CVE-2026-52915
Security update for the Linux Kernel
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_hbh: reject oversized option lists struct ip6t_opts stores at most IP6T_OPTS_OPTSNR option descriptors, but hbh_mt6_check() does not reject larger optsnr values supplied from userspace. Validate optsnr in the rule setup path so only match data that fits the fixed-size opts array can be installed. This follows the existing xtables pattern of rejecting invalid user-provided counts in checkentry() and keeps the packet matching path unchanged. `struct ip6t_opts` has a fixed `opts[IP6T_OPTS_OPTSNR]` array, where `IP6T_OPTS_OPTSNR` is 16, then off-by-one array access is possible: [ 137.924693][ T8692] UBSAN: array-index-out-of-bounds in ../net/ipv6/netfilter/ip6t_hbh.c:110:29 [ 137.926167][ T8692] index 16 is out of range for type '__u16 [16]'
Metrics
Reanalysis & status changes
Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.
- New CVE Received2026-06-24 08:16 UTC· 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- Affected: Linux, Linux
- Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_hbh: reject oversized option lists struct ip6t_opts stores at most IP6T_OPTS_OPTSNR option descriptors, but hbh_mt6_check() does not reject larger optsnr values supplied from userspace. Validate optsnr in the rule setup path so only match data that fits the fixed-size opts array can be installed. This follows the existing xtables pattern of rejecting invalid user-provided counts in checkentry() and keeps the packet matching path unchanged. `struct ip6t_opts` has a fixed `opts[IP6T_OPTS_OPTSNR]` array, where `IP6T_OPTS_OPTSNR` is 16, then off-by-one array access is possible: [ 137.924693][ T8692] UBSAN: array-index-out-of-bounds in ../net/ipv6/netfilter/ip6t_hbh.c:110:29 [ 137.926167][ T8692] index 16 is out of range for type '__u16 [16]'
- Reference: https://git.kernel.org/stable/c/2d523ba48d4ecc46acfb6aba548292cfcce1ac02
- Reference: https://git.kernel.org/stable/c/41ec2e242f1702e8370ddfe14d22b7a766021c3e
Affected operating systems
linux
amazon / amazon_linux
linux
suse / basesystem_module15
linux
debian / debian_linux11.0
linux
debian / debian_linux12.0
linux
debian / debian_linux13.0
linux
suse / development_tools_module15
linux
redhat / enterprise_linux10.0
linux
redhat / enterprise_linux7.0
linux
redhat / enterprise_linux8.0
linux
redhat / enterprise_linux9.0
linux
redhat / enterprise_linux_aus8.4
linux
redhat / enterprise_linux_aus8.6
linux
redhat / enterprise_linux_eus10.0
linux
redhat / enterprise_linux_eus8.4
linux
redhat / enterprise_linux_eus9.4
linux
redhat / enterprise_linux_eus9.6
linux
redhat / enterprise_linux_tus8.6
linux
redhat / enterprise_linux_tus8.8
linux
redhat / enterprise_linux_update_services_for_sap_solutions8.6
linux
redhat / enterprise_linux_update_services_for_sap_solutions8.8
linux
redhat / enterprise_linux_update_services_for_sap_solutions9.0
linux
redhat / enterprise_linux_update_services_for_sap_solutions9.2
linux
opensuse / leap15.3
linux
opensuse / leap15.4
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
arista
cloudvision_agni2024.4.0 – 2025.2.2
arista
cloudvision_portal2024.2.0 – 2026.1.0
arista
velocloud_edge4.5.0 – 6.4.1
arista
velocloud_gateway
arista
velocloud_orchestrator
redhat
openshift_container_platform4.12 – 4.12.89
redhat
openshift_container_platform4.13 – 4.13.66
redhat
openshift_container_platform4.14 – 4.14.65
redhat
openshift_container_platform4.15 – 4.15.64
redhat
openshift_container_platform4.16 – 4.16.61
redhat
openshift_container_platform4.17 – 4.17.53
redhat
openshift_container_platform4.18 – 4.18.40
redhat
openshift_container_platform4.19 – 4.19.30
redhat
openshift_container_platform4.20 – 4.20.21
