15:43:56.372Z","updated":"2026-08-05T08:59:00.865Z","title":"wifi: mt76: mt76x0: fix oob access in mt76x0_phy_get_target_power","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2022-50507","published":"2025-10-04T15:43:55.675Z","updated":"2026-08-15T12:23:34.113Z","title":"fs/ntfs3: Validate data run offset","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2022-50506","published":"2025-10-04T15:43:54.955Z","updated":"2026-05-11T19:20:44.998Z","title":"drbd: only clone bio if we have a backing device","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2022-50505","published":"2025-10-04T15:43:54.265Z","updated":"2026-05-11T19:20:43.821Z","title":"iommu/amd: Fix pci device refcount leak in ppr_notifier()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2022-50504","published":"2025-10-04T15:43:53.523Z","updated":"2026-05-11T19:20:42.680Z","title":"powerpc/rtas: avoid scheduling in rtas_os_term()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2022-50503","published":"2025-10-04T15:43:52.845Z","updated":"2026-05-11T19:20:41.530Z","title":"mtd: lpddr2_nvm: Fix possible null-ptr-deref","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2022-50501","published":"2025-10-04T15:43:51.498Z","updated":"2026-05-11T19:20:40.366Z","title":"media: coda: Add check for dcoda_iram_alloc","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2022-50500","published":"2025-10-04T15:43:50.792Z","updated":"2026-05-11T19:20:39.281Z","title":"netdevsim: fix memory leak in nsim_drv_probe() when nsim_dev_resources_register() failed","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2022-50499","published":"2025-10-04T15:43:50.064Z","updated":"2026-05-23T15:24:34.965Z","title":"media: dvb-core: Fix double free in dvb_register_device()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2022-50498","published":"2025-10-04T15:43:49.383Z","updated":"2026-05-11T19:20:36.875Z","title":"eth: alx: take rtnl_lock on resume","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2022-50497","published":"2025-10-04T15:43:48.656Z","updated":"2026-05-11T19:20:35.762Z","title":"binfmt_misc: fix shift-out-of-bounds in check_special_flags","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2022-50496","published":"2025-10-04T15:43:47.948Z","updated":"2026-05-11T19:20:34.603Z","title":"dm cache: Fix UAF in destroy()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2022-50494","published":"2025-10-04T15:43:46.562Z","updated":"2026-05-11T19:20:33.464Z","title":"thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2022-50493","published":"2025-10-04T15:43:45.895Z","updated":"2026-10-15T21:41:21.723Z","title":"scsi: qla2xxx: Fix crash when I/O abort times out","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2022-50492","published":"2025-10-04T15:43:45.204Z","updated":"2026-08-05T08:58:57.602Z","title":"drm/msm: fix use-after-free on probe deferral","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2022-50491","published":"2025-10-04T15:43:44.470Z","updated":"2026-05-11T19:20:30.117Z","title":"coresight: cti: Fix hang in cti_disable_hw()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2022-50490","published":"2025-10-04T15:43:43.790Z","updated":"2026-10-15T21:41:21.599Z","title":"bpf: Propagate error from htab_lock_bucket() to userspace","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2022-50489","published":"2025-10-04T15:43:43.124Z","updated":"2026-05-11T19:20:27.824Z","title":"drm/mipi-dsi: Detach devices when removing the host","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2022-50488","published":"2025-10-04T15:43:42.352Z","updated":"2026-10-15T21:41:21.456Z","title":"block, bfq: fix possible uaf for 'bfqq->bic'","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2023-53579","published":"2025-10-04T15:17:18.040Z","updated":"2026-05-23T15:29:40.585Z","title":"gpio: mvebu: fix irq domain leak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2023-53578","published":"2025-10-04T15:17:17.350Z","updated":"2026-05-11T19:47:46.809Z","title":"net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2023-53577","published":"2025-10-04T15:17:16.632Z","updated":"2026-08-05T09:14:55.401Z","title":"bpf, cpumap: Make sure kthread is running before map update returns","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2023-53576","published":"2025-10-04T15:17:15.931Z","updated":"2026-05-11T19:47:44.323Z","title":"null_blk: Always check queue mode setting from configfs","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2023-53575","published":"2025-10-04T15:17:15.224Z","updated":"2026-05-11T19:47:43.191Z","title":"wifi: iwlwifi: mvm: fix potential array out of bounds access","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2023-53574","published":"2025-10-04T15:17:14.532Z","updated":"2026-10-03T10:54:57.740Z","title":"wifi: rtw88: delete timer and free skb queue when unloading","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2023-53573","published":"2025-10-04T15:17:13.872Z","updated":"2026-05-23T15:29:37.444Z","title":"clk: rs9: Fix suspend/resume","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2023-53572","published":"2025-10-04T15:17:13.089Z","updated":"2026-08-05T09:14:54.320Z","title":"clk: imx: scu: use _safe list iterator to avoid a use after