Linux

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

• 7.8HighMay 23, 2026Linux Memory corruptionCVE-2026-46300In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whetAdded to KEV Oct 28, 2026 · 158 days after publicationExploited2.4% likelyExploit-DB · Metasploit
• 9.8CriticalSep 18, 2026Linux KernelCVE-2025-39682Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.Added to KEV Sep 18, 2026Exploited2.9% likely
• 8.8HighSep 18, 2026Linux Kernel Memory corruptionCVE-2026-53266Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.Added to KEV Sep 18, 2026Exploited
• 7.8HighSep 18, 2026Linux KernelCVE-2025-39964Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.Added to KEV Sep 18, 2026Exploited1.4% likely
• 7.8HighAug 27, 2026Linux KernelCVE-2026-53362Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux. Added to KEV Aug 27, 2026Exploited
• 7.8HighAug 26, 2026Linux Kernel Memory corruptionCVE-2022-0995Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system.Added to KEV Aug 26, 2026Exploited8.9% likelyExploit codeMetasploit
• 7.8HighJun 2, 2026Linux Kernel Auth bypass / access controlCVE-2022-0492Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.Added to KEV Jun 2, 2026Exploited5.5% likelyExploit codeMetasploit
• 7.8HighMay 1, 2026Linux KernelCVE-2026-31431Linux kernel memory management is affected. An attacker gains arbitrary read and write access to kernel memory. Update the Linux kernel to the latest version with the relevant security patch applied.Added to KEV May 1, 2026Exploited3.4% likelyExploit codeMetasploitDetection
• 7.8HighJan 26, 2026Linux Kernel Memory corruptionCVE-2018-14634Linux Kernel contains an integer overflow vulnerability in the create_elf_tables() function which could allow an unprivileged local user with access to SUID (or otherwise privileged) binary to escalate their privileges on the system.Added to KEV Jan 26, 2026Exploited15% likelyExploit codeExploit-DB
• 8.3HighJul 7, 2021Linux Kernel Memory corruptionCVE-2021-22555Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.Added to KEV Oct 6, 2025 · 1,552 days after publicationExploited79% likelyExploit codeExploit-DB · Metasploit
• 7.8HighJul 22, 2025Linux KernelCVE-2025-38352Linux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability.Added to KEV Sep 4, 2025 · 44 days after publicationExploited1.4% likely
• 7.8HighMar 22, 2023Linux KernelCVE-2023-0386Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.Added to KEV Jun 17, 2025 · 818 days after publicationExploited7.9% likelyExploit codeMetasploit
• 7.8HighDec 27, 2024Linux Kernel Memory corruptionCVE-2024-53197Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code.Added to KEV Apr 9, 2025 · 102 days after publicationExploited4.1% likely
• 7.1HighDec 24, 2024Linux Kernel Memory corruptionCVE-2024-53150Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information.Added to KEV Apr 9, 2025 · 106 days after publicationExploited1.4% likely
• 5.5MediumNov 19, 2024Linux Kernel Memory corruptionCVE-2024-50302The Linux kernel contains a use of uninitialized resource vulnerability that allows an attacker to leak kernel memory via a specially crafted HID report.Added to KEV Mar 4, 2025 · 105 days after publicationExploited
• 7.8HighDec 2, 2024Linux Kernel Memory corruptionCVE-2024-53104Linux kernel contains an out-of-bounds write vulnerability in the uvc_parse_streaming component of the USB Video Class (UVC) driver that could allow for physical escalation of privilege.Added to KEV Feb 5, 2025 · 65 days after publicationExploited3.4% likely
• 7.8HighOct 4, 2017Linux Kernel Memory corruptionCVE-2017-1000253Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges. Added to KEV Sep 9, 2024 · 2,532 days after publicationExploited11% likelyExploit codeExploit-DB
• 8.4HighFeb 11, 2022Linux Kernel Memory corruptionCVE-2022-0185Linux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges.Added to KEV Aug 21, 2024 · 921 days after publicationExploited25% likely
• 5.3MediumJan 8, 2024Linux Kernel Memory corruptionCVE-2022-2586Linux Kernel contains a use-after-free vulnerability in the nft_object, allowing local attackers to escalate privileges. Added to KEV Jun 26, 2024 · 169 days after publicationExploited10% likely
• 7.8HighJan 31, 2024Linux Kernel Memory corruptionCVE-2024-1086Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation.Added to KEV May 30, 2024 · 119 days after publicationExploited28% likely
• 7.8HighDec 6, 2010Linux KernelCVE-2010-3904Linux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (RDS) protocol implementation that allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.Added to KEV May 12, 2023 · 4,539 days after publicationExploited16% likelyExploit codeExploit-DB · Metasploit