redhat
openshift_container_platform4.21 – 4.21.14
redhat
openshift_container_platform
siemens
simatic_ax_runtime
suse
caas_platform
suse
enterprise_storage
suse
manager_proxy
suse
manager_retail_branch_server
suse
manager_server
suse
openstack_cloud
suse
openstack_cloud_crowbar
References & sources
- https://git.kernel.org/stable/c/d3e535533767c85788529e626478718b7e95a59feuvd
- https://git.kernel.org/stable/c/3b5a754ec86bc6064af9aca76eb191c2405e6b0ceuvd
- https://git.kernel.org/stable/c/a785c4e2a999c2d51dfcf40d317cfb30cc735d2ceuvd
- https://git.kernel.org/stable/c/0b038c0be6827dd2dbb1ce4f8d92d97c80cbe9cceuvd
- https://git.kernel.org/stable/c/11a93180a70bb3095a9bd80d113d9277e30d9959euvd
- https://git.kernel.org/stable/c/f57b61624c86ef8f87f6e6b7dd0755de03d90e89euvd
- https://git.kernel.org/stable/c/011a0502801c8536f64141a2b61362c14f456544euvd
- https://git.kernel.org/stable/c/09880592f5a9dc73377d6eb5ac123537b5f8df49euvd
- https://git.kernel.org/stable/c/80fc6ca2cbde018d52e13f305edcd643911bd94beuvd
- https://git.kernel.org/stable/c/1985cb3247e87ff6b8ca4bc5f9626f4f51024507euvd
- https://git.kernel.org/stable/c/883cc33b7af1c448663287f069ef9dfea001e90feuvd
- https://git.kernel.org/stable/c/7f9f7c697474268d9ef9479df3ddfe7cdcfbbffceuvd
- https://git.kernel.org/stable/c/66df9f30673db66ac35145820a8e24906069ae57
- https://git.kernel.org/stable/c/4166d5234fe8b6c3c7f796a6c198605356c5b355
- https://git.kernel.org/stable/c/a9055300e07d9d6800264d3c2560e1d0144689ca
- https://git.kernel.org/stable/c/0b9e4bbfb7c949151e3acd44ed4aa33614d2e110euvd
- https://git.kernel.org/stable/c/81af4137a30c4c2dc694dea8cacb180bd66000efeuvd
- https://git.kernel.org/stable/c/5424e678f9b304e148cf5dcc047cffc7a56a3bb5euvd
- https://git.kernel.org/stable/c/9a2d9d4e657b23dc21f24cf139e3aeff0b61341feuvd
- https://git.kernel.org/stable/c/df4601653201de21b487c3e7fffd464790cab808euvd
Linked CVEs
- CVE-2026-64600
In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink…
highCVSSv3 7.8 - CVE-2026-64564
In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sc…
criticalCVSSv3 9.8 - CVE-2026-64465
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix sleep in atomic context in xhci_free_streams() When…
mediumCVSSv3 5.5 - CVE-2026-64330
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Validate SVID index in svdm_consume_modes() In sv…
highCVSSv3 7.8 - CVE-2026-64298
In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC POSIX…
highCVSSv3 7.8 - CVE-2026-63958
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsi_connector_change…
criticalCVSSv3 9.8 - CVE-2026-63928
In the Linux kernel, the following vulnerability has been resolved: USB: serial: omninet: fix memory corruption with small endpoint Mak…
— - CVE-2026-63927
In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: Fix use after free in debug code We're not allowed to de…
highCVSSv3 7.8 - CVE-2026-63924
In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() ipv6_hop_j…
criticalCVSSv3 9.8 - CVE-2026-63922
In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv()…
criticalCVSSv3 9.8 - CVE-2026-63915
In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfc_hci…
highCVSSv3 8.8 - CVE-2026-63901
In the Linux kernel, the following vulnerability has been resolved: USB: serial: digi_acceleport: fix memory corruption with small endpo…
— - CVE-2026-63899
In the Linux kernel, the following vulnerability has been resolved: USB: serial: mxuport: fix memory corruption with small endpoint Mak…
— - CVE-2026-63893
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()…
highCVSSv3 8.1 - CVE-2026-63829
In the Linux kernel, the following vulnerability has been resolved: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelin…
