| audit.rawnix.org | kernel | rawnix.org |
No known CVE is fixed in a later 7.2 release.
Only CVEs in code this kernel builds are listed; 5 more concern code its configuration leaves out, such as other architectures or drivers it does not build.
None.
Affects 7.2.10, and no 7.2 release has the fix yet; no 7.2 update helps.
| CVE | Severity | CVSS | Fixed in mainline | Published | Title |
|---|---|---|---|---|---|
| CVE-2026-68086 | unscored | — | — | 2026-08-10 | mm/khugepaged: write all dirty file folios when collapsing |
No known CVE is fixed in a later 7.2 release.
Only CVEs in code this kernel builds are listed; 6 more concern code its configuration leaves out, such as other architectures or drivers it does not build.
None.
Affects 7.2.10, and no 7.2 release has the fix yet; no 7.2 update helps.
None.
Update to 6.18.56: 3 CVEs affecting Linux 6.18.55 are fixed in later 6.18 releases.
Only CVEs in code this kernel builds are listed; 213 more concern code its configuration leaves out, such as other architectures or drivers it does not build.
| CVE | Severity | CVSS | Fixed in | Published | Title |
|---|---|---|---|---|---|
| CVE-2026-80734 | HIGH | 8.8 | 6.18.56 | 2026-09-03 | btrfs: initialize inode mapping flags for cached inodes |
| CVE-2026-80729 | unscored | — | 6.18.56 | 2026-09-03 | mm/huge_memory: initialise workingset state before folio split |
| CVE-2026-98375 | unscored | — | 6.18.56 | 2026-10-09 | xen/netfront: drop RX packets with a short Ethernet header |
Affects 6.18.55, and no 6.18 release has the fix yet; no 6.18 update helps.
| CVE | Severity | CVSS | Fixed in mainline | Published | Title |
|---|---|---|---|---|---|
| CVE-2026-72493 | CRITICAL | 9.9 | 7.2 | 2026-08-15 | net: serialize netif_running() check in enqueue_to_backlog() |
| CVE-2026-64067 | CRITICAL | 9.8 | 7.1 | 2026-07-19 | netfs: Fix missing barriers when accessing stream->subrequests locklessly |
| CVE-2026-64160 | CRITICAL | 9.8 | 7.1 | 2026-07-19 | netfs: Fix potential for tearing in ->remote_i_size and ->zero_point |
| CVE-2026-72477 | CRITICAL | 9.8 | 7.2 | 2026-08-15 | fs/ntfs3: call _ntfs_bad_inode() when failing to rename |
| CVE-2026-74723 | CRITICAL | 9.8 | 7.2 | 2026-08-22 | btrfs: lzo: reject inline extents without valid headers |
| CVE-2026-80634 | CRITICAL | 9.8 | 7.2 | 2026-08-28 | netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag |
| CVE-2026-80668 | CRITICAL | 9.8 | 7.2 | 2026-08-28 | netfilter: nf_conntrack_expect: use conntrack GC to reap expectations |
| CVE-2026-90104 | CRITICAL | 9.8 | 7.3 | 2026-09-17 | NFSv4.1: zero referring call lists before decoding |
| CVE-2026-89537 | CRITICAL | 9.1 | 7.3 | 2026-09-11 | SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 |
| CVE-2026-64117 | HIGH | 8.8 | 7.1 | 2026-07-19 | wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb |
| CVE-2026-68470 | HIGH | 8.8 | 7.2 | 2026-08-15 | wifi: mac80211: validate extension-frame layout before RX |
| CVE-2026-74277 | HIGH | 8.8 | 7.2 | 2026-08-15 | iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path |
| CVE-2026-74530 | HIGH | 8.8 | 7.2 | 2026-08-15 | Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback |
| CVE-2026-74533 | HIGH | 8.8 | 7.2 | 2026-08-15 | Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero |
| CVE-2026-74561 | HIGH | 8.8 | 7.2 | 2026-08-15 | nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush |
| CVE-2026-74562 | HIGH | 8.8 | 7.2 | 2026-08-15 | nexthop: take nh->lock for f6i_list walks in replace check and notify |
| CVE-2026-80692 | HIGH | 8.8 | 7.2 | 2026-08-28 | Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks |
| CVE-2026-90256 | HIGH | 8.8 | 7.3 | 2026-09-17 | Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind |
| CVE-2026-90380 | HIGH | 8.8 | 7.3 | 2026-09-17 | wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete |
| CVE-2026-90381 | HIGH | 8.8 | 7.3 | 2026-09-17 | wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx() |
| CVE-2026-93189 | HIGH | 8.8 | 7.3 | 2026-09-17 | HID: core: quiesce input in hid_hw_stop() to prevent use-after-free |
| CVE-2026-53091 | HIGH | 8.4 | 7.1 | 2026-06-24 | net: pull headers in qdisc_pkt_len_segs_init() |
| CVE-2026-31771 | HIGH | 8.1 | 7.0 | 2026-05-01 | Bluetooth: hci_event: move wake reason storage into validated event handlers |
| CVE-2026-89709 | HIGH | 8.1 | 7.3 | 2026-09-11 | lockd, nfsd: RCU-protect nlmsvc_ops dispatch |
| CVE-2026-46311 | HIGH | 7.8 | 7.1 | 2026-06-08 | drm/amdgpu/userq: fix access to stale wptr mapping |
| CVE-2026-63858 | HIGH | 7.8 | 7.1 | 2026-07-19 | netfilter: nf_tables: add hook transactions for device deletions |
| CVE-2026-63879 | HIGH | 7.8 | 7.1 | 2026-07-19 | drm/amdgpu: fix amdgpu_hmm_range_get_pages |
| CVE-2026-68305 | HIGH | 7.8 | 7.2 | 2026-08-10 | drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers |
| CVE-2026-68382 | HIGH | 7.8 | 7.2 | 2026-08-10 | drm/xe/guc: Hold device ref until queue teardown completes |
| CVE-2026-68383 | HIGH | 7.8 | 7.2 | 2026-08-10 | drm/xe/guc: Keep scheduler timeline name alive |
| CVE-2026-68399 | HIGH | 7.8 | 7.2 | 2026-08-10 | bpf: Fix UAF in sock clone early bailouts |
| CVE-2026-68404 | HIGH | 7.8 | 7.2 | 2026-08-10 | wifi: cfg80211: use wiphy work for socket owner autodisconnect |
| CVE-2026-74260 | HIGH | 7.8 | 7.2 | 2026-08-15 | netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them |
| CVE-2026-74314 | HIGH | 7.8 | 7.2 | 2026-08-15 | bpf: Cancel special fields on map value recycle |
| CVE-2026-74317 | HIGH | 7.8 | 7.2 | 2026-08-15 | ixgbe: do not configure xps for XDP queues |
| CVE-2026-74338 | HIGH | 7.8 | 7.2 | 2026-08-15 | bpf: Reject sleepable BPF_LSM_CGROUP programs at load time |
| CVE-2026-74354 | HIGH | 7.8 | 7.2 | 2026-08-15 | bpf: Take mmap_lock in zap_pages() |
| CVE-2026-74367 | HIGH | 7.8 | 7.2 | 2026-08-15 | wifi: ath12k: fix inconsistent arvif state in vdev_create error paths |
| CVE-2026-74529 | HIGH | 7.8 | 7.2 | 2026-08-15 | Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback |
| CVE-2026-74605 | HIGH | 7.8 | 7.2 | 2026-08-22 | eventfs: Use children field for rcu head and add memory barriers |
| CVE-2026-74747 | HIGH | 7.8 | 7.2 | 2026-08-26 | ipvs: revalidate ihl to prevent out-of-bounds access |
| CVE-2026-80579 | HIGH | 7.8 | 7.2 | 2026-08-26 | fbdev: clear fb_info->mode before deleting a videomode |
| CVE-2026-80580 | HIGH | 7.8 | 7.2 | 2026-08-26 | fbdev: bound mode sysfs output to the sysfs buffer |
| CVE-2026-89584 | HIGH | 7.8 | 7.3 | 2026-09-11 | block: validate user space vectors during extraction |
| CVE-2026-90093 | HIGH | 7.8 | 7.3 | 2026-09-17 | Bluetooth: L2CAP: access chan->conn safely in get/setsockopt |
| CVE-2026-90142 | HIGH | 7.8 | 7.3 | 2026-09-17 | virtio_net: Fix resize of the RX ring |
| CVE-2026-90177 | HIGH | 7.8 | 7.3 | 2026-09-17 | bpf: Check pointer type for all atomic RMW paths |
| CVE-2026-90237 | HIGH | 7.8 | 7.3 | 2026-09-17 | netfilter: nft_ct: move custom expectation support to helper |
| CVE-2026-90317 | HIGH | 7.8 | 7.3 | 2026-09-17 | bpf: Invalidate RCU pointers after final spin unlock |
| CVE-2026-92485 | HIGH | 7.8 | 7.3 | 2026-09-17 | bpf: Fix WARNING in bpf_tracing_link_release |
| CVE-2026-93105 | HIGH | 7.8 | 7.3 | 2026-09-17 | esp: do not unref managed frag pages in esp_ssg_unref() |
| CVE-2026-93125 | HIGH | 7.8 | 7.3 | 2026-09-17 | bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max |
| CVE-2026-93144 | HIGH | 7.8 | 7.3 | 2026-09-17 | bpf: Reject writes through untrusted BTF pointers |
| CVE-2026-93148 | HIGH | 7.8 | 7.3 | 2026-09-17 | bpf: Reject MEM_ALLOC BTF accesses past object bounds |
| CVE-2026-98364 | HIGH | 7.8 | 7.3 | 2026-10-06 | xfrm: hold net_device reference under RCU in bundle creation |
| CVE-2026-90408 | HIGH | 7.7 | 7.3 | 2026-09-17 | wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() |
| CVE-2026-64020 | HIGH | 7.5 | 7.1 | 2026-07-19 | nvme-pci: fix dma_vecs leak on p2p memory |
