CVE-2026-43450
Security update for the Linux Kernel
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label inside the for loop body. When the "last" helper saved in cb->args[1] is deleted between dump rounds, every entry fails the (cur != last) check, so cb->args[1] is never cleared. The for loop finishes with cb->args[0] == nf_ct_helper_hsize, and the 'goto restart' jumps back into the loop body bypassing the bounds check, causing an 8-byte out-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize]. The 'goto restart' block was meant to re-traverse the current bucket when "last" is no longer found, but it was placed after the for loop instead of inside it. Move the block into the for loop body so that the restart only occurs while cb->args[0] is still within bounds. BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0 Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131 Call Trace: nfnl_cthelper_dump_table+0x9f/0x1b0 netlink_dump+0x333/0x880 netlink_recvmsg+0x3e2/0x4b0 sock_recvmsg+0xde/0xf0 __sys_recvfrom+0x150/0x200 __x64_sys_recvfrom+0x76/0x90 do_syscall_64+0xc3/0x6e0 Allocated by task 1: __kvmalloc_node_noprof+0x21b/0x700 nf_ct_alloc_hashtable+0x65/0xd0 nf_conntrack_helper_init+0x21/0x60 nf_conntrack_init_start+0x18d/0x300 nf_conntrack_standalone_init+0x12/0xc0
Metrics
Affected operating systems
linux
amazon / amazon_linux
linux
suse / basesystem_module15
linux
debian / debian_linux11.0
linux
debian / debian_linux12.0
linux
debian / debian_linux13.0
linux
suse / development_tools_module15
linux
redhat / enterprise_linux10.0
linux
redhat / enterprise_linux7.0
linux
redhat / enterprise_linux8.0
linux
redhat / enterprise_linux9.0
linux
redhat / enterprise_linux_aus8.4
linux
redhat / enterprise_linux_aus8.6
linux
redhat / enterprise_linux_eus10.0
linux
redhat / enterprise_linux_eus8.4
linux
redhat / enterprise_linux_eus9.4
linux
redhat / enterprise_linux_eus9.6
linux
redhat / enterprise_linux_tus8.6
linux
redhat / enterprise_linux_tus8.8
linux
redhat / enterprise_linux_update_services_for_sap_solutions8.6
linux
redhat / enterprise_linux_update_services_for_sap_solutions8.8
linux
redhat / enterprise_linux_update_services_for_sap_solutions9.0
linux
redhat / enterprise_linux_update_services_for_sap_solutions9.2
linux
opensuse / leap15.3
linux
opensuse / leap15.4
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
arista
cloudvision_agni2024.4.0 – 2025.2.2
arista
cloudvision_portal2024.2.0 – 2026.1.0
arista
velocloud_edge4.5.0 – 6.4.1
arista
velocloud_gateway
arista
velocloud_orchestrator
redhat
openshift_container_platform4.12 – 4.12.89
redhat
openshift_container_platform4.13 – 4.13.66
redhat
openshift_container_platform4.14 – 4.14.65
redhat
openshift_container_platform4.15 – 4.15.64
redhat
openshift_container_platform4.16 – 4.16.61
redhat
openshift_container_platform4.17 – 4.17.53
redhat
openshift_container_platform4.18 – 4.18.40
redhat
openshift_container_platform4.19 – 4.19.30
redhat
openshift_container_platform4.20 – 4.20.21
redhat
openshift_container_platform4.21 – 4.21.14
redhat
openshift_container_platform
siemens
simatic_ax_runtime
suse
caas_platform
suse
enterprise_storage
suse
manager_proxy
suse
manager_retail_branch_server
suse
manager_server
suse
openstack_cloud
suse
openstack_cloud_crowbar
References & sources
- https://git.kernel.org/stable/c/d3e535533767c85788529e626478718b7e95a59feuvd
- https://git.kernel.org/stable/c/3b5a754ec86bc6064af9aca76eb191c2405e6b0ceuvd
- https://git.kernel.org/stable/c/a785c4e2a999c2d51dfcf40d317cfb30cc735d2ceuvd
- https://git.kernel.org/stable/c/0b038c0be6827dd2dbb1ce4f8d92d97c80cbe9cceuvd
- https://git.kernel.org/stable/c/11a93180a70bb3095a9bd80d113d9277e30d9959euvd
- https://git.kernel.org/stable/c/f57b61624c86ef8f87f6e6b7dd0755de03d90e89euvd
- https://git.kernel.org/stable/c/011a0502801c8536f64141a2b61362c14f456544euvd
- https://git.kernel.org/stable/c/09880592f5a9dc73377d6eb5ac123537b5f8df49euvd
- https://git.kernel.org/stable/c/80fc6ca2cbde018d52e13f305edcd643911bd94beuvd
- https://git.kernel.org/stable/c/1985cb3247e87ff6b8ca4bc5f9626f4f51024507euvd
- https://git.kernel.org/stable/c/883cc33b7af1c448663287f069ef9dfea001e90feuvd
- https://git.kernel.org/stable/c/7f9f7c697474268d9ef9479df3ddfe7cdcfbbffceuvd
- https://git.kernel.org/stable/c/66df9f30673db66ac35145820a8e24906069ae57
- https://git.kernel.org/stable/c/4166d5234fe8b6c3c7f796a6c198605356c5b355
- https://git.kernel.org/stable/c/a9055300e07d9d6800264d3c2560e1d0144689ca