• 5.5MediumMay 7, 2014Linux KernelCVE-2014-0196Linux Kernel contains a race condition vulnerability within the n_tty_write function that allows local users to cause a denial-of-service (DoS) or gain privileges via read and write operations with long strings.Added to KEV May 12, 2023 · 3,292 days after publicationExploited20% likelyExploit codeExploit-DB
• 7.9HighJan 30, 2023Linux Kernel Memory corruptionCVE-2023-0266Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user.Added to KEV Mar 30, 2023 · 58 days after publicationExploited3.7% likely
• 8.8HighApr 17, 2021Linux Kernel Auth bypass / access controlCVE-2021-3493The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation.Added to KEV Oct 20, 2022 · 551 days after publicationExploited49% likelyExploit codeMetasploit
• 8.4HighMay 14, 2013Linux Kernel Privilege escalationCVE-2013-2094Linux kernel fails to check all 64 bits of attr.config passed by user space, resulting to out-of-bounds access of the perf_swevent_enabled array in sw_perf_event_destroy(). Explotation allows for privilege escalation.Added to KEV Sep 15, 2022 · 3,410 days after publicationExploited48% likelyExploit codeExploit-DB

Recent

• –UnscoredOct 28, 2026LinuxCVE-2026-99213In the Linux kernel, the following vulnerability has been resolved: vsock: treat TCP_CLOSING as once-established Handle the TCP_ESTABLISHED -> TCP_CLOSING transition on OP_RST, which can race with the connect loop. Immediately break and return 0 on ESTABLISHED/CLOSING. The return value of connect(
• –UnscoredOct 28, 2026LinuxCVE-2026-99203In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure F_SETFL and FIOASYNC decide whether to invoke ->fasync() before pipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO can therefore both enter the callback.
• –UnscoredOct 28, 2026LinuxCVE-2026-99100In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate firmware record lengths The p54 firmware parser accesses component ID and component version records without checking that their lengths cover the fields being read. A malformed record can therefore make the parser read past the record. Validate the component ID and component version record lengths before accessing their data. The descriptor record is also checked against the shortest descriptor length foun
• 7.8HighMay 23, 2026Linux Memory corruptionCVE-2026-46300In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whetExploited2.4% likelyExploit-DB · Metasploit
• –UnscoredOct 26, 2026LinuxCVE-2026-99090In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: serialize vblank counter reads against GPU reset The vblank counter callback reads display registers and scanout position without holding reset_domain->sem. During GPU recovery, display commit work can call the callback while reset owns the semaphore for writing. The hardware access then triggers the lockdep_assert_held() in amdgpu_device_skip_hw_access() and sets TAINT_WARN when lockdep is enabled. Try to acquire
• –UnscoredOct 26, 2026LinuxCVE-2026-99096In the Linux kernel, the following vulnerability has been resolved: io_uring/register: don't exempt disabled rings from task restrictions A ring created with IORING_SETUP_R_DISABLED is exempt from its register restrictions until it is enabled. This lets the creator register the restrictions and th
• –UnscoredOct 26, 2026LinuxCVE-2026-99095In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the job_done_work that the render-done interrupt queues, at teardown: vc4_irq_disable() cancels only overflow
• –UnscoredOct 26, 2026LinuxCVE-2026-99094In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: fix TX descriptor bounds check btintel_pcie_prepare_tx() uses tfd_index to access the TFD and data buffer arrays before the index is advanced modulo txq->count. An index equal to txq->count is one past the
• 7.4HighOct 23, 2026LinuxCVE-2026-99077In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exception (FNHE) is only created if the kernel can match the UDP packet to an existing socket. This behavior allows off-path attackers to conduct a side-channel attack on the FNHE cache in order to discover the ephemeral port used by a connected
• 7.5HighOct 23, 2026LinuxCVE-2026-99081In the Linux kernel, the following vulnerability has been resolved: bnxt_en: fix DMA mapping length for padded small packets Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412 NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces: DMAR: [DMA Read NO_PASID] Reque
• 9.8CriticalOct 23, 2026LinuxCVE-2026-99079In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on refill retry When an XDP redirect to an AF_XDP socket fails because its RX ring is full, the XSK core frees the buffer. During the subsequent batched refill of a legacy cyclic RQ, mlx
