MediumCVE-2026-98532

    Linux Kernel: Mehrere Schwachstellen

    Published Sources: BSI

    What is affected, what to do

    In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6_find_hdr() return an offset past the packet end ipv6_find_hdr() walks the extension header chain, skipping each header by the length that header itself declares. ipv6_optlen() returns up to 2048, and the skip is never checked against skb->len, so the offset stored in *offset can point past the end of the packet. openvswitch installs that offset as the transport header, and update_ipv6_checksum() then reads and writes the transport checksum field out of bounds: BUG: KASAN: slab-use-after-free in inet_proto_csum_replace16+0x445/0x470 Read of size 2 at addr ffff88810b754b06 by task ovs_ipv6_oob/629 CPU: 4 UID: 1000 PID: 629 Comm: ovs_ipv6_oob Tainted: G N 7.3.0-rc3+ #348 Call Trace: inet_proto_csum_replace16+0x445/0x470 set_ipv6_addr+0x3dd/0x460 do_execute_actions+0x6a3d/0x7c40 ovs_execute_actions+0xfd/0x480 ovs_packet_cmd_execute+0xc38/0xf20 genl_rcv_msg+0x59e/0x870 netlink_rcv_skb+0x18b/0x450 genl_rcv+0x2d/0x40 netlink_unicast+0x6bc/0xa20 The buggy address belongs to the object at ffff88810b754980 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 390 bytes inside of freed 704-byte region [ffff88810b754980, ffff88810b754c40) Other callers use that offset too, so bound it here rather than in one caller. Reject a header whose declared length does not fit in the packet. ipv6_find_hdr() already fails with -EBADMSG on a malformed chain, so this adds no new failure mode.

    Update Linux Kernel to version 6.1.189, Linux Kernel to version 6.6.158, Linux Kernel to version 6.12.112.

    Affected
    • Linux Kernel lt 5.16..6.1.189
    • Linux Kernel lt 6.2..6.6.158
    • Linux Kernel lt 6.7..6.12.112
    • Linux Kernel lt 6.13..6.18.55
    • Linux Kernel lt 6.19..7.2.9
    • Linux Kernel lt 3.8..5.10.271
    • Linux Kernel lt 5.11..5.15.222
    Fixed in
    • Linux Kernel 6.1.189
    • Linux Kernel 6.6.158
    • Linux Kernel 6.12.112
    • Linux Kernel 6.18.55
    • Linux Kernel 7.2.9
    • Linux Kernel 7.3
    • Linux Kernel 5.10.271
    • Linux Kernel 5.15.222

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    5.6

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: Vendor (CNA), CVSS v3

    5.6

    CVSS v3

    Severity Medium on the scale from 0 to 10.

    Source: BSI

    0.6 %

    EPSS score

    Low — model estimates < 1% exploitation likelihood.

    Source: FIRST EPSS, percentile 49.4

    Show all metrics
    Severity
    Medium
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    56.41 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    no public PoC known
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    5.6 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    5.6
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    0.6 %
    Low — model estimates < 1% exploitation likelihood.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    49.4
    High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    —
    Published

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    Handle the vulnerability in regular vulnerability handling under Art. 21(2)(e) NIS2.
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6_find_hdr() return an offset past the packet end ipv6_find_hdr() walks the extension header chain, skipping each header by the length that header itself declares. ipv6_optlen() returns up to 2048, and the skip is never checked against skb->len, so the offset stored in *offset can point past the end of the packet. openvswitch installs that offset as the transport header, and update_ipv6_checksum() then reads and writes the transport checksum field out of bounds: BUG: KASAN: slab-use-after-free in inet_proto_csum_replace16+0x445/0x470 Read of size 2 at addr ffff88810b754b06 by task ovs_ipv6_oob/629 CPU: 4 UID: 1000 PID: 629 Comm: ovs_ipv6_oob Tainted: G N 7.3.0-rc3+ #348 Call Trace: inet_proto_csum_replace16+0x445/0x470 set_ipv6_addr+0x3dd/0x460 do_execute_actions+0x6a3d/0x7c40 ovs_execute_actions+0xfd/0x480 ovs_packet_cmd_execute+0xc38/0xf20 genl_rcv_msg+0x59e/0x870 netlink_rcv_skb+0x18b/0x450 genl_rcv+0x2d/0x40 netlink_unicast+0x6bc/0xa20 The buggy address belongs to the object at ffff88810b754980 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 390 bytes inside of freed 704-byte region [ffff88810b754980, ffff88810b754c40) Other callers use that offset too, so bound it here rather than in one caller. Reject a header whose declared length does not fit in the packet. ipv6_find_hdr() already fails with -EBADMSG on a malformed chain, so this adds no new failure mode.