- https://git.kernel.org/stable/c/0b9e4bbfb7c949151e3acd44ed4aa33614d2e110euvd
- https://git.kernel.org/stable/c/81af4137a30c4c2dc694dea8cacb180bd66000efeuvd
- https://git.kernel.org/stable/c/5424e678f9b304e148cf5dcc047cffc7a56a3bb5euvd
- https://git.kernel.org/stable/c/9a2d9d4e657b23dc21f24cf139e3aeff0b61341feuvd
- https://git.kernel.org/stable/c/df4601653201de21b487c3e7fffd464790cab808euvd
Linked CVEs
- CVE-2026-64600
In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink…
highCVSSv3 7.8 - CVE-2026-64564
In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sc…
criticalCVSSv3 9.8 - CVE-2026-64465
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix sleep in atomic context in xhci_free_streams() When…
mediumCVSSv3 5.5 - CVE-2026-64330
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Validate SVID index in svdm_consume_modes() In sv…
highCVSSv3 7.8 - CVE-2026-64298
In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC POSIX…
highCVSSv3 7.8 - CVE-2026-63958
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsi_connector_change…
criticalCVSSv3 9.8 - CVE-2026-63928
In the Linux kernel, the following vulnerability has been resolved: USB: serial: omninet: fix memory corruption with small endpoint Mak…
— - CVE-2026-63927
In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: Fix use after free in debug code We're not allowed to de…
highCVSSv3 7.8 - CVE-2026-63924
In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() ipv6_hop_j…
criticalCVSSv3 9.8 - CVE-2026-63922
In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv()…
criticalCVSSv3 9.8 - CVE-2026-63915
In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfc_hci…
highCVSSv3 8.8 - CVE-2026-63901
In the Linux kernel, the following vulnerability has been resolved: USB: serial: digi_acceleport: fix memory corruption with small endpo…
— - CVE-2026-63899
In the Linux kernel, the following vulnerability has been resolved: USB: serial: mxuport: fix memory corruption with small endpoint Mak…
— - CVE-2026-63893
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()…
highCVSSv3 8.1 - CVE-2026-63829
In the Linux kernel, the following vulnerability has been resolved: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelin…
highCVSSv3 8.2 - CVE-2026-63826
In the Linux kernel, the following vulnerability has been resolved: fbdev: fix use-after-free in store_modes() store_modes() replaces a…
highCVSSv3 7.1 - CVE-2026-63806
In the Linux kernel, the following vulnerability has been resolved: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with…
highCVSSv3 7.3 - CVE-2026-63794
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path In…
highCVSSv3 7.8 - CVE-2026-53399
In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4_alloc_stid() pub…
mediumCVSSv3 5.5 - CVE-2026-53397
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak on SETACL decode failure nfsaclsvc_decode_…
mediumCVSSv3 6.7 - CVE-2026-53392
In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count ff_layout_all…
mediumCVSSv3 5.5 - CVE-2026-53391
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr nfs…
mediumCVSSv3 5.5 - CVE-2026-53388
In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fuse_try_mo…
highCVSSv3 7.8 - CVE-2026-53376
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add upper bound check for num_of_nodes drm/amdkfd: Add…
criticalCVSSv3 9.8
Show 164 more CVEs
- CVE-2026-53375
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: Prevent partial address patches In the case that on…
highCVSSv3 7.5 - CVE-2026-53374
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: zero-initialize GART table on allocation GART TLB is fl…
criticalCVSSv3 9.8 - CVE-2026-53369
In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC length udf_read_tagged()…
highCVSSv3 8.4 - CVE-2026-53359
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role C…
highCVSSv3 8.8 - CVE-2026-53355
In the Linux kernel, the following vulnerability has been resolved: net: rds: clear i_sends on setup unwind The RDS IB connection teard…
mediumCVSSv3 5.5 - CVE-2026-53354
In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Mitigate TLBI errata on various Arm CPUs A number of…
highCVSSv3 7.1 - CVE-2026-53325
In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL…
mediumCVSSv3 5.5 - CVE-2026-53306
In the Linux kernel, the following vulnerability has been resolved: tty: hvc_iucv: fix off-by-one in number of supported devices MAX_HV…
highCVSSv3 7.1 - CVE-2026-53275
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free when processing MLD queries When pr…