• 8.1HighOct 23, 2026LinuxCVE-2026-99064In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust cached offsets for options that follow them. For example, with a valid 10-byte CIPSO option followed by
• 7.8HighOct 23, 2026LinuxCVE-2026-99054In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipc_topsrv_stop() closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could
• 8.1HighOct 23, 2026LinuxCVE-2026-98968In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb->cb. For example, with igmp_qrv set to 1 on the relay a tunnel lives for
• –UnscoredOct 23, 2026LinuxCVE-2026-98909In the Linux kernel, the following vulnerability has been resolved: net: cpsw_new: unregister devlink on port registration failure cpsw_probe() registers devlink before registering the CPSW ports. If cpsw_register_ports() fails, the error path only unregisters the notifiers and then releases the lower level resources. It does not undo the successful cpsw_register_devlink() call, leaving the devlink instance and its parameters registered after probe has failed. Add a devlink cleanup label for
• –UnscoredOct 23, 2026LinuxCVE-2026-98908In the Linux kernel, the following vulnerability has been resolved: net: microchip: sparx5: clean up PSFP resources on flower setup failure sparx5_tc_flower_psfp_setup() allocates PSFP stream gate, flow meter and stream filter resources before adding VCAP actions. If a later step fails, the resources allocated earlier in the function are not unwound. Add error paths to release the stream filter, flow meter and stream gate when setup fails after they have been acquired. Also make sparx5_psfp_
• –UnscoredOct 23, 2026LinuxCVE-2026-98907In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sb_write_pointer() with invalidate lock sb_write_pointer() reads the super block from the block device page cache using read_cache_page_gfp(). This has the same race with BLKBSZSET as the one fixed by commit 3f29d661e568 ("btrfs: sync read disk super and set block size"). Take the mapping invalidate lock around read_cache_page_gfp() to serialize the read against block size changes.
• –UnscoredOct 23, 2026LinuxCVE-2026-98906In the Linux kernel, the following vulnerability has been resolved: net: lan966x: restore RX state on reload failure lan966x_fdma_reload() backs up rx->page_pool and rx->fdma before reallocating the RX resources for the new MTU. If the allocation fails, the restore path puts these fields back before restarting RX. However, the reload path also updates rx->page_order and rx->max_mtu before calling lan966x_fdma_rx_alloc(). These fields are not restored on failure, so RX can be restarted with th
• –UnscoredOct 23, 2026LinuxCVE-2026-98905In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Properly acquire queue buffers in CRIU restore When kfd_queue_acquire_buffers() was split off from set_queue_properties_from_user(), set_queue_properties_from_criu() was missed. Thus, set_queue_properties_from_criu() is not filling out the buffer fields of queue_properties, which can come up when subsequent code expects them to be non-null. Add the proper call to kfd_queue_acquire_buffers(), and also use the right
• –UnscoredOct 23, 2026LinuxCVE-2026-98904In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Use devm_pm_runtime_enable() sashiko complained about early usage of the device while probe isn't completed. This can be mitigated by delaying the pm_runtime_enable() into the removal path instead doing it early. This ensures that in an error case the device is removed (and imx_mu_shutdown()) before pm_runtime_disable() so we don't have to do this manually. For the order to work, lets move devm_mbox_controller_r
• –UnscoredOct 23, 2026LinuxCVE-2026-98903In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Add a channel shutdown field sashiko complained about possible teardown problem. The scenario CPU 0 CPU 1 imx_mu_isr() imx_mu_shutdown() imx_mu_xcr_rmw(priv, IMX_MU_RCR, 0, IMX_MU_xCR_RIEn(priv->dcfg->type, cp->idx)); imx_mu_specific_rx() imx_mu_xcr_rmw(priv, IMX_MU_RCR, IMX_MU_xCR_RIEn(priv->dcfg->type, 0), 0);
• –UnscoredOct 23, 2026LinuxCVE-2026-98902In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bm_seq comparison wrap-safe Once the 32-bit seq wraps, a newer bm_seq can look smaller than old, so .. covert to wrap-safe calculate way.
• –UnscoredOct 23, 2026LinuxCVE-2026-98901In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix lease break and ack state handling Do not skip valid lease states containing WRITE_CACHING when breaking level-II/read leases for writes and truncates. Handle lease break acknowledgments according to the SMB2 rule that the acknowledged state must be a subset of the server's break target. Apply the acknowledged state directly and keep the break pending on failed ACKs.
