https://vulnogram.org/ Most recent CVEs assigned by kernel.org (linux). https://vulnogram.org/seaview/icons/linux.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-98868 https://vulnogram.org/CVE-2026-98868 In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject a kset that overruns its segment cache_replay(), the writeback worker and the GC worker read a kset of get_kset_onmedia_size() bytes and advance the position by it.… Sun, 18 Oct 2026 15:51:30 GMT https://vulnogram.org/CVE-2026-98867 https://vulnogram.org/CVE-2026-98867 In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the logical key offset from persistent memory cache_key_decode() takes a key's logical off from the cache device and later indexes req_key_tree->subtrees[] by it in… Sun, 18 Oct 2026 15:51:29 GMT https://vulnogram.org/CVE-2026-98866 https://vulnogram.org/CVE-2026-98866 In the Linux kernel, the following vulnerability has been resolved: sched/cache: Introduce task_struct->sched_cache_grp to fix UAF Add a sched_cache_grp pointer to task_struct so that scheduler code can access the cache group directly via the task, w… Sun, 18 Oct 2026 15:51:27 GMT https://vulnogram.org/CVE-2026-98865 https://vulnogram.org/CVE-2026-98865 In the Linux kernel, the following vulnerability has been resolved: sched_ext: Don't run ops.dequeue() with a DSQ lock held ops.dequeue() is invoked with the source user DSQ's lock still held on the consume and move paths (scx_consume_dispatch_q(), m… Sun, 18 Oct 2026 15:51:26 GMT https://vulnogram.org/CVE-2026-98864 https://vulnogram.org/CVE-2026-98864 In the Linux kernel, the following vulnerability has been resolved: sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task ebf1ccff79c4 ("sched_ext: Fix ops.dequeue() semantics") moved the final ops_state store in scx_dispatch_enqueue()… Sun, 18 Oct 2026 15:51:25 GMT https://vulnogram.org/CVE-2026-98863 https://vulnogram.org/CVE-2026-98863 In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails Re-pend GET_NESTED_STATE_PAGES before exiting to userspace if getting the nested pages fails in the KVM_RUN path.… Sun, 18 Oct 2026 15:51:24 GMT https://vulnogram.org/CVE-2026-98862 https://vulnogram.org/CVE-2026-98862 In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in kill_rules() kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit tree is pruned. It drops entry->rule.exe before removing the rule from… Sun, 18 Oct 2026 15:51:23 GMT https://vulnogram.org/CVE-2026-98861 https://vulnogram.org/CVE-2026-98861 In the Linux kernel, the following vulnerability has been resolved: fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching() unregister_fprobe() and unregister_fprobe_async() (used by BPF kprobe-multi) rely on standard RCU grace periods (sync… Sun, 18 Oct 2026 15:51:22 GMT https://vulnogram.org/CVE-2026-98860 https://vulnogram.org/CVE-2026-98860 In the Linux kernel, the following vulnerability has been resolved: HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request As reported by Sashiko: If a transport driver encounters a hardware error and returns a negative error code such as -E… Sun, 18 Oct 2026 15:51:21 GMT https://vulnogram.org/CVE-2026-98859 https://vulnogram.org/CVE-2026-98859 In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: stop the release timer from being rearmed on remove mt_remove() quiesces the sticky-finger timer before stopping the hardware: timer_delete_sync(&td->release_timer);… Sun, 18 Oct 2026 15:51:20 GMT https://vulnogram.org/CVE-2026-98858 https://vulnogram.org/CVE-2026-98858 In the Linux kernel, the following vulnerability has been resolved: io_uring: fix task_work add use-after-free with SQPOLL For SQPOLL, the sqpoll thread runs task_work off its own list and doesn't need to be told about it, so it can pop and complete… Sun, 18 Oct 2026 15:51:19 GMT https://vulnogram.org/CVE-2026-98857 https://vulnogram.org/CVE-2026-98857 In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for every previously unseen destination address. The table max_size only tells the… Sun, 18 Oct 2026 15:51:17 GMT https://vulnogram.org/CVE-2026-98856 https://vulnogram.org/CVE-2026-98856 