highCVSSv3 8.8 - CVE-2026-53273
In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-free when the client exits before the…
highCVSSv3 7.8 - CVE-2026-53270
In the Linux kernel, the following vulnerability has been resolved: ipvs: clear the svc scheduler ptr early on edit ip_vs_edit_service(…
highCVSSv3 7.8 - CVE-2026-53268
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack_irc: fix possible out-of-bounds read When pars…
highCVSSv3 8.2 - CVE-2026-53267
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: bail out on template ct in get eval I noticed th…
highCVSSv3 7.8 - CVE-2026-53262
In the Linux kernel, the following vulnerability has been resolved: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() pppol…
highCVSSv3 7.8 - CVE-2026-53256
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() rfc…
highCVSSv3 8.0 - CVE-2026-53255
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate advertising TLV before type checks tlv_da…
mediumCVSSv3 5.5 - CVE-2026-53254
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in MCC handlers The RFCOMM M…
highCVSSv3 8.1 - CVE-2026-53252
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix memory leak in error path of hci_alloc_dev() Early f…
mediumCVSSv3 5.5 - CVE-2026-53249
In the Linux kernel, the following vulnerability has been resolved: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options This patch restric…
highCVSSv3 7.0 - CVE-2026-53246
In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processi…
criticalCVSSv3 9.8 - CVE-2026-53245
In the Linux kernel, the following vulnerability has been resolved: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr…
mediumCVSSv3 5.5 - CVE-2026-53242
In the Linux kernel, the following vulnerability has been resolved: ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on link…
highCVSSv3 7.8 - CVE-2026-53236
In the Linux kernel, the following vulnerability has been resolved: tcp: restrict SO_ATTACH_FILTER to priv users This patch restricts t…
highCVSSv3 7.0 - CVE-2026-53227
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix possible kfree_skb of ERR_PTR After the patch…
mediumCVSSv3 5.5 - CVE-2026-53225
In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asc…
criticalCVSSv3 9.1 - CVE-2026-53224
In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cooki…
criticalCVSSv3 9.1 - CVE-2026-53218
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag nft…
highCVSSv3 7.0 - CVE-2026-53213
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: fix krealloc() memory leak Don't just overwrite the origin…
mediumCVSSv3 5.5 - CVE-2026-53208
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig net/b…
highCVSSv3 7.0 - CVE-2026-53196
In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf…
mediumCVSSv3 6.8 - CVE-2026-53186
In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_proce…
criticalCVSSv3 9.1 - CVE-2026-53181
In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix sk_ack_backlog leak on failed handshake When vmci_t…
mediumCVSSv3 5.5 - CVE-2026-53176
In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In driver…
criticalCVSSv3 9.8 - CVE-2026-53167
In the Linux kernel, the following vulnerability has been resolved: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios FUSE_NOTIFY_RET…
highCVSSv3 7.0 - CVE-2026-53149
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound root directory content to block size __tb_proper…
mediumCVSSv3 5.5 - CVE-2026-53147
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast…
highCVSSv3 8.1 - CVE-2026-53146
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Limit XDomain response copy to actual frame size tb_xd…
highCVSSv3 7.1 - CVE-2026-53134
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_fib: fix stale stack leak via the OIFNAME register F…
mediumCVSSv3 5.5 - CVE-2026-53131
In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t…
criticalCVSSv3 9.4 - CVE-2026-53129
In the Linux kernel, the following vulnerability has been resolved: fs/mbcache: cancel shrink work before destroying the cache mb_cache…
mediumCVSSv3 5.5 - CVE-2026-53107
In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: don't kill URBs in interrupt context Serialization…
mediumCVSSv3 5.5 - CVE-2026-53093
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix error pointer dereference The function brcmf_ch…
mediumCVSSv3 5.5 - CVE-2026-53080
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_fw: fix NULL dereference of "old" filters before chan…