| CVE-2026-74745 | HIGH | 7.5 | 7.2 | 2026-08-26 | eth: bnxt: avoid deadlock when canceling IRQ affinity notifier |
| CVE-2026-80631 | HIGH | 7.5 | 7.2 | 2026-08-28 | btrfs: lzo: reject compressed segment that overflows the compressed input |
| CVE-2026-90234 | HIGH | 7.5 | 7.3 | 2026-09-17 | NFS: Return a delegation the client fails to record |
| CVE-2026-80738 | HIGH | 7.3 | 7.2 | 2026-09-03 | bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie |
| CVE-2026-43042 | HIGH | 7.1 | 7.0 | 2026-05-01 | mpls: add seqcount to protect the platform_label{,s} pair |
| CVE-2026-68103 | HIGH | 7.1 | 7.2 | 2026-08-10 | drm/amdgpu: reject mapping a reserved doorbell to a new queue |
| CVE-2026-90401 | HIGH | 7.1 | 7.3 | 2026-09-17 | md: remove REQ_NOWAIT support from raid1/10/456 |
| CVE-2026-93116 | HIGH | 7.0 | 7.3 | 2026-09-17 | platform/x86: asus-wmi: fix resource leaks on probe failure |
| CVE-2026-100072 | unscored | — | 7.3 | 2026-09-25 | ACPI: platform: Use acpi_bus_get_primary_device() |
| CVE-2026-100073 | unscored | — | 7.3 | 2026-09-25 | ext4: fix transaction overflow during writeback |
| CVE-2026-23374 | unscored | — | 7.0 | 2026-03-25 | blktrace: fix __this_cpu_read/write in preemptible context |
| CVE-2026-43022 | unscored | — | 7.0 | 2026-05-01 | Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists |
| CVE-2026-43053 | unscored | — | 7.0 | 2026-05-01 | xfs: close crash window in attr dabtree inactivation |
| CVE-2026-43174 | unscored | — | 7.0 | 2026-05-06 | io_uring/zcrx: fix post open error handling |
| CVE-2026-43299 | unscored | — | 7.0 | 2026-05-08 | btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() |
| CVE-2026-43308 | unscored | — | 7.0 | 2026-05-08 | btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() |
| CVE-2026-43326 | unscored | — | 7.0 | 2026-05-08 | sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback |
| CVE-2026-46017 | unscored | — | 7.1 | 2026-05-27 | mm: fix deferred split queue races during migration |
| CVE-2026-46032 | unscored | — | 7.1 | 2026-05-27 | KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT |
| CVE-2026-46153 | unscored | — | 7.1 | 2026-05-28 | 8021q: delete cleared egress QoS mappings |
| CVE-2026-52949 | unscored | — | 7.1 | 2026-06-24 | drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure |
| CVE-2026-52965 | unscored | — | 7.1 | 2026-06-24 | drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure |
| CVE-2026-53017 | unscored | — | 7.1 | 2026-06-24 | f2fs: fix data loss caused by incorrect use of nat_entry flag |
| CVE-2026-53106 | unscored | — | 7.1 | 2026-06-24 | bpf: Do not allow deleting local storage in NMI |
| CVE-2026-53257 | unscored | — | 7.1 | 2026-06-25 | wifi: cfg80211: enforce HE/EHT cap/oper consistency |
| CVE-2026-63811 | unscored | — | 7.2 | 2026-07-19 | f2fs: read COW data with the original inode during atomic write |
| CVE-2026-64013 | unscored | — | 7.1 | 2026-07-19 | ACPI: button: Fix ACPI GPE handler leak during removal |
| CVE-2026-64019 | unscored | — | 7.1 | 2026-07-19 | nvme-pci: fix dma mapping leak on data setup error |
| CVE-2026-64079 | unscored | — | 7.1 | 2026-07-19 | netfilter: x_tables: allocate hook ops while under mutex |
| CVE-2026-64159 | unscored | — | 7.1 | 2026-07-19 | netfs: Fix zeropoint update where i_size > remote_i_size |
| CVE-2026-64325 | unscored | — | 7.2 | 2026-07-25 | wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon |
| CVE-2026-68086 | unscored | — | — | 2026-08-10 | mm/khugepaged: write all dirty file folios when collapsing |
| CVE-2026-68105 | unscored | — | 7.2 | 2026-08-10 | drm/amdgpu: Fix kernel panic during driver load failure |
| CVE-2026-68242 | unscored | — | 7.2 | 2026-08-10 | drm/i915/gt: Fix NULL deref on sched_engine alloc failure |
| CVE-2026-68375 | unscored | — | 7.2 | 2026-08-10 | bnxt_en: Handle partially initialized auxiliary devices |
| CVE-2026-68441 | unscored | — | 7.2 | 2026-08-12 | net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains |
| CVE-2026-72031 | unscored | — | 7.2 | 2026-08-15 | ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD |
| CVE-2026-72370 | unscored | — | 7.2 | 2026-08-15 | iomap: release pages on atomic dio size mismatch |
| CVE-2026-74307 | unscored | — | 7.2 | 2026-08-15 | ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT |
| CVE-2026-74342 | unscored | — | 7.2 | 2026-08-15 | kernfs: link kn to its parent before the LSM init hook |
| CVE-2026-74375 | unscored | — | 7.2 | 2026-08-15 | md/raid1,raid10: fix deadlock in read error recovery path |
| CVE-2026-74542 | unscored | — | 7.2 | 2026-08-15 | netfs: Fix folio_queue ENOMEM in writeback by adding a mempool |
| CVE-2026-74558 | unscored | — | 7.2 | 2026-08-15 | xsk: reclaim invalid Tx descriptors in ZC batch path |
| CVE-2026-74571 | unscored | — | 7.2 | 2026-08-15 | btrfs: skip global block reserve accounting for rescue mounts |
| CVE-2026-74754 | unscored | — | 7.2 | 2026-08-26 | scsi: core: pair EH runtime PM get and put |
| CVE-2026-80785 | unscored | — | 7.2 | 2026-09-04 | fbdev: serialize mode sysfs access with lock_fb_info() |
| CVE-2026-80786 | unscored | — | 7.2 | 2026-09-04 | fbdev: Wrap user-invoked calls to fb_set_var() in helper |
| CVE-2026-89772 | unscored | — | 7.3 | 2026-09-11 | btrfs: write-protect folios during data writeback |
| CVE-2026-89812 | unscored | — | 7.3 | 2026-09-16 | drm/amdgpu: force complete the MES ring fences on reset |
| CVE-2026-89813 | unscored | — | 7.3 | 2026-09-16 | drm/amdgpu: force complete the KIQ ring fences on reset |
| CVE-2026-90040 | unscored | — | 7.3 | 2026-09-16 | KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped |
| CVE-2026-90061 | unscored | — | 7.3 | 2026-09-17 | netfilter: nf_tables: skip double clone set expressions on element insert |
| CVE-2026-90087 | unscored | — | 7.3 | 2026-09-17 | Bluetooth: do not leak an hci_conn when a second LE connect is rejected |
| CVE-2026-90095 | unscored | — | 7.3 | 2026-09-17 | fuse: Fix the condition to enable over-io-uring |
| CVE-2026-90099 | unscored | — | 7.3 | 2026-09-17 | net/sched: account classifier filter allocations to memcg |
| CVE-2026-90106 | unscored | — | 7.3 | 2026-09-17 | net: bridge: arp/nd proxy: fix reading neigh ha |
| CVE-2026-90182 | unscored | — | 7.3 | 2026-09-17 | blk-iocost: clear delay state when freeing policy data |
| CVE-2026-90183 | unscored | — | 7.3 | 2026-09-17 | blk-iolatency: clear delay state when freeing policy data |
| CVE-2026-90242 | unscored | — | 7.3 | 2026-09-17 | iommu/vt-d: Fix iopf_refcount leak on RID domain replacement |
| CVE-2026-90261 | unscored | — | 7.3 | 2026-09-17 | btrfs: zoned: flush active metadata block group at btree_writepages() start |
| CVE-2026-90263 | unscored | — | 7.3 | 2026-09-17 | btrfs: check if root is readonly when setting posix acl |
| CVE-2026-90267 | unscored | — | 7.3 | 2026-09-17 | scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails |
| CVE-2026-90300 | unscored | — | 7.3 | 2026-09-17 | bpf: Clear buf on error in __bpf_get_task_stack |
| CVE-2026-90311 | unscored | — | 7.3 | 2026-09-17 | thermal: hwmon: Remove hwmon class device along with its parent |
| CVE-2026-90315 | unscored | — | 7.3 | 2026-09-17 | PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers |
| CVE-2026-90335 | unscored | — | 7.3 | 2026-09-17 | tty: skip cdev_del() when no cdev is registered |
| CVE-2026-90336 | unscored | — | 7.3 | 2026-09-17 | serial: core: clear freed pointers on uart_register_driver() failure |
| CVE-2026-90337 | unscored | — | 7.3 | 2026-09-17 | serial: core: do fallible allocations before the console can be registered |
| CVE-2026-90345 | unscored | — | 7.3 | 2026-09-17 | wifi: brcmfmac: fix P2P action frame handling without device vif |
| CVE-2026-90346 | unscored | — | 7.3 | 2026-09-17 | wifi: nl80211: clean up color-change beacon data on errors |