highCVSSv3 8.2 - CVE-2026-63826
In the Linux kernel, the following vulnerability has been resolved: fbdev: fix use-after-free in store_modes() store_modes() replaces a…
highCVSSv3 7.1 - CVE-2026-63806
In the Linux kernel, the following vulnerability has been resolved: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with…
highCVSSv3 7.3 - CVE-2026-63794
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path In…
highCVSSv3 7.8 - CVE-2026-53399
In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4_alloc_stid() pub…
mediumCVSSv3 5.5 - CVE-2026-53397
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak on SETACL decode failure nfsaclsvc_decode_…
mediumCVSSv3 6.7 - CVE-2026-53392
In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count ff_layout_all…
mediumCVSSv3 5.5 - CVE-2026-53391
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr nfs…
mediumCVSSv3 5.5 - CVE-2026-53388
In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fuse_try_mo…
highCVSSv3 7.8 - CVE-2026-53376
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add upper bound check for num_of_nodes drm/amdkfd: Add…
criticalCVSSv3 9.8
Show 164 more CVEs
- CVE-2026-53375
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: Prevent partial address patches In the case that on…
highCVSSv3 7.5 - CVE-2026-53374
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: zero-initialize GART table on allocation GART TLB is fl…
criticalCVSSv3 9.8 - CVE-2026-53369
In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC length udf_read_tagged()…
highCVSSv3 8.4 - CVE-2026-53359
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role C…
highCVSSv3 8.8 - CVE-2026-53355
In the Linux kernel, the following vulnerability has been resolved: net: rds: clear i_sends on setup unwind The RDS IB connection teard…
mediumCVSSv3 5.5 - CVE-2026-53354
In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Mitigate TLBI errata on various Arm CPUs A number of…
highCVSSv3 7.1 - CVE-2026-53325
In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL…
mediumCVSSv3 5.5 - CVE-2026-53306
In the Linux kernel, the following vulnerability has been resolved: tty: hvc_iucv: fix off-by-one in number of supported devices MAX_HV…
highCVSSv3 7.1 - CVE-2026-53275
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free when processing MLD queries When pr…
highCVSSv3 8.8 - CVE-2026-53273
In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-free when the client exits before the…
highCVSSv3 7.8 - CVE-2026-53270
In the Linux kernel, the following vulnerability has been resolved: ipvs: clear the svc scheduler ptr early on edit ip_vs_edit_service(…
highCVSSv3 7.8 - CVE-2026-53268
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack_irc: fix possible out-of-bounds read When pars…
highCVSSv3 8.2 - CVE-2026-53267
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: bail out on template ct in get eval I noticed th…
highCVSSv3 7.8 - CVE-2026-53262
In the Linux kernel, the following vulnerability has been resolved: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() pppol…
highCVSSv3 7.8 - CVE-2026-53256
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() rfc…
highCVSSv3 8.0 - CVE-2026-53255
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate advertising TLV before type checks tlv_da…
mediumCVSSv3 5.5 - CVE-2026-53254
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in MCC handlers The RFCOMM M…
highCVSSv3 8.1 - CVE-2026-53252
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix memory leak in error path of hci_alloc_dev() Early f…
mediumCVSSv3 5.5 - CVE-2026-53249
In the Linux kernel, the following vulnerability has been resolved: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options This patch restric…
