HighCVE-2026-99153

    Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

    Published Sources: BSI

    Share

    What is affected, what to do

    In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy to find the task to clean up: memcpy(&rejected_pdu, data, sizeof(struct iscsi_hdr)); ... task = iscsi_itt_to_task(conn, rejected_pdu.itt); That value is whatever the target put there. iscsi_itt_to_task() bounds the index against cmds_max and checks nothing else, so any task in the pool can be named, and iscsi_nop_out_rsp() then completes it. An index that has never been used gives a NULL task->conn: the pool is zeroed at session setup and conn is assigned only when a task is allocated.

    Update Linux Kernel to version 5.10.273, Linux Kernel to version 5.15.224, Linux Kernel to version 6.1.191.

    Affected
    • Linux Kernel lt 2.6.32..5.10.273
    • Linux Kernel lt 5.11..5.15.224
    • Linux Kernel lt 5.16..6.1.191
    • Linux Kernel lt 6.2..6.6.161
    • Linux Kernel lt 6.7..6.12.115
    • Linux Kernel lt 6.13..6.18.59
    • Linux Kernel lt 6.19..7.2.13
    Fixed in
    • Linux Kernel 5.10.273
    • Linux Kernel 5.15.224
    • Linux Kernel 6.1.191
    • Linux Kernel 6.6.161
    • Linux Kernel 6.12.115
    • Linux Kernel 6.18.59
    • Linux Kernel 7.2.13
    • Linux Kernel 7.3

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    7.1

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: Vendor (CNA), CVSS v3

    7.1

    CVSS v3

    Severity High on the scale from 0 to 10.

    Source: BSI

    0.5 %

    EPSS score

    Low — model estimates < 1% exploitation likelihood.

    Source: FIRST EPSS, percentile 46.2

    Show all metrics
    Severity
    High
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    57.79 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    no public PoC known
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    7.1 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    7.1
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    0.5 %
    Low — model estimates < 1% exploitation likelihood.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    46.2
    High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    —
    Published

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    High technical severity: assess and remediate the vulnerability in vulnerability handling under Art. 21(2)(e) NIS2 and document the decision.
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy to find the task to clean up: memcpy(&rejected_pdu, data, sizeof(struct iscsi_hdr)); ... task = iscsi_itt_to_task(conn, rejected_pdu.itt); That value is whatever the target put there. iscsi_itt_to_task() bounds the index against cmds_max and checks nothing else, so any task in the pool can be named, and iscsi_nop_out_rsp() then completes it. An index that has never been used gives a NULL task->conn: the pool is zeroed at session setup and conn is assigned only when a task is allocated. If the task was used and returned, iscsi_complete_task() hits its WARN_ON_ONCE(task->state == ISCSI_TASK_FREE) and the refcount underflows. An in-flight SCSI command is completed as successful - a 1 MiB read returned 1048576 with none of its buffer written and no warning. Validate the reflected ITT the way iscsi_itt_to_ctask() validates a command ITT, and require the task to be in flight and not a SCSI command. [ 6.248477] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI [ 6.249357] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] [ 6.249951] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy) [ 6.250718] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 6.251616] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160 [ 6.252043] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00 [ 6.252813] RSP: 0018:ffff88806c907b80 EFLAGS: 00010206 [ 6.253042] RAX: dffffc0000000000 RBX: ffff88800607e000 RCX: ffffffff8d571a25 [ 6.253345] RDX: 000000000000000c RSI: ffff88806c907c38 RDI: 0000000000000060 [ 6.253642] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff235a504 [ 6.253947] R10: 0000000000000003 R11: 7463656e6e6f6320 R12: 0000000000000000 [ 6.254251] R13: 0000000000000000 R14: ffff88806c907c38 R15: 0000000000000000 [ 6.254549] FS: 0000000000000000(0000) GS:ffff8880d95bc000(0000) knlGS:0000000000000000 [ 6.254887] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6.255140] CR2: 00007fc393e8ffc0 CR3: 0000000005252006 CR4: 0000000000770ef0 [ 6.255439] PKRU: 55555554 [ 6.255564] Call Trace: [ 6.255674] <IRQ> [ 6.255768] __iscsi_complete_pdu+0x18bf/0x22a0 [ 6.256733] iscsi_complete_pdu+0x54/0xa0 [ 6.256905] iscsi_tcp_data_recv_done+0xf4/0x250 [ 6.257103] iscsi_tcp_recv_skb+0x31e/0xec0 [ 6.257680] iscsi_sw_tcp_recv+0x12f/0x390 [ 6.258061] __tcp_read_sock+0x1ab/0x810 [ 6.258853] iscsi_sw_tcp_data_ready+0x18b/0x510 [ 6.259808] tcp_data_queue+0x1f13/0x4cd0 [ 6.260567] tcp_rcv_established+0x8a5/0x3a00 [ 6.261931] tcp_v4_do_rcv+0x449/0x960 [ 6.262269] tcp_v4_rcv+0x2245/0x3bc0

