Tagged “cve.org”
CVEs tagged cve.org, newest first.
18496 CVEsRSS
CVE-2026-89487High· 7.0kernel: openvswitch: only skb_tx_error() a packet we are about to drop (CVE-2026-89487)
A flaw was found in openvswitch in the Linux kernel. This vulnerability occurs when the `queue_userspace_packet()` function incorrectly modifies a shared network packet buffer by stripping a critical flag. This action can lead to an unpriv…
CVE-2026-89485High· 7.0⚖ disputedkernel: lockd: pin next file across nlm_inspect_file lock-drop (CVE-2026-89485)
A flaw was found in the `lockd` component of the Linux kernel. This use-after-free vulnerability occurs in the `nlm_traverse_files()` function when a file's memory is prematurely released while an iterator still holds a pointer to it. A re…
CVE-2026-89483Medium· 5.5⚖ disputedkernel: nvme: zero the discard fallback page (CVE-2026-89483)
A flaw was found in the Linux kernel's Non-Volatile Memory Express (NVMe) subsystem. Under specific memory pressure conditions, a local user could trigger a scenario where uninitialized kernel memory is used and potentially exposed. This c…
CVE-2026-89607High· 7.0kernel: ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet (CVE-2026-89607)
A flaw was found in ecryptfs in the Linux kernel. The parse_tag_3_packet() function does not properly validate the size of the encrypted key, allowing an oversized key to be processed. This improper validation leads to out-of-bounds writes…
CVE-2026-89606High· 7.0kernel: ecryptfs: reject too-small tag 70 packets (CVE-2026-89606)
A flaw was found in ecryptfs, a component of the Linux kernel. This vulnerability allows a remote attacker to send a specially crafted tag 70 packet with a body smaller than expected. This can lead to an integer underflow during size calcu…
CVE-2026-89605Medium· 5.5⚖ disputedkernel: ecryptfs: release message context on send failure (CVE-2026-89605)
A flaw was found in the `ecryptfs` component of the Linux kernel. When the `ecryptfs_send_miscdev()` function fails to send a message to the userspace daemon, the associated message context is not properly released. This oversight leaves t…
CVE-2026-89604Medium· 5.5kernel: efivarfs: Rate limit statfs() handler (CVE-2026-89604)
A flaw was found in the Linux kernel's efivarfs component. An unprivileged local user can exploit this by repeatedly calling the `statfs()` handler on the `efivarfs` mount point. This action triggers a flood of calls to the `QueryVariableI…
CVE-2026-89603High· 7.8kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)
A flaw was found in the Linux kernel. A race condition exists where a seccomp filter, intended to restrict system calls, can be bypassed by an unprivileged process. This occurs when a thread is stopped for tracing (ptrace) and another thre…
CVE-2026-89599Medium· 5.5⚖ disputedkernel: fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (CVE-2026-89599)
A flaw was found in the Linux kernel's `fbdev: omapfb: panel-dsi-cm` component. The `dsicm_probe()` function registers a display before its associated lock (mutex) is properly initialized. This timing issue allows another process to attemp…
CVE-2026-89598Medium· 5.5kernel: fbdev: ssd1307fb: defer I2C transfers from damage callbacks (CVE-2026-89598)
A flaw was found in the Linux kernel's fbdev (framebuffer device) subsystem, specifically within the ssd1307fb driver. This vulnerability occurs when display damage callbacks, which handle updates to the display, perform synchronous I2C (I…
CVE-2026-89597Medium· 5.5⚖ disputedkernel: fbdev: uvesafb: unregister connector callback on init failure (CVE-2026-89597)
A flaw was found in the `uvesafb` component of the Linux kernel. During the initialization process, if the platform driver fails to register, a connector callback is not properly unregistered. This oversight can lead to a resource leak, wh…
CVE-2026-89596Medium· 5.5kernel: forcedeth: fix off-by-one when saving/restoring non-PCI config space (CVE-2026-89596)
A flaw was found in the Linux kernel's forcedeth driver. An off-by-one error in the `nv_suspend()` and `nv_resume()` functions, which handle saving and restoring non-PCI configuration space, can lead to an out-of-bounds memory access. This…
CVE-2026-89595Medium· 5.5kernel: fsnotify: Fix stale object mask after concurrent mark updates (CVE-2026-89595)
A flaw was found in the Linux kernel's fsnotify subsystem, affecting fanotify and inotify. A race condition can occur during concurrent updates to event marks, where the object mask becomes stale. This can lead to a denial of service or in…
CVE-2026-89594Medium· 5.5⚖ disputedkernel: hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device (CVE-2026-89594)
A flaw was found in the Linux kernel's OMAP SSI driver. The driver uses a synthetic HSI controller device that does not properly initialize its Direct Memory Access (DMA) mask. This oversight can lead to the driver crashing or triggering w…
CVE-2026-89593High· 7.1hugetlb: only adjust reservation during unmapping if mapcount is 0
In the Linux kernel, the following vulnerability has been resolved: hugetlb: only adjust reservation during unmapping if mapcount is 0 Since df7a6d1f6405, __unmap_hugepage_range can adjust reservations. In the case of folio mapped in …