free","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2023-53571","published":"2025-10-04T15:17:12.304Z","updated":"2026-05-11T19:47:32.643Z","title":"drm/i915: Make intel_get_crtc_new_encoder() less oopsy","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2023-53570","published":"2025-10-04T15:17:11.525Z","updated":"2026-08-05T09:14:53.243Z","title":"wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2023-53569","published":"2025-10-04T15:17:10.734Z","updated":"2026-05-11T19:47:30.361Z","title":"ext2: Check block size validity during mount","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2023-53568","published":"2025-10-04T15:17:10.044Z","updated":"2026-05-11T19:47:29.216Z","title":"s390/zcrypt: don't leak memory if dev_set_name() fails","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2023-53567","published":"2025-10-04T15:17:09.350Z","updated":"2026-05-11T19:47:28.004Z","title":"spi: qup: Don't skip cleanup in remove's error path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2023-53566","published":"2025-10-04T15:17:08.598Z","updated":"2026-10-15T21:41:30.987Z","title":"netfilter: nft_set_rbtree: fix null deref on element insertion","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2023-53565","published":"2025-10-04T15:17:07.921Z","updated":"2026-05-11T19:47:25.729Z","title":"wifi: brcmfmac: Check for probe() id argument being NULL","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2023-53564","published":"2025-10-04T15:17:07.114Z","updated":"2026-05-11T19:47:24.582Z","title":"ocfs2: fix defrag path triggering jbd2 ASSERT","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2023-53563","published":"2025-10-04T15:17:06.340Z","updated":"2026-05-11T19:47:23.424Z","title":"cpufreq: amd-pstate-ut: Fix kernel panic when loading the driver","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2023-53562","published":"2025-10-04T15:17:05.652Z","updated":"2026-05-23T15:29:30.764Z","title":"drm/msm: fix vram leak on bind errors","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2023-53561","published":"2025-10-04T15:17:05.000Z","updated":"2026-05-11T19:47:21.192Z","title":"net: wwan: iosm: fix NULL pointer dereference when removing device","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2023-53560","published":"2025-10-04T15:17:04.299Z","updated":"2026-10-15T21:41:30.854Z","title":"tracing/histograms: Add histograms to hist_vars if they have referenced variables","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2023-53559","published":"2025-10-04T15:17:03.497Z","updated":"2026-08-05T09:14:50.051Z","title":"ip_vti: fix potential slab-use-after-free in decode_session6","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2023-53558","published":"2025-10-04T15:17:02.822Z","updated":"2026-05-11T19:47:17.694Z","title":"rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2023-53557","published":"2025-10-04T15:17:02.077Z","updated":"2026-10-15T21:41:30.540Z","title":"fprobe: Release rethook after the ftrace_ops is unregistered","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2023-53556","published":"2025-10-04T15:17:01.238Z","updated":"2026-08-05T09:14:47.905Z","title":"iavf: Fix use-after-free in free_netdev","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2023-53555","published":"2025-10-04T15:17:00.514Z","updated":"2026-05-11T19:47:14.324Z","title":"mm/damon/core: initialize damo_filter->list from damos_new_filter()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2023-53554","published":"2025-10-04T15:16:59.749Z","updated":"2026-08-05T09:14:46.814Z","title":"staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2023-53553","published":"2025-10-04T15:16:59.091Z","updated":"2026-05-11T19:47:11.954Z","title":"HID: hyperv: avoid struct memcpy overrun warning","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2023-53552","published":"2025-10-04T15:16:58.429Z","updated":"2026-08-05T09:14:45.743Z","title":"drm/i915: mark requests for GuC virtual engines to avoid use-after-free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2023-53551","published":"2025-10-04T15:16:57.736Z","updated":"2026-05-11T19:47:09.678Z","title":"usb: gadget: u_serial: Add null pointer check in gserial_resume","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53550","published":"2025-10-04T15:16:57.061Z","updated":"2026-05-11T19:47:08.498Z","title":"cpufreq: amd-pstate: fix global sysfs attribute type","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2023-53549","published":"2025-10-04T15:16:56.382Z","updated":"2026-05-23T15:29:28.550Z","title":"netfilter: ipset: Rework long task execution when adding/deleting entries","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2023-53548","published":"2025-10-04T15:16:55.612Z","updated":"2026-05-11T19:47:06.180Z","title":"net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53547","published":"2025-10-04T15:16:54.794Z","updated":"2026-05-11T19:47:05.034Z","title":"drm/amdgpu: Fix sdma v4 sw fini error","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2023-53546","published":"2025-10-04T15:16:54.132Z","updated":"2026-05-11T19:47:03.901Z","title":"net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53545","published":"2025-10-04T15:16:53.452Z","updated":"2026-08-05T09:14:44.686Z","title":"drm/amdgpu: