linux vulnerabilities
CVEs whose affected-version data names the linux package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
1356 CVEsRSS
CVE-2026-89763High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted_tpm_exit() drops the TPM chip reference and frees the digest array before unregistering the trusted key type
In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted_tpm_exit() drops the TPM chip reference and frees the digest array before unregistering the trusted key type. key_type…
CVE-2026-89761Medium· 5.5⚖ disputedkernel: apparmor: fix out-of-bounds write when null terminating a label vec (CVE-2026-89761)
A flaw was found in the Linux kernel's AppArmor security module. An out-of-bounds write vulnerability exists when null terminating a label vector due to improper memory allocation. An unprivileged local attacker can exploit this by writing…
CVE-2026-89755High· 7.8In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: clear stale mapping after freeing swapcache __migrate_device_pages() reads the folio mapping before calling folio_free_swap()
In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: clear stale mapping after freeing swapcache __migrate_device_pages() reads the folio mapping before calling folio_free_swap(). When folio_free_swap…
CVE-2026-89731High· 7.1In the Linux kernel, the following vulnerability has been resolved: cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read cxl_rch_get_aer_info() copies the RCH Downstream Port AER capability from the RCRB MMIO block using…
In the Linux kernel, the following vulnerability has been resolved: cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read cxl_rch_get_aer_info() copies the RCH Downstream Port AER capability from the RCRB MMIO block using…
CVE-2026-89708Critical· 9.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown After a DESTROY_SESSION the per-session teardown path can free a session while rpciod still h…
In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown After a DESTROY_SESSION the per-session teardown path can free a session while rpciod still h…
CVE-2026-80968Medium· 5.5kernel: ALSA: mts64: Check card index validity at probe (CVE-2026-80968)
A flaw was found in the ALSA mts64 driver within the Linux kernel. This driver does not properly validate the card index, specifically failing to check for negative ID values when bound via sysfs. A local attacker could exploit this vulner…
CVE-2026-80966Medium· 5.5kernel: ALSA: portman2x4: Check card index validity at probe (CVE-2026-80966)
A flaw was found in the ALSA portman2x4 driver of the Linux kernel. This vulnerability occurs because the driver does not properly validate the card index, specifically failing to check for negative ID values. A local attacker could exploi…
CVE-2026-80965Medium· 5.5kernel: ALSA: serial-u16550: Check card index validity at probe (CVE-2026-80965)
A flaw was found in the Linux kernel's ALSA serial-u16550 driver. This vulnerability occurs because the driver does not properly validate the card index when a device is manually bound via the sysfs interface. A local user could exploit th…
CVE-2026-80938Medium· 5.5kernel: wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (CVE-2026-80938)
A flaw was found in the Linux kernel, specifically within the `mt7615` Wi-Fi driver. A deadlock can occur during system suspend operations when the suspend process attempts to acquire a mutex (a locking mechanism) while simultaneously wait…
CVE-2026-80935Medium· 5.5⚖ disputedkernel: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy (CVE-2026-80935)
A flaw was found in the Linux kernel's Wi-Fi driver for MediaTek MT7996 devices. A malicious or malfunctioning Wi-Fi device can exploit improper validation of an EEPROM (Electrically Erasable Programmable Read-Only Memory) address during a…
CVE-2026-80933Medium· 5.5⚖ disputedkernel: wifi: mt76: mt7996: validate default EEPROM firmware size (CVE-2026-80933)
A flaw was found in the Linux kernel's mt76: mt7996 Wi-Fi driver. This vulnerability occurs because the driver does not properly validate the size of the default EEPROM (Electrically Erasable Programmable Read-Only Memory) firmware. A spec…
CVE-2026-80931Medium· 5.5⚖ disputedkernel: w1: ds28e17: reject an oversize length on an I2C block read (CVE-2026-80931)
A flaw was found in the Linux kernel's w1: ds28e17 1-Wire to I2C bridge driver. A malicious I2C slave device can provide an oversized length during an I2C block read operation. This causes the driver to read beyond the allocated buffer, le…
CVE-2026-80928Medium· 5.5⚖ disputedkernel: smack: fix cred UAF in smack_file_send_sigiotask() (CVE-2026-80928)
A flaw was found in the Linux kernel's SMACK (Simplified Mandatory Access Control Kernel) security module. Incorrect handling of task credentials within the smack_file_send_sigiotask() function can lead to a Use-After-Free (UAF) vulnerabil…
CVE-2026-89437Medium· 5.5kernel: platform/x86: int1092: Fix potential memory leak in sar_probe() (CVE-2026-89437)
A flaw was found in the Linux kernel. The `sar_probe()` function, specifically in its error handling paths, fails to free memory allocated for `device_mode_info` by the `parse_package()` function, which is called by `sar_get_data()`. This …