CVE-2026-89587High· 7.0kernel: ACPI: pfr_update: fix stack buffer overflow in query_capability() (CVE-2026-89587)
A flaw was found in the Linux kernel's ACPI Platform Firmware Runtime Update (pfr_update) component. The `query_capability()` function, responsible for handling ACPI buffer objects from firmware, performs an unchecked memory copy operation…
CVE-2026-89586Medium· 5.5⚖ disputedkernel: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes (CVE-2026-89586)
A flaw was found in the Linux kernel's `libata-scsi` component. This vulnerability occurs when the system attempts to perform Data Set Management (DSM) TRIM operations on storage devices with logical sector sizes exceeding 2048 bytes. Due …
CVE-2026-89585Medium· 5.5⚖ disputedkernel: auxdisplay: charlcd: cancel backlight work on registration failure (CVE-2026-89585)
A flaw was found in the `auxdisplay: charlcd` component of the Linux kernel. This use-after-free vulnerability occurs when the `charlcd_register()` function fails, leading to the `charlcd` object being freed while a delayed work item still…
CVE-2026-89583High· 7.0kernel: Bluetooth: eir: Fix OOB read in eir_get_service_data() (CVE-2026-89583)
A flaw was found in the Linux kernel's Bluetooth subsystem. An out-of-bounds (OOB) read vulnerability exists in the `eir_get_service_data()` function due to incorrect length calculation when parsing Extended Inquiry Response (EIR) advertis…
CVE-2026-89582High· 7.0kernel: bnx2x: fix double free in bnx2x_init_firmware() error path (CVE-2026-89582)
A flaw was found in the `bnx2x` component of the Linux kernel. This flaw occurs due to a double free vulnerability within the `bnx2x_init_firmware()` function's error handling path. Memory pointers are freed without being set to NULL, allo…
CVE-2026-89579Medium· 6.7kernel: bpf: Harden bloom filter sizing and indexing on 32-bit kernels (CVE-2026-89579)
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) component, specifically impacting 32-bit systems. This vulnerability stems from incorrect sizing and indexing of bloom filters, which can lead to out-of-bounds memory acce…
CVE-2026-89576Medium· 5.5kernel: dm-era: fix shadowed superblock leak on take-snap failure (CVE-2026-89576)
A flaw was found in the Linux kernel's device-mapper era (dm-era) component. When a snapshot operation fails, a block of metadata is allocated but not properly freed. This leads to a permanent leak of system resources with each failed atte…
CVE-2026-89575High· 7.0kernel: dm raid1: reserve space for NUL-terminator in build_constructor_string() (CVE-2026-89575)
A flaw was found in the Linux kernel's device mapper (dm-raid1) component. This vulnerability occurs in the `build_constructor_string()` function, where insufficient space is reserved for a NUL-terminator when formatting a string with `spr…
CVE-2026-89573High· 7.8dm array: reject an array block whose value size is not the caller's
In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's array_block_check() can only compare the header against itself, so a block with value_size 4 and m…
CVE-2026-89569High· 7.0kernel: Bluetooth: RFCOMM: serialize security confirmation handling (CVE-2026-89569)
A flaw was found in the Linux kernel's Bluetooth RFCOMM subsystem. This vulnerability arises because the system does not properly manage memory when handling Bluetooth security confirmations. A race condition allows a part of the system to…
CVE-2026-89565Medium· 5.5kernel: ipip: fix skb leak in collect_md mode when metadata_dst allocation fails (CVE-2026-89565)
A flaw was found in the Linux kernel's IP over IP (ipip) tunnel driver. When operating in collect_md mode, the ipip_tunnel_rcv() function fails to free a network packet buffer (skb) if the metadata_dst allocation fails. This oversight lead…
CVE-2026-89563High· 7.0kernel: ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() (CVE-2026-89563)
A flaw was found in the `ip6_tunnel` module of the Linux kernel. Incorrect handling of socket buffers (skb) during headroom reallocation in the `ip6_tnl_xmit()` function can lead to a double-free vulnerability. This occurs when an error pa…
CVE-2026-89562High· 7.8ip6_gre: fix hardware header length for NBMA tunnels
In the Linux kernel, the following vulnerability has been resolved: ip6_gre: fix hardware header length for NBMA tunnels ip6gre_tnl_link_config_route() accumulates the lower device's hardware header length into dev->hard_header_len whe…
CVE-2026-89560High· 8.4In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation Whiteout objects are used in the upper layer of an OverlayFS to indicate that the file with this na…
In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation Whiteout objects are used in the upper layer of an OverlayFS to indicate that the file with this na…
CVE-2026-89559High· 7.0kernel: libnvdimm/labels: Prevent integer overflow in __nd_label_validate() (CVE-2026-89559)
A flaw was found in the Linux kernel's `libnvdimm/labels` component. An integer overflow vulnerability exists in the `__nd_label_validate()` function, where a 32-bit calculation of a namespace index field (`nslot`) can wrap around. This al…