    Source: BSI WID Portal

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    LinuxLinux
    • 2.6.12 – < 7.2.13
    • 2.6.18 – < 5.10.273
    • 2.6.24 – < 5.10.273
    • 2.6.26 – < 5.10.273
    • 2.6.28 – < 5.10.273
    • 2.6.28.9 – < 2.6.29
    • 2.6.29 – < 5.10.273
    • 2.6.30 – < 5.10.273
    • 2.6.30 – < 5.15.224
    • 2.6.32 – < 5.10.273
    • 2.6.33 – < 5.10.273
    • 2.6.38 – < 6.12.115
    • 3.1 – < 5.10.273
    • 3.11 – < 5.10.273
    • 3.16.50 – < 3.17
    • 3.2 – < 5.15.224
    • 3.7 – < 5.10.273
    • 3.9 – < 5.10.273
    • 3.9 – < 6.18.59
    • 4.1 – < 5.10.273
    • 4.1 – < 6.18.59
    • 4.12 – < 5.10.273
    • 4.13 – < 6.1.191
    • 4.15 – < 5.10.273
    • 4.16 – < 5.10.273
    • 4.18 – < 5.10.273
    • 4.19 – < 5.10.273
    • 4.19.118 – < 4.20
    • 4.2 – < 5.10.273
    • 4.4 – < 5.10.273
    • 4.6 – < 5.10.273
    • 4.7 – < 5.10.273
    • 4.8 – < 5.15.224
    • 5.10 – < 5.10.273
    • 5.10.11 – < 5.10.273
    • 5.10.237 – < 5.10.273
    • 5.11 – < 5.15.224
    • 5.13 – < 5.15.224
    • 5.15 – < 5.15.224
    • 5.15 – < 6.18.59
    • 5.15.124 – < 5.15.224
    • 5.16 – < 6.1.191
    • 5.16 – < 6.6.161
    • 5.18 – < 6.1.191
    • 5.19 – < 6.1.191
    • 5.19 – < 6.6.161
    • 5.19 – < 7.2.13
    • 5.2 – < 5.10.273
    • 7.2.13
    • 5.10.273
    • 5.10.273
    • 5.10.273
    • 5.10.273
    • 2.6.29
    • 5.10.273
    • 5.10.273
    • 5.15.224
    • 5.10.273
    • 5.10.273
    • 6.12.115
    • 5.10.273
    • 5.10.273
    • 3.17
    • 5.15.224
    • 5.10.273
    • 5.10.273
    • 6.18.59
    • 5.10.273
    • 6.18.59
    • 5.10.273
    • 6.1.191
    • 5.10.273
    • 5.10.273
    • 5.10.273
    • 5.10.273
    • 4.20
    • 5.10.273
    • 5.10.273
    • 5.10.273
    • 5.10.273
    • 5.15.224
    • 5.10.273
    • 5.10.273
    • 5.10.273
    • 5.15.224
    • 5.15.224
    • 5.15.224
    • 6.18.59
    • 5.15.224
    • 6.1.191
    • 6.6.161
    • 6.1.191
    • 6.1.191
    • 6.6.161
    • 7.2.13
    • 5.10.273

    Vendors and products

    Affected operating systems

    Affected operating systems
    Linuxdebianlinuxtrixie

    References & sources

    Changes to this CVE

    Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

    1. Record modifiedLinux

      CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      Show the original change
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      CVSSadded
      —
      AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      Source identifier: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    2. Record modifiedLinux

      Show 6 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Affected versions (publisher)added
      —
      Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/99xxx/CVE-2026-99153.json">CVE-2026-99153</a>
      Referenceadded
      —
      https://git.kernel.org/stable/c/21ef746340ce246344f34278e205b8960c1d8874
      Referenceadded
      —
      https://git.kernel.org/stable/c/3637a4ad1d07477f1c60609876da6b60154d224b
      Referenceadded
      —
      https://git.kernel.org/stable/c/576125e7382a7826bd6c3c1ca4d9c582ed5be21d
      Referenceadded
      —
      https://git.kernel.org/stable/c/d20583a9dbe0d32a9af8384c857c95c0fc115103
      Referenceadded
      —
      https://git.kernel.org/stable/c/ebb8c5ef2aabf66895253600e8390e8fc7094807