highCVSSv3 7.0 - CVE-2026-53246
In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processi…
criticalCVSSv3 9.8 - CVE-2026-53245
In the Linux kernel, the following vulnerability has been resolved: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr…
mediumCVSSv3 5.5 - CVE-2026-53242
In the Linux kernel, the following vulnerability has been resolved: ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on link…
highCVSSv3 7.8 - CVE-2026-53236
In the Linux kernel, the following vulnerability has been resolved: tcp: restrict SO_ATTACH_FILTER to priv users This patch restricts t…
highCVSSv3 7.0 - CVE-2026-53227
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix possible kfree_skb of ERR_PTR After the patch…
mediumCVSSv3 5.5 - CVE-2026-53225
In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asc…
criticalCVSSv3 9.1 - CVE-2026-53224
In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cooki…
criticalCVSSv3 9.1 - CVE-2026-53218
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag nft…
highCVSSv3 7.0 - CVE-2026-53213
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: fix krealloc() memory leak Don't just overwrite the origin…
mediumCVSSv3 5.5 - CVE-2026-53208
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig net/b…
highCVSSv3 7.0 - CVE-2026-53196
In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf…
mediumCVSSv3 6.8 - CVE-2026-53186
In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_proce…
criticalCVSSv3 9.1 - CVE-2026-53181
In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix sk_ack_backlog leak on failed handshake When vmci_t…
mediumCVSSv3 5.5 - CVE-2026-53176
In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In driver…
criticalCVSSv3 9.8 - CVE-2026-53167
In the Linux kernel, the following vulnerability has been resolved: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios FUSE_NOTIFY_RET…
highCVSSv3 7.0 - CVE-2026-53149
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound root directory content to block size __tb_proper…
mediumCVSSv3 5.5 - CVE-2026-53147
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast…
highCVSSv3 8.1 - CVE-2026-53146
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Limit XDomain response copy to actual frame size tb_xd…
highCVSSv3 7.1 - CVE-2026-53134
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_fib: fix stale stack leak via the OIFNAME register F…
mediumCVSSv3 5.5 - CVE-2026-53131
In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t…
criticalCVSSv3 9.4 - CVE-2026-53129
In the Linux kernel, the following vulnerability has been resolved: fs/mbcache: cancel shrink work before destroying the cache mb_cache…
mediumCVSSv3 5.5 - CVE-2026-53107
In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: don't kill URBs in interrupt context Serialization…
mediumCVSSv3 5.5 - CVE-2026-53093
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix error pointer dereference The function brcmf_ch…
mediumCVSSv3 5.5 - CVE-2026-53080
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_fw: fix NULL dereference of "old" filters before chan…
mediumCVSSv3 5.5 - CVE-2026-53064
In the Linux kernel, the following vulnerability has been resolved: dm cache: fix null-deref with concurrent writes in passthrough mode…
highCVSSv3 7.1 - CVE-2026-53063
In the Linux kernel, the following vulnerability has been resolved: dm cache: fix write hang in passthrough mode The invalidate_remove(…
highCVSSv3 7.1 - CVE-2026-53062
In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: fix missing locks in invalidating cache blocks…
criticalCVSSv3 9.8 - CVE-2026-53060
In the Linux kernel, the following vulnerability has been resolved: dm cache metadata: fix memory leak on metadata abort retry When fai…