| CVE-2026-90359 | unscored | — | 7.3 | 2026-09-17 | bpf: Reject >8 byte return values on return-reading trampoline paths |
| CVE-2026-90421 | unscored | — | 7.3 | 2026-09-17 | PCI: Fix UAF when probe runs concurrent to dyn ID removal |
| CVE-2026-92503 | unscored | — | 7.3 | 2026-09-17 | ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() |
| CVE-2026-93044 | unscored | — | 7.3 | 2026-09-17 | bpf: Disallow interpreter fallback for arena-related insns |
| CVE-2026-93129 | unscored | — | 7.3 | 2026-09-17 | platform/x86: dell-wmi-base: Fix handling of ultra performance key |
| CVE-2026-93164 | unscored | — | 7.3 | 2026-09-17 | uprobes/x86: Move optimized uprobe from nop5 to nop10 |
| CVE-2026-93181 | unscored | — | 7.3 | 2026-09-17 | perf/x86/intel/uncore: Fix uncore_box ref/unref ordering |
| CVE-2026-93248 | unscored | — | 7.3 | 2026-09-24 | drm/xe: don't WARN on kernel job timeout when device already wedged |
| CVE-2026-93251 | unscored | — | 7.3 | 2026-09-24 | ACPI: bus: Introduce acpi_bus_get_primary_device() |
| CVE-2026-93270 | unscored | — | 7.3 | 2026-09-24 | bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn |
| CVE-2026-97928 | unscored | — | 7.3 | 2026-09-25 | drm/amdgpu: skip the VMID 0 flush for VRAM |
| CVE-2026-97933 | unscored | — | 7.3 | 2026-09-25 | tracing: Take trace_array reference when opening a tracer options file |
| CVE-2026-97997 | unscored | — | 7.3 | 2026-09-25 | virtio_ring: fix stale descriptor flags after a failed packed add |
| CVE-2026-98019 | unscored | — | 7.3 | 2026-09-25 | bpf: mark a NULL call argument precise |
| CVE-2026-98032 | unscored | — | 7.3 | 2026-09-25 | tracing: Fix subbuf resize races with trace_pipe_raw readers |
| CVE-2026-98033 | unscored | — | 7.3 | 2026-09-25 | bpf: Preserve inner map identity in callback frames |
| CVE-2026-98034 | unscored | — | 7.3 | 2026-09-25 | bpf: Mark NULL kptr stores precise |
| CVE-2026-98038 | unscored | — | 7.3 | 2026-09-25 | bpf: Keep refcount_acquire nullable for borrowed RCU kptrs |
| CVE-2026-98043 | unscored | — | 7.3 | 2026-09-25 | bpf: Don't infer non-NULL from a pointer with an unbounded offset |
| CVE-2026-98048 | unscored | — | 7.3 | 2026-09-25 | bpf: don't rewrite bpf_fastcall patterns entered by a jump |
| CVE-2026-98057 | unscored | — | 7.3 | 2026-09-25 | ring-buffer: Add checking nr_subbufs to persistent ring buffer validation |
| CVE-2026-98058 | unscored | — | 7.3 | 2026-09-25 | bpf: Mark syscall helpers as sleepable |
| CVE-2026-98099 | unscored | — | 7.3 | 2026-09-25 | ipv6: mcast: use rcu_assign_pointer() for __rcu list updates |
| CVE-2026-98106 | unscored | — | 7.3 | 2026-09-25 | drm/pagemap: Prevent double migration of device pages |
| CVE-2026-98118 | unscored | — | 7.3 | 2026-09-25 | netfs: Fix readahead synchronisation issues by loading all folios upfront |
| CVE-2026-98134 | unscored | — | 7.3 | 2026-09-25 | bpf: check_cond_jmp_op(): properly infer if register is null |
| CVE-2026-98147 | unscored | — | 7.3 | 2026-09-25 | printk: Don't WARN on kthread_run failure. |
| CVE-2026-98153 | unscored | — | 7.3 | 2026-09-25 | nvme: fix racy access to FDP placement id array |
| CVE-2026-98284 | unscored | — | 7.3 | 2026-10-06 | netlink: do not free nlk->groups while lockless readers can use it |
| CVE-2026-98332 | unscored | — | 7.3 | 2026-10-06 | wifi: mac80211: only operate on TDLS peers in the TDLS code |
| CVE-2026-98333 | unscored | — | 7.3 | 2026-10-06 | wifi: mac80211: reset the LED state when ifup fails |
| CVE-2026-98338 | unscored | — | 7.3 | 2026-10-06 | wifi: cfg80211: ibss: ref BSS entry for joined event |
| CVE-2026-98376 | unscored | — | 7.1 | 2026-10-09 | bpf: Use array_map_meta_equal for percpu array inner map replacement |
| CVE-2026-98427 | unscored | — | 7.3 | 2026-10-14 | net/sched: codel: bound the dropping loop per dequeue call |
Update to 6.18.56: 1 CVE affecting Linux 6.18.55 is fixed in later 6.18 releases.
Only CVEs in code this kernel builds are listed; 277 more concern code its configuration leaves out, such as other architectures or drivers it does not build.
| CVE | Severity | CVSS | Fixed in | Published | Title |
|---|---|---|---|---|---|
| CVE-2026-80734 | HIGH | 8.8 | 6.18.56 | 2026-09-03 | btrfs: initialize inode mapping flags for cached inodes |
Affects 6.18.55, and no 6.18 release has the fix yet; no 6.18 update helps.
| CVE | Severity | CVSS | Fixed in mainline | Published | Title |
|---|---|---|---|---|---|
| CVE-2026-72493 | CRITICAL | 9.9 | 7.2 | 2026-08-15 | net: serialize netif_running() check in enqueue_to_backlog() |
| CVE-2026-64067 | CRITICAL | 9.8 | 7.1 | 2026-07-19 | netfs: Fix missing barriers when accessing stream->subrequests locklessly |
| CVE-2026-64160 | CRITICAL | 9.8 | 7.1 | 2026-07-19 | netfs: Fix potential for tearing in ->remote_i_size and ->zero_point |
| CVE-2026-74723 | CRITICAL | 9.8 | 7.2 | 2026-08-22 | btrfs: lzo: reject inline extents without valid headers |
| CVE-2026-80668 | CRITICAL | 9.8 | 7.2 | 2026-08-28 | netfilter: nf_conntrack_expect: use conntrack GC to reap expectations |
| CVE-2026-90104 | CRITICAL | 9.8 | 7.3 | 2026-09-17 | NFSv4.1: zero referring call lists before decoding |
| CVE-2026-89537 | CRITICAL | 9.1 | 7.3 | 2026-09-11 | SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 |
| CVE-2026-64117 | HIGH | 8.8 | 7.1 | 2026-07-19 | wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb |
| CVE-2026-68470 | HIGH | 8.8 | 7.2 | 2026-08-15 | wifi: mac80211: validate extension-frame layout before RX |
| CVE-2026-74277 | HIGH | 8.8 | 7.2 | 2026-08-15 | iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path |
| CVE-2026-74561 | HIGH | 8.8 | 7.2 | 2026-08-15 | nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush |
| CVE-2026-74562 | HIGH | 8.8 | 7.2 | 2026-08-15 | nexthop: take nh->lock for f6i_list walks in replace check and notify |
| CVE-2026-93189 | HIGH | 8.8 | 7.3 | 2026-09-17 | HID: core: quiesce input in hid_hw_stop() to prevent use-after-free |
| CVE-2026-53091 | HIGH | 8.4 | 7.1 | 2026-06-24 | net: pull headers in qdisc_pkt_len_segs_init() |
| CVE-2026-89709 | HIGH | 8.1 | 7.3 | 2026-09-11 | lockd, nfsd: RCU-protect nlmsvc_ops dispatch |
| CVE-2026-63858 | HIGH | 7.8 | 7.1 | 2026-07-19 | netfilter: nf_tables: add hook transactions for device deletions |
| CVE-2026-68399 | HIGH | 7.8 | 7.2 | 2026-08-10 | bpf: Fix UAF in sock clone early bailouts |
| CVE-2026-68404 | HIGH | 7.8 | 7.2 | 2026-08-10 | wifi: cfg80211: use wiphy work for socket owner autodisconnect |
| CVE-2026-74314 | HIGH | 7.8 | 7.2 | 2026-08-15 | bpf: Cancel special fields on map value recycle |
| CVE-2026-74317 | HIGH | 7.8 | 7.2 | 2026-08-15 | ixgbe: do not configure xps for XDP queues |
| CVE-2026-74605 | HIGH | 7.8 | 7.2 | 2026-08-22 | eventfs: Use children field for rcu head and add memory barriers |
| CVE-2026-80579 | HIGH | 7.8 | 7.2 | 2026-08-26 | fbdev: clear fb_info->mode before deleting a videomode |
| CVE-2026-80580 | HIGH | 7.8 | 7.2 | 2026-08-26 | fbdev: bound mode sysfs output to the sysfs buffer |
| CVE-2026-89584 | HIGH | 7.8 | 7.3 | 2026-09-11 | block: validate user space vectors during extraction |
| CVE-2026-90142 | HIGH | 7.8 | 7.3 | 2026-09-17 | virtio_net: Fix resize of the RX ring |
| CVE-2026-90237 | HIGH | 7.8 | 7.3 | 2026-09-17 | netfilter: nft_ct: move custom expectation support to helper |
| CVE-2026-92485 | HIGH | 7.8 | 7.3 | 2026-09-17 | bpf: Fix WARNING in bpf_tracing_link_release |
| CVE-2026-93105 | HIGH | 7.8 | 7.3 | 2026-09-17 | esp: do not unref managed frag pages in esp_ssg_unref() |
| CVE-2026-93148 | HIGH | 7.8 | 7.3 | 2026-09-17 | bpf: Reject MEM_ALLOC BTF accesses past object bounds |
| CVE-2026-98364 | HIGH | 7.8 | 7.3 | 2026-10-06 | xfrm: hold net_device reference under RCU in bundle creation |
| CVE-2026-64020 | HIGH | 7.5 | 7.1 | 2026-07-19 | nvme-pci: fix dma_vecs leak on p2p memory |
| CVE-2026-74745 | HIGH | 7.5 | 7.2 | 2026-08-26 | eth: bnxt: avoid deadlock when canceling IRQ affinity notifier |