      Source identifier: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    3. ReceivedLinux

      Description added or changed

      Show 5 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Descriptionadded
      —
      In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy to find the task to clean up: memcpy(&rejected_pdu, data, sizeof(struct iscsi_hdr)); ... task = iscsi_itt_to_task(conn, rejected_pdu.itt); That value is whatever the target put there. iscsi_itt_to_task() bounds the index against cmds_max and checks nothing else, so any task in the pool can be named, and iscsi_nop_out_rsp() then completes it. An index that has never been used gives a NULL task->conn: the pool is zeroed at session setup and conn is assigned only when a task is allocated. If the task was used and returned, iscsi_complete_task() hits its WARN_ON_ONCE(task->state == ISCSI_TASK_FREE) and the refcount underflows. An in-flight SCSI command is completed as successful - a 1 MiB read returned 1048576 with none of its buffer written and no warning. Validate the reflected ITT the way iscsi_itt_to_ctask() validates a command ITT, and require the task to be in flight and not a SCSI command. [ 6.248477] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI [ 6.249357] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] [ 6.249951] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy) [ 6.250718] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 6.251616] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160 [ 6.252043] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00 [ 6.252813] RSP: 0018:ffff88806c907b80 EFLAGS: 00010206 [ 6.253042] RAX: dffffc0000000000 RBX: ffff88800607e000 RCX: ffffffff8d571a25 [ 6.253345] RDX: 000000000000000c RSI: ffff88806c907c38 RDI: 0000000000000060 [ 6.253642] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff235a504 [ 6.253947] R10: 0000000000000003 R11: 7463656e6e6f6320 R12: 0000000000000000 [ 6.254251] R13: 0000000000000000 R14: ffff88806c907c38 R15: 0000000000000000 [ 6.254549] FS: 0000000000000000(0000) GS:ffff8880d95bc000(0000) knlGS:0000000000000000 [ 6.254887] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6.255140] CR2: 00007fc393e8ffc0 CR3: 0000000005252006 CR4: 0000000000770ef0 [ 6.255439] PKRU: 55555554 [ 6.255564] Call Trace: [ 6.255674] <IRQ> [ 6.255768] __iscsi_complete_pdu+0x18bf/0x22a0 [ 6.256733] iscsi_complete_pdu+0x54/0xa0 [ 6.256905] iscsi_tcp_data_recv_done+0xf4/0x250 [ 6.257103] iscsi_tcp_recv_skb+0x31e/0xec0 [ 6.257680] iscsi_sw_tcp_recv+0x12f/0x390 [ 6.258061] __tcp_read_sock+0x1ab/0x810 [ 6.258853] iscsi_sw_tcp_data_ready+0x18b/0x510 [ 6.259808] tcp_data_queue+0x1f13/0x4cd0 [ 6.260567] tcp_rcv_established+0x8a5/0x3a00 [ 6.261931] tcp_v4_do_rcv+0x449/0x960 [ 6.262269] tcp_v4_rcv+0x2245/0x3bc0
      Affected versions (publisher)added
      —
      New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/99xxx/CVE-2026-99153.json">CVE-2026-99153</a>
      Referenceadded
      —
      https://git.kernel.org/stable/c/7215a69b6456fda79c0935c2959045dff3fcaac8
      Referenceadded
      —
      https://git.kernel.org/stable/c/c5958c770b2a0ee492414e26b07da9164a0d1f5d
      Referenceadded
      —
      https://git.kernel.org/stable/c/d79343ae3223b3f7f74b55e79f8a1371fa3f4b1a

      Source identifier: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Linked CVEs