unmap and remove csa_va properly","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2023-53544","published":"2025-10-04T15:16:52.791Z","updated":"2026-05-11T19:47:01.512Z","title":"cpufreq: davinci: Fix clk use after free","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2023-53543","published":"2025-10-04T15:16:52.114Z","updated":"2026-06-01T16:04:13.122Z","title":"vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2023-53542","published":"2025-10-04T15:16:51.440Z","updated":"2026-05-11T19:46:59.187Z","title":"ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53541","published":"2025-10-04T15:16:50.765Z","updated":"2026-05-11T19:46:58.053Z","title":"mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2023-53540","published":"2025-10-04T15:16:50.079Z","updated":"2026-10-15T21:41:30.375Z","title":"wifi: cfg80211: reject auth/assoc to AP with our address","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2023-53539","published":"2025-10-04T15:16:49.379Z","updated":"2026-08-05T09:14:42.566Z","title":"RDMA/rxe: Fix incomplete state save in rxe_requester","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2023-53538","published":"2025-10-04T15:16:48.694Z","updated":"2026-10-03T10:54:56.659Z","title":"btrfs: insert tree mod log move in push_node_left","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2023-53537","published":"2025-10-04T15:16:48.006Z","updated":"2026-08-05T09:14:41.501Z","title":"f2fs: fix to avoid use-after-free for cached IPU bio","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2023-53536","published":"2025-10-04T15:16:47.304Z","updated":"2026-08-05T09:14:40.430Z","title":"blk-crypto: make blk_crypto_evict_key() more robust","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2023-53535","published":"2025-10-04T15:16:46.583Z","updated":"2026-10-15T21:41:30.176Z","title":"net: bcmgenet: Add a check for oversized packets","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2023-53534","published":"2025-10-04T15:16:45.909Z","updated":"2026-05-11T19:46:50.078Z","title":"drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2023-53533","published":"2025-10-04T15:16:45.207Z","updated":"2026-05-11T19:46:48.942Z","title":"Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2022-50486","published":"2025-10-04T15:16:43.791Z","updated":"2026-05-11T19:20:25.437Z","title":"net: ethernet: ti: Fix return type of netcp_ndo_start_xmit()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2022-50485","published":"2025-10-04T15:16:43.093Z","updated":"2026-05-11T19:20:24.290Z","title":"ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2022-50484","published":"2025-10-04T15:16:42.385Z","updated":"2026-05-11T19:20:23.113Z","title":"ALSA: usb-audio: Fix potential memory leaks","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2022-50483","published":"2025-10-04T15:16:41.703Z","updated":"2026-08-05T08:58:54.379Z","title":"net: enetc: avoid buffer leaks on xdp_do_redirect() failure","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00436,"kevAdded":null},{"id":"CVE-2022-50482","published":"2025-10-04T15:16:41.033Z","updated":"2026-05-11T19:20:20.843Z","title":"iommu/vt-d: Clean up si_domain in the init_dmars() error path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2022-50481","published":"2025-10-04T15:16:40.374Z","updated":"2026-05-11T19:20:19.702Z","title":"cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2022-50480","published":"2025-10-04T15:16:39.704Z","updated":"2026-05-11T19:20:18.550Z","title":"memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2022-50479","published":"2025-10-04T15:16:39.021Z","updated":"2026-08-15T12:23:33.018Z","title":"drm/amd: fix potential memory leak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2022-50478","published":"2025-10-04T15:16:38.346Z","updated":"2026-05-11T19:20:16.210Z","title":"nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2022-50477","published":"2025-10-04T15:16:37.654Z","updated":"2026-05-11T19:20:15.051Z","title":"rtc: class: Fix potential memleak in devm_rtc_allocate_device()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2022-50476","published":"2025-10-04T15:16:36.895Z","updated":"2026-05-11T19:20:13.817Z","title":"ntb_netdev: Use dev_kfree_skb_any() in interrupt context","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2022-50475","published":"2025-10-04T15:16:36.235Z","updated":"2026-05-11T19:20:12.658Z","title":"RDMA/core: Make sure \"ib_port\" is valid when access sysfs node","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2022-50474","published":"2025-10-04T15:16:35.537Z","updated":"2026-05-11T19:20:11.509Z","title":"macintosh: fix possible memory leak in macio_add_one_device()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2022-50473","published":"2025-10-04T15:16:34.859Z","updated":"2026-05-23T15:24:31.068Z","title":"cpufreq: Init completion before kobject_init_and_add()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2022-50472","published":"2025-10-04T15:16:34.180Z","updated":"2026-10-15T21:31:20.681Z","title":"IB/mad: Don't call to function that might sleep while in atomic context","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00367,"kevAdded":null},{"id":"CVE-2022-50471","published":"2025-10-04T15:16:33.489Z","updated":"2026-05-11T19:20:07.965Z","title":"xen/gntdev: Accommodate VMA splitting","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2022-50470","published":"2025-10-04T15:16:32.764Z","updated":"2026-05-11T19:20:06.795Z","title":"xhci: Remove device endpoints from bandwidth list when freeing the device","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00172,"kevAdded":null},{"id":"CVE-2025-39953","published":"2025-10-04T07:31:13.237Z","updated":"2026-10-15T01:08:38.925Z","title":"cgroup: split cgroup_destroy_wq into 3 workqueues","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2025-39952","published":"2025-10-04T07:31:12.445Z","updated":"2026-10-30T12:22:39.571Z","title":"wifi: wilc1000: avoid buffer overflow in WID string configuration","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-39951","published":"2025-10-04T07:31:11.684Z","updated":"2026-08-05T12:06:24.628Z","title":"um: virtio_uml: Fix use-after-free after put_device in probe","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-39950","published":"2025-10-04T07:31:10.926Z","updated":"2026-05-11T21:39:33.592Z","title":"net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-39949","published":"2025-10-04T07:31:10.164Z","updated":"2026-08-05T12:06:23.545Z","title":"qed: Don't collect too many protection override GRC elements","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2025-39948","published":"2025-10-04T07:31:09.403Z","updated":"2026-10-21T12:37:38.940Z","title":"ice: fix Rx page leak on multi-buffer frames","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2025-39947","published":"2025-10-04T07:31:08.636Z","updated":"2026-05-11T21:39:30.137Z","title":"net/mlx5e: Harden uplink netdev access against device unbind","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2025-39946","published":"2025-10-04T07:31:07.871Z","updated":"2026-08-05T12:06:21.386Z","title":"tls: make sure to abort the stream if headers are bogus","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.10258,"kevAdded":null},{"id":"CVE-2025-39945","published":"2025-10-04T07:31:07.109Z","updated":"2026-08-05T12:06:20.222Z","title":"cnic: Fix use-after-free bugs in cnic_delete_task","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2025-39944","published":"2025-10-04T07:31:06.339Z","updated":"2026-10-15T22:02:33.699Z","title":"octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2025-39943","published":"2025-10-04T07:31:05.581Z","updated":"2026-08-05T12:06:18.093Z","title":"ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer","severity":"CRITICAL","score":9.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2025-39942","published":"2025-10-04T07:31:04.810Z","updated":"2026-08-05T12:06:17.026Z","title":"ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00286,"kevAdded":null},{"id":"CVE-2025-39941","published":"2025-10-04T07:31:04.080Z","updated":"2026-08-05T12:06:15.944Z","title":"zram: fix slot write race condition","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00101,"kevAdded":null},{"id":"CVE-2025-39940","published":"2025-10-04T07:31:03.309Z","updated":"2026-10-21T12:37:37.824Z","title":"dm-stripe: fix a possible integer overflow","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2025-39939","published":"2025-10-04T07:31:02.521Z","updated":"2026-10-15T22:02:33.574Z","title":"iommu/s390: Fix memory corruption when using identity domain","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2025-39938","published":"2025-10-04T07:31:01.736Z","updated":"2026-05-11T21:39:19.660Z","title":"ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-39937","published":"2025-10-04T07:31:00.879Z","updated":"2026-05-11T21:39:18.519Z","title":"net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2025-39936","published":"2025-10-04T07:30:59.857Z","updated":"2026-07-24T14:33:25.404Z","title":"crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2025-39935","published":"2025-10-04T07:30:59.102Z","updated":"2026-08-05T12:06:13.802Z","title":"ASoC: codec: sma1307: Fix memory corruption in sma1307_setting_loaded()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2025-39934","published":"2025-10-04T07:30:58.284Z","updated":"2026-05-11T21:39:14.992Z","title":"drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2025-39933","published":"2025-10-04T07:30:57.496Z","updated":"2026-10-30T12:22:38.495Z","title":"smb: client: let recv_done verify data_offset, data_length and remaining_data_length","severity":"CRITICAL","score":9.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00347,"kevAdded":null},{"id":"CVE-2025-39932","published":"2025-10-04T07:30:56.726Z","updated":"2026-10-30T12:22:37.422Z","title":"smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2025-39931","published":"2025-10-04T07:30:55.964Z","updated":"2026-10-15T22:02:33.324Z","title":"crypto: af_alg - Set merge to zero early in af_alg_sendmsg","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2025-39929","published":"2025-10-04T07:30:55.153Z","updated":"2026-10-15T22:02:33.170Z","title":"smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2023-53532","published":"2025-10-01T11:46:16.713Z","updated":"2026-05-11T19:46:47.827Z","title":"wifi: ath11k: fix deinitialization of firmware