| CVE-2026-80631 | HIGH | 7.5 | 7.2 | 2026-08-28 | btrfs: lzo: reject compressed segment that overflows the compressed input |
| CVE-2026-90234 | HIGH | 7.5 | 7.3 | 2026-09-17 | NFS: Return a delegation the client fails to record |
| CVE-2026-80738 | HIGH | 7.3 | 7.2 | 2026-09-03 | bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie |
| CVE-2026-43042 | HIGH | 7.1 | 7.0 | 2026-05-01 | mpls: add seqcount to protect the platform_label{,s} pair |
| CVE-2026-90401 | HIGH | 7.1 | 7.3 | 2026-09-17 | md: remove REQ_NOWAIT support from raid1/10/456 |
| CVE-2026-100072 | unscored | — | 7.3 | 2026-09-25 | ACPI: platform: Use acpi_bus_get_primary_device() |
| CVE-2026-100073 | unscored | — | 7.3 | 2026-09-25 | ext4: fix transaction overflow during writeback |
| CVE-2026-23374 | unscored | — | 7.0 | 2026-03-25 | blktrace: fix __this_cpu_read/write in preemptible context |
| CVE-2026-43053 | unscored | — | 7.0 | 2026-05-01 | xfs: close crash window in attr dabtree inactivation |
| CVE-2026-43174 | unscored | — | 7.0 | 2026-05-06 | io_uring/zcrx: fix post open error handling |
| CVE-2026-43299 | unscored | — | 7.0 | 2026-05-08 | btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() |
| CVE-2026-43308 | unscored | — | 7.0 | 2026-05-08 | btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() |
| CVE-2026-43326 | unscored | — | 7.0 | 2026-05-08 | sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback |
| CVE-2026-46017 | unscored | — | 7.1 | 2026-05-27 | mm: fix deferred split queue races during migration |
| CVE-2026-53257 | unscored | — | 7.1 | 2026-06-25 | wifi: cfg80211: enforce HE/EHT cap/oper consistency |
| CVE-2026-64013 | unscored | — | 7.1 | 2026-07-19 | ACPI: button: Fix ACPI GPE handler leak during removal |
| CVE-2026-64019 | unscored | — | 7.1 | 2026-07-19 | nvme-pci: fix dma mapping leak on data setup error |
| CVE-2026-64079 | unscored | — | 7.1 | 2026-07-19 | netfilter: x_tables: allocate hook ops while under mutex |
| CVE-2026-64159 | unscored | — | 7.1 | 2026-07-19 | netfs: Fix zeropoint update where i_size > remote_i_size |
| CVE-2026-68375 | unscored | — | 7.2 | 2026-08-10 | bnxt_en: Handle partially initialized auxiliary devices |
| CVE-2026-68441 | unscored | — | 7.2 | 2026-08-12 | net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains |
| CVE-2026-72031 | unscored | — | 7.2 | 2026-08-15 | ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD |
| CVE-2026-72370 | unscored | — | 7.2 | 2026-08-15 | iomap: release pages on atomic dio size mismatch |
| CVE-2026-74307 | unscored | — | 7.2 | 2026-08-15 | ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT |
| CVE-2026-74342 | unscored | — | 7.2 | 2026-08-15 | kernfs: link kn to its parent before the LSM init hook |
| CVE-2026-74375 | unscored | — | 7.2 | 2026-08-15 | md/raid1,raid10: fix deadlock in read error recovery path |
| CVE-2026-74542 | unscored | — | 7.2 | 2026-08-15 | netfs: Fix folio_queue ENOMEM in writeback by adding a mempool |
| CVE-2026-74558 | unscored | — | 7.2 | 2026-08-15 | xsk: reclaim invalid Tx descriptors in ZC batch path |
| CVE-2026-74571 | unscored | — | 7.2 | 2026-08-15 | btrfs: skip global block reserve accounting for rescue mounts |
| CVE-2026-74754 | unscored | — | 7.2 | 2026-08-26 | scsi: core: pair EH runtime PM get and put |
| CVE-2026-80785 | unscored | — | 7.2 | 2026-09-04 | fbdev: serialize mode sysfs access with lock_fb_info() |
| CVE-2026-80786 | unscored | — | 7.2 | 2026-09-04 | fbdev: Wrap user-invoked calls to fb_set_var() in helper |
| CVE-2026-89772 | unscored | — | 7.3 | 2026-09-11 | btrfs: write-protect folios during data writeback |
| CVE-2026-90040 | unscored | — | 7.3 | 2026-09-16 | KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped |
| CVE-2026-90061 | unscored | — | 7.3 | 2026-09-17 | netfilter: nf_tables: skip double clone set expressions on element insert |
| CVE-2026-90099 | unscored | — | 7.3 | 2026-09-17 | net/sched: account classifier filter allocations to memcg |
| CVE-2026-90182 | unscored | — | 7.3 | 2026-09-17 | blk-iocost: clear delay state when freeing policy data |
| CVE-2026-90183 | unscored | — | 7.3 | 2026-09-17 | blk-iolatency: clear delay state when freeing policy data |
| CVE-2026-90242 | unscored | — | 7.3 | 2026-09-17 | iommu/vt-d: Fix iopf_refcount leak on RID domain replacement |
| CVE-2026-90261 | unscored | — | 7.3 | 2026-09-17 | btrfs: zoned: flush active metadata block group at btree_writepages() start |
| CVE-2026-90267 | unscored | — | 7.3 | 2026-09-17 | scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails |
| CVE-2026-90311 | unscored | — | 7.3 | 2026-09-17 | thermal: hwmon: Remove hwmon class device along with its parent |
| CVE-2026-90315 | unscored | — | 7.3 | 2026-09-17 | PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers |
| CVE-2026-90335 | unscored | — | 7.3 | 2026-09-17 | tty: skip cdev_del() when no cdev is registered |
| CVE-2026-90336 | unscored | — | 7.3 | 2026-09-17 | serial: core: clear freed pointers on uart_register_driver() failure |
| CVE-2026-90337 | unscored | — | 7.3 | 2026-09-17 | serial: core: do fallible allocations before the console can be registered |
| CVE-2026-90346 | unscored | — | 7.3 | 2026-09-17 | wifi: nl80211: clean up color-change beacon data on errors |
| CVE-2026-90421 | unscored | — | 7.3 | 2026-09-17 | PCI: Fix UAF when probe runs concurrent to dyn ID removal |
| CVE-2026-92503 | unscored | — | 7.3 | 2026-09-17 | ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() |
| CVE-2026-93164 | unscored | — | 7.3 | 2026-09-17 | uprobes/x86: Move optimized uprobe from nop5 to nop10 |
| CVE-2026-93181 | unscored | — | 7.3 | 2026-09-17 | perf/x86/intel/uncore: Fix uncore_box ref/unref ordering |
| CVE-2026-93251 | unscored | — | 7.3 | 2026-09-24 | ACPI: bus: Introduce acpi_bus_get_primary_device() |
| CVE-2026-93270 | unscored | — | 7.3 | 2026-09-24 | bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn |
| CVE-2026-97933 | unscored | — | 7.3 | 2026-09-25 | tracing: Take trace_array reference when opening a tracer options file |
| CVE-2026-97997 | unscored | — | 7.3 | 2026-09-25 | virtio_ring: fix stale descriptor flags after a failed packed add |
| CVE-2026-98032 | unscored | — | 7.3 | 2026-09-25 | tracing: Fix subbuf resize races with trace_pipe_raw readers |
| CVE-2026-98048 | unscored | — | 7.3 | 2026-09-25 | bpf: don't rewrite bpf_fastcall patterns entered by a jump |
| CVE-2026-98057 | unscored | — | 7.3 | 2026-09-25 | ring-buffer: Add checking nr_subbufs to persistent ring buffer validation |
| CVE-2026-98099 | unscored | — | 7.3 | 2026-09-25 | ipv6: mcast: use rcu_assign_pointer() for __rcu list updates |
| CVE-2026-98118 | unscored | — | 7.3 | 2026-09-25 | netfs: Fix readahead synchronisation issues by loading all folios upfront |
| CVE-2026-98147 | unscored | — | 7.3 | 2026-09-25 | printk: Don't WARN on kthread_run failure. |
| CVE-2026-98153 | unscored | — | 7.3 | 2026-09-25 | nvme: fix racy access to FDP placement id array |
| CVE-2026-98284 | unscored | — | 7.3 | 2026-10-06 | netlink: do not free nlk->groups while lockless readers can use it |
| CVE-2026-98332 | unscored | — | 7.3 | 2026-10-06 | wifi: mac80211: only operate on TDLS peers in the TDLS code |
| CVE-2026-98333 | unscored | — | 7.3 | 2026-10-06 | wifi: mac80211: reset the LED state when ifup fails |
| CVE-2026-98338 | unscored | — | 7.3 | 2026-10-06 | wifi: cfg80211: ibss: ref BSS entry for joined event |
| CVE-2026-98427 | unscored | — | 7.3 | 2026-10-14 | net/sched: codel: bound the dropping loop per dequeue call |
No known CVE is fixed in a later 6.12 release.
Only CVEs in code this kernel builds are listed; 388 more concern code its configuration leaves out, such as other architectures or drivers it does not build.
None.
Affects 6.12.112, and no 6.12 release has the fix yet; no 6.12 update helps.
