Tagged “cve.org”
CVEs tagged cve.org, newest first.
20118 CVEsRSS
CVE-2026-89520High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: sched/core: Make core-sched flips wait for in-flight selections Core scheduling's pick_next_task() operates on all sibling rqs under one acquisition of the shared core…
In the Linux kernel, the following vulnerability has been resolved: sched/core: Make core-sched flips wait for in-flight selections Core scheduling's pick_next_task() operates on all sibling rqs under one acquisition of the shared core…
CVE-2026-89513Medium· 5.5kernel: RISC-V: KVM: Fix PMU event info array size overflow (CVE-2026-89513)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) component for RISC-V architectures. A malicious guest operating system could exploit an integer overflow vulnerability by providing a crafted number of Performance M…
CVE-2026-89507Medium· 5.5⚖ disputedkernel: RDMA/ucma: Lock the handler in ucma_write_cm_event() (CVE-2026-89507)
A flaw was found in the Linux kernel's RDMA/ucma component. A race condition exists in the `ucma_write_cm_event()` function where it re-reads a critical file pointer multiple times without proper locking. This allows another function, `ucm…
CVE-2026-89503High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() ring_buffer_alloc_read_page() is racy with ring_buffer_subbuf_order_set, it can allocate a reade…
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() ring_buffer_alloc_read_page() is racy with ring_buffer_subbuf_order_set, it can allocate a reade…
CVE-2026-89501High· 7.0kernel: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf (CVE-2026-89501)
A flaw was found in the Linux kernel's ring-buffer component. A race condition occurs when resizing a sub-buffer without properly holding the `cpu_buffer::lock`. This oversight can lead to concurrency issues with memory allocation and deal…
CVE-2026-89500High· 7.8In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page Discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuf_order …
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page Discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuf_order …
CVE-2026-89499Medium· 5.5⚖ disputedkernel: ring-buffer: Stop remote reader update when page swap fails (CVE-2026-89499)
A flaw was found in the Linux kernel's ring-buffer component. When a remote reader update fails during a page swap, the system incorrectly proceeds as if the swap succeeded. This can lead to log flooding, potentially causing a denial of se…
CVE-2026-89492Critical· 9.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and signature of an indexed-dire…
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and signature of an indexed-dire…
CVE-2026-89486Medium· 5.5⚖ disputedkernel: ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() (CVE-2026-89486)
A flaw was found in the Linux kernel's Intelligent Platform Management Interface (IPMI) subsystem. Due to incorrect synchronization during the deallocation of command receiver objects, a use-after-free vulnerability can occur. This allows …
CVE-2026-89472Medium· 5.5⚖ disputedkernel: power: supply: charger-manager: register regulators before exposing sysfs (CVE-2026-89472)
A flaw was found in the Linux kernel's power supply charger-manager component. A race condition exists where the system frees charger regulators before their corresponding sysfs entries are unregistered. A local attacker can exploit this b…
CVE-2026-89459Medium· 5.5⚖ disputedkernel: s390/percpu: Fix MVIY_PERCPU() with older binutils (CVE-2026-89459)
A flaw was found in the Linux kernel's s390/percpu component. This vulnerability arises when the kernel is compiled with older versions of GNU as (prior to binutils 2.39). A parsing error prevents a crucial instruction from being correctly…
CVE-2026-89452High· 8.4⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: iommu/msm: Unwind probe state on registration failure msm_iommu_probe() adds its devm-managed IOMMU object to qcom_iommu_devices before adding the IOMMU sysfs device a…
In the Linux kernel, the following vulnerability has been resolved: iommu/msm: Unwind probe state on registration failure msm_iommu_probe() adds its devm-managed IOMMU object to qcom_iommu_devices before adding the IOMMU sysfs device a…
CVE-2026-89450High· 7.8kernel: iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field (CVE-2026-89450)
A flaw was found in the Linux kernel's iommu/tegra241-cmdqv module. A Virtual Machine Manager (VMM) can exploit this vulnerability by providing a virtual Stream ID (vSID) that exceeds the intended 20-bit width of the SID_MATCH field. This …
CVE-2026-89445High· 8.8In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGER_IOPF borrows an attach handle from group->pasid_array without synchronizing against PASID detach, …
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGER_IOPF borrows an attach handle from group->pasid_array without synchronizing against PASID detach, …
CVE-2026-89441High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: cancel card-detect work on remove Disabling the device interrupt and freeing the IRQ prevents new card-detect work from being queued, but carddet_work …
In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: cancel card-detect work on remove Disabling the device interrupt and freeing the IRQ prevents new card-detect work from being queued, but carddet_work …