resources","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2023-53531","published":"2025-10-01T11:46:15.949Z","updated":"2026-08-05T09:14:38.269Z","title":"null_blk: fix poll request timeout handling","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2023-53530","published":"2025-10-01T11:46:15.075Z","updated":"2026-05-11T19:46:45.450Z","title":"scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2023-53529","published":"2025-10-01T11:46:14.358Z","updated":"2026-05-11T19:46:44.263Z","title":"wifi: rtw88: Fix memory leak in rtw88_usb","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2023-53528","published":"2025-10-01T11:46:13.504Z","updated":"2026-05-11T19:46:43.116Z","title":"RDMA/rxe: Fix unsafe drain work queue code","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2023-53527","published":"2025-10-01T11:46:12.696Z","updated":"2026-05-11T19:46:41.950Z","title":"thunderbolt: Fix memory leak in tb_handle_dp_bandwidth_request()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2023-53526","published":"2025-10-01T11:46:11.862Z","updated":"2026-10-15T21:41:30.040Z","title":"jbd2: check 'jh->b_transaction' before removing it from checkpoint","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2023-53525","published":"2025-10-01T11:46:11.188Z","updated":"2026-05-23T15:29:20.818Z","title":"RDMA/cma: Allow UD qp_type to join multicast only","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2023-53524","published":"2025-10-01T11:46:10.397Z","updated":"2026-05-11T19:46:38.536Z","title":"wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2023-53523","published":"2025-10-01T11:46:09.632Z","updated":"2026-10-30T12:17:31.534Z","title":"can: gs_usb: fix time stamp counter initialization","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2023-53522","published":"2025-10-01T11:46:08.909Z","updated":"2026-05-11T19:46:36.143Z","title":"cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2023-53521","published":"2025-10-01T11:46:08.131Z","updated":"2026-05-11T19:46:35.012Z","title":"scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2023-53520","published":"2025-10-01T11:46:07.355Z","updated":"2026-10-15T21:41:29.915Z","title":"Bluetooth: Fix hci_suspend_sync crash","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2023-53519","published":"2025-10-01T11:46:06.419Z","updated":"2026-05-11T19:46:32.646Z","title":"media: v4l2-mem2mem: add lock to protect parameter num_rdy","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2023-53518","published":"2025-10-01T11:46:05.446Z","updated":"2026-10-15T21:41:29.791Z","title":"PM / devfreq: Fix leak in devfreq_dev_release()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53517","published":"2025-10-01T11:46:04.673Z","updated":"2026-10-15T21:41:29.651Z","title":"tipc: do not update mtu if msg_max is too small in mtu negotiation","severity":"CRITICAL","score":9.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2023-53516","published":"2025-10-01T11:46:03.878Z","updated":"2026-05-11T19:46:29.202Z","title":"macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2023-53515","published":"2025-10-01T11:46:03.192Z","updated":"2026-05-11T19:46:28.049Z","title":"virtio-mmio: don't break lifecycle of vm_dev","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2023-53514","published":"2025-10-01T11:46:02.393Z","updated":"2026-05-11T19:46:26.888Z","title":"gpu: host1x: Fix memory leak of device names","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2023-53513","published":"2025-10-01T11:46:01.717Z","updated":"2026-06-11T18:44:23.322Z","title":"nbd: fix incomplete validation of ioctl arg","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00149,"kevAdded":null},{"id":"CVE-2023-53512","published":"2025-10-01T11:46:00.888Z","updated":"2026-05-11T19:46:24.566Z","title":"scsi: mpt3sas: Fix a memory leak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2023-53511","published":"2025-10-01T11:46:00.185Z","updated":"2026-05-23T15:29:17.822Z","title":"io_uring: fix fget leak when fs don't support nowait buffered read","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2023-53510","published":"2025-10-01T11:45:59.421Z","updated":"2026-08-05T09:14:32.898Z","title":"scsi: ufs: core: Fix handling of lrbp->cmd","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2023-53509","published":"2025-10-01T11:45:58.762Z","updated":"2026-05-11T19:46:21.126Z","title":"qed: allow sleep in qed_mcp_trace_dump()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2023-53508","published":"2025-10-01T11:45:58.042Z","updated":"2026-05-11T19:46:19.983Z","title":"ublk: fail to start device if queue setup is interrupted","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2023-53507","published":"2025-10-01T11:45:57.310Z","updated":"2026-05-11T19:46:18.867Z","title":"net/mlx5: Unregister devlink params in case interface is down","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2023-53506","published":"2025-10-01T11:45:56.616Z","updated":"2026-10-15T21:41:29.526Z","title":"udf: Do not bother merging very long extents","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2023-53505","published":"2025-10-01T11:45:55.859Z","updated":"2026-05-11T19:46:16.541Z","title":"clk: tegra: tegra124-emc: Fix potential memory