| CVE | Severity | CVSS | Fixed in mainline | Published | Title |
|---|---|---|---|---|---|
| CVE-2026-72493 | CRITICAL | 9.9 | 7.2 | 2026-08-15 | net: serialize netif_running() check in enqueue_to_backlog() |
| CVE-2025-68359 | CRITICAL | 9.8 | 6.19 | 2025-12-24 | btrfs: fix double free of qgroup record after failure to add delayed ref head |
| CVE-2026-63979 | CRITICAL | 9.8 | 7.1 | 2026-07-19 | net/handshake: hand off the pinned file reference to accept_doit |
| CVE-2026-64066 | CRITICAL | 9.8 | 7.1 | 2026-07-19 | netfs: Fix netfs_read_to_pagecache() to pause on subreq failure |
| CVE-2026-64067 | CRITICAL | 9.8 | 7.1 | 2026-07-19 | netfs: Fix missing barriers when accessing stream->subrequests locklessly |
| CVE-2026-64068 | CRITICAL | 9.8 | 7.1 | 2026-07-19 | netfs: Fix missing locking around retry adding new subreqs |
| CVE-2026-64160 | CRITICAL | 9.8 | 7.1 | 2026-07-19 | netfs: Fix potential for tearing in ->remote_i_size and ->zero_point |
| CVE-2026-68426 | CRITICAL | 9.8 | 7.2 | 2026-08-10 | xfrm: fix stale skb->prev after async crypto steals a GSO segment |
| CVE-2026-72355 | CRITICAL | 9.8 | 7.2 | 2026-08-15 | netfs: Fix barriering when walking subrequest list |
| CVE-2026-72366 | CRITICAL | 9.8 | 7.2 | 2026-08-15 | netfs: Fix netfs_create_write_req() to handle async cache object creation |
| CVE-2026-74269 | CRITICAL | 9.8 | 7.2 | 2026-08-15 | bnxt: fix head underflow on XDP head-grow |
| CVE-2026-74723 | CRITICAL | 9.8 | 7.2 | 2026-08-22 | btrfs: lzo: reject inline extents without valid headers |
| CVE-2026-80668 | CRITICAL | 9.8 | 7.2 | 2026-08-28 | netfilter: nf_conntrack_expect: use conntrack GC to reap expectations |
| CVE-2026-90104 | CRITICAL | 9.8 | 7.3 | 2026-09-17 | NFSv4.1: zero referring call lists before decoding |
| CVE-2026-64024 | CRITICAL | 9.4 | 7.1 | 2026-07-19 | tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction |
| CVE-2026-43083 | CRITICAL | 9.1 | 7.0 | 2026-05-06 | net: ioam6: fix OOB and missing lock |
| CVE-2026-89537 | CRITICAL | 9.1 | 7.3 | 2026-09-11 | SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 |
| CVE-2025-39862 | HIGH | 8.8 | 6.17 | 2025-09-19 | wifi: mt76: mt7915: fix list corruption after hardware restart |
| CVE-2025-68304 | HIGH | 8.8 | 6.18 | 2025-12-16 | Bluetooth: hci_core: lookup hci_conn on RX path on protocol side |
| CVE-2025-71202 | HIGH | 8.8 | 6.19 | 2026-02-14 | iommu/sva: invalidate stale IOTLB entries for kernel address space |
| CVE-2026-31435 | HIGH | 8.8 | 7.0 | 2026-04-22 | netfs: Fix read abandonment during retry |
| CVE-2026-43048 | HIGH | 8.8 | 7.0 | 2026-05-01 | HID: core: Mitigate potential OOB by removing bogus memset() |
| CVE-2026-43172 | HIGH | 8.8 | 7.0 | 2026-05-06 | wifi: iwlwifi: fix 22000 series SMEM parsing |
| CVE-2026-53281 | HIGH | 8.8 | 7.1 | 2026-06-26 | iommu/vt-d: Avoid NULL pointer dereference or refcount corruption |
| CVE-2026-63832 | HIGH | 8.8 | 7.2 | 2026-07-19 | wifi: mt76: add wcid publish check in mt76_sta_add |
| CVE-2026-64117 | HIGH | 8.8 | 7.1 | 2026-07-19 | wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb |
| CVE-2026-68393 | HIGH | 8.8 | 7.2 | 2026-08-10 | Bluetooth: hci_sync: extend conn_hash lookup critical sections |
| CVE-2026-68409 | HIGH | 8.8 | 7.2 | 2026-08-10 | wifi: mac80211: defer link RX stats percpu free to RCU |
| CVE-2026-68470 | HIGH | 8.8 | 7.2 | 2026-08-15 | wifi: mac80211: validate extension-frame layout before RX |
| CVE-2026-74407 | HIGH | 8.8 | 7.2 | 2026-08-15 | wifi: ath11k: cancel SSR work items during PCI shutdown |
| CVE-2026-74520 | HIGH | 8.8 | 7.2 | 2026-08-15 | iommu/iommufd: Fix IOPF group ownership UAF |
| CVE-2026-74530 | HIGH | 8.8 | 7.2 | 2026-08-15 | Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback |
| CVE-2026-74533 | HIGH | 8.8 | 7.2 | 2026-08-15 | Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero |
| CVE-2026-74534 | HIGH | 8.8 | 7.2 | 2026-08-15 | Bluetooth: ISO: fix refcounting of iso_conn |
| CVE-2026-74537 | HIGH | 8.8 | 7.2 | 2026-08-15 | Bluetooth: ISO: hold sk properly in iso_conn_ready |
| CVE-2026-74538 | HIGH | 8.8 | 7.2 | 2026-08-15 | Bluetooth: ISO: lock sk in iso_connect_ind |
| CVE-2026-80692 | HIGH | 8.8 | 7.2 | 2026-08-28 | Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks |
| CVE-2026-80721 | HIGH | 8.8 | 7.2 | 2026-08-28 | Bluetooth: ISO: ensure no dangling hcon references in iso_conn |
| CVE-2026-80734 | HIGH | 8.8 | 7.2 | 2026-09-03 | btrfs: initialize inode mapping flags for cached inodes |
| CVE-2026-90240 | HIGH | 8.8 | 7.3 | 2026-09-17 | iommu/vt-d: Flush context cache with correct SID when tearing down aliases |
| CVE-2026-90256 | HIGH | 8.8 | 7.3 | 2026-09-17 | Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind |
| CVE-2026-90379 | HIGH | 8.8 | 7.3 | 2026-09-17 | wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash |
| CVE-2026-93189 | HIGH | 8.8 | 7.3 | 2026-09-17 | HID: core: quiesce input in hid_hw_stop() to prevent use-after-free |
| CVE-2026-53091 | HIGH | 8.4 | 7.1 | 2026-06-24 | net: pull headers in qdisc_pkt_len_segs_init() |
| CVE-2025-68360 | HIGH | 8.2 | 6.19 | 2025-12-24 | wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks |
| CVE-2026-74697 | HIGH | 8.2 | 7.2 | 2026-08-22 | bnxt_en: Disable EOP for TPA on all chips to prevent data corruption |
| CVE-2025-40158 | HIGH | 8.1 | 6.18 | 2025-11-12 | ipv6: use RCU in ip6_output() |
| CVE-2026-31771 | HIGH | 8.1 | 7.0 | 2026-05-01 | Bluetooth: hci_event: move wake reason storage into validated event handlers |
| CVE-2026-89709 | HIGH | 8.1 | 7.3 | 2026-09-11 | lockd, nfsd: RCU-protect nlmsvc_ops dispatch |
| CVE-2025-22109 | HIGH | 7.8 | 6.15 | 2025-04-16 | ax25: Remove broken autobind |
| CVE-2025-38064 | HIGH | 7.8 | 6.15 | 2025-06-18 | virtio: break and reset virtio devices on device_shutdown() |
| CVE-2025-38656 | HIGH | 7.8 | — | 2025-08-22 | wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() |
| CVE-2025-39677 | HIGH | 7.8 | 6.17 | 2025-09-05 | net/sched: Fix backlog accounting in qdisc_dequeue_internal |
| CVE-2025-40025 | HIGH | 7.8 | 6.18 | 2025-10-28 | f2fs: fix to do sanity check on node footer for non inode dnode |
| CVE-2025-40190 | HIGH | 7.8 | 6.18 | 2025-11-12 | ext4: guard against EA inode refcount underflow in xattr update |
| CVE-2026-43009 | HIGH | 7.8 | 7.0 | 2026-05-01 | bpf: Fix incorrect pruning due to atomic fetch precision tracking |
| CVE-2026-46324 | HIGH | 7.8 | 7.1 | 2026-06-09 | netfilter: nf_tables: use list_del_rcu for netlink hooks |
| CVE-2026-52991 | HIGH | 7.8 | 7.1 | 2026-06-24 | sched/psi: fix race between file release and pressure write |
| CVE-2026-53000 | HIGH | 7.8 | 7.1 | 2026-06-24 | netfilter: nat: use kfree_rcu to release ops |
| CVE-2026-63819 | HIGH | 7.8 | 7.2 | 2026-07-19 | f2fs: fix to do sanity check on f2fs_get_node_folio_ra() |
| CVE-2026-63853 | HIGH | 7.8 | 7.1 | 2026-07-19 | drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring |
| CVE-2026-63858 | HIGH | 7.8 | 7.1 | 2026-07-19 | netfilter: nf_tables: add hook transactions for device deletions |
| CVE-2026-63879 | HIGH | 7.8 | 7.1 | 2026-07-19 | drm/amdgpu: fix amdgpu_hmm_range_get_pages |
| CVE-2026-64036 | HIGH | 7.8 | 7.1 | 2026-07-19 | cgroup/rstat: validate cpu before css_rstat_cpu() access |
| CVE-2026-64078 | HIGH | 7.8 | 7.1 | 2026-07-19 | netfilter: x_tables: add and use xtables_unregister_table_exit |
| CVE-2026-68382 | HIGH | 7.8 | 7.2 | 2026-08-10 | drm/xe/guc: Hold device ref until queue teardown completes |
| CVE-2026-68383 | HIGH | 7.8 | 7.2 | 2026-08-10 | drm/xe/guc: Keep scheduler timeline name alive |
| CVE-2026-68399 | HIGH | 7.8 | 7.2 | 2026-08-10 | bpf: Fix UAF in sock clone early bailouts |
| CVE-2026-68404 | HIGH | 7.8 | 7.2 | 2026-08-10 | wifi: cfg80211: use wiphy work for socket owner autodisconnect |
| CVE-2026-74257 | HIGH | 7.8 | 7.2 | 2026-08-15 | sockmap: Fix use-after-free in udp_bpf_recvmsg() |
| CVE-2026-74264 | HIGH | 7.8 | 7.2 | 2026-08-15 | net: watchdog: fix refcount tracking races |
| CVE-2026-74314 | HIGH | 7.8 | 7.2 | 2026-08-15 | bpf: Cancel special fields on map value recycle |
| CVE-2026-74317 | HIGH | 7.8 | 7.2 | 2026-08-15 | ixgbe: do not configure xps for XDP queues |
| CVE-2026-74338 | HIGH | 7.8 | 7.2 | 2026-08-15 | bpf: Reject sleepable BPF_LSM_CGROUP programs at load time |
| CVE-2026-74344 | HIGH | 7.8 | 7.2 | 2026-08-15 | bpf: Clear rb node linkage when freeing bpf_rb_root |
| CVE-2026-74354 | HIGH | 7.8 | 7.2 | 2026-08-15 | bpf: Take mmap_lock in zap_pages() |
| CVE-2026-74529 | HIGH | 7.8 | 7.2 | 2026-08-15 | Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback |
| CVE-2026-74605 | HIGH | 7.8 | 7.2 | 2026-08-22 | eventfs: Use children field for rcu head and add memory barriers |
| CVE-2026-74747 | HIGH | 7.8 | 7.2 | 2026-08-26 | ipvs: revalidate ihl to prevent out-of-bounds access |