In the Linux kernel, the following vulnerability has been resolved: kprobes: Skip disarmed probes when checking optkprobe overlap On x86, an optkprobe at A replaces five bytes with a jump. If a disabled probe B is at A+2, get_optimized_kprobe() stops… Sun, 18 Oct 2026 15:51:12 GMT https://vulnogram.org/CVE-2026-98855 https://vulnogram.org/CVE-2026-98855 In the Linux kernel, the following vulnerability has been resolved: of/overlay: put property on deadprops only after changeset add succeeds add_changeset_property() links a new property of a not-yet-live target node into the node's deadprops list bef… Sun, 18 Oct 2026 15:51:09 GMT https://vulnogram.org/CVE-2026-98854 https://vulnogram.org/CVE-2026-98854 In the Linux kernel, the following vulnerability has been resolved: of/overlay: only treat a positive changeset id as registered of_overlay_fdt_apply() stores the idr_alloc() return value in ovcs->id before checking it. On failure the stored id is ne… Sun, 18 Oct 2026 15:51:06 GMT https://vulnogram.org/CVE-2026-98853 https://vulnogram.org/CVE-2026-98853 In the Linux kernel, the following vulnerability has been resolved: net: gso: limit recursive IP-in-IP segmentation IP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment() for each nested IP header. encap_level tracks header bytes, not cal… Sun, 18 Oct 2026 15:51:02 GMT https://vulnogram.org/CVE-2026-98852 https://vulnogram.org/CVE-2026-98852 In the Linux kernel, the following vulnerability has been resolved: net: extend IPv6 exthdr detection of tunneled packets Commit c4336a07eb6b ("net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback") split skb_gso_has_extension_hdr() into… Sun, 18 Oct 2026 15:50:55 GMT https://vulnogram.org/CVE-2026-98851 https://vulnogram.org/CVE-2026-98851 In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_flow_offload: drop flowtable reference on init error path nft_flow_offload_init() bumps the flowtable use count with nft_use_inc() before calling nf_ct_netns_get(). Wh… Sun, 18 Oct 2026 15:50:50 GMT https://vulnogram.org/CVE-2026-98850 https://vulnogram.org/CVE-2026-98850 In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TX_RING byte count overflow tpacket_snd() drains every SEND_REQUEST frame in a TX ring and adds each valid packet length to the signed int len_sum. Userspace can… Sun, 18 Oct 2026 15:50:50 GMT https://vulnogram.org/CVE-2026-98849 https://vulnogram.org/CVE-2026-98849 In the Linux kernel, the following vulnerability has been resolved: pfcp: fix socket lifetime on netdevice registration failure pfcp_newlink() creates the UDP socket before register_netdevice(). If registration fails after pfcp_dev_init() succeeds, t… Sun, 18 Oct 2026 15:50:48 GMT https://vulnogram.org/CVE-2026-98848 https://vulnogram.org/CVE-2026-98848 In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Assign .num before accessing .hws Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by") annotated the hws member of 'struct clk_hw_onecell_da… Sun, 18 Oct 2026 15:50:47 GMT https://vulnogram.org/CVE-2026-98847 https://vulnogram.org/CVE-2026-98847 In the Linux kernel, the following vulnerability has been resolved: rtc: spear: initialize IRQ state before requesting alarm IRQ devm_request_irq() enables the interrupt before it returns, so the handler may run while probe is still initializing the… Sun, 18 Oct 2026 15:50:40 GMT https://vulnogram.org/CVE-2026-98846 https://vulnogram.org/CVE-2026-98846 In the Linux kernel, the following vulnerability has been resolved: sctp: check RCV_SHUTDOWN after the sendmsg connect wait sctp_wait_for_connect() drops the socket lock while it sleeps. An out-of-the-blue ABORT can then be processed from the socket… Sun, 18 Oct 2026 15:50:34 GMT https://vulnogram.org/CVE-2026-98845 https://vulnogram.org/CVE-2026-98845 In the Linux kernel, the following vulnerability has been resolved: tpm: Disable TPM on null key name mismatch The null key name check exists to protect against TPM reset attacks, so a mismatch should stop the device from serving further requests. Cu… Sun, 18 Oct 2026 15:50:27 GMT https://vulnogram.org/CVE-2026-98844 https://vulnogram.org/CVE-2026-98844 