mediumCVSSv3 5.5 - CVE-2026-53064
In the Linux kernel, the following vulnerability has been resolved: dm cache: fix null-deref with concurrent writes in passthrough mode…
highCVSSv3 7.1 - CVE-2026-53063
In the Linux kernel, the following vulnerability has been resolved: dm cache: fix write hang in passthrough mode The invalidate_remove(…
highCVSSv3 7.1 - CVE-2026-53062
In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: fix missing locks in invalidating cache blocks…
criticalCVSSv3 9.8 - CVE-2026-53060
In the Linux kernel, the following vulnerability has been resolved: dm cache metadata: fix memory leak on metadata abort retry When fai…
mediumCVSSv3 5.5 - CVE-2026-53039
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate group add input before caching [BUG] OCFS2_IOC_GROU…
highCVSSv3 7.8 - CVE-2026-53036
In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix off-by-one in check_imm signed range check check_im…
criticalCVSSv3 9.8 - CVE-2026-53021
In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix integer overflow in UNMAP bounds check sbc_…
mediumCVSSv3 6.1 - CVE-2026-53016
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - copy IV using skcipher ivsize AF_ALG rfc3686-ctr-aes-…
highCVSSv3 7.8 - CVE-2026-53006
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr befo…
criticalCVSSv3 9.8 - CVE-2026-53004
In the Linux kernel, the following vulnerability has been resolved: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks…
highCVSSv3 7.8 - CVE-2026-53002
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprint…
criticalCVSSv3 9.8 - CVE-2026-52998
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl chec…
highCVSSv3 7.5 - CVE-2026-52995
In the Linux kernel, the following vulnerability has been resolved: net/rds: zero per-item info buffer before handing it to visitors rd…
mediumCVSSv3 5.5 - CVE-2026-52986
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: don't use simple_strtoul Replace unsaf…
criticalCVSSv3 9.8 - CVE-2026-52984
In the Linux kernel, the following vulnerability has been resolved: net/sched: netem: fix queue limit check to include reordered packets…
mediumCVSSv3 5.5 - CVE-2026-52982
In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() syzbo…
criticalCVSSv3 9.8 - CVE-2026-52981
In the Linux kernel, the following vulnerability has been resolved: neigh: let neigh_xmit take skb ownership neigh_xmit always releases…
highCVSSv3 7.5 - CVE-2026-52958
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in osdmap_decode() When…
criticalCVSSv3 9.1 - CVE-2026-52956
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() I…
criticalCVSSv3 9.8 - CVE-2026-52948
In the Linux kernel, the following vulnerability has been resolved: i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl While fuzzi…
mediumCVSSv3 5.5 - CVE-2026-52942
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: validate MAC header was set before dumping it Th…
highCVSSv3 7.1 - CVE-2026-52930
In the Linux kernel, the following vulnerability has been resolved: ipc/shm: serialize orphan cleanup with shm_nattch updates shm_destr…
mediumCVSSv3 5.5 - CVE-2026-52927
In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix OOB read in compat_mtw_from_user Luxiao Xu…
highCVSSv3 7.8 - CVE-2026-52915
In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_hbh: reject oversized option lists struct ip6t_opts…
highCVSSv3 7.1 - CVE-2026-52910
In the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog after RCU grace period.
highCVSSv3 7.8 - CVE-2026-46322
In the Linux kernel, the following vulnerability has been resolved: tun: free page on build_skb failure in tun_xdp_one() When build_skb…
highCVSSv3 7.1 - CVE-2026-46321
In the Linux kernel, the following vulnerability has been resolved: tun: free page on short-frame rejection in tun_xdp_one() tun_xdp_on…
highCVSSv3 7.1 - CVE-2026-46307
In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: > The ath5k d…
highCVSSv3 8.3 - CVE-2026-46294
In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in ioctl processing Tony Asleson (using C…
highCVSSv3 7.8 - CVE-2026-46252
In the Linux kernel, the following vulnerability has been resolved: regulator: core: fix locking in regulator_resolve_supply() error pat…
mediumCVSSv3 5.5 - CVE-2026-46245
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dc_link NULL handling in HPD init amdgpu_dm_hp…
mediumCVSSv3 5.5 - CVE-2026-46243
A privilege escalation vulnerability was found in the Linux kernel's CIFS client implementation.
