linux vulnerabilities
CVEs whose affected-version data names the linux package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
1965 CVEsRSS
CVE-2026-89466Medium· 5.5⚖ disputedkernel: power: supply: qcom_battmgr: terminate the strings from firmware (CVE-2026-89466)
A flaw was found in the Linux kernel's `qcom_battmgr` component, responsible for power supply management. This vulnerability occurs due to improper string termination when handling firmware-provided strings. A malicious or malformed firmwa…
CVE-2026-89465Medium· 5.5⚖ disputedkernel: power: supply: rt9455: quiesce delayed work before teardown (CVE-2026-89465)
A flaw was found in the Linux kernel, specifically within the rt9455 power supply driver. This vulnerability occurs due to improper management of delayed tasks when the device is being removed or if its initialization fails. A pending task…
CVE-2026-81012Medium· 5.5⚖ disputedkernel: platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() (CVE-2026-81012)
A flaw was found in the Linux kernel's hp-bioscfg component. The `hp_get_string_from_buffer()` function contains an off-by-one write vulnerability. This occurs because the NUL terminator can be written one byte beyond the allocated buffer,…
CVE-2026-89550Critical· 9.8SUNRPC: svcauth_gss: enforce krb5 token minimum length
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: enforce krb5 token minimum length svcauth_gss_unwrap_priv() validates only an upper bound on the wire-supplied opaque length before handing the bu…
CVE-2026-89549High· 7.5sunrpc: route to a populated pool in svc_pool_for_cpu()
In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svc_pool_for_cpu() svc_set_num_threads() spreads the requested threads evenly across the service's pools (base = nrservs / sv_nrpo…
CVE-2026-89542Critical· 9.8SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens gss_krb5_unwrap_v2() reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is a…
CVE-2026-89536Critical· 9.8SUNRPC: wait for in-flight client TLS handshake callback
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake callback xs_tls_handshake_sync() gives xs_tls_handshake_done() a reference to the lower transport before submitting the…
CVE-2026-89524Medium· 5.5⚖ disputedkernel: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (CVE-2026-89524)
A flaw was found in the ath6kl Wi-Fi driver of the Linux kernel. An integer underflow vulnerability occurs when processing Wi-Fi association requests or responses that are shorter than expected. This can cause the system to read beyond the…
CVE-2026-89512Medium· 5.5kernel: remoteproc: scp: Fix device reference leak on failed lookup (CVE-2026-89512)
A flaw was found in the Linux kernel's remoteproc SCP component. This vulnerability involves a device reference leak, where the system fails to properly release a reference to a device during a driver data lookup. This occurs specifically …
CVE-2026-89497High· 7.8orangefs: skip leading spaces before parsing client debug masks
In the Linux kernel, the following vulnerability has been resolved: orangefs: skip leading spaces before parsing client debug masks orangefs_prepare_cdm_array() sizes each client debug keyword buffer with strcspn(cds_head, " "), but th…
CVE-2026-89496Medium· 5.5kernel: ocfs2: always run deallocs on copy-on-write completion (CVE-2026-89496)
A flaw was found in ocfs2, the Oracle Cluster File System, within the Linux kernel. A local user could exploit this vulnerability by performing a `copy_file_range()` operation within the same filesystem. This can lead to a memory leak, pot…
CVE-2026-89494Critical· 9.8ocfs2: validate lengths in dlm_mig_lockres_handler
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlm_mig_lockres_handler A node receiving a DLM_MIG_LOCKRES message trusts several fields of the peer-supplied dlm_migratable_lockres without…
CVE-2026-89493Medium· 5.5⚖ disputedkernel: ocfs2: validate rl_used against rl_count in refcount block validator (CVE-2026-89493)
A flaw was found in the Linux kernel's ocfs2 component. A local attacker with CAP_SYS_ADMIN privileges could exploit this by mounting a crafted or corrupted ocfs2 image, or by performing a raw write to the block device backing an already-m…
CVE-2026-89491Medium· 5.5kernel: ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() (CVE-2026-89491)
A flaw was found in the Linux kernel's ocfs2 cluster module. This vulnerability allows a local attacker to trigger a denial of service. The issue arises when a sleeping function is called while a spinlock is held within the o2hb_region_pin…
CVE-2026-89599Medium· 5.5⚖ disputedkernel: fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (CVE-2026-89599)
A flaw was found in the Linux kernel's `fbdev: omapfb: panel-dsi-cm` component. The `dsicm_probe()` function registers a display before its associated lock (mutex) is properly initialized. This timing issue allows another process to attemp…