    Source: BSI WID Portal

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    LinuxLinux
    • 2.6.12 – < 5.10.271
    • 2.6.12 – < 5.10.273
    • 2.6.12 – < 5.15.222
    • 2.6.14 – < 5.10.271
    • 2.6.14 – < 5.10.273
    • 2.6.21 – < 5.10.273
    • 2.6.24 – < 7.2.10
    • 2.6.26 – < 5.10.273
    • 2.6.26 – < 7.2.9
    • 2.6.27 – < 5.10.271
    • 2.6.27 – < 5.10.273
    • 2.6.30 – < 5.10.273
    • 2.6.31 – < 5.10.273
    • 2.6.31.2 – < 2.6.32
    • 2.6.32 – < 5.10.273
    • 2.6.33 – < 5.10.273
    • 2.6.34 – < 5.10.273
    • 2.6.35 – < 5.10.271
    • 2.6.35 – < 6.12.113
    • 2.6.36 – < 5.15.224
    • 2.6.38 – < 7.2.10
    • 2.6.39 – < 5.10.271
    • 3.0 – < 5.10.273
    • 3.1 – < 5.15.224
    • 3.10 – < 5.10.271
    • 3.10 – < 5.10.273
    • 3.10 – < 5.15.224
    • 3.10.106 – < 3.11
    • 3.11 – < 5.10.273
    • 3.12 – < 5.10.271
    • 3.12.18 – < 3.13
    • 3.12.71 – < 3.13
    • 3.13 – < 5.10.271
    • 3.13 – < 5.10.273
    • 3.13 – < 6.18.60
    • 3.13.10 – < 3.14
    • 3.14 – < 5.10.271
    • 3.14 – < 5.10.273
    • 3.15 – < 5.10.273
    • 3.16 – < 5.10.271
    • 3.16.52 – < 3.17
    • 3.16.54 – < 3.17
    • 3.16.57 – < 3.17
    • 3.16.83 – < 3.17
    • 3.17 – < 5.10.273
    • 3.18 – < 5.10.273
    • 3.18.94 – < 3.19
    • 3.19 – < 6.6.160
    • 5.10.271
    • 5.10.273
    • 5.15.222
    • 5.10.271
    • 5.10.273
    • 5.10.273
    • 7.2.10
    • 5.10.273
    • 7.2.9
    • 5.10.271
    • 5.10.273
    • 5.10.273
    • 5.10.273
    • 2.6.32
    • 5.10.273
    • 5.10.273
    • 5.10.273
    • 5.10.271
    • 6.12.113
    • 5.15.224
    • 7.2.10
    • 5.10.271
    • 5.10.273
    • 5.15.224
    • 5.10.271
    • 5.10.273
    • 5.15.224
    • 3.11
    • 5.10.273
    • 5.10.271
    • 3.13
    • 3.13
    • 5.10.271
    • 5.10.273
    • 6.18.60
    • 3.14
    • 5.10.271
    • 5.10.273
    • 5.10.273
    • 5.10.271
    • 3.17
    • 3.17
    • 3.17
    • 3.17
    • 5.10.273
    • 5.10.273
    • 3.19
    • 6.6.160

    Vendors and products

    Affected operating systems

    Affected operating systems
    Linuxdebianlinux-6.12bookworm

    References & sources

    Changes to this CVE

    Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

    1. Record modifiedLinux

      CVSS V3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

      Show the original change
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      CVSSadded
      —
      AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

      Source identifier: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    2. Record modifiedLinux

      1 individual change: Affected versions (publisher)

      Show the original change
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Affected versions (publisher)added
      —
      Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/98xxx/CVE-2026-98532.json">CVE-2026-98532</a>

      Source identifier: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    3. ReceivedLinux