highCVSSv3 7.8 - CVE-2026-46220
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission sdm…
mediumCVSSv3 6.6 - CVE-2026-46193
In the Linux kernel, the following vulnerability has been resolved: xfrm: ah: account for ESN high bits in async callbacks AH allocates…
mediumCVSSv3 5.5 - CVE-2026-46191
In the Linux kernel, the following vulnerability has been resolved: fbcon: Avoid OOB font access if console rotation fails Clear the fo…
highCVSSv3 7.7 - CVE-2026-46189
In the Linux kernel, the following vulnerability has been resolved: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error pa…
highCVSSv3 7.8 - CVE-2026-46184
In the Linux kernel, the following vulnerability has been resolved: sound: ua101: fix division by zero at probe Add a missing sanity ch…
mediumCVSSv3 5.5 - CVE-2026-46180
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential use-after-free issue when stopping wat…
mediumCVSSv3 5.5 - CVE-2026-46178
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Sashi…
highCVSSv3 7.8 - CVE-2026-46177
In the Linux kernel, the following vulnerability has been resolved: ipmi: Add limits to event and receive message requests The driver w…
highCVSSv3 7.5 - CVE-2026-46174
In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2'…
highCVSSv3 8.8 - CVE-2026-46167
In the Linux kernel, the following vulnerability has been resolved: usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Just…
mediumCVSSv3 5.5 - CVE-2026-46165
In the Linux kernel, the following vulnerability has been resolved: openvswitch: vport: fix self-deadlock on release of tunnel ports vp…
mediumCVSSv3 5.5 - CVE-2026-46161
In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix divide-by-zero in setup_geo() with zero far_copies s…
mediumCVSSv3 5.5 - CVE-2026-46149
In the Linux kernel, the following vulnerability has been resolved: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_…
highCVSSv3 7.1 - CVE-2026-46146
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()…
highCVSSv3 7.1 - CVE-2026-46109
In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: fix memory leak on ulpi_register() error paths Commit 01…
mediumCVSSv3 5.5 - CVE-2026-46102
In the Linux kernel, the following vulnerability has been resolved: net: strparser: fix skb_head leak in strp_abort_strp() When the str…
highCVSSv3 7.5 - CVE-2026-46088
In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_ini…
mediumCVSSv3 5.5 - CVE-2026-46086
In the Linux kernel, the following vulnerability has been resolved: net: bridge: use a stable FDB dst snapshot in RCU readers Local FDB…
mediumCVSSv3 5.5 - CVE-2026-46080
In the Linux kernel, the following vulnerability has been resolved: ocfs2: split transactions in dio completion to avoid credit exhausti…
highCVSSv3 7.1 - CVE-2026-46068
In the Linux kernel, the following vulnerability has been resolved: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ct…
mediumCVSSv3 5.5 - CVE-2026-46064
In the Linux kernel, the following vulnerability has been resolved: ibmasm: fix heap over-read in ibmasm_send_i2o_message() The ibmasm_…
mediumCVSSv3 5.5 - CVE-2026-46056
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci…
highCVSSv3 8.8 - CVE-2026-46051
In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix soft lockup in retry_aligned_read() When retry_aligne…
mediumCVSSv3 5.5 - CVE-2026-46049
In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Add fallback to default RSR for S/PDIF spdif_passthru_…
mediumCVSSv3 5.5 - CVE-2026-46040
In the Linux kernel, the following vulnerability has been resolved: inotify: fix watch count leak when fsnotify_add_inode_mark_locked()…
mediumCVSSv3 5.5 - CVE-2026-46033
In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - reject short ahash digests during instance crea…
highCVSSv3 7.1 - CVE-2026-46027
In the Linux kernel, the following vulnerability has been resolved: net/smc: avoid early lgr access in smc_clc_wait_msg A CLC decline c…
highCVSSv3 7.5 - CVE-2026-46023
In the Linux kernel, the following vulnerability has been resolved: dm mirror: fix integer overflow in create_dirty_log() The argument…
lowCVSSv3 3.4 - CVE-2026-46018
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES parse_uac2…
mediumCVSSv3 5.5 - CVE-2026-45997