CVE-2026-89597Medium· 5.5⚖ disputedkernel: fbdev: uvesafb: unregister connector callback on init failure (CVE-2026-89597)
A flaw was found in the `uvesafb` component of the Linux kernel. During the initialization process, if the platform driver fails to register, a connector callback is not properly unregistered. This oversight can lead to a resource leak, wh…
CVE-2026-89596Medium· 5.5kernel: forcedeth: fix off-by-one when saving/restoring non-PCI config space (CVE-2026-89596)
A flaw was found in the Linux kernel's forcedeth driver. An off-by-one error in the `nv_suspend()` and `nv_resume()` functions, which handle saving and restoring non-PCI configuration space, can lead to an out-of-bounds memory access. This…
CVE-2026-89594Medium· 5.5⚖ disputedkernel: hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device (CVE-2026-89594)
A flaw was found in the Linux kernel's OMAP SSI driver. The driver uses a synthetic HSI controller device that does not properly initialize its Direct Memory Access (DMA) mask. This oversight can lead to the driver crashing or triggering w…
CVE-2026-89593High· 7.1hugetlb: only adjust reservation during unmapping if mapcount is 0
In the Linux kernel, the following vulnerability has been resolved: hugetlb: only adjust reservation during unmapping if mapcount is 0 Since df7a6d1f6405, __unmap_hugepage_range can adjust reservations. In the case of folio mapped in …
CVE-2026-89585Medium· 5.5⚖ disputedkernel: auxdisplay: charlcd: cancel backlight work on registration failure (CVE-2026-89585)
A flaw was found in the `auxdisplay: charlcd` component of the Linux kernel. This use-after-free vulnerability occurs when the `charlcd_register()` function fails, leading to the `charlcd` object being freed while a delayed work item still…
CVE-2026-89573High· 7.8dm array: reject an array block whose value size is not the caller's
In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's array_block_check() can only compare the header against itself, so a block with value_size 4 and m…
CVE-2026-89562High· 7.8ip6_gre: fix hardware header length for NBMA tunnels
In the Linux kernel, the following vulnerability has been resolved: ip6_gre: fix hardware header length for NBMA tunnels ip6gre_tnl_link_config_route() accumulates the lower device's hardware header length into dev->hard_header_len whe…
CVE-2026-89560High· 8.4landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation
In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation Whiteout objects are used in the upper layer of an OverlayFS to indicate that the file with this na…
CVE-2026-89557High· 7.8md: do overflow check for sb->bblog_shift in super_1_load()
In the Linux kernel, the following vulnerability has been resolved: md: do overflow check for sb->bblog_shift in super_1_load() In super_1_load(), sb->bblog_shift is an __u8 type value loaded from on- disk superblock. It is used for ba…
CVE-2026-89555Critical· 9.8mpls: reload header after pskb_may_pull()
In the Linux kernel, the following vulnerability has been resolved: mpls: reload header after pskb_may_pull() mpls_select_multipath() calls mpls_multipath_hash() to choose a nexthop when an MPLS route has multiple nexthops. While walk…
CVE-2026-89674Medium· 5.5⚖ disputedkernel: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (CVE-2026-89674)
A flaw was found in the `nfsd` component of the Linux kernel. Incorrect calculations in the XDR (External Data Representation) buffer size within the `nfsd4_ff_encode_layoutget()` function can lead to two critical issues. An attacker could…
CVE-2026-89643Critical· 9.8audit: avoid dropping live tree ref on fsnotify rule autoremove
In the Linux kernel, the following vulnerability has been resolved: audit: avoid dropping live tree ref on fsnotify rule autoremove audit_del_rule() is used for both netlink deletion templates and internal fsnotify autoremove. The for…
CVE-2026-89617Medium· 5.5⚖ disputedkernel: fs/ntfs3: validate dirty page table on log replay (CVE-2026-89617)
A flaw was found in the Linux kernel's NTFS3 filesystem driver. An attacker with local access could craft a malicious NTFS log file. During log replay, insufficient validation of the `lcns_follow` field in a `DIR_PAGE_ENTRY` could lead to …
CVE-2026-89616Medium· 5.5⚖ disputedkernel: fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() (CVE-2026-89616)
A flaw was found in the Linux kernel's NTFS3 filesystem driver. When decompressing LZNT data, the `ni_read_frame()` function may not fully zero out memory after a partial decompression. This can lead to the disclosure of previously used ke…
CVE-2026-89615Medium· 5.5⚖ disputedkernel: fs/ntfs3: bound page_lcns[] index by the log record (CVE-2026-89615)
A flaw was found in the Linux kernel's NTFS3 file system driver. A local attacker could exploit this by providing a specially crafted log record. This crafted record causes a buffer overflow in the page_lcns[] array, leading to memory corr…