leak","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53504","published":"2025-10-01T11:45:54.977Z","updated":"2026-10-15T21:41:29.404Z","title":"RDMA/bnxt_re: Properly order ib_device_unalloc() to avoid UAF","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2023-53503","published":"2025-10-01T11:45:54.052Z","updated":"2026-05-11T19:46:14.267Z","title":"ext4: allow ext4_get_group_info() to fail","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2023-53501","published":"2025-10-01T11:45:52.204Z","updated":"2026-05-11T19:46:13.112Z","title":"iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2023-53500","published":"2025-10-01T11:45:51.182Z","updated":"2026-10-15T21:41:29.274Z","title":"xfrm: fix slab-use-after-free in decode_session6","severity":"HIGH","score":7.3,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2023-53499","published":"2025-10-01T11:45:50.367Z","updated":"2026-10-15T21:41:29.137Z","title":"virtio_net: Fix error unwinding of XDP initialization","severity":"HIGH","score":7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53498","published":"2025-10-01T11:45:49.549Z","updated":"2026-05-11T19:46:09.699Z","title":"drm/amd/display: Fix potential null dereference","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53497","published":"2025-10-01T11:45:48.728Z","updated":"2026-05-11T19:46:08.572Z","title":"media: vsp1: Replace vb2_is_streaming() with vb2_start_streaming_called()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2023-53496","published":"2025-10-01T11:45:47.807Z","updated":"2026-05-11T19:46:07.408Z","title":"x86/platform/uv: Use alternate source for socket to node data","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2023-53495","published":"2025-10-01T11:45:46.877Z","updated":"2026-08-05T09:14:27.541Z","title":"net: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2023-53494","published":"2025-10-01T11:45:45.773Z","updated":"2026-08-05T09:14:26.466Z","title":"crypto: xts - Handle EBUSY correctly","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2023-53493","published":"2025-10-01T11:45:44.939Z","updated":"2026-08-05T09:14:25.393Z","title":"accel/qaic: tighten bounds checking in decode_message()","severity":"HIGH","score":8.4,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2023-53492","published":"2025-10-01T11:45:44.019Z","updated":"2026-10-15T21:41:28.999Z","title":"netfilter: nf_tables: do not ignore genmask when looking up chain by id","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2023-53491","published":"2025-10-01T11:45:43.101Z","updated":"2026-10-15T21:41:28.874Z","title":"start_kernel: Add __no_stack_protector function attribute","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00353,"kevAdded":null},{"id":"CVE-2023-53490","published":"2025-10-01T11:45:42.182Z","updated":"2026-08-05T09:14:22.176Z","title":"mptcp: fix disconnect vs accept race","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2023-53489","published":"2025-10-01T11:45:41.304Z","updated":"2026-05-11T19:45:58.719Z","title":"tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2023-53488","published":"2025-10-01T11:45:40.546Z","updated":"2026-05-11T19:45:57.565Z","title":"IB/hfi1: Fix possible panic during hotplug remove","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2022-50469","published":"2025-10-01T11:45:39.811Z","updated":"2026-05-11T19:20:05.644Z","title":"staging: rtl8723bs: fix potential memory leak in rtw_init_drv_sw()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2022-50468","published":"2025-10-01T11:45:38.881Z","updated":"2026-05-11T19:20:04.497Z","title":"platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2022-50467","published":"2025-10-01T11:45:38.110Z","updated":"2026-05-11T19:20:02.592Z","title":"scsi: lpfc: Fix null ndlp ptr dereference in abnormal exit path for GFT_ID","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2022-50466","published":"2025-10-01T11:45:37.376Z","updated":"2026-05-11T19:20:00.393Z","title":"fs/binfmt_elf: Fix memory leak in load_elf_binary()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2022-50465","published":"2025-10-01T11:45:36.647Z","updated":"2026-05-11T19:19:58.959Z","title":"ext4: fix leaking uninitialized memory in fast-commit journal","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2022-50464","published":"2025-10-01T11:45:35.878Z","updated":"2026-05-11T19:19:57.801Z","title":"mt76: mt7915: Fix PCI device refcount leak in mt7915_pci_init_hif2()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2022-50463","published":"2025-10-01T11:45:34.858Z","updated":"2026-05-11T19:19:56.674Z","title":"powerpc/52xx: Fix a resource leak in an error handling path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2022-50462","published":"2025-10-01T11:45:34.107Z","updated":"2026-05-11T19:19:55.430Z","title":"MIPS: vpe-mt: fix possible memory leak while module exiting","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2022-50461","published":"2025-10-01T11:45:33.300Z","updated":"2026-05-11T19:19:54.278Z","title":"net: ethernet: ti: am65-cpsw: Fix PM runtime leakage in am65_cpsw_nuss_ndo_slave_open()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2022-50460","published":"2025-10-01T11:45:32.484Z","updated":"2026-05-11T19:19:53.059Z","title":"cifs: Fix xid leak in