In the Linux kernel, the following vulnerability has been resolved: scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails I…
mediumCVSSv3 5.5 - CVE-2026-45994
In the Linux kernel, the following vulnerability has been resolved: ibmasm: fix OOB reads in command_file_write due to missing size chec…
mediumCVSSv3 5.5 - CVE-2026-45985
In the Linux kernel, the following vulnerability has been resolved: ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submit…
—CVSSv3 0.0 - CVE-2026-45981
In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() `…
—CVSSv3 0.0 - CVE-2026-45923
In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: enable basic endpoint checking catc_probe() fills t…
mediumCVSSv3 5.5 - CVE-2026-45920
In the Linux kernel, the following vulnerability has been resolved: ext4: fix dirtyclusters double decrement on fs shutdown fstests tes…
highCVSSv3 7.8 - CVE-2026-45917
In the Linux kernel, the following vulnerability has been resolved: ipvs: do not keep dest_dst if dev is going down There is race betwe…
mediumCVSSv3 5.5 - CVE-2026-45915
In the Linux kernel, the following vulnerability has been resolved: fat: avoid parent link count underflow in rmdir Corrupted FAT image…
mediumCVSSv3 5.5 - CVE-2026-45905
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path icmp_rou…
mediumCVSSv3 4.7 - CVE-2026-45899
In the Linux kernel, the following vulnerability has been resolved: ext4: drop extent cache when splitting extent fails When the split…
criticalCVSSv3 9.8 - CVE-2026-45877
In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clien…
mediumCVSSv3 5.5 - CVE-2026-45871
In the Linux kernel, the following vulnerability has been resolved: tpm: st33zp24: Fix missing cleanup on get_burstcount() error get_bu…
mediumCVSSv3 5.5 - CVE-2026-45858
In the Linux kernel, the following vulnerability has been resolved: ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1…
mediumCVSSv3 5.5 - CVE-2026-45857
In the Linux kernel, the following vulnerability has been resolved: scsi: csiostor: Fix dereference of null pointer rn The error exit p…
mediumCVSSv3 5.5 - CVE-2026-43496
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_…
mediumCVSSv3 5.5 - CVE-2026-43493
In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG r…
criticalCVSSv3 9.8 - CVE-2026-43466
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery In case of…
highCVSSv3 8.2 - CVE-2026-43452
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: guard option walkers against 1-byte tail reads…
highCVSSv3 8.2 - CVE-2026-43451
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error p…
—CVSSv3 0.0 - CVE-2026-43449
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set dev->online_queu…
—CVSSv3 0.0 - CVE-2026-43445
In the Linux kernel, the following vulnerability has been resolved: e1000/e1000e: Fix leak in DMA error cleanup If an error is encounte…
—CVSSv3 0.0 - CVE-2026-43427
In the Linux kernel, the following vulnerability has been resolved: usb: class: cdc-wdm: fix reordering issue in read code path Quoting…
—CVSSv3 0.0 - CVE-2026-43425
In the Linux kernel, the following vulnerability has been resolved: usb: image: mdc800: kill download URB on timeout mdc800_device_read…
—CVSSv3 0.0 - CVE-2026-43383
In the Linux kernel, the following vulnerability has been resolved: net/tcp-md5: Fix MAC comparison to be constant-time To prevent timi…
criticalCVSSv3 9.4 - CVE-2026-43373
In the Linux kernel, the following vulnerability has been resolved: net: ncsi: fix skb leak in error paths Early return paths in NCSI R…
highCVSSv3 7.5 - CVE-2026-43370
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix use-after-free race in VM acquire Replace non-atomi…
highCVSSv3 7.8 - CVE-2026-43313
In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Fix NULL-pointer dereference in acpi_processor_erra…
—CVSSv3 0.0 - CVE-2026-43309
In the Linux kernel, the following vulnerability has been resolved: md raid: fix hang when stopping arrays with metadata through dm-raid…
mediumCVSSv3 5.5 - CVE-2026-43308
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed…
mediumCVSSv3 5.5 - CVE-2026-43287
In the Linux kernel, the following vulnerability has been resolved: drm: Account property blob allocations to memcg DRM_IOCTL_MODE_CREA…
—CVSSv3 0.0 - CVE-2026-43281
In the Linux kernel, the following vulnerability has been resolved: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() Alth…