CVE-2026-89436Medium· 5.5⚖ disputedkernel: platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[] (CVE-2026-89436)
A flaw was found in the Linux kernel's `panasonic-laptop` driver. This vulnerability involves an out-of-bounds write when processing ACPI SINF packages, where a small amount of data is written beyond the intended memory buffer. This can le…
CVE-2026-81016High· 7.7⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Propagate SMU errors and validate S2D address amd_stb_s2d_init() discards the return value of several S2D SMU commands. When the SMU refuses a co…
In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Propagate SMU errors and validate S2D address amd_stb_s2d_init() discards the return value of several S2D SMU commands. When the SMU refuses a co…
CVE-2026-81015High· 7.8In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails amd_pmc_probe() registers the LPS0 s2idle handler with acpi_register_lps0_dev() and creates the dr…
In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails amd_pmc_probe() registers the LPS0 s2idle handler with acpi_register_lps0_dev() and creates the dr…
CVE-2026-81006Medium· 5.5⚖ disputedkernel: ipmi: Remove all sysfs files on registration failure (CVE-2026-81006)
A flaw was found in the Linux kernel's Intelligent Platform Management Interface (IPMI) component. During the registration of an IPMI system management interface, an error in the cleanup process can leave a system file (sysfs attribute) re…
CVE-2026-89635Medium· 5.5⚖ disputedkernel: ksmbd: only rebind the reopened file's own oplock on durable reconnect (CVE-2026-89635)
A flaw was found in ksmbd, a component of the Linux kernel. An authenticated attacker could exploit a use-after-free vulnerability by manipulating durable handles and oplocks during session reconnection. When two sessions hold durable hand…
CVE-2026-89633High· 8.0⚖ disputedkernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)
A flaw was found in the Linux kernel's Server Message Block (SMB) client. The `coalesce_t2()` function processes server-supplied `DataOffset` fields without proper validation against buffer boundaries. A remote attacker could exploit this …
CVE-2026-89631High· 8.1⚖ disputedkernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631)
A flaw was found in the Linux kernel's Server Message Block (SMB) client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an intege…
CVE-2026-89630High· 7.0⚖ disputedkernel: smb: client: restore the data_offset bound in is_valid_oplock_break() (CVE-2026-89630)
A flaw was found in the Linux kernel's Server Message Block (SMB) client. An incorrect calculation of the `data_offset` bound in the `is_valid_oplock_break()` function can lead to a read overflow. This vulnerability allows a malicious SMB …
CVE-2026-89624High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: HID: universal-pidff: stop the device when force-feedback init fails universal_pidff_probe() starts the device with hid_hw_start() and then, if force-feedback initiali…
In the Linux kernel, the following vulnerability has been resolved: HID: universal-pidff: stop the device when force-feedback init fails universal_pidff_probe() starts the device with hid_hw_start() and then, if force-feedback initiali…
CVE-2026-89622High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcp_i2c_smbus_read() stores the caller-supplied buffer pointer in mcp->rxbuf for the duration of a transfe…
In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcp_i2c_smbus_read() stores the caller-supplied buffer pointer in mcp->rxbuf for the duration of a transfe…
CVE-2026-89620High· 7.0kernel: HID: intel-thc-hid: intel-quickspi: validate report size before copy (CVE-2026-89620)
A flaw was found in the Linux kernel's HID Intel QuickSPI driver. A local attacker can exploit a heap buffer overflow by providing a specially crafted report through a `hidraw SET_REPORT/SET_FEATURE ioctl`. This allows the attacker to over…
CVE-2026-89619High· 7.0kernel: HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer (CVE-2026-89619)
A flaw was found in the Linux kernel, specifically within the `intel-quickspi` driver. This vulnerability allows a malicious Human Interface Device (HID) to send an oversized report, which is then copied into a buffer without proper size v…
CVE-2026-89614Medium· 5.5⚖ disputedkernel: ntfs: bound the free-cluster bitmap scan to the volume (CVE-2026-89614)
A flaw was found in the Linux kernel's NTFS file system driver. This vulnerability occurs because the free-cluster bitmap scan is not properly bounded to the volume size. A specially crafted NTFS image, where the bitmap covers more cluster…
CVE-2026-89613Medium· 5.5⚖ disputedkernel: ntfs: reject invalid empty mapping pairs (CVE-2026-89613)
A flaw was found in the Linux kernel's NTFS filesystem driver. This vulnerability occurs when the driver processes an attribute with empty mapping pairs that have inconsistent highest Virtual Cluster Number (VCN) and size. A local attacker…
CVE-2026-89612Medium· 5.5⚖ disputedkernel: ntfs: reject invalid MFT LCNs from boot sector (CVE-2026-89612)
A flaw was found in the Linux kernel's NTFS filesystem driver. A local attacker could provide a specially crafted NTFS boot sector containing an invalid Master File Table (MFT) Logical Cluster Number (LCN). Due to an integer overflow durin…