In the Linux kernel, the following vulnerability has been resolved: netfs: clear post-EOF pagecache when extending a file via write Fix netfs to erase the contents of a hole created after the EOF by an ordinary write if dirty data has been previously… Sun, 18 Oct 2026 15:50:25 GMT https://vulnogram.org/CVE-2026-98843 https://vulnogram.org/CVE-2026-98843 In the Linux kernel, the following vulnerability has been resolved: netfs: zero gaps in read-gaps folio to avoid writing back stale data netfs_read_gaps() leaves gaps around a streaming write's dirty region unread on the server side, so a short/EOF r… Sun, 18 Oct 2026 15:50:23 GMT https://vulnogram.org/CVE-2026-98842 https://vulnogram.org/CVE-2026-98842 In the Linux kernel, the following vulnerability has been resolved: module: fix lost error code from codetag_load_module() If codetag_load_module() fails, err is not set to reflect the failure and load_module() returns 0 after the module has been tor… Sun, 18 Oct 2026 15:50:19 GMT https://vulnogram.org/CVE-2026-98841 https://vulnogram.org/CVE-2026-98841 In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driver_data before registering notification handlers Both probe paths register their notification handler before assigning driver_data, which the handler dereferen… Sun, 18 Oct 2026 15:50:15 GMT https://vulnogram.org/CVE-2026-98840 https://vulnogram.org/CVE-2026-98840 In the Linux kernel, the following vulnerability has been resolved: vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF The reload of 'vc' added by commit 8fb9ea65c9d1 ("vc_screen: reload load of struct vc_data pointer in vcs_wri… Sun, 18 Oct 2026 15:50:14 GMT https://vulnogram.org/CVE-2026-98839 https://vulnogram.org/CVE-2026-98839 In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() In paste_selection(), the loop copies min_t(unsigned int, vc_sel.buf_len - pasted,tty->receive_… Sun, 18 Oct 2026 15:50:11 GMT https://vulnogram.org/CVE-2026-98838 https://vulnogram.org/CVE-2026-98838 In the Linux kernel, the following vulnerability has been resolved: vt: skip screen update for DEC alignment test on backgroup consoles [BUG] Recently, we encountered a KASAN warning as follows: BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer… Sun, 18 Oct 2026 15:50:07 GMT https://vulnogram.org/CVE-2026-98837 https://vulnogram.org/CVE-2026-98837 In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: unregister the input device when probe fails setup_card() registers the input device, whose name and phys point into struct snd_usb_caiaqdev, and then goes on to snd_car… Sun, 18 Oct 2026 15:50:05 GMT https://vulnogram.org/CVE-2026-98836 https://vulnogram.org/CVE-2026-98836 In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: reject oversized playback packets Each playback URB is handed a slice of out.buffer that is exactly LINE6_ISO_PACKETS * max_packet_size_out bytes, sized from the OUT end… Sun, 18 Oct 2026 15:49:51 GMT https://vulnogram.org/CVE-2026-98835 https://vulnogram.org/CVE-2026-98835 In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Fix array boundary check The driver performs a sanity check for an array size, when converting a register value to an array index. The check incorrectly ac… Sun, 18 Oct 2026 15:49:48 GMT https://vulnogram.org/CVE-2026-98834 https://vulnogram.org/CVE-2026-98834 In the Linux kernel, the following vulnerability has been resolved: mtd: core: avoid double-free of OTP NVMEM device If factory OTP setup fails after the user OTP NVMEM device has been registered, mtd_otp_nvmem_add() unregisters the user device but l… Sun, 18 Oct 2026 15:49:46 GMT https://vulnogram.org/CVE-2026-98833 https://vulnogram.org/CVE-2026-98833 In the Linux kernel, the following vulnerability has been resolved: mtd: core: call _get_device() with the master MTD __get_mtd_device() calls the master's _get_device() callback with mtd, which may be a partition. __put_mtd_device() passes the maste… Sun, 18 Oct 2026 15:49:42 GMT https://vulnogram.org/CVE-2026-98832 https://vulnogram.org/CVE-2026-98832 In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: save IRQ state in