      Description added or changed

      Show 10 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Descriptionadded
      —
      In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6_find_hdr() return an offset past the packet end ipv6_find_hdr() walks the extension header chain, skipping each header by the length that header itself declares. ipv6_optlen() returns up to 2048, and the skip is never checked against skb->len, so the offset stored in *offset can point past the end of the packet. openvswitch installs that offset as the transport header, and update_ipv6_checksum() then reads and writes the transport checksum field out of bounds: BUG: KASAN: slab-use-after-free in inet_proto_csum_replace16+0x445/0x470 Read of size 2 at addr ffff88810b754b06 by task ovs_ipv6_oob/629 CPU: 4 UID: 1000 PID: 629 Comm: ovs_ipv6_oob Tainted: G N 7.3.0-rc3+ #348 Call Trace: inet_proto_csum_replace16+0x445/0x470 set_ipv6_addr+0x3dd/0x460 do_execute_actions+0x6a3d/0x7c40 ovs_execute_actions+0xfd/0x480 ovs_packet_cmd_execute+0xc38/0xf20 genl_rcv_msg+0x59e/0x870 netlink_rcv_skb+0x18b/0x450 genl_rcv+0x2d/0x40 netlink_unicast+0x6bc/0xa20 The buggy address belongs to the object at ffff88810b754980 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 390 bytes inside of freed 704-byte region [ffff88810b754980, ffff88810b754c40) Other callers use that offset too, so bound it here rather than in one caller. Reject a header whose declared length does not fit in the packet. ipv6_find_hdr() already fails with -EBADMSG on a malformed chain, so this adds no new failure mode.
      Affected versions (publisher)added
      —
      New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/98xxx/CVE-2026-98532.json">CVE-2026-98532</a>
      Referenceadded
      —
      https://git.kernel.org/stable/c/1c70275ca87e769e1a52abc644d61372d8c016cb
      Referenceadded
      —
      https://git.kernel.org/stable/c/1d42828565889632068fbc2983c34d57c66af4e0
      Referenceadded
      —
      https://git.kernel.org/stable/c/4254d5878c320c19961dd0b8e1d0aca4800d8b7d
      Referenceadded
      —
      https://git.kernel.org/stable/c/531255de8971c06d5d5986f85fdc2525d707ba71
      Referenceadded
      —
      https://git.kernel.org/stable/c/543354c6efb27eae3372a3a9674aeaa2a86e2b2c
      Referenceadded
      —
      https://git.kernel.org/stable/c/ca96b38730e31357ef4a9d76af1336958ac670d7
      Referenceadded
      —
      https://git.kernel.org/stable/c/dc92cb972e86790b8078337ec41015b748b8f8e5
      Referenceadded
      —
      https://git.kernel.org/stable/c/ee319bd3a0e976af5087cbe59ebc50a66f31d202

      Source identifier: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Linked CVEs