| CVE-2026-80579 | HIGH | 7.8 | 7.2 | 2026-08-26 | fbdev: clear fb_info->mode before deleting a videomode |
| CVE-2026-80580 | HIGH | 7.8 | 7.2 | 2026-08-26 | fbdev: bound mode sysfs output to the sysfs buffer |
| CVE-2026-81010 | HIGH | 7.8 | 7.3 | 2026-09-11 | io_uring/waitid: honor task_work cancellation |
| CVE-2026-90093 | HIGH | 7.8 | 7.3 | 2026-09-17 | Bluetooth: L2CAP: access chan->conn safely in get/setsockopt |
| CVE-2026-90142 | HIGH | 7.8 | 7.3 | 2026-09-17 | virtio_net: Fix resize of the RX ring |
| CVE-2026-90146 | HIGH | 7.8 | 7.3 | 2026-09-17 | bpf, xdp: move offload check into dev_xdp_install() |
| CVE-2026-90177 | HIGH | 7.8 | 7.3 | 2026-09-17 | bpf: Check pointer type for all atomic RMW paths |
| CVE-2026-90237 | HIGH | 7.8 | 7.3 | 2026-09-17 | netfilter: nft_ct: move custom expectation support to helper |
| CVE-2026-90317 | HIGH | 7.8 | 7.3 | 2026-09-17 | bpf: Invalidate RCU pointers after final spin unlock |
| CVE-2026-90326 | HIGH | 7.8 | 7.3 | 2026-09-17 | blk-cgroup: fix race between policy activation and blkg destruction |
| CVE-2026-90343 | HIGH | 7.8 | 7.3 | 2026-09-17 | wifi: cfg80211: stop PMSR before P2P and NAN teardown |
| CVE-2026-92485 | HIGH | 7.8 | 7.3 | 2026-09-17 | bpf: Fix WARNING in bpf_tracing_link_release |
| CVE-2026-93105 | HIGH | 7.8 | 7.3 | 2026-09-17 | esp: do not unref managed frag pages in esp_ssg_unref() |
| CVE-2026-93125 | HIGH | 7.8 | 7.3 | 2026-09-17 | bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max |
| CVE-2026-93144 | HIGH | 7.8 | 7.3 | 2026-09-17 | bpf: Reject writes through untrusted BTF pointers |
| CVE-2026-93148 | HIGH | 7.8 | 7.3 | 2026-09-17 | bpf: Reject MEM_ALLOC BTF accesses past object bounds |
| CVE-2026-98073 | HIGH | 7.8 | 7.3 | 2026-09-25 | net: Remove conflicting altnames for dying netns in __dev_change_net_namespace(). |
| CVE-2026-98156 | HIGH | 7.8 | 7.3 | 2026-09-25 | drm/virtio: use the DMA API for resource backing on Xen |
| CVE-2026-98341 | HIGH | 7.8 | 7.3 | 2026-10-06 | wifi: cfg80211: don't free driver-owned scan requests |
| CVE-2026-98364 | HIGH | 7.8 | 7.3 | 2026-10-06 | xfrm: hold net_device reference under RCU in bundle creation |
| CVE-2026-90408 | HIGH | 7.7 | 7.3 | 2026-09-17 | wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() |
| CVE-2026-43101 | HIGH | 7.5 | 7.0 | 2026-05-06 | ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() |
| CVE-2026-43213 | HIGH | 7.5 | 7.0 | 2026-05-06 | wifi: rtw89: pci: validate sequence number of TX release report |
| CVE-2026-53284 | HIGH | 7.5 | 7.1 | 2026-06-26 | btrfs: only release the dirty pages io tree after successful writes |
| CVE-2026-74695 | HIGH | 7.5 | 7.2 | 2026-08-22 | netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() |
| CVE-2026-80631 | HIGH | 7.5 | 7.2 | 2026-08-28 | btrfs: lzo: reject compressed segment that overflows the compressed input |
| CVE-2026-90149 | HIGH | 7.5 | 7.3 | 2026-09-17 | NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers |
| CVE-2026-90234 | HIGH | 7.5 | 7.3 | 2026-09-17 | NFS: Return a delegation the client fails to record |
| CVE-2026-45932 | HIGH | 7.3 | 7.0 | 2026-05-27 | bpf: Fix tcx/netkit detach permissions when prog fd isn't given |
| CVE-2026-80738 | HIGH | 7.3 | 7.2 | 2026-09-03 | bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie |
| CVE-2026-43042 | HIGH | 7.1 | 7.0 | 2026-05-01 | mpls: add seqcount to protect the platform_label{,s} pair |
| CVE-2026-46175 | HIGH | 7.1 | 7.1 | 2026-05-28 | f2fs: fix fsck inconsistency caused by FGGC of node block |
| CVE-2026-52953 | HIGH | 7.1 | 7.1 | 2026-06-24 | iommu/vt-d: Fix oops due to out of scope access |
| CVE-2026-53368 | HIGH | 7.1 | 7.1 | 2026-07-19 | f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage |
| CVE-2026-80685 | HIGH | 7.1 | 7.2 | 2026-08-28 | mm/util: don't read __page_2 for order-1 folios in snapshot_page() |
| CVE-2026-90260 | HIGH | 7.1 | 7.3 | 2026-09-17 | btrfs: zoned: don't clobber the extent buffer when zeroing it out |
| CVE-2026-90401 | HIGH | 7.1 | 7.3 | 2026-09-17 | md: remove REQ_NOWAIT support from raid1/10/456 |
| CVE-2025-23132 | HIGH | 7.0 | 6.15 | 2025-04-16 | f2fs: quota: fix to avoid warning in dquot_writeback_dquots() |
| CVE-2026-93116 | HIGH | 7.0 | 7.3 | 2026-09-17 | platform/x86: asus-wmi: fix resource leaks on probe failure |
| CVE-2026-98330 | HIGH | 7.0 | 7.3 | 2026-10-06 | wifi: cfg80211: get the wiphy out of a dying network namespace |
| CVE-2025-39910 | MEDIUM | 5.5 | 6.17 | 2025-10-01 | mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() |
| CVE-2024-58074 | unscored | — | 6.14 | 2025-03-06 | drm/i915: Grab intel_display from the encoder to avoid potential oopsies |
| CVE-2025-21752 | unscored | — | 6.14 | 2025-02-26 | btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents |
| CVE-2025-37743 | unscored | — | 6.15 | 2025-05-01 | wifi: ath12k: Avoid memory leak while enabling statistics |
| CVE-2025-38036 | unscored | — | 6.15 | 2025-06-18 | drm/xe/vf: Perform early GT MMIO initialization to read GMDID |
| CVE-2025-38140 | unscored | — | 6.16 | 2025-07-03 | dm: limit swapping tables for devices with zone write plugs |
| CVE-2025-38199 | unscored | — | 6.16 | 2025-07-04 | wifi: ath12k: Fix memory leak due to multiple rx_stats allocation |
| CVE-2025-38207 | unscored | — | 6.16 | 2025-07-04 | mm: fix uprobe pte be overwritten when expanding vma |
| CVE-2025-38284 | unscored | — | 6.16 | 2025-07-10 | wifi: rtw89: pci: configure manual DAC mode via PCI config API only |
| CVE-2025-38605 | unscored | — | 6.17 | 2025-08-19 | wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() |
| CVE-2025-39775 | unscored | — | 6.17 | 2025-09-11 | mm/mremap: fix WARN with uffd that has remap events disabled |
| CVE-2025-40086 | unscored | — | 6.18 | 2025-10-30 | drm/xe: Don't allow evicting of BOs in same VM in array of VM binds |
| CVE-2025-40146 | unscored | — | 6.18 | 2025-11-12 | blk-mq: fix potential deadlock while nr_requests grown |
| CVE-2025-40197 | unscored | — | 6.18 | 2025-11-12 | media: mc: Clear minor number before put device |
| CVE-2025-40217 | unscored | — | 6.18 | 2025-12-04 | pidfs: validate extensible ioctls |
| CVE-2025-40355 | unscored | — | 6.18 | 2025-12-16 | sysfs: check visibility before changing group attribute ownership |
| CVE-2025-68193 | unscored | — | 6.18 | 2025-12-16 | drm/xe/guc: Add devm release action to safely tear down CT |
| CVE-2025-68319 | unscored | — | 6.18 | 2025-12-16 | netconsole: Acquire su_mutex before navigating configs hierarchy |
| CVE-2025-68368 | unscored | — | 6.19 | 2025-12-24 | md: init bioset in mddev_init |
| CVE-2025-68729 | unscored | — | 6.19 | 2025-12-24 | wifi: ath12k: Fix MSDU buffer types handling in RX error path |
| CVE-2025-71117 | unscored | — | 6.19 | 2026-01-14 | block: Remove queue freezing from several sysfs store callbacks |
| CVE-2025-71227 | unscored | — | 6.19 | 2026-02-18 | wifi: mac80211: don't WARN for connections on invalid channels |
| CVE-2025-71285 | unscored | — | 7.0 | 2026-05-06 | net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels |
| CVE-2026-100072 | unscored | — | 7.3 | 2026-09-25 | ACPI: platform: Use acpi_bus_get_primary_device() |
| CVE-2026-100074 | unscored | — | 7.3 | 2026-09-25 | bpf: Mark bpf_refcount field as unique |
| CVE-2026-23143 | unscored | — | 6.19 | 2026-02-14 | virtio_net: Fix misalignment bug in struct virtnet_info |
| CVE-2026-23152 | unscored | — | 6.19 | 2026-02-14 | wifi: mac80211: correctly decode TTLM with default link map |
| CVE-2026-23208 | unscored | — | 6.19 | 2026-02-14 | ALSA: usb-audio: Prevent excessive number of frames |
| CVE-2026-23259 | unscored | — | 6.19 | 2026-03-18 | io_uring/rw: free potentially allocated iovec on cache put failure |
| CVE-2026-23265 | unscored | — | 7.0 | 2026-03-18 | f2fs: fix to do sanity check on node footer in {read,write}_end_io |
| CVE-2026-23371 | unscored | — | 7.0 | 2026-03-25 | sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting |
| CVE-2026-23385 | unscored | — | 7.0 | 2026-03-25 | netfilter: nf_tables: clone set on flush only |
| CVE-2026-23472 | unscored | — | 7.0 | 2026-04-03 | serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN |
| CVE-2026-31526 | unscored | — | 7.0 | 2026-04-22 | bpf: Fix exception exit lock checking for subprogs |
| CVE-2026-31579 | unscored | — | 7.1 | 2026-04-24 | wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit |
| CVE-2026-31591 | unscored | — | 7.1 | 2026-04-24 | KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish |
| CVE-2026-31592 | unscored | — | 7.1 | 2026-04-24 | KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock |
| CVE-2026-31692 | unscored | — | 7.0 | 2026-04-30 | rtnetlink: add missing netlink_ns_capable() check for peer netns |