cifs_flock()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2022-50459","published":"2025-10-01T11:45:31.740Z","updated":"2026-08-05T08:58:52.235Z","title":"scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2022-50458","published":"2025-10-01T11:45:30.959Z","updated":"2026-05-11T19:19:50.687Z","title":"clk: tegra: Fix refcount leak in tegra210_clock_init","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2022-50457","published":"2025-10-01T11:45:30.263Z","updated":"2026-10-30T12:17:10.412Z","title":"mtd: core: Fix refcount error in del_mtd_device()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2022-50456","published":"2025-10-01T11:45:29.587Z","updated":"2026-05-11T19:19:48.327Z","title":"btrfs: fix resolving backrefs for inline extent followed by prealloc","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2022-50454","published":"2025-10-01T11:45:27.337Z","updated":"2026-08-05T08:58:51.159Z","title":"drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2022-50453","published":"2025-10-01T11:45:26.499Z","updated":"2026-05-11T19:19:45.976Z","title":"gpiolib: cdev: fix NULL-pointer dereferences","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2022-50452","published":"2025-10-01T11:45:25.394Z","updated":"2026-05-11T19:19:44.873Z","title":"net: sched: cake: fix null pointer access issue when cake_init() fails","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2022-50451","published":"2025-10-01T11:45:24.652Z","updated":"2026-08-15T12:23:31.929Z","title":"fs/ntfs3: Fix memory leak on ntfs_fill_super() error path","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2022-50449","published":"2025-10-01T11:45:23.226Z","updated":"2026-05-11T19:19:42.611Z","title":"clk: samsung: Fix memory leak in _samsung_clk_register_pll()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2022-50448","published":"2025-10-01T11:45:22.513Z","updated":"2026-05-11T19:19:41.418Z","title":"mm/uffd: fix warning without PTE_MARKER_UFFD_WP compiled in","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2022-50447","published":"2025-10-01T11:45:21.804Z","updated":"2026-05-11T19:19:40.253Z","title":"Bluetooth: hci_conn: Fix crash on hci_create_cis_sync","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2022-50446","published":"2025-10-01T11:45:20.854Z","updated":"2026-05-11T19:19:39.140Z","title":"ARC: mm: fix leakage of memory allocated for PTE","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2022-50445","published":"2025-10-01T11:45:19.954Z","updated":"2026-05-23T15:24:28.439Z","title":"xfrm: Reinject transport-mode packets through workqueue","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2021-4460","published":"2025-10-01T11:45:19.050Z","updated":"2026-08-11T02:05:07.041Z","title":"drm/amdkfd: Fix UBSAN shift-out-of-bounds warning","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2023-53487","published":"2025-10-01T11:42:54.747Z","updated":"2026-05-11T19:45:56.368Z","title":"powerpc/rtas_flash: allow user copy to flash block cache objects","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2023-53486","published":"2025-10-01T11:42:54.028Z","updated":"2026-08-05T09:14:21.111Z","title":"fs/ntfs3: Enhance the attribute size check","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2023-53485","published":"2025-10-01T11:42:53.337Z","updated":"2026-08-05T09:14:20.042Z","title":"fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2023-53484","published":"2025-10-01T11:42:52.590Z","updated":"2026-10-15T21:41:28.750Z","title":"lib: cpu_rmap: Avoid use after free on rmap->obj array entries","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2023-53483","published":"2025-10-01T11:42:51.778Z","updated":"2026-05-11T19:45:51.667Z","title":"ACPI: processor: Check for null return of devm_kzalloc() in fch_misc_setup()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2023-53482","published":"2025-10-01T11:42:50.800Z","updated":"2026-05-11T19:45:50.492Z","title":"iommu: Fix error unwind in iommu_group_alloc()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2023-53481","published":"2025-10-01T11:42:49.825Z","updated":"2026-10-15T21:41:28.594Z","title":"ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2023-53480","published":"2025-10-01T11:42:48.919Z","updated":"2026-05-11T19:45:48.153Z","title":"kobject: Add sanity check for kset->kobj.ktype in kset_register()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53479","published":"2025-10-01T11:42:47.987Z","updated":"2026-05-11T19:45:46.984Z","title":"cxl/acpi: Fix a use-after-free in cxl_parse_cfmws()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2023-53478","published":"2025-10-01T11:42:47.185Z","updated":"2026-08-05T09:14:16.799Z","title":"tracing/synthetic: Fix races on freeing last_cmd","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00116,"kevAdded":null},{"id":"CVE-2023-53477","published":"2025-10-01T11:42:46.279Z","updated":"2026-05-11T19:45:44.688Z","title":"ipv6: Add lwtunnel encap size of all siblings in nexthop calculation","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53476","published":"2025-10-01T11:42:45.499Z","updated":"2026-05-11T19:45:43.579Z","title":"iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2023-53475","published":"2025-10-01T11:42:44.604Z","updated":"2026-05-11T19:45:42.377Z","title":"usb: xhci: tegra: fix sleep in atomic call","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2023-53474","published":"2025-10-01T11:42:43.798Z","updated":"2026-10-15T21:41:28.463Z","title":"x86/MCE/AMD: Use an u64 for bank_map","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2023-53473","published":"2025-10-01T11:42:42.875Z","updated":"2026-10-15T21:41:28.341Z","title":"ext4: improve error handling from ext4_dirhash()","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2023-53472","published":"2025-10-01T11:42:41.951Z","updated":"2026-05-23T15:29:04.344Z","title":"pwm: lpc32xx: Remove handling of PWM channels","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53471","published":"2025-10-01T11:42:41.046Z","updated":"2026-05-11T19:45:37.613Z","title":"drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2023-53470","published":"2025-10-01T11:42:40.221Z","updated":"2026-05-11T19:45:36.431Z","title":"ionic: catch failure from devlink_alloc","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2023-53468","published":"2025-10-01T11:42:38.673Z","updated":"2026-05-11T19:45:35.279Z","title":"ubifs: Fix memory leak in alloc_wbufs()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53467","published":"2025-10-01T11:42:37.757Z","updated":"2026-05-11T19:45:34.102Z","title":"wifi: rtw89: fix potential leak in rtw89_append_probe_req_ie()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2023-53466","published":"2025-10-01T11:42:36.809Z","updated":"2026-05-11T19:45:32.930Z","title":"wifi: mt76: mt7915: fix memory leak in mt7915_mcu_exit","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2023-53465","published":"2025-10-01T11:42:36.007Z","updated":"2026-08-05T09:14:13.583Z","title":"soundwire: qcom: fix storing port config out-of-bounds","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2023-53464","published":"2025-10-01T11:42:35.186Z","updated":"2026-05-23T15:29:00.948Z","title":"scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2023-53463","published":"2025-10-01T11:42:34.308Z","updated":"2026-10-15T21:41:28.220Z","title":"ibmvnic: Do not reset dql stats on NON_FATAL err","severity":"HIGH","score":7.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00364,"kevAdded":null},{"id":"CVE-2023-53462","published":"2025-10-01T11:42:33.434Z","updated":"2026-08-05T09:14:11.442Z","title":"hsr: Fix uninit-value access in fill_frame_info()","severity":"HIGH","score":7.1,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2023-53461","published":"2025-10-01T11:42:32.525Z","updated":"2026-05-11T19:45:27.294Z","title":"io_uring: wait interruptibly for request completions on exit","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2023-53460","published":"2025-10-01T11:42:31.620Z","updated":"2026-05-11T19:45:26.102Z","title":"wifi: rtw88: fix memory leak in rtw_usb_probe()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0014,"kevAdded":null},{"id":"CVE-2023-53459","published":"2025-10-01T11:42:30.648Z","updated":"2026-05-11T19:45:24.981Z","title":"HID: mcp-2221: prevent UAF in delayed work","severity":"HIGH","score":7.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2023-53458","published":"2025-10-01T11:42:29.665Z","updated":"2026-05-11T19:45:23.834Z","title":"media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2023-53457","published":"2025-10-01T11:42:28.730Z","updated":"2026-05-11T19:45:22.673Z","title":"FS: JFS: Fix null-ptr-deref Read in txBegin","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53456","published":"2025-10-01T11:42:27.821Z","updated":"2026-05-11T19:45:21.497Z","title":"scsi: qla4xxx: Add length check when parsing nlattrs","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2023-53455","published":"2025-10-01T11:42:26.791Z","updated":"2026-05-11T19:45:20.350Z","title":"drm/vc4: drop all currently held locks if deadlock happens","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2023-53454","published":"2025-10-01T11:42:25.760Z","updated":"2026-10-15T21:41:28.079Z","title":"HID: multitouch: Correct devm device reference for hidinput input_dev name","severity":"HIGH","score":8.8,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2023-53453","published":"2025-10-01T11:42:24.649Z","updated":"2026-05-11T19:45:17.978Z","title":"drm/radeon: free iio for atombios when driver shutdown","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53452","published":"2025-10-01T11:42:23.831Z","updated":"2026-05-11T19:45:16.842Z","title":"wifi: rtw89: fix potential race condition between napi_init and napi_enable","severity":"MEDIUM","score":4.7,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2023-53451","published":"2025-10-01T11:42:22.857Z","updated":"2026-05-11T19:45:15.706Z","title":"scsi: qla2xxx: Fix potential NULL pointer dereference","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2023-53450","published":"2025-10-01T11:42:22.074Z","updated":"2026-05-11T19:45:14.540Z","title":"ext4: remove a BUG_ON in ext4_mb_release_group_pa()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2023-53449","published":"2025-10-01T11:42:21.371Z","updated":"2026-05-11T19:45:13.231Z","title":"s390/dasd: Fix potential memleak in dasd_eckd_init()","severity":"MEDIUM","score":5.5,"vendor":"Linux","product":"Linux","kev":false,"epss":0.0016,"kevAdded":null}]}