    Linked CVEs
    MediumCVE-2026-99216Linux Kernel: security vulnerability5.5—
    MediumCVE-2026-99215Linux Kernel: Use-After-Free5.5—
    Not ratedCVE-2026-99214Linux Kernel: security vulnerability——
    MediumCVE-2026-99213Linux Kernel: Memory Corruption5.5—
    MediumCVE-2026-99212Linux Kernel: security vulnerability5.5—
    MediumCVE-2026-99211Linux Kernel: security vulnerability5.5—
    Not ratedCVE-2026-99210Linux Kernel: security vulnerability——
    Not ratedCVE-2026-99209Linux Kernel: NULL Pointer Dereference——
    Not ratedCVE-2026-99208Linux Kernel: Information Disclosure——
    Not ratedCVE-2026-99207Linux Kernel: security vulnerability——
    MediumCVE-2026-99206Linux Kernel: Double Free4.1—
    Not ratedCVE-2026-99205Linux Kernel: security vulnerability——
    HighCVE-2026-99204Linux Kernel: Use-After-Free7.1—
    MediumCVE-2026-99203Linux Kernel: Use-After-Free4.7—
    Not ratedCVE-2026-99202Linux Kernel: Deadlock——
    LowCVE-2026-99201Linux Kernel: security vulnerability3.3—
    Not ratedCVE-2026-99200Linux Kernel: NULL Pointer Dereference——
    Not ratedCVE-2026-99199Linux Kernel: NULL Pointer Dereference——
    Not ratedCVE-2026-99198Linux Kernel: NULL Pointer Dereference——
    Not ratedCVE-2026-99197Linux Kernel: NULL Pointer Dereference——
    Not ratedCVE-2026-99196Linux Kernel: NULL Pointer Dereference——
    Not ratedCVE-2026-99195Linux Kernel: NULL Pointer Dereference——
    Not ratedCVE-2026-99194Linux Kernel: NULL Pointer Dereference——
    Not ratedCVE-2026-99193Linux Kernel: NULL Pointer Dereference——
    Show 92 more CVEs
    Linked CVEs
    HighCVE-2026-99192Linux Kernel: security vulnerability7.8—
    MediumCVE-2026-99191Linux Kernel: security vulnerability6.5—
    Not ratedCVE-2026-99190Linux Kernel: Memory Leak——
    MediumCVE-2026-99189Linux Kernel: security vulnerability5.5—
    Not ratedCVE-2026-99188Linux Kernel: security vulnerability——
    MediumCVE-2026-99187Linux Kernel: security vulnerability5.5—
    Not ratedCVE-2026-99186Linux Kernel: security vulnerability——
    HighCVE-2026-99185Linux Kernel: Race Condition8.8—
    Not ratedCVE-2026-99184Linux Kernel: security vulnerability——
    Not ratedCVE-2026-99183Linux Kernel: NULL Pointer Dereference——
    HighCVE-2026-99182Linux Kernel: Out-of-Bounds Access7.1—
    HighCVE-2026-99181Linux Kernel: Memory Corruption7.8—
    HighCVE-2026-99180Linux Kernel: Use-After-Free7.0—
    MediumCVE-2026-99179Linux Kernel: NULL Pointer Dereference5.5—
    MediumCVE-2026-99178Linux Kernel: security vulnerability6.5—
    HighCVE-2026-99177Linux Kernel: security vulnerability7.8—
    MediumCVE-2026-99176Linux Kernel: NULL Pointer Dereference4.7—
    Not ratedCVE-2026-99175Linux Kernel: NULL Pointer Dereference——
    HighCVE-2026-99174Linux Kernel: NULL Pointer Dereference7.1—
    HighCVE-2026-99173Linux Kernel: Use-After-Free7.8—
    HighCVE-2026-99172Linux Kernel: security vulnerability7.1—
    MediumCVE-2026-99171Linux Kernel: Use-After-Free4.7—
    HighCVE-2026-99170Linux Kernel: security vulnerability8.8—
    MediumCVE-2026-99169Linux Kernel: security vulnerability5.5—
    Not ratedCVE-2026-99168Linux Kernel: security vulnerability——
    HighCVE-2026-99167Linux Kernel: Use-After-Free7.8—
    MediumCVE-2026-99166Linux Kernel: security vulnerability5.5—
    MediumCVE-2026-99165Linux Kernel: NULL Pointer Dereference5.3—
    HighCVE-2026-99164Linux Kernel: Use-After-Free7.8—
    MediumCVE-2026-99163Linux Kernel: security vulnerability5.5—
    Not ratedCVE-2026-99162Linux Kernel: Use-After-Free——
    HighCVE-2026-99161Linux Kernel: security vulnerability7.1—
    Not ratedCVE-2026-99160Linux Kernel: security vulnerability——
    Not ratedCVE-2026-99159Linux Kernel: security vulnerability——
    Not ratedCVE-2026-99158Linux Kernel: security vulnerability——