    Linked CVEs
    Not ratedCVE-2026-98868Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98867Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98866Linux Kernel: Use-After-Free——
    Not ratedCVE-2026-98865Linux Kernel: Deadlock——
    Not ratedCVE-2026-98864Linux Kernel: security vulnerability——
    HighCVE-2026-98863Linux Kernel: security vulnerability7.8—
    MediumCVE-2026-98862Linux Kernel: Use-After-Free6.0—
    Not ratedCVE-2026-98861Linux Kernel: Use-After-Free——
    Not ratedCVE-2026-98860Linux Kernel: security vulnerability——
    MediumCVE-2026-98859Linux Kernel: security vulnerability5.7—
    Not ratedCVE-2026-98858Linux Kernel: Use-After-Free——
    HighCVE-2026-98857Linux Kernel: security vulnerability7.5—
    MediumCVE-2026-98856Linux Kernel: security vulnerability6.4—
    MediumCVE-2026-98855Linux Kernel: security vulnerability5.2—
    MediumCVE-2026-98854Linux Kernel: security vulnerability4.1—
    MediumCVE-2026-98853Linux Kernel: security vulnerability5.5—
    LowCVE-2026-98852Linux Kernel: security vulnerability3.7—
    LowCVE-2026-98851Linux Kernel: security vulnerability2.3—
    MediumCVE-2026-98850Linux Kernel: security vulnerability4.1—
    Not ratedCVE-2026-98849Linux Kernel: NULL Pointer Dereference——
    MediumCVE-2026-98848Linux Kernel: Out-of-Bounds Access4.1—
    MediumCVE-2026-98847Linux Kernel: security vulnerability4.1—
    HighCVE-2026-98846Linux Kernel: security vulnerability7.5—
    Not ratedCVE-2026-98845Linux Kernel: security vulnerability——
    Show 305 more CVEs
    Linked CVEs
    Not ratedCVE-2026-98844Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98843Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98842Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98841Linux Kernel: NULL Pointer Dereference——
    MediumCVE-2026-98840Linux Kernel: Use-After-Free4.7—
    LowCVE-2026-98839Linux Kernel: Out-of-Bounds Read3.0—
    MediumCVE-2026-98838Linux Kernel: Out-of-Bounds Access4.1—
    MediumCVE-2026-98837Linux Kernel: Use-After-Free4.6—
    MediumCVE-2026-98836Linux Kernel: Out-of-Bounds Access6.8—
    MediumCVE-2026-98835Linux Kernel: security vulnerability5.2—
    MediumCVE-2026-98834Linux Kernel: Double Free6.4—
    MediumCVE-2026-98833Linux Kernel: security vulnerability4.4—
    Not ratedCVE-2026-98832Linux Kernel: Deadlock——
    LowCVE-2026-98831Linux Kernel: security vulnerability2.3—
    MediumCVE-2026-98830Linux Kernel: security vulnerability6.8—
    HighCVE-2026-98829Linux Kernel: security vulnerability8.1—
    MediumCVE-2026-98828Linux Kernel: security vulnerability5.2—
    HighCVE-2026-98827Linux Kernel: security vulnerability7.1—
    MediumCVE-2026-98826Linux Kernel: Use-After-Free6.4—
    MediumCVE-2026-98825Linux Kernel: security vulnerability4.4—
    MediumCVE-2026-98824Linux Kernel: Out-of-Bounds Access5.2—
    MediumCVE-2026-98823Linux Kernel: security vulnerability6.4—
    MediumCVE-2026-98822Linux Kernel: security vulnerability6.5—
    Not ratedCVE-2026-98821Linux Kernel: NULL Pointer Dereference——
    MediumCVE-2026-98820Linux Kernel: security vulnerability4.1—
    MediumCVE-2026-98819Linux Kernel: security vulnerability5.2—
    Not ratedCVE-2026-98818Linux Kernel: Deadlock——
    Not ratedCVE-2026-98817Linux Kernel: security vulnerability——
    MediumCVE-2026-98816Linux Kernel: security vulnerability4.1—
    MediumCVE-2026-98815Linux Kernel: Use-After-Free6.5—
    MediumCVE-2026-98814Linux Kernel: Use-After-Free4.7—
    Not ratedCVE-2026-98813Linux Kernel: Use-After-Free——
    MediumCVE-2026-98812Linux Kernel: NULL Pointer Dereference4.7—
    LowCVE-2026-98811Linux Kernel: security vulnerability1.9—
    MediumCVE-2026-98810Linux Kernel: Out-of-Bounds Read5.1—
    MediumCVE-2026-98809Linux Kernel: security vulnerability5.5—
    HighCVE-2026-98808Linux Kernel: Buffer Overflow7.8—
    LowCVE-2026-98807Linux Kernel: Out-of-Bounds Access3.4—
    Not ratedCVE-2026-98806Linux Kernel: security vulnerability——
    MediumCVE-2026-98805Linux Kernel: security vulnerability6.8—
    Not ratedCVE-2026-98804Linux Kernel: Use-After-Free——
    MediumCVE-2026-98803Linux Kernel: security vulnerability6.5—
    LowCVE-2026-98802Linux Kernel: security vulnerability3.7—