blkg_tryget_closest() bio_set_dev() associates the bio with a blkg through bio_associate_blkg(). If the blkg lookup misses, blkg_tryget_closest() takes… Sun, 18 Oct 2026 15:49:36 GMT https://vulnogram.org/CVE-2026-98831 https://vulnogram.org/CVE-2026-98831 In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails init_overlay_changeset() stores the number of initialized fragments in ovcs->count only on full success. When fin… Sun, 18 Oct 2026 15:49:32 GMT https://vulnogram.org/CVE-2026-98830 https://vulnogram.org/CVE-2026-98830 In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfx_hif_read_mib() copies reply->length bytes from the firmware response into the caller-provided buffer without checking… Sun, 18 Oct 2026 15:49:31 GMT https://vulnogram.org/CVE-2026-98829 https://vulnogram.org/CVE-2026-98829 In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop oversized fragments to avoid extra_len overflow In ieee80211_rx_h_defragment(), fragment payloads are accumulated into entry->extra_len as subsequent fragments a… Sun, 18 Oct 2026 15:49:29 GMT https://vulnogram.org/CVE-2026-98828 https://vulnogram.org/CVE-2026-98828 In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: reject short WMI command responses ath9k_wmi_rsp_callback() removes the validated WMI header and copies the number of bytes expected by the waiting command into its resp… Sun, 18 Oct 2026 15:49:22 GMT https://vulnogram.org/CVE-2026-98827 https://vulnogram.org/CVE-2026-98827 In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE __hif_usb_tx() dequeues up to MAX_TX_AGGR_NUM (20) frames into a single tx_buf of MAX_TX_BUF_SIZE (32768) bytes, limiting the… Sun, 18 Oct 2026 15:49:20 GMT https://vulnogram.org/CVE-2026-98826 https://vulnogram.org/CVE-2026-98826 In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Fix clock provider use-after-free on probe failure ac100_rtc_register_clks() registers the RTC-32k clock with clk_hw_register_fixed_rate() and the clock provider with of_… Sun, 18 Oct 2026 15:49:19 GMT https://vulnogram.org/CVE-2026-98825 https://vulnogram.org/CVE-2026-98825 In the Linux kernel, the following vulnerability has been resolved: rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() devm_clk_get(&pdev->dev, "rtcref")'s return value was passed straight into clk_get_rate() without checking it for an… Sun, 18 Oct 2026 15:49:17 GMT https://vulnogram.org/CVE-2026-98824 https://vulnogram.org/CVE-2026-98824 In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate TX status rate metadata minstrel_ht_tx_status() converts the HT/VHT rate reported in a TX status into a group and rate index and uses those to index the mins… Sun, 18 Oct 2026 15:49:16 GMT https://vulnogram.org/CVE-2026-98823 https://vulnogram.org/CVE-2026-98823 In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: preserve hidden-group beacon IE ownership A hidden-group probe-response entry borrows its beacon IEs from the group's beacon entry. cfg80211_update_assoc_bss_entry()… Sun, 18 Oct 2026 15:49:15 GMT https://vulnogram.org/CVE-2026-98822 https://vulnogram.org/CVE-2026-98822 In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: prevent AP VLAN tx from other interfaces Since the station lookup was factored out of ieee80211_build_hdr(), ieee80211_lookup_ra_sta() uses sta_info_get_bss() for all… Sun, 18 Oct 2026 15:49:14 GMT https://vulnogram.org/CVE-2026-98821 https://vulnogram.org/CVE-2026-98821 In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCB_HAS_METADATA leaves iocb->private as a uio_meta, while iocb_bio_iopoll() expects a bio. Since 2729a60bbfb9, metadata I/O al… Sun, 18 Oct 2026 15:49:13 GMT https://vulnogram.org/CVE-2026-98820 https://vulnogram.org/CVE-2026-98820 In the Linux kernel, the following vulnerability has been resolved: blk-mq: set RQF_USE_SCHED when the operation is known The cached requests are allocated for one operation but can be handed out for another. A passthrough command has RQF_USE_SCHED c… Sun, 18 Oct 2026 15:49:12 GMT https://vulnogram.org/CVE-2026-98819 https://vulnogram.org/CVE-2026-98819 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, recor… Sun, 18 Oct 2026 15:49:11 GMT