| CVE-2026-43022 | unscored | — | 7.0 | 2026-05-01 | Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists |
| CVE-2026-43034 | unscored | — | 7.0 | 2026-05-01 | bnxt_en: set backing store type from query type |
| CVE-2026-43053 | unscored | — | 7.0 | 2026-05-01 | xfs: close crash window in attr dabtree inactivation |
| CVE-2026-43118 | unscored | — | 7.0 | 2026-05-06 | btrfs: fix zero size inode with non-zero size after log replay |
| CVE-2026-43127 | unscored | — | 7.0 | 2026-05-06 | ntfs3: fix circular locking dependency in run_unpack_ex |
| CVE-2026-43272 | unscored | — | 7.0 | 2026-05-06 | ring-buffer: Fix possible dereference of uninitialized pointer |
| CVE-2026-43298 | unscored | — | 7.0 | 2026-05-08 | drm/amdgpu: Skip vcn poison irq release on VF |
| CVE-2026-43299 | unscored | — | 7.0 | 2026-05-08 | btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() |
| CVE-2026-43308 | unscored | — | 7.0 | 2026-05-08 | btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() |
| CVE-2026-43309 | unscored | — | 7.0 | 2026-05-08 | md raid: fix hang when stopping arrays with metadata through dm-raid |
| CVE-2026-43325 | unscored | — | 7.0 | 2026-05-08 | wifi: iwlwifi: mvm: don't send a 6E related command when not supported |
| CVE-2026-43326 | unscored | — | 7.0 | 2026-05-08 | sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback |
| CVE-2026-45934 | unscored | — | 7.0 | 2026-05-27 | btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation |
| CVE-2026-46014 | unscored | — | 7.1 | 2026-05-27 | KVM: SVM: Add missing save/restore handling of LBR MSRs |
| CVE-2026-46017 | unscored | — | 7.1 | 2026-05-27 | mm: fix deferred split queue races during migration |
| CVE-2026-46032 | unscored | — | 7.1 | 2026-05-27 | KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT |
| CVE-2026-46059 | unscored | — | 7.1 | 2026-05-27 | KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN |
| CVE-2026-46071 | unscored | — | 7.1 | 2026-05-27 | KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 |
| CVE-2026-46153 | unscored | — | 7.1 | 2026-05-28 | 8021q: delete cleared egress QoS mappings |
| CVE-2026-46279 | unscored | — | 7.1 | 2026-06-08 | mm/alloc_tag: clear codetag for pages allocated before page_ext initialization |
| CVE-2026-52994 | unscored | — | 7.1 | 2026-06-24 | vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting |
| CVE-2026-53017 | unscored | — | 7.1 | 2026-06-24 | f2fs: fix data loss caused by incorrect use of nat_entry flag |
| CVE-2026-53018 | unscored | — | 7.1 | 2026-06-24 | f2fs: avoid reading already updated pages during GC |
| CVE-2026-53103 | unscored | — | 7.1 | 2026-06-24 | wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync |
| CVE-2026-53104 | unscored | — | 7.1 | 2026-06-24 | wifi: mt76: Fix memory leak destroying device |
| CVE-2026-53106 | unscored | — | 7.1 | 2026-06-24 | bpf: Do not allow deleting local storage in NMI |
| CVE-2026-53258 | unscored | — | 7.1 | 2026-06-25 | wifi: fix leak if split 6 GHz scanning fails |
| CVE-2026-53321 | unscored | — | 7.1 | 2026-06-26 | io_uring/napi: cap busy_poll_to 10 msec |
| CVE-2026-63811 | unscored | — | 7.2 | 2026-07-19 | f2fs: read COW data with the original inode during atomic write |
| CVE-2026-63998 | unscored | — | 7.1 | 2026-07-19 | ethtool: module: call ethnl_ops_complete() on module flash errors |
| CVE-2026-63999 | unscored | — | 7.1 | 2026-07-19 | ethtool: rss: fix indir_table and hkey leak on get_rxfh failure |
| CVE-2026-64006 | unscored | — | 7.1 | 2026-07-19 | netfilter: nf_tables: fix dst corruption in same register operation |
| CVE-2026-64060 | unscored | — | 7.1 | 2026-07-19 | netfs: Fix leak of request in netfs_write_begin() error handling |
| CVE-2026-64079 | unscored | — | 7.1 | 2026-07-19 | netfilter: x_tables: allocate hook ops while under mutex |
| CVE-2026-64159 | unscored | — | 7.1 | 2026-07-19 | netfs: Fix zeropoint update where i_size > remote_i_size |
| CVE-2026-64513 | unscored | — | 7.2 | 2026-07-25 | KVM: x86: Unconditionally recompute CR8 intercept on PPR update |
| CVE-2026-68086 | unscored | — | — | 2026-08-10 | mm/khugepaged: write all dirty file folios when collapsing |
| CVE-2026-68105 | unscored | — | 7.2 | 2026-08-10 | drm/amdgpu: Fix kernel panic during driver load failure |
| CVE-2026-68238 | unscored | — | 7.2 | 2026-08-10 | drm/amdgpu: Release VFCT ACPI table reference |
| CVE-2026-68241 | unscored | — | 7.2 | 2026-08-10 | drm/i915/mst: limit DP MST ESI service loop |
| CVE-2026-68242 | unscored | — | 7.2 | 2026-08-10 | drm/i915/gt: Fix NULL deref on sched_engine alloc failure |
| CVE-2026-68375 | unscored | — | 7.2 | 2026-08-10 | bnxt_en: Handle partially initialized auxiliary devices |
| CVE-2026-68412 | unscored | — | 7.2 | 2026-08-10 | wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() |
| CVE-2026-68441 | unscored | — | 7.2 | 2026-08-12 | net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains |
| CVE-2026-68448 | unscored | — | 7.2 | 2026-08-12 | ovl: check access to copy_file_range source with src mounter creds |
| CVE-2026-72031 | unscored | — | 7.2 | 2026-08-15 | ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD |
| CVE-2026-72321 | unscored | — | 7.2 | 2026-08-15 | ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() |
| CVE-2026-72365 | unscored | — | 7.2 | 2026-08-15 | netfs: Fix writethrough to use collection offload |
| CVE-2026-74261 | unscored | — | 7.2 | 2026-08-15 | ALSA: seq: avoid stale FIFO cells during resize |
| CVE-2026-74337 | unscored | — | 7.2 | 2026-08-15 | bpf: Fix NMI/tracepoint re-entry deadlock on lru locks |
| CVE-2026-74342 | unscored | — | 7.2 | 2026-08-15 | kernfs: link kn to its parent before the LSM init hook |
| CVE-2026-74375 | unscored | — | 7.2 | 2026-08-15 | md/raid1,raid10: fix deadlock in read error recovery path |
| CVE-2026-74542 | unscored | — | 7.2 | 2026-08-15 | netfs: Fix folio_queue ENOMEM in writeback by adding a mempool |
| CVE-2026-74558 | unscored | — | 7.2 | 2026-08-15 | xsk: reclaim invalid Tx descriptors in ZC batch path |
| CVE-2026-74559 | unscored | — | 7.2 | 2026-08-15 | xsk: drain continuation descs after overflow in xsk_build_skb() |
| CVE-2026-74560 | unscored | — | 7.2 | 2026-08-15 | xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx |
| CVE-2026-74571 | unscored | — | 7.2 | 2026-08-15 | btrfs: skip global block reserve accounting for rescue mounts |
| CVE-2026-74600 | unscored | — | 7.2 | 2026-08-22 | mm/page_table_check: skip special zero mappings |
| CVE-2026-74728 | unscored | — | 7.2 | 2026-08-22 | xfs: handle NULL b_addr in xfs_buf_free |
| CVE-2026-74754 | unscored | — | 7.2 | 2026-08-26 | scsi: core: pair EH runtime PM get and put |
| CVE-2026-80607 | unscored | — | 7.2 | 2026-08-28 | tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg |
| CVE-2026-80761 | unscored | — | 7.3 | 2026-09-04 | Bluetooth: ISO: zero the sockaddr before returning it in getname |
| CVE-2026-80785 | unscored | — | 7.2 | 2026-09-04 | fbdev: serialize mode sysfs access with lock_fb_info() |
| CVE-2026-80786 | unscored | — | 7.2 | 2026-09-04 | fbdev: Wrap user-invoked calls to fb_set_var() in helper |
| CVE-2026-80920 | unscored | — | 7.3 | 2026-09-09 | io_uring: defer eventfd signaling when queued from a wakeup handler |
| CVE-2026-80948 | unscored | — | 7.3 | 2026-09-11 | wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() |
| CVE-2026-89722 | unscored | — | 7.3 | 2026-09-11 | PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() |
| CVE-2026-89757 | unscored | — | 7.3 | 2026-09-11 | mm/mglru: fix and remove redundant unevictable folio handling |
| CVE-2026-89812 | unscored | — | 7.3 | 2026-09-16 | drm/amdgpu: force complete the MES ring fences on reset |
| CVE-2026-89813 | unscored | — | 7.3 | 2026-09-16 | drm/amdgpu: force complete the KIQ ring fences on reset |
| CVE-2026-89833 | unscored | — | 7.3 | 2026-09-16 | f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() |
| CVE-2026-89987 | unscored | — | 7.3 | 2026-09-16 | mm/huge_memory: transfer the pmd dirty bit to the folio on zap |
| CVE-2026-90040 | unscored | — | 7.3 | 2026-09-16 | KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped |
| CVE-2026-90061 | unscored | — | 7.3 | 2026-09-17 | netfilter: nf_tables: skip double clone set expressions on element insert |
| CVE-2026-90086 | unscored | — | 7.3 | 2026-09-17 | xsk: honor XDP_TX_METADATA in zero-copy path |
| CVE-2026-90087 | unscored | — | 7.3 | 2026-09-17 | Bluetooth: do not leak an hci_conn when a second LE connect is rejected |
| CVE-2026-90097 | unscored | — | 7.3 | 2026-09-17 | Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition |
| CVE-2026-90099 | unscored | — | 7.3 | 2026-09-17 | net/sched: account classifier filter allocations to memcg |