    HighCVE-2026-98801Linux Kernel: security vulnerability7.1—
    MediumCVE-2026-98800Linux Kernel: Out-of-Bounds Access5.2—
    MediumCVE-2026-98799Linux Kernel: security vulnerability5.2—
    MediumCVE-2026-98798Linux Kernel: security vulnerability4.4—
    MediumCVE-2026-98797Linux Kernel: Out-of-Bounds Access6.4—
    MediumCVE-2026-98796Linux Kernel: security vulnerability5.7—
    MediumCVE-2026-98795Linux Kernel: NULL Pointer Dereference4.4—
    CriticalCVE-2026-98794Linux Kernel: security vulnerability9.1—
    MediumCVE-2026-98793Linux Kernel: security vulnerability6.7—
    MediumCVE-2026-98792Linux Kernel: security vulnerability5.2—
    Not ratedCVE-2026-98791Linux Kernel: security vulnerability——
    LowCVE-2026-98790Linux Kernel: Race Condition2.5—
    MediumCVE-2026-98789Linux Kernel: security vulnerability4.4—
    Not ratedCVE-2026-98788Linux Kernel: Use-After-Free——
    Not ratedCVE-2026-98787Linux Kernel: security vulnerability——
    MediumCVE-2026-98786Linux Kernel: security vulnerability4.0—
    MediumCVE-2026-98785Linux Kernel: security vulnerability4.1—
    LowCVE-2026-98784Linux Kernel: security vulnerability2.3—
    MediumCVE-2026-98783Linux Kernel: security vulnerability5.5—
    HighCVE-2026-98782Linux Kernel: security vulnerability7.1—
    HighCVE-2026-98781Linux Kernel: security vulnerability7.1—
    LowCVE-2026-98780Linux Kernel: Memory Leak1.9—
    LowCVE-2026-98779Linux Kernel: security vulnerability1.9—
    MediumCVE-2026-98778Linux Kernel: security vulnerability6.3—
    MediumCVE-2026-98777Linux Kernel: security vulnerability4.7—
    Not ratedCVE-2026-98776Linux Kernel: Use-After-Free——
    MediumCVE-2026-98775Linux Kernel: Use-After-Free6.5—
    Not ratedCVE-2026-98774Linux Kernel: security vulnerability——
    MediumCVE-2026-98773Linux Kernel: Use-After-Free5.7—
    MediumCVE-2026-98772Linux Kernel: Use-After-Free5.7—
    MediumCVE-2026-98771Linux Kernel: security vulnerability4.3—
    MediumCVE-2026-98770Linux Kernel: security vulnerability6.0—
    MediumCVE-2026-98769Linux Kernel: Out-of-Bounds Access6.8—
    MediumCVE-2026-98768Linux Kernel: security vulnerability4.1—
    MediumCVE-2026-98767Linux Kernel: security vulnerability4.4—
    MediumCVE-2026-98766Linux Kernel: Use-After-Free5.2—
    MediumCVE-2026-98765Linux Kernel: security vulnerability5.7—
    MediumCVE-2026-98764Linux Kernel: NULL Pointer Dereference4.4—
    MediumCVE-2026-98763Linux Kernel: security vulnerability6.8—
    MediumCVE-2026-98762Linux Kernel: security vulnerability5.7—
    LowCVE-2026-98761Linux Kernel: security vulnerability1.8—
    MediumCVE-2026-98760Linux Kernel: security vulnerability6.4—
    Not ratedCVE-2026-98759Linux Kernel: security vulnerability——
    MediumCVE-2026-98758Linux Kernel: Use-After-Free5.2—
    MediumCVE-2026-98757Linux Kernel: Use-After-Free6.4—
    MediumCVE-2026-98756Linux Kernel: NULL Pointer Dereference4.1—
    MediumCVE-2026-98755Linux Kernel: security vulnerability4.3—
    MediumCVE-2026-98754Linux Kernel: Use-After-Free5.2—
    MediumCVE-2026-98753Linux Kernel: NULL Pointer Dereference4.7—
    MediumCVE-2026-98752Linux Kernel: Use-After-Free5.7—
    MediumCVE-2026-98751Linux Kernel: security vulnerability4.7—
    MediumCVE-2026-98750Linux Kernel: Use-After-Free6.4—
    MediumCVE-2026-98749Linux Kernel: security vulnerability5.7—
    MediumCVE-2026-98748Linux Kernel: Use-After-Free4.1—
    MediumCVE-2026-98747Linux Kernel: NULL Pointer Dereference4.4—
    LowCVE-2026-98746Linux Kernel: security vulnerability2.3—
    MediumCVE-2026-98745Linux Kernel: security vulnerability4.7—
    LowCVE-2026-98744Linux Kernel: security vulnerability2.5—
    LowCVE-2026-98743Linux Kernel: security vulnerability3.6—
    MediumCVE-2026-98742Linux Kernel: security vulnerability6.5—
    MediumCVE-2026-98741Linux Kernel: Out-of-Bounds Access6.6—
    MediumCVE-2026-98740Linux Kernel: security vulnerability4.1—
    MediumCVE-2026-98739Linux Kernel: Use-After-Free5.8—
    MediumCVE-2026-98738Linux Kernel: Use-After-Free6.4—
    HighCVE-2026-98737Linux Kernel: Use-After-Free7.1—
    HighCVE-2026-98736Linux Kernel: Use-After-Free7.1—
    HighCVE-2026-98735Linux Kernel: Use-After-Free7.5—