highCVSSv3 7.1 - CVE-2026-43273
In the Linux kernel, the following vulnerability has been resolved: ceph: supply snapshot context in ceph_zero_partial_object() The cep…
—CVSSv3 0.0 - CVE-2026-43268
In the Linux kernel, the following vulnerability has been resolved: hfsplus: pretend special inodes as regular files Since commit af153…
—CVSSv3 0.0 - CVE-2026-43266
In the Linux kernel, the following vulnerability has been resolved: EFI/CPER: don't go past the ARM processor CPER record buffer There'…
—CVSSv3 0.0 - CVE-2026-43255
In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix WARNING in usb_tx_block The function usb_tx_blo…
—CVSSv3 0.0 - CVE-2026-43253
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: move wait_on_sem() out of spinlock With iommu.strict=1,…
highCVSSv3 7.5 - CVE-2026-43244
In the Linux kernel, the following vulnerability has been resolved: kcm: fix zero-frag skb in frag_list on partial sendmsg error Syzkal…
mediumCVSSv3 5.5 - CVE-2026-43230
In the Linux kernel, the following vulnerability has been resolved: net/rds: Clear reconnect pending bit When canceling the reconnect w…
highCVSSv3 7.5 - CVE-2026-43226
In the Linux kernel, the following vulnerability has been resolved: net/rds: No shortcut out of RDS_CONN_ERROR RDS connections carry a…
highCVSSv3 7.5 - CVE-2026-43216
In the Linux kernel, the following vulnerability has been resolved: net: Drop the lock in skb_may_tx_timestamp() skb_may_tx_timestamp()…
mediumCVSSv3 5.5 - CVE-2026-43211
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix pci_slot_trylock() error handling Commit a4e772898f8b ("PC…
highCVSSv3 7.8 - CVE-2026-43180
In the Linux kernel, the following vulnerability has been resolved: net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode…
highCVSSv3 7.8 - CVE-2026-43168
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix reflink preserve cleanup issue commit c06c303832ec ("ocf…
—CVSSv3 0.0 - CVE-2026-43156
In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: enable basic endpoint checking pegasus_probe() f…
—CVSSv3 0.0 - CVE-2026-43124
In the Linux kernel, the following vulnerability has been resolved: pstore: ram_core: fix incorrect success return when vmap() fails In…
—CVSSv3 0.0 - CVE-2026-43123
In the Linux kernel, the following vulnerability has been resolved: fbcon: check return value of con2fb_acquire_newinfo() If fbcon_open…
—CVSSv3 0.0 - CVE-2026-43069
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_ll: Fix firmware leak on error path Smatch reports:…
—CVSSv3 0.0 - CVE-2026-43068
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_g…
—CVSSv3 0.0 - CVE-2026-43033
In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - Do not place hiseq at end of dst for out-of-pla…
highCVSSv3 7.8 - CVE-2026-31759
In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: fix double free in ulpi_register_interface() error path…
—CVSSv3 0.0 - CVE-2026-31678
In the Linux kernel, the following vulnerability has been resolved: openvswitch: defer tunnel netdev_put to RCU release ovs_netdev_tunn…
highCVSSv3 7.8 - CVE-2026-31628
In the Linux kernel, the following vulnerability has been resolved: x86/CPU: Fix FPDSS on Zen1 Zen1's hardware divider can leave, under…
mediumCVSSv3 5.5 - CVE-2026-31624
In the Linux kernel, the following vulnerability has been resolved: HID: core: clamp report_size in s32ton() to avoid undefined shift s…
highCVSSv3 7.1 - CVE-2026-31598
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix possible deadlock between unlink and dio_end_io_write oc…
highCVSSv3 7.5 - CVE-2026-31510
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb Before…
mediumCVSSv3 5.5 - CVE-2026-31450
In the Linux kernel, the following vulnerability has been resolved: ext4: publish jinode after initialization ext4_inode_attach_jinode(…
highCVSSv3 8.8 - CVE-2026-31431Actively exploited
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly r…
criticalCVSSv3 7.8 - CVE-2025-54518
Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instruct…
highCVSSv3 7.0 - CVE-2025-38250
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix use-after-free in vhci_flush() syzbot repo…
highCVSSv3 7.8 - CVE-2023-2058
A vulnerability was found in EyouCms up to 1.6.2.
lowCVSSv3 2.4