• –UnscoredOct 23, 2026LinuxCVE-2026-98900In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntalloc_ioctl_alloc() allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so reject them before the user-controlled allocation reaches kcalloc(). Use a subtraction-based check while holding gref_mutex so adding the requested count cannot wrap. Also cast the count before advanci
• 7.8HighOct 23, 2026LinuxCVE-2026-98899In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: mark the rcu locked areas properly When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtype_gc we need the rcu lock and not a spinlock.
• –UnscoredOct 23, 2026LinuxCVE-2026-98898In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized When DPM is turned off with the amdgpu.dpm=0 module parameter, the thermal work queue isn't initialized so we shouldn't schedule any work on it. (cherry picked from commit bd018d36171a695952c6d391471c279c9e05c8b2)
• –UnscoredOct 23, 2026LinuxCVE-2026-98897In the Linux kernel, the following vulnerability has been resolved: ksmbd: don't hold ci->m_lock while waiting for a lease break ack When a cifs.ko client caches a read-handle (RH) lease via deferred close and a conflicting open arrives, ksmbd breaks the lease and waits for the acknowledgment in wait_for_break_ack() for up to OPLOCK_WAIT_TIME (35s). __smb_break_all_levII_oplock() runs that wait while holding ci->m_lock for read. cifs.ko reacts to a handle-lease break by closing the deferred h
• –UnscoredOct 23, 2026LinuxCVE-2026-98896In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tb_domain_remove(). For example if user unloads the driver while at the same time plugging a device router we may have scheduled tb_handle_hotplug() to run. Avoid possible UAF in this case by taking the domain reference before scheduling the hotplug handler in tb_queue_hotp
• 7.0HighOct 23, 2026LinuxCVE-2026-98895In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Handle destroying table that has a miss table If a table has a miss table that was created by 'mlx5hws_table_set_default_miss' API function, its miss_tbl keeps the table that points to it in a list. If such table is deleted, we need to also remove it from the miss_tbl list, otherwise the node in miss_tbl list will contain garbage.
• –UnscoredOct 23, 2026LinuxCVE-2026-98894In the Linux kernel, the following vulnerability has been resolved: drm/amd/ras: reset CPER ring on corrupt entry size When CPER ring overflow handling advances the read pointer, it trusts the parsed entry size from the current ring contents. Corrupt CPER data can produce an entry size that does not advance rptr after dword conversion and pointer masking. In that case the recovery loop keeps testing the same location while holding the CPER ring mutex. This can hang the worker that is writing
• –UnscoredOct 23, 2026LinuxCVE-2026-98893In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Validate SENSOR_UPDATE payload size SENSOR_UPDATE carries one or more sensor readings after the fixed notification header. The parser derives the expected reading count from the sensor description, but it did not verify that the received payload contains those entries before parsing them. Reject truncated update notifications before reading the variable array.
• –UnscoredOct 23, 2026LinuxCVE-2026-98892In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size BASE_ERROR_EVENT carries a variable number of message reports, with the count encoded in error_status. The notification parser used that count without checking whether the received payload contained all reported entries. Reject truncated payloads before copying the report array.
• –UnscoredOct 23, 2026LinuxCVE-2026-98891In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate deauth frame length before reason access ieee80211_rx_mgmt_deauth() reads the deauth reason code before checking that the fixed field is actually present in the received frame. Validate the deauth frame length first and only then read the reason code.