    HighCVE-2026-98734Linux Kernel: Use-After-Free7.5—
    HighCVE-2026-98733Linux Kernel: Use-After-Free7.0—
    LowCVE-2026-98732Linux Kernel: Buffer Over-read2.4—
    Not ratedCVE-2026-98731Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98730Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98729Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98728Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98727Linux Kernel: security vulnerability——
    MediumCVE-2026-98726Linux Kernel: security vulnerability6.3—
    CriticalCVE-2026-98725Linux Kernel: Out-of-Bounds Write9.1—
    Not ratedCVE-2026-98724Linux Kernel: Out-of-Bounds Access——
    Not ratedCVE-2026-98723Linux Kernel: security vulnerability——
    MediumCVE-2026-98722Linux Kernel: security vulnerability4.4—
    MediumCVE-2026-98721Linux Kernel: security vulnerability5.7—
    HighCVE-2026-98720Linux Kernel: security vulnerability7.7—
    Not ratedCVE-2026-98719Linux Kernel: Double Free——
    Not ratedCVE-2026-98718Linux Kernel: security vulnerability——
    MediumCVE-2026-98717Linux Kernel: NULL Pointer Dereference4.7—
    HighCVE-2026-98716Linux Kernel: security vulnerability7.8—
    HighCVE-2026-98715Linux Kernel: security vulnerability7.8—
    MediumCVE-2026-98714Linux Kernel: security vulnerability4.2—
    Not ratedCVE-2026-98713Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98712Linux Kernel: security vulnerability——
    MediumCVE-2026-98711Linux Kernel: security vulnerability4.6—
    LowCVE-2026-98710Linux Kernel: security vulnerability2.3—
    HighCVE-2026-98709Linux Kernel: Use-After-Free7.1—
    MediumCVE-2026-98708Linux Kernel: security vulnerability5.2—
    HighCVE-2026-98707Linux Kernel: security vulnerability7.5—
    HighCVE-2026-98706Linux Kernel: security vulnerability7.1—
    MediumCVE-2026-98705Linux Kernel: security vulnerability5.7—
    MediumCVE-2026-98704Linux Kernel: security vulnerability6.4—
    MediumCVE-2026-98703Linux Kernel: Out-of-Bounds Access6.3—
    Not ratedCVE-2026-98702Linux Kernel: security vulnerability——
    MediumCVE-2026-98701Linux Kernel: security vulnerability4.3—
    LowCVE-2026-98700Linux Kernel: security vulnerability3.3—
    MediumCVE-2026-98699Linux Kernel: security vulnerability6.4—
    MediumCVE-2026-98698Linux Kernel: security vulnerability5.7—
    LowCVE-2026-98697Linux Kernel: security vulnerability1.9—
    MediumCVE-2026-98696Linux Kernel: Use-After-Free5.2—
    MediumCVE-2026-98695Linux Kernel: security vulnerability4.2—
    MediumCVE-2026-98694Linux Kernel: Use-After-Free5.2—
    Not ratedCVE-2026-98693Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98692Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98691Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98690Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98689Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98688Linux Kernel: security vulnerability——
    HighCVE-2026-98687Linux Kernel: Out-of-Bounds Read8.1—
    HighCVE-2026-98686Linux Kernel: security vulnerability7.1—
    MediumCVE-2026-98685Linux Kernel: security vulnerability4.4—
    LowCVE-2026-98684Linux Kernel: security vulnerability2.5—
    Not ratedCVE-2026-98683Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98682Linux Kernel: security vulnerability——
    MediumCVE-2026-98681Linux Kernel: security vulnerability5.0—
    Not ratedCVE-2026-98680Linux Kernel: Memory Leak——
    LowCVE-2026-98679Linux Kernel: security vulnerability3.3—
    Not ratedCVE-2026-98678Linux Kernel: security vulnerability——
    MediumCVE-2026-98677Linux Kernel: Use-After-Free5.7—
    Not ratedCVE-2026-98676Linux Kernel: NULL Pointer Dereference——
    Not ratedCVE-2026-98675Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98674Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98673Linux Kernel: security vulnerability——
    MediumCVE-2026-98672Linux Kernel: Divide By Zero5.5—
    LowCVE-2026-98671Linux Kernel: security vulnerability2.3—
    MediumCVE-2026-98670Linux Kernel: security vulnerability5.7—
    MediumCVE-2026-98669Linux Kernel: security vulnerability6.4—
    MediumCVE-2026-98668Linux Kernel: security vulnerability5.5—