| CVE-2026-90106 | unscored | — | 7.3 | 2026-09-17 | net: bridge: arp/nd proxy: fix reading neigh ha |
| CVE-2026-90182 | unscored | — | 7.3 | 2026-09-17 | blk-iocost: clear delay state when freeing policy data |
| CVE-2026-90183 | unscored | — | 7.3 | 2026-09-17 | blk-iolatency: clear delay state when freeing policy data |
| CVE-2026-90247 | unscored | — | 7.3 | 2026-09-17 | bpf: Fix mmap_lock leak in irq_work path |
| CVE-2026-90259 | unscored | — | 7.3 | 2026-09-17 | btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() |
| CVE-2026-90261 | unscored | — | 7.3 | 2026-09-17 | btrfs: zoned: flush active metadata block group at btree_writepages() start |
| CVE-2026-90263 | unscored | — | 7.3 | 2026-09-17 | btrfs: check if root is readonly when setting posix acl |
| CVE-2026-90264 | unscored | — | 7.3 | 2026-09-17 | btrfs: always wait for ordered extents to avoid OE races |
| CVE-2026-90265 | unscored | — | 7.3 | 2026-09-17 | btrfs: defrag: fix deadlock between defrag and delalloc space reservation |
| CVE-2026-90267 | unscored | — | 7.3 | 2026-09-17 | scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails |
| CVE-2026-90300 | unscored | — | 7.3 | 2026-09-17 | bpf: Clear buf on error in __bpf_get_task_stack |
| CVE-2026-90311 | unscored | — | 7.3 | 2026-09-17 | thermal: hwmon: Remove hwmon class device along with its parent |
| CVE-2026-90315 | unscored | — | 7.3 | 2026-09-17 | PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers |
| CVE-2026-90335 | unscored | — | 7.3 | 2026-09-17 | tty: skip cdev_del() when no cdev is registered |
| CVE-2026-90336 | unscored | — | 7.3 | 2026-09-17 | serial: core: clear freed pointers on uart_register_driver() failure |
| CVE-2026-90337 | unscored | — | 7.3 | 2026-09-17 | serial: core: do fallible allocations before the console can be registered |
| CVE-2026-90345 | unscored | — | 7.3 | 2026-09-17 | wifi: brcmfmac: fix P2P action frame handling without device vif |
| CVE-2026-90346 | unscored | — | 7.3 | 2026-09-17 | wifi: nl80211: clean up color-change beacon data on errors |
| CVE-2026-90359 | unscored | — | 7.3 | 2026-09-17 | bpf: Reject >8 byte return values on return-reading trampoline paths |
| CVE-2026-90421 | unscored | — | 7.3 | 2026-09-17 | PCI: Fix UAF when probe runs concurrent to dyn ID removal |
| CVE-2026-92499 | unscored | — | 7.3 | 2026-09-17 | ext4: validate readdir offset before accessing dirent |
| CVE-2026-92500 | unscored | — | 7.3 | 2026-09-17 | ext4: use fsdata to track inline data write state and fix race |
| CVE-2026-92503 | unscored | — | 7.3 | 2026-09-17 | ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() |
| CVE-2026-92520 | unscored | — | 7.3 | 2026-09-17 | bpf: Zero queue and stack outputs on lock failure |
| CVE-2026-93044 | unscored | — | 7.3 | 2026-09-17 | bpf: Disallow interpreter fallback for arena-related insns |
| CVE-2026-93129 | unscored | — | 7.3 | 2026-09-17 | platform/x86: dell-wmi-base: Fix handling of ultra performance key |
| CVE-2026-93146 | unscored | — | 7.3 | 2026-09-17 | time/namespace: Validate nanosecond field in proc_timens_set_offset() |
| CVE-2026-93181 | unscored | — | 7.3 | 2026-09-17 | perf/x86/intel/uncore: Fix uncore_box ref/unref ordering |
| CVE-2026-93230 | unscored | — | 7.3 | 2026-09-24 | mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier |
| CVE-2026-93243 | unscored | — | 7.3 | 2026-09-24 | mm/secretmem: properly account locked pages |
| CVE-2026-93251 | unscored | — | 7.3 | 2026-09-24 | ACPI: bus: Introduce acpi_bus_get_primary_device() |
| CVE-2026-93270 | unscored | — | 7.3 | 2026-09-24 | bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn |
| CVE-2026-97424 | unscored | — | 7.2 | 2026-09-24 | drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq |
| CVE-2026-97432 | unscored | — | 7.2 | 2026-09-24 | wifi: iwlwifi: mvm: fix P2P-Device binding handling |
| CVE-2026-97479 | unscored | — | 7.2 | 2026-09-24 | driver core: Avoid warning when removing a device while its supplier is unbinding |
| CVE-2026-97480 | unscored | — | 7.2 | 2026-09-24 | tty: serial: 8250: protect against NULL uart->port.dev in register |
| CVE-2026-97493 | unscored | — | 7.2 | 2026-09-24 | drm/amdgpu: Bound GPIO I2C table entry count from VBIOS |
| CVE-2026-97503 | unscored | — | 7.2 | 2026-09-24 | genirq/proc: Size interrupt directory names for 10-digit interrupt numbers |
| CVE-2026-97928 | unscored | — | 7.3 | 2026-09-25 | drm/amdgpu: skip the VMID 0 flush for VRAM |
| CVE-2026-97960 | unscored | — | 7.3 | 2026-09-25 | perf/x86/intel: Prevent drain_pebs() reentry |
| CVE-2026-97975 | unscored | — | 7.3 | 2026-09-25 | Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() |
| CVE-2026-97997 | unscored | — | 7.3 | 2026-09-25 | virtio_ring: fix stale descriptor flags after a failed packed add |
| CVE-2026-98003 | unscored | — | 7.3 | 2026-09-25 | iommu/amd: Do not reallocate GA log buffers on resume |
| CVE-2026-98019 | unscored | — | 7.3 | 2026-09-25 | bpf: mark a NULL call argument precise |
| CVE-2026-98032 | unscored | — | 7.3 | 2026-09-25 | tracing: Fix subbuf resize races with trace_pipe_raw readers |
| CVE-2026-98033 | unscored | — | 7.3 | 2026-09-25 | bpf: Preserve inner map identity in callback frames |
| CVE-2026-98034 | unscored | — | 7.3 | 2026-09-25 | bpf: Mark NULL kptr stores precise |
| CVE-2026-98038 | unscored | — | 7.3 | 2026-09-25 | bpf: Keep refcount_acquire nullable for borrowed RCU kptrs |
| CVE-2026-98043 | unscored | — | 7.3 | 2026-09-25 | bpf: Don't infer non-NULL from a pointer with an unbounded offset |
| CVE-2026-98044 | unscored | — | 7.3 | 2026-09-25 | bpf: Reject legacy packet loads from callbacks |
| CVE-2026-98047 | unscored | — | 7.3 | 2026-09-25 | bpf: Check ancestor frames for rbtree callbacks |
| CVE-2026-98048 | unscored | — | 7.3 | 2026-09-25 | bpf: don't rewrite bpf_fastcall patterns entered by a jump |
| CVE-2026-98058 | unscored | — | 7.3 | 2026-09-25 | bpf: Mark syscall helpers as sleepable |
| CVE-2026-98062 | unscored | — | 7.3 | 2026-09-25 | bpf: Mark signal tracepoint siginfo arguments as scalar |
| CVE-2026-98079 | unscored | — | 7.3 | 2026-09-25 | btrfs: zstd: fix lost wakeup when waiting for a workspace |
| CVE-2026-98087 | unscored | — | 7.3 | 2026-09-25 | sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate |
| CVE-2026-98099 | unscored | — | 7.3 | 2026-09-25 | ipv6: mcast: use rcu_assign_pointer() for __rcu list updates |
| CVE-2026-98118 | unscored | — | 7.3 | 2026-09-25 | netfs: Fix readahead synchronisation issues by loading all folios upfront |
| CVE-2026-98119 | unscored | — | 7.3 | 2026-09-25 | netfs: break unbuffered write when netfs_alloc_subrequest() fails |
| CVE-2026-98134 | unscored | — | 7.3 | 2026-09-25 | bpf: check_cond_jmp_op(): properly infer if register is null |
| CVE-2026-98147 | unscored | — | 7.3 | 2026-09-25 | printk: Don't WARN on kthread_run failure. |
| CVE-2026-98273 | unscored | — | 7.3 | 2026-10-06 | x86/kprobes: Fix crash when probing CS CALL instructions |
| CVE-2026-98279 | unscored | — | 7.3 | 2026-10-06 | btrfs: handle lack of space when cleaning up verity items |
| CVE-2026-98284 | unscored | — | 7.3 | 2026-10-06 | netlink: do not free nlk->groups while lockless readers can use it |
| CVE-2026-98289 | unscored | — | 7.3 | 2026-10-06 | af_unix: Unify scc_index when finalising SCC in __unix_walk_scc(). |
| CVE-2026-98296 | unscored | — | 7.3 | 2026-10-06 | Bluetooth: btintel_pcie: validate TX skb length in send_sync |
| CVE-2026-98317 | unscored | — | 7.3 | 2026-10-06 | neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS. |
| CVE-2026-98321 | unscored | — | 7.3 | 2026-10-06 | netfilter: nf_nat: unregister and release hooks on error |
| CVE-2026-98332 | unscored | — | 7.3 | 2026-10-06 | wifi: mac80211: only operate on TDLS peers in the TDLS code |
| CVE-2026-98333 | unscored | — | 7.3 | 2026-10-06 | wifi: mac80211: reset the LED state when ifup fails |
| CVE-2026-98338 | unscored | — | 7.3 | 2026-10-06 | wifi: cfg80211: ibss: ref BSS entry for joined event |
| CVE-2026-98375 | unscored | — | 7.3 | 2026-10-09 | xen/netfront: drop RX packets with a short Ethernet header |
| CVE-2026-98376 | unscored | — | 7.1 | 2026-10-09 | bpf: Use array_map_meta_equal for percpu array inner map replacement |
| CVE-2026-98393 | unscored | — | 7.3 | 2026-10-14 | net: ipv4: Fix UDP length overflow with PMTU discover and big MTU |
| CVE-2026-98424 | unscored | — | 7.3 | 2026-10-14 | wifi: cfg80211: undo netns switch if renaming the wiphy fails |
| CVE-2026-98427 | unscored | — | 7.3 | 2026-10-14 | net/sched: codel: bound the dropping loop per dequeue call |
The CVE records of the kernel CVE team, which are updated as fixes are backported; scores from the CVE record where one is published.
| Checked 2026-10-15 05:36 UTC | rawnix |