    HighCVE-2026-99157Linux Kernel: security vulnerability7.8—
    HighCVE-2026-99156Linux Kernel: Use-After-Free7.8—
    MediumCVE-2026-99155Linux Kernel: security vulnerability5.5—
    HighCVE-2026-99154Linux Kernel: security vulnerability7.8—
    HighCVE-2026-99153Linux Kernel: NULL Pointer Dereference7.1—
    MediumCVE-2026-99152Linux Kernel: NULL Pointer Dereference5.5—
    Not ratedCVE-2026-99151Linux Kernel: NULL Pointer Dereference——
    LowCVE-2026-99150Linux Kernel: security vulnerability3.3—
    Not ratedCVE-2026-99149Linux Kernel: security vulnerability——
    HighCVE-2026-99148Linux Kernel: security vulnerability7.0—
    HighCVE-2026-99147Linux Kernel: Memory Corruption7.1—
    LowCVE-2026-99146Linux Kernel: security vulnerability3.0—
    Not ratedCVE-2026-99145Linux Kernel: security vulnerability——
    Not ratedCVE-2026-99144Linux Kernel: Use-After-Free——
    MediumCVE-2026-99143Linux Kernel: security vulnerability5.5—
    HighCVE-2026-99142Linux Kernel: security vulnerability7.1—
    Not ratedCVE-2026-99141Linux Kernel: NULL Pointer Dereference——
    MediumCVE-2026-99140Linux Kernel: security vulnerability5.5—
    HighCVE-2026-99139Linux Kernel: Use-After-Free7.8—
    HighCVE-2026-99138Linux Kernel: Use-After-Free7.8—
    Not ratedCVE-2026-99137Linux Kernel: security vulnerability——
    HighCVE-2026-99136Linux Kernel: Race Condition7.1—
    MediumCVE-2026-99135Linux Kernel: Infinite Loop5.5—
    Not ratedCVE-2026-99134Linux Kernel: security vulnerability——
    MediumCVE-2026-99133Linux Kernel: security vulnerability5.5—
    MediumCVE-2026-99132Linux Kernel: Deadlock5.5—
    MediumCVE-2026-99131Linux Kernel: security vulnerability4.3—
    MediumCVE-2026-99130Linux Kernel: security vulnerability5.5—
    Not ratedCVE-2026-99129Linux Kernel: security vulnerability——
    HighCVE-2026-99128Linux Kernel: security vulnerability7.5—
    MediumCVE-2026-99127Linux Kernel: security vulnerability5.5—
    MediumCVE-2026-99126Linux Kernel: security vulnerability6.5—
    Not ratedCVE-2026-99125Linux Kernel: security vulnerability——
    HighCVE-2026-99124Linux Kernel: Out-of-Bounds Read7.1—
    MediumCVE-2026-99123Linux Kernel: security vulnerability5.1—
    MediumCVE-2026-99122Linux Kernel: security vulnerability5.5—
    MediumCVE-2026-99121Linux Kernel: Divide By Zero4.1—
    Not ratedCVE-2026-99120Linux Kernel: Out-of-Bounds Access——
    Not ratedCVE-2026-99119Linux Kernel: security vulnerability——
    MediumCVE-2026-99118Linux Kernel: security vulnerability5.5—
    HighCVE-2026-99117Linux Kernel: Use-After-Free7.1—
    HighCVE-2026-99116Linux Kernel: Use-After-Free7.8—
    LowCVE-2026-99115Linux Kernel: security vulnerability3.1—
    LowCVE-2026-99114Linux Kernel: security vulnerability3.1—
    LowCVE-2026-99113Linux Kernel: security vulnerability3.1—
    MediumCVE-2026-99112Linux Kernel: Out-of-Bounds Read5.5—
    Not ratedCVE-2026-99111Linux Kernel: security vulnerability——
    HighCVE-2026-99110Linux Kernel: security vulnerability7.8—
    MediumCVE-2026-99109Linux Kernel: Out-of-Bounds Access6.5—
    Not ratedCVE-2026-99108Linux Kernel: security vulnerability——
    HighCVE-2026-99107Linux Kernel: security vulnerability7.8—
    LowCVE-2026-99106Linux Kernel: security vulnerability3.3—
    Not ratedCVE-2026-99105Linux Kernel: security vulnerability——
    Not ratedCVE-2026-99104Linux Kernel: security vulnerability——
    Not ratedCVE-2026-99103Linux Kernel: Use-After-Free——
    Not ratedCVE-2026-99102Linux Kernel: security vulnerability——
    MediumCVE-2026-99101Linux Kernel: security vulnerability4.4—
    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2026-99153
    <a href="https://intel.neosec.eu/en/cve/CVE-2026-99153"><img src="https://intel.neosec.eu/badge/cve/CVE-2026-99153.svg?lang=en" alt="CVE-2026-99153 – NEOSEC Intel" height="20"></a>