    Not ratedCVE-2026-98667Linux Kernel: security vulnerability——
    MediumCVE-2026-98666Linux Kernel: security vulnerability5.7—
    MediumCVE-2026-98665Linux Kernel: NULL Pointer Dereference4.6—
    MediumCVE-2026-98664Linux Kernel: security vulnerability5.3—
    MediumCVE-2026-98663Linux Kernel: security vulnerability5.7—
    MediumCVE-2026-98662Linux Kernel: Use-After-Free5.2—
    LowCVE-2026-98661Linux Kernel: security vulnerability3.3—
    MediumCVE-2026-98660Linux Kernel: Out-of-Bounds Access6.1—
    Not ratedCVE-2026-98659Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98658Linux Kernel: security vulnerability——
    MediumCVE-2026-98657Linux Kernel: security vulnerability5.2—
    MediumCVE-2026-98656Linux Kernel: security vulnerability5.2—
    MediumCVE-2026-98655Linux Kernel: security vulnerability5.5—
    Not ratedCVE-2026-98654Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98653Linux Kernel: security vulnerability——
    MediumCVE-2026-98652Linux Kernel: security vulnerability4.1—
    Not ratedCVE-2026-98651Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98650Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98649Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98648Linux Kernel: Out-of-Bounds Read——
    MediumCVE-2026-98647Linux Kernel: security vulnerability4.1—
    MediumCVE-2026-98646Linux Kernel: security vulnerability4.4—
    Not ratedCVE-2026-98645Linux Kernel: Use-After-Free——
    MediumCVE-2026-98644Linux Kernel: security vulnerability4.4—
    MediumCVE-2026-98643Linux Kernel: Out-of-Bounds Read4.4—
    MediumCVE-2026-98642Linux Kernel: Use-After-Free6.4—
    Not ratedCVE-2026-98641Linux Kernel: security vulnerability——
    MediumCVE-2026-98640Linux Kernel: Out-of-Bounds Access4.4—
    Not ratedCVE-2026-98639Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98638Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98637Linux Kernel: security vulnerability——
    MediumCVE-2026-98636Linux Kernel: Out-of-Bounds Access4.4—
    Not ratedCVE-2026-98635Linux Kernel: Out-of-Bounds Write——
    MediumCVE-2026-98634Linux Kernel: security vulnerability6.1—
    Not ratedCVE-2026-98633Linux Kernel: security vulnerability——
    MediumCVE-2026-98632Linux Kernel: Use-After-Free5.2—
    MediumCVE-2026-98631Linux Kernel: security vulnerability6.0—
    Not ratedCVE-2026-98630Linux Kernel: security vulnerability——
    LowCVE-2026-98629Linux Kernel: security vulnerability3.4—
    LowCVE-2026-98628Linux Kernel: security vulnerability2.3—
    Not ratedCVE-2026-98627Linux Kernel: Out-of-Bounds Access——
    HighCVE-2026-98626Linux Kernel: security vulnerability7.1—
    MediumCVE-2026-98625Linux Kernel: Use-After-Free5.7—
    MediumCVE-2026-98624Linux Kernel: security vulnerability4.1—
    MediumCVE-2026-98623Linux Kernel: Out-of-Bounds Read5.1—
    MediumCVE-2026-98622Linux Kernel: security vulnerability4.7—
    CriticalCVE-2026-98621Linux Kernel: security vulnerability9.1—
    MediumCVE-2026-98620Linux Kernel: security vulnerability4.4—
    Not ratedCVE-2026-98619Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98618Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98617Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98616Linux Kernel: NULL Pointer Dereference——
    Not ratedCVE-2026-98615Linux Kernel: security vulnerability——
    MediumCVE-2026-98614Linux Kernel: security vulnerability5.9—
    Not ratedCVE-2026-98613Linux Kernel: security vulnerability——
    MediumCVE-2026-98612Linux Kernel: security vulnerability6.1—
    Not ratedCVE-2026-98611Linux Kernel: security vulnerability——
    MediumCVE-2026-98610Linux Kernel: security vulnerability5.9—
    MediumCVE-2026-98609Linux Kernel: security vulnerability5.5—
    MediumCVE-2026-98608Linux Kernel: security vulnerability5.5—
    LowCVE-2026-98607Linux Kernel: security vulnerability3.3—
    MediumCVE-2026-98606Linux Kernel: security vulnerability6.5—
    MediumCVE-2026-98605Linux Kernel: security vulnerability5.1—
    Not ratedCVE-2026-98604Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98603Linux Kernel: security vulnerability——
    HighCVE-2026-98602Linux Kernel: Out-of-Bounds Read8.1—