mediumCVSSv3 5.5 - CVE-2026-53039
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate group add input before caching [BUG] OCFS2_IOC_GROU…
highCVSSv3 7.8 - CVE-2026-53036
In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix off-by-one in check_imm signed range check check_im…
criticalCVSSv3 9.8 - CVE-2026-53021
In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix integer overflow in UNMAP bounds check sbc_…
mediumCVSSv3 6.1 - CVE-2026-53016
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - copy IV using skcipher ivsize AF_ALG rfc3686-ctr-aes-…
highCVSSv3 7.8 - CVE-2026-53006
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr befo…
criticalCVSSv3 9.8 - CVE-2026-53004
In the Linux kernel, the following vulnerability has been resolved: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks…
highCVSSv3 7.8 - CVE-2026-53002
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprint…
criticalCVSSv3 9.8 - CVE-2026-52998
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl chec…
highCVSSv3 7.5 - CVE-2026-52995
In the Linux kernel, the following vulnerability has been resolved: net/rds: zero per-item info buffer before handing it to visitors rd…
mediumCVSSv3 5.5 - CVE-2026-52986
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: don't use simple_strtoul Replace unsaf…
criticalCVSSv3 9.8 - CVE-2026-52984
In the Linux kernel, the following vulnerability has been resolved: net/sched: netem: fix queue limit check to include reordered packets…
mediumCVSSv3 5.5 - CVE-2026-52982
In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() syzbo…
criticalCVSSv3 9.8 - CVE-2026-52981
In the Linux kernel, the following vulnerability has been resolved: neigh: let neigh_xmit take skb ownership neigh_xmit always releases…
highCVSSv3 7.5 - CVE-2026-52958
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in osdmap_decode() When…
criticalCVSSv3 9.1 - CVE-2026-52956
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() I…
criticalCVSSv3 9.8 - CVE-2026-52948
In the Linux kernel, the following vulnerability has been resolved: i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl While fuzzi…
mediumCVSSv3 5.5 - CVE-2026-52942
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: validate MAC header was set before dumping it Th…
highCVSSv3 7.1 - CVE-2026-52930
In the Linux kernel, the following vulnerability has been resolved: ipc/shm: serialize orphan cleanup with shm_nattch updates shm_destr…
mediumCVSSv3 5.5 - CVE-2026-52927
In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix OOB read in compat_mtw_from_user Luxiao Xu…
highCVSSv3 7.8 - CVE-2026-52910
In the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog after RCU grace period.
highCVSSv3 7.8 - CVE-2026-46322
In the Linux kernel, the following vulnerability has been resolved: tun: free page on build_skb failure in tun_xdp_one() When build_skb…
highCVSSv3 7.1 - CVE-2026-46321
In the Linux kernel, the following vulnerability has been resolved: tun: free page on short-frame rejection in tun_xdp_one() tun_xdp_on…
highCVSSv3 7.1 - CVE-2026-46307
In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: > The ath5k d…
highCVSSv3 8.3 - CVE-2026-46294
In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in ioctl processing Tony Asleson (using C…
highCVSSv3 7.8 - CVE-2026-46252
In the Linux kernel, the following vulnerability has been resolved: regulator: core: fix locking in regulator_resolve_supply() error pat…
mediumCVSSv3 5.5 - CVE-2026-46245
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dc_link NULL handling in HPD init amdgpu_dm_hp…
mediumCVSSv3 5.5 - CVE-2026-46243
A privilege escalation vulnerability was found in the Linux kernel's CIFS client implementation.