• –UnscoredOct 23, 2026LinuxCVE-2026-98890In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: reject short monitor TX frames In monitor mode, lbs_hard_start_xmit() casts skb->data to a radiotap TX header, skips that header, and then copies the 802.11 destination address from offset 4 in the remaining frame. The generic length check only rejects zero-length and oversized skbs, so a short monitor frame can be read past the end of the skb data. Require enough bytes for the radiotap TX header and the dest
• –UnscoredOct 23, 2026LinuxCVE-2026-98888In the Linux kernel, the following vulnerability has been resolved: arm64: kprobes: Allow reentering kprobes while single-stepping A kprobe can be hit while another kprobe is in KPROBE_HIT_SS state. This can happen when tracing or perf code runs from the debug exception path while the first kprobe is preparing or executing its out-of-line single-step instruction. Currently arm64 treats a kprobe hit in KPROBE_HIT_SS as unrecoverable, the same as a hit in KPROBE_REENTER. This is too strict. A h
• –UnscoredOct 23, 2026LinuxCVE-2026-98887In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO hwsim_tx_info_frame_received_nl() casts the HWSIM_ATTR_TX_INFO payload to a struct hwsim_tx_rate * and unconditionally reads IEEE80211_TX_MAX_RATES entries (8 bytes) from it. The policy only bounds the attribute from above (NLA_BINARY .len is a maximum) and the op sets GENL_DONT_VALIDATE_STRICT, so a short or zero-length attribute is accepted and the loop reads past th
• –UnscoredOct 23, 2026LinuxCVE-2026-98886In the Linux kernel, the following vulnerability has been resolved: drm/gma500: return errors from Oaktrail HDMI I2C reads xfer_read() waits for the HDMI I2C transaction to reach I2C_TRANSACTION_DONE, but it ignores both timeout and signal returns from wait_for_completion_interruptible_timeout(). If the interrupt never advances the transaction state, the loop can wait forever. Return -ETIMEDOUT when the completion wait expires, propagate interrupted waits, and make the I2C master_xfer callba
• –UnscoredOct 23, 2026LinuxCVE-2026-98885In the Linux kernel, the following vulnerability has been resolved: ima: return error early if file xattr cannot be changed During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which fails with the following warning. WARNING: fs/ext4/ext4_jbd2.c:75 at ext4_journal_check_start+0x63/0xa0 [ext4], CPU#1: systemd-sysroot/561 CPU: 1 UID: 0 PID: 561 Comm: systemd-sysroot Not tainted 6.19
• –UnscoredOct 23, 2026LinuxCVE-2026-98884In the Linux kernel, the following vulnerability has been resolved: mmc: core: Add validation for host-provided max_segs The max_segs field is of type unsigned short, and if a host driver sets an excessively large value, it may be truncated to zero. This can cause mmc_alloc_sg() to call kmalloc_objs() with a zero size allocation request, which leads to undefined behavior. Under the SLUB allocator, kmalloc(0) returns a special pointer (ZERO_SIZE_PTR). The subsequent 'if (sg)' check will evalua
• –UnscoredOct 23, 2026LinuxCVE-2026-98883In the Linux kernel, the following vulnerability has been resolved: serial: 8250_port: recognize UPIO_AU My MIPS Alchemy systems generate the following warning during probe of the 8250 driver: WARNING: drivers/tty/serial/8250/8250_port.c:462 at set_io_from_upio+0xfc/0x124, CPU#0: swapper/0/1 Unsupported UART type 4 [...] [<80521d40>] set_io_from_upio+0xfc/0x124 [<80521dfc>] serial8250_set_defaults+0x94/0xe0 [<80520fb4>] serial8250_register_8250_port+0x288/0x51c [<805214ec>] serial8250_probe+0
• –UnscoredOct 23, 2026LinuxCVE-2026-98881In the Linux kernel, the following vulnerability has been resolved: net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() This rcu_barrier() came from a time call_rcu() calls were used in net/bridge/br_multicast.c. Now kfree_rcu() is there, we can remove this problematic rcu_barrier() which causes extreme RTNL pressure in many syzbot reports. INFO: task syz-executor:77945 is blocked on a mutex likely owned by task kworker/u1024:5:36537. task:kworker/u1024:5 state:D stack:24616 pi
• –UnscoredOct 23, 2026LinuxCVE-2026-98880In the Linux kernel, the following vulnerability has been resolved: ntfs3: handle set_blocksize failures ntfs3 uses buffer_heads, which don't handle block size > PAGE_SIZE well. Without this, mounting we will hit the BUG_ON(offset >= folio_size(folio)); in folio_set_bh on the first __bread_gfp call.
• –UnscoredOct 23, 2026LinuxCVE-2026-98879In the Linux kernel, the following vulnerability has been resolved: isofs: handle set_blocksize failures isofs uses buffer_heads, which don't handle block size > PAGE_SIZE well. Without this, mounting we will hit the BUG_ON(offset >= folio_size(folio)); in folio_set_bh on the first __bread_gfp call.