    Not ratedCVE-2026-98601Linux Kernel: Out-of-Bounds Access——
    Not ratedCVE-2026-98600Linux Kernel: security vulnerability——
    MediumCVE-2026-98599Linux Kernel: security vulnerability6.7—
    MediumCVE-2026-98598Linux Kernel: security vulnerability4.1—
    MediumCVE-2026-98597Linux Kernel: security vulnerability6.1—
    Not ratedCVE-2026-98596Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98595Linux Kernel: security vulnerability——
    LowCVE-2026-98594Linux Kernel: security vulnerability2.3—
    MediumCVE-2026-98593Linux Kernel: NULL Pointer Dereference4.4—
    Not ratedCVE-2026-98592Linux Kernel: security vulnerability——
    MediumCVE-2026-98591Linux Kernel: security vulnerability6.7—
    MediumCVE-2026-98590Linux Kernel: security vulnerability6.3—
    MediumCVE-2026-98589Linux Kernel: security vulnerability6.7—
    MediumCVE-2026-98588Linux Kernel: Out-of-Bounds Write5.7—
    Not ratedCVE-2026-98587Linux Kernel: security vulnerability——
    MediumCVE-2026-98586Linux Kernel: security vulnerability5.9—
    Not ratedCVE-2026-98585Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98584Linux Kernel: security vulnerability——
    MediumCVE-2026-98583Linux Kernel: security vulnerability4.6—
    MediumCVE-2026-98582Linux Kernel: security vulnerability5.2—
    HighCVE-2026-98581Linux Kernel: Use-After-Free7.1—
    MediumCVE-2026-98580Linux Kernel: Race Condition5.8—
    LowCVE-2026-98579Linux Kernel: security vulnerability2.3—
    MediumCVE-2026-98578Linux Kernel: security vulnerability5.2—
    MediumCVE-2026-98577Linux Kernel: security vulnerability5.3—
    MediumCVE-2026-98576Linux Kernel: Out-of-Bounds Read5.9—
    LowCVE-2026-98575Linux Kernel: security vulnerability3.5—
    Not ratedCVE-2026-98574Linux Kernel: Use-After-Free——
    CriticalCVE-2026-98573Linux Kernel: security vulnerability9.4—
    MediumCVE-2026-98572Linux Kernel: security vulnerability4.4—
    Not ratedCVE-2026-98571Linux Kernel: security vulnerability——
    HighCVE-2026-98570Linux Kernel: security vulnerability7.4—
    MediumCVE-2026-98569Linux Kernel: security vulnerability4.4—
    MediumCVE-2026-98568Linux Kernel: security vulnerability6.0—
    MediumCVE-2026-98567Linux Kernel: Out-of-Bounds Access6.7—
    Not ratedCVE-2026-98566Linux Kernel: security vulnerability——
    MediumCVE-2026-98565Linux Kernel: security vulnerability4.4—
    Not ratedCVE-2026-98564Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98563Linux Kernel: security vulnerability——
    Not ratedCVE-2026-98562Linux Kernel: security vulnerability——
    HighCVE-2026-98561Linux Kernel: security vulnerability7.5—
    Not ratedCVE-2026-98560Linux Kernel: security vulnerability——
    HighCVE-2026-98559Linux Kernel: security vulnerability7.7—
    MediumCVE-2026-98558Linux Kernel: security vulnerability4.1—
    Not ratedCVE-2026-98557Linux Kernel: security vulnerability——
    MediumCVE-2026-98556Linux Kernel: security vulnerability5.5—
    MediumCVE-2026-98555Linux Kernel: Double Free6.4—
    MediumCVE-2026-98537Linux Kernel: security vulnerability4.7—
    MediumCVE-2026-98536Linux Kernel: security vulnerability4.1—
    LowCVE-2026-98535Linux Kernel: security vulnerability2.3—
    Not ratedCVE-2026-98534Linux Kernel: Use-After-Free——
    Not ratedCVE-2026-98533Linux Kernel: security vulnerability——
    MediumCVE-2026-98532Linux Kernel: Use-After-Free5.6—
    MediumCVE-2026-98531Linux Kernel: Out-of-Bounds Read4.4—
    Not ratedCVE-2026-98528Linux Kernel: security vulnerability——
    MediumCVE-2026-98439Linux Kernel: security vulnerability4.3—
    Not ratedCVE-2026-98438Linux Kernel: Use of Uninitialized Memory——
    Not ratedCVE-2026-98437Linux Kernel: security vulnerability——
    HighCVE-2026-98436Linux Kernel: security vulnerability7.1—
    MediumCVE-2026-98435Linux Kernel: security vulnerability5.2—
    Not ratedCVE-2026-98434Linux Kernel: security vulnerability——
    MediumCVE-2026-98433Linux Kernel: security vulnerability5.5—
    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2026-98532
    <a href="https://intel.neosec.eu/en/cve/CVE-2026-98532"><img src="https://intel.neosec.eu/badge/cve/CVE-2026-98532.svg?lang=en" alt="CVE-2026-98532 – NEOSEC Intel" height="20"></a>