CVE-2026-81017Medium· 5.5⚖ disputedkernel: platform/chrome: sensorhub: Bound the EC-reported sensor number (CVE-2026-81017)
A flaw was found in the Linux kernel's `sensorhub` component. A local attacker could provide a maliciously crafted sensor number in an EC FIFO event. This unchecked sensor number could lead to an out-of-bounds read and write in the `batch_…
CVE-2026-81014Medium· 5.5kernel: platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() (CVE-2026-81014)
A flaw was found in the Linux kernel's `hp-bioscfg` module. A local attacker with write access to the `sysfs` entry for `hp-bioscfg` could exploit a heap out-of-bounds read vulnerability. This occurs because the `sk_store()` and `kek_store…
CVE-2026-81013Medium· 5.5kernel: platform/x86: hp-bioscfg: fix heap OOB read on empty password write (CVE-2026-81013)
A flaw was found in the hp-bioscfg component of the Linux kernel. A local user could trigger a heap out-of-bounds read by writing an empty string to the current_password or new_password fields. This occurs because the validate_password_inp…
CVE-2026-81011Medium· 5.5kernel: platform/x86: hp-bioscfg: pass validated element count to package parsers (CVE-2026-81011)
A flaw was found in the Linux kernel's hp-bioscfg module. The module's package parsers incorrectly determine the number of elements in a package, using a value derived from a name string rather than the true package size. While currently p…
CVE-2026-81007High· 7.1ipmi: ipmb: validate write message length
In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmb_write() read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes…
CVE-2026-81005Medium· 4.1kernel: ipmi: si: Fix NULL pointer dereference after failed registration (CVE-2026-81005)
A flaw was found in the Linux kernel's Intelligent Platform Management Interface (IPMI) subsystem. During the registration of an IPMI message handler, if the Baseboard Management Controller (BMC) device information cannot be fetched, a NUL…
CVE-2026-81003High· 8.1net/iucv: filter frames in afiucv_hs_rcv() by ingress device
In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucv_hs_rcv() by ingress device afiucv_hs_rcv() selects a socket from iucv_sk_list by matching four 8-byte name fields in the transport he…
CVE-2026-80992Medium· 5.5⚖ disputedkernel: net: ravb: avoid dereferencing an invalid PTP clock (CVE-2026-80992)
A flaw was found in the `net: ravb` component of the Linux kernel. This vulnerability allows for a NULL pointer dereference when the Precision Time Protocol (PTP) clock's index is queried before it is properly initialized or if its registr…
CVE-2026-89490Noneocfs2: fix readdir position truncation on 32-bit kernels
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix readdir position truncation on 32-bit kernels In ocfs2_dir_foreach_blk_el(), the directory cookie position is rebuilt with ctx->pos = (ctx->pos & ~(sb->s_…
CVE-2026-89470Medium· 5.5⚖ disputedkernel: power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (CVE-2026-89470)
A flaw was found in the Linux kernel's `cros_usbpd-charger` driver. This driver, which manages USB power delivery, incorrectly processes port count information from an embedded controller. A malicious embedded controller could provide an e…
CVE-2026-89466Medium· 5.5⚖ disputedkernel: power: supply: qcom_battmgr: terminate the strings from firmware (CVE-2026-89466)
A flaw was found in the Linux kernel's `qcom_battmgr` component, responsible for power supply management. This vulnerability occurs due to improper string termination when handling firmware-provided strings. A malicious or malformed firmwa…
CVE-2026-89465Medium· 5.5⚖ disputedkernel: power: supply: rt9455: quiesce delayed work before teardown (CVE-2026-89465)
A flaw was found in the Linux kernel, specifically within the rt9455 power supply driver. This vulnerability occurs due to improper management of delayed tasks when the device is being removed or if its initialization fails. A pending task…
CVE-2026-81012Medium· 5.5⚖ disputedkernel: platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() (CVE-2026-81012)
A flaw was found in the Linux kernel's hp-bioscfg component. The `hp_get_string_from_buffer()` function contains an off-by-one write vulnerability. This occurs because the NUL terminator can be written one byte beyond the allocated buffer,…
CVE-2026-89550Critical· 9.8SUNRPC: svcauth_gss: enforce krb5 token minimum length
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: enforce krb5 token minimum length svcauth_gss_unwrap_priv() validates only an upper bound on the wire-supplied opaque length before handing the bu…
CVE-2026-89549High· 7.5sunrpc: route to a populated pool in svc_pool_for_cpu()
In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svc_pool_for_cpu() svc_set_num_threads() spreads the requested threads evenly across the service's pools (base = nrservs / sv_nrpo…
CVE-2026-89542Critical· 9.8SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens gss_krb5_unwrap_v2() reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is a…