• –UnscoredOct 23, 2026LinuxCVE-2026-98878In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v5: Immediately exec priority drop following activate With GICv5 an interrupt of equal or lower priority cannot be signalled until there has been a priority drop. This is done via the GIC CDEOI system instruction. Once this has been executed, the hardware is able to signal the next interrupt if there is one. As all interrupts are programmed to have the same priority, no new interrupts can be signalled until the pr
• –UnscoredOct 23, 2026LinuxCVE-2026-98877In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed When accidentally setting “kvm-arm.vgic_v4_enable=1” on a system that has no MSI controller device tree node and GICv4, it results a panic as “gic_domain” is NULL and the kernel attempts to access it. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 Mem abort info: ESR = 0x0000000096000006 CPU: 1 UID: 0 PID: 295 Co
• –UnscoredOct 23, 2026LinuxCVE-2026-98876In the Linux kernel, the following vulnerability has been resolved: host1x: bus: Fix missing ops null check in error teardown In host1x_device_init(), the error teardown paths do not check client->ops before dereferencing it, unlike the forward init paths which correctly guard with 'client->ops &&'. This can result in a NULL pointer dereference if client->ops is NULL. Fix by adding the missing client->ops check in both the teardown and teardown_late labels.
• –UnscoredOct 23, 2026LinuxCVE-2026-98875In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/gsp: add SEC2 to GA100 chip table The booter-load and booter-unload firmware run on the SEC2 falcon. During tu102_gsp_oneinit(), the booter constructor needs device->sec2 to access the SEC2 falcon. Without the .sec2 entry, device->sec2 is NULL and this dereference crashes during GSP-RM boot.
• –UnscoredOct 23, 2026LinuxCVE-2026-98874In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect Clearly, from a user perspective, it must be valid to configure WoWLAN and then suspend while not connected to a network. Since mac80211 doesn't distinguish these cases and simply calls the driver to suspend whenever WoWLAN is configured, the driver has to cleanly handle the case where it's called for WoWLAN, it's not connected but there's also no netdetect configu
• –UnscoredOct 23, 2026LinuxCVE-2026-98873In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: zero at allocation time There are occasional LLM hints wrt. leaking uninitialized data to userspace via ctnetlink. Just zero at allocation time, expectations are not frequently used these days. Intentionally keeps _init as-is because we could theoretically support re-init, so add the missing exp->dir there.
• –UnscoredOct 23, 2026LinuxCVE-2026-98872In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG() on unknown typed-extent type vxfs_bmap_typed() handles four typed-extent types and calls BUG() in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from ioctl(FIBMAP) on a regular file: kernel BUG at fs/freevxfs/vxfs_bmap.c:230! RIP: vxfs_bmap_typed fs/freevxfs/vxfs_bmap.c:230 [inline] vxfs_bmap1+0x128a/0x12d0 fs/freevxfs/vxfs_bmap.c:257

See every Linux entry on the dashboard.

Top products

• Linux132 CVEs in the last year, 8 critical, 1 exploited
• linux kernel61 CVEs in the last year, 7 critical
• Kernel8 CVEs in the last year, 1 critical, 8 exploited

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• CISA · Oct 29, 2026Hitachi Energy CoreTec ProductCVE-2026-43284
• CISA · Oct 28, 2026CISA Adds Two Known Exploited Vulnerabilities to CatalogCVE-2026-46300
• CISA · Oct 22, 2026Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFPCVE-2023-52927CVE-2023-53292CVE-2024-26783CVE-2024-27056CVE-2024-36903CVE-2024-36927
• CISA · Oct 22, 2026Siemens SIMATIC S7-1500 TM MFPCVE-2023-52927CVE-2023-53292CVE-2023-54271CVE-2024-26982CVE-2024-36922CVE-2024-40945
• AWS · Oct 15, 2026Issue in the Linux kernel virtio-net/TAP networking path affecting KVM-based hypervisorsCVE-2026-99999
• EUVD exploited · May 23, 2026EUVD-2026-31535 · In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag…CVE-2026-46300
• Google Kubernetes Engine · May 14, 2026GCP-2026-033CVE-2026-46300
• Synology · May 11, 2026Synology-SA-26:09 Linux Kernel (Dirty Frag)CVE-2026-43284CVE-2026-43500
• Google Kubernetes Engine · May 11, 2026GCP-2026-030CVE-2026-43284CVE-2026-43500
• QNAP · May 10, 2026Local Privilege Escalation Vulnerability in Linux Kernel ("Dirty Frag")CVE-2026-43284
• Synology · May 4, 2026Synology-SA-26:08 Linux Kernel (Copy Fail)CVE-2026-31431
• Google Kubernetes Engine · May 1, 2026GCP-2026-027CVE-2026-23351
• Google Kubernetes Engine · Apr 30, 2026GCP-2026-025CVE-2026-23274
• Google Kubernetes Engine · Apr 30, 2026GCP-2026-026CVE-2026-31431
• Google Kubernetes Engine · Apr 28, 2026GCP-2026-023CVE-2026-23074