highCVSSv3 7.8 - CVE-2026-46220
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission sdm…
mediumCVSSv3 6.6 - CVE-2026-46193
In the Linux kernel, the following vulnerability has been resolved: xfrm: ah: account for ESN high bits in async callbacks AH allocates…
mediumCVSSv3 5.5 - CVE-2026-46191
In the Linux kernel, the following vulnerability has been resolved: fbcon: Avoid OOB font access if console rotation fails Clear the fo…
highCVSSv3 7.7 - CVE-2026-46189
In the Linux kernel, the following vulnerability has been resolved: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error pa…
highCVSSv3 7.8 - CVE-2026-46184
In the Linux kernel, the following vulnerability has been resolved: sound: ua101: fix division by zero at probe Add a missing sanity ch…
mediumCVSSv3 5.5 - CVE-2026-46180
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential use-after-free issue when stopping wat…
mediumCVSSv3 5.5 - CVE-2026-46178
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Sashi…
highCVSSv3 7.8 - CVE-2026-46177
In the Linux kernel, the following vulnerability has been resolved: ipmi: Add limits to event and receive message requests The driver w…
highCVSSv3 7.5 - CVE-2026-46174
In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2'…
highCVSSv3 8.8 - CVE-2026-46167
In the Linux kernel, the following vulnerability has been resolved: usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Just…
mediumCVSSv3 5.5 - CVE-2026-46165
In the Linux kernel, the following vulnerability has been resolved: openvswitch: vport: fix self-deadlock on release of tunnel ports vp…
mediumCVSSv3 5.5 - CVE-2026-46161
In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix divide-by-zero in setup_geo() with zero far_copies s…
mediumCVSSv3 5.5 - CVE-2026-46149
In the Linux kernel, the following vulnerability has been resolved: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_…
highCVSSv3 7.1 - CVE-2026-46146
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()…
highCVSSv3 7.1 - CVE-2026-46109
In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: fix memory leak on ulpi_register() error paths Commit 01…
mediumCVSSv3 5.5 - CVE-2026-46102
In the Linux kernel, the following vulnerability has been resolved: net: strparser: fix skb_head leak in strp_abort_strp() When the str…
highCVSSv3 7.5 - CVE-2026-46088
In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_ini…
mediumCVSSv3 5.5 - CVE-2026-46086
In the Linux kernel, the following vulnerability has been resolved: net: bridge: use a stable FDB dst snapshot in RCU readers Local FDB…
mediumCVSSv3 5.5 - CVE-2026-46080
In the Linux kernel, the following vulnerability has been resolved: ocfs2: split transactions in dio completion to avoid credit exhausti…
highCVSSv3 7.1 - CVE-2026-46068
In the Linux kernel, the following vulnerability has been resolved: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ct…
mediumCVSSv3 5.5 - CVE-2026-46064
In the Linux kernel, the following vulnerability has been resolved: ibmasm: fix heap over-read in ibmasm_send_i2o_message() The ibmasm_…
mediumCVSSv3 5.5 - CVE-2026-46056
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci…
highCVSSv3 8.8 - CVE-2026-46051
In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix soft lockup in retry_aligned_read() When retry_aligne…
mediumCVSSv3 5.5 - CVE-2026-46049
In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Add fallback to default RSR for S/PDIF spdif_passthru_…
mediumCVSSv3 5.5 - CVE-2026-46040
In the Linux kernel, the following vulnerability has been resolved: inotify: fix watch count leak when fsnotify_add_inode_mark_locked()…
mediumCVSSv3 5.5 - CVE-2026-46033
In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - reject short ahash digests during instance crea…
highCVSSv3 7.1 - CVE-2026-46027
In the Linux kernel, the following vulnerability has been resolved: net/smc: avoid early lgr access in smc_clc_wait_msg A CLC decline c…
highCVSSv3 7.5 - CVE-2026-46023
In the Linux kernel, the following vulnerability has been resolved: dm mirror: fix integer overflow in create_dirty_log() The argument…
lowCVSSv3 3.4 - CVE-2026-46018
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES parse_uac2…
mediumCVSSv3 5.5 - CVE-2026-45997
In the Linux kernel, the following vulnerability has been resolved: scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails I…
mediumCVSSv3 5.5 - CVE-2026-45994
In the Linux kernel, the following vulnerability has been resolved: ibmasm: fix OOB reads in command_file_write due to missing size chec…
mediumCVSSv3 5.5 - CVE-2026-45985
In the Linux kernel, the following vulnerability has been resolved: ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submit…
—CVSSv3 0.0 - CVE-2026-45981
In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() `…
—CVSSv3 0.0 - CVE-2026-45923
In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: enable basic endpoint checking catc_probe() fills t…
mediumCVSSv3 5.5 - CVE-2026-45920
In the Linux kernel, the following vulnerability has been resolved: ext4: fix dirtyclusters double decrement on fs shutdown fstests tes…
highCVSSv3 7.8 - CVE-2026-45917
In the Linux kernel, the following vulnerability has been resolved: ipvs: do not keep dest_dst if dev is going down There is race betwe…
mediumCVSSv3 5.5 - CVE-2026-45915
In the Linux kernel, the following vulnerability has been resolved: fat: avoid parent link count underflow in rmdir Corrupted FAT image…
mediumCVSSv3 5.5 - CVE-2026-45905
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path icmp_rou…
mediumCVSSv3 4.7 - CVE-2026-45899
In the Linux kernel, the following vulnerability has been resolved: ext4: drop extent cache when splitting extent fails When the split…
criticalCVSSv3 9.8 - CVE-2026-45877
In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clien…
mediumCVSSv3 5.5 - CVE-2026-45871
In the Linux kernel, the following vulnerability has been resolved: tpm: st33zp24: Fix missing cleanup on get_burstcount() error get_bu…
mediumCVSSv3 5.5 - CVE-2026-45858
In the Linux kernel, the following vulnerability has been resolved: ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1…
mediumCVSSv3 5.5 - CVE-2026-45857
In the Linux kernel, the following vulnerability has been resolved: scsi: csiostor: Fix dereference of null pointer rn The error exit p…
mediumCVSSv3 5.5 - CVE-2026-43496
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_…
mediumCVSSv3 5.5 - CVE-2026-43493
In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG r…
criticalCVSSv3 9.8 - CVE-2026-43466
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery In case of…
highCVSSv3 8.2 - CVE-2026-43452
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: guard option walkers against 1-byte tail reads…
highCVSSv3 8.2 - CVE-2026-43451
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error p…
—CVSSv3 0.0 - CVE-2026-43450
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_ta…
—CVSSv3 0.0 - CVE-2026-43449
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set dev->online_queu…
—CVSSv3 0.0 - CVE-2026-43445
In the Linux kernel, the following vulnerability has been resolved: e1000/e1000e: Fix leak in DMA error cleanup If an error is encounte…
—CVSSv3 0.0 - CVE-2026-43427
In the Linux kernel, the following vulnerability has been resolved: usb: class: cdc-wdm: fix reordering issue in read code path Quoting…
—CVSSv3 0.0 - CVE-2026-43425
In the Linux kernel, the following vulnerability has been resolved: usb: image: mdc800: kill download URB on timeout mdc800_device_read…
—CVSSv3 0.0 - CVE-2026-43383
In the Linux kernel, the following vulnerability has been resolved: net/tcp-md5: Fix MAC comparison to be constant-time To prevent timi…
criticalCVSSv3 9.4 - CVE-2026-43373
In the Linux kernel, the following vulnerability has been resolved: net: ncsi: fix skb leak in error paths Early return paths in NCSI R…
highCVSSv3 7.5 - CVE-2026-43370
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix use-after-free race in VM acquire Replace non-atomi…
highCVSSv3 7.8 - CVE-2026-43313
In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Fix NULL-pointer dereference in acpi_processor_erra…
—CVSSv3 0.0 - CVE-2026-43309
In the Linux kernel, the following vulnerability has been resolved: md raid: fix hang when stopping arrays with metadata through dm-raid…
mediumCVSSv3 5.5 - CVE-2026-43308
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed…
mediumCVSSv3 5.5 - CVE-2026-43287
In the Linux kernel, the following vulnerability has been resolved: drm: Account property blob allocations to memcg DRM_IOCTL_MODE_CREA…
—CVSSv3 0.0 - CVE-2026-43281
In the Linux kernel, the following vulnerability has been resolved: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() Alth…
highCVSSv3 7.1 - CVE-2026-43273
In the Linux kernel, the following vulnerability has been resolved: ceph: supply snapshot context in ceph_zero_partial_object() The cep…
—CVSSv3 0.0 - CVE-2026-43268
In the Linux kernel, the following vulnerability has been resolved: hfsplus: pretend special inodes as regular files Since commit af153…
—CVSSv3 0.0 - CVE-2026-43266
In the Linux kernel, the following vulnerability has been resolved: EFI/CPER: don't go past the ARM processor CPER record buffer There'…
—CVSSv3 0.0 - CVE-2026-43255
In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix WARNING in usb_tx_block The function usb_tx_blo…
—CVSSv3 0.0 - CVE-2026-43253
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: move wait_on_sem() out of spinlock With iommu.strict=1,…
highCVSSv3 7.5 - CVE-2026-43244
In the Linux kernel, the following vulnerability has been resolved: kcm: fix zero-frag skb in frag_list on partial sendmsg error Syzkal…
mediumCVSSv3 5.5 - CVE-2026-43230
In the Linux kernel, the following vulnerability has been resolved: net/rds: Clear reconnect pending bit When canceling the reconnect w…
highCVSSv3 7.5 - CVE-2026-43226
In the Linux kernel, the following vulnerability has been resolved: net/rds: No shortcut out of RDS_CONN_ERROR RDS connections carry a…
highCVSSv3 7.5 - CVE-2026-43216
In the Linux kernel, the following vulnerability has been resolved: net: Drop the lock in skb_may_tx_timestamp() skb_may_tx_timestamp()…
mediumCVSSv3 5.5 - CVE-2026-43211
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix pci_slot_trylock() error handling Commit a4e772898f8b ("PC…
highCVSSv3 7.8 - CVE-2026-43180
In the Linux kernel, the following vulnerability has been resolved: net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode…
highCVSSv3 7.8 - CVE-2026-43168
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix reflink preserve cleanup issue commit c06c303832ec ("ocf…
—CVSSv3 0.0 - CVE-2026-43156
In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: enable basic endpoint checking pegasus_probe() f…
—CVSSv3 0.0 - CVE-2026-43124
In the Linux kernel, the following vulnerability has been resolved: pstore: ram_core: fix incorrect success return when vmap() fails In…
—CVSSv3 0.0 - CVE-2026-43123
In the Linux kernel, the following vulnerability has been resolved: fbcon: check return value of con2fb_acquire_newinfo() If fbcon_open…
—CVSSv3 0.0 - CVE-2026-43069
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_ll: Fix firmware leak on error path Smatch reports:…
—CVSSv3 0.0 - CVE-2026-43068
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_g…
—CVSSv3 0.0 - CVE-2026-43033
In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - Do not place hiseq at end of dst for out-of-pla…
highCVSSv3 7.8 - CVE-2026-31759
In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: fix double free in ulpi_register_interface() error path…
—CVSSv3 0.0 - CVE-2026-31678
In the Linux kernel, the following vulnerability has been resolved: openvswitch: defer tunnel netdev_put to RCU release ovs_netdev_tunn…
highCVSSv3 7.8 - CVE-2026-31628
In the Linux kernel, the following vulnerability has been resolved: x86/CPU: Fix FPDSS on Zen1 Zen1's hardware divider can leave, under…
mediumCVSSv3 5.5 - CVE-2026-31624
In the Linux kernel, the following vulnerability has been resolved: HID: core: clamp report_size in s32ton() to avoid undefined shift s…
highCVSSv3 7.1 - CVE-2026-31598
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix possible deadlock between unlink and dio_end_io_write oc…
highCVSSv3 7.5 - CVE-2026-31510
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb Before…
mediumCVSSv3 5.5 - CVE-2026-31450
In the Linux kernel, the following vulnerability has been resolved: ext4: publish jinode after initialization ext4_inode_attach_jinode(…
highCVSSv3 8.8 - CVE-2026-31431Actively exploited
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly r…
criticalCVSSv3 7.8 - CVE-2025-54518
Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instruct…
highCVSSv3 7.0 - CVE-2025-38250
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix use-after-free in vhci_flush() syzbot repo…
highCVSSv3 7.8 - CVE-2023-2058
A vulnerability was found in EyouCms up to 1.6.2.
lowCVSSv3 2.4