CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- linuxmm/damon/ops-common: putback folios on invalid migrate nidNo score
- linuxsamples/damon/mtier: error out for zero quota goal target valuesNo score
- linuxALSA: usb: Fix UAF at delayed release of MIDI2 EPs5.4 Medium
- linuxALSA: usx2y: bound the hwdep mmap fault offset7.8 High
- linuxALSA: FCP: fix OOB write in fcp_meter_ctl_get()7.8 High
- linuxALSA: us144mkii: re-anchor capture URBs on resubmission7.0 High
- linuxdrm/v3d: Serialize the scheduler timeout handlers5.7 Medium
- linuxperf/core: Fix group leader use-after-free after sibling detach7.8 High
- linuxtracing: Fix race between update_event_fields and, event_define_fields10.0 Critical
- linuxfbdev: bitblit: bound-check glyph index in bit_cursor()7.8 High
- linuxring-buffer: Prevent subbuf order change when resizing is disabled7.8 High
- linuxtracing: Fix NULL pointer dereference in module event cache removalNo score
- linuxmm/huge_memory: fix huge_zero_pfn race7.8 High
- linuxnet: smc: fix splice entry lifetime imbalance in smc_rx_splice8.4 High
- linuxipv6: prevent in6_dev_get() from resurrecting inet6_dev7.8 High
- linuxnet/dibs: Correct freeing of dmb_clientid_arr8.8 High
- linuxnet/x25: fix use-after-free of the socket by its timers9.8 Critical
- linuxnet: devmem: prevent net-iov / page mixing7.8 High
- linuxNTB: ntb_netdev: Preserve RX queue depth on allocation failure7.5 High
- linuxnetfilter: bridge: release template ct on non-IP path7.5 High
- linuxnetfilter: nf_conntrack: defer invalid log until after unlock7.5 High
- linuxnet: atlantic: free stranded TX buffers on ring deinit10.0 Critical
- linuxnet: atlantic: free RX pages of consumed but not refilled buffers6.7 Medium
- linuxnet/sched: act_ct: fix sk_buff leak when the header checks reject a packet7.5 High
- linuxnet/sched: act_gact, act_police: range check the fallback control action6.8 Medium
- linuxovl: don't warn when the mount is completed from another user namespace6.8 Medium
- linuxbinfmt_misc: don't warn when the mount is completed from another user namespace6.8 Medium
- linuxdibs: initialise dibs->lock in dibs_dev_alloc()9.8 Critical
- linuxxdp: reject clones that overrun skb_shared_info tailroom9.8 Critical
- linuxvxlan: do not arm the ageing timer on a device that is down8.8 High
- linuxvsock/virtio: read virtqueues under worker locks8.4 High
- linuxvsock/virtio: avoid refilling the RX queue after teardown7.8 High
- linuxveth: fix skb length accounting after XDP frag adjustment10.0 Critical
- linuxtls: rx: restore msg_iter before TLS 1.3 optimistic retry9.8 Critical
- linuxtls: don't leave a full plaintext sk_msg ring unpushed7.8 High
- linuxtipc: read le->link under the node lock in tipc_node_link_down()7.8 High
- linuxsmb: client: Fix use-after-free in cifs_try_adding_channels()9.8 Critical
- linuxKVM: SVM: Serialize accesses to the owner and mirror list with separate lock8.8 High
- linuxeventfs: Fix use-after-free in eventfs_remove_rec()7.8 High
- linuxeventfs: Use children field for rcu head and add memory barriers7.8 High
- linuxRevert "thermal/drivers/hwmon: Cleanup coding style a bit"8.4 High
- linuxptp: ocp: Fix board ID over-read7.1 High
- linuxring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()No score
- linuxring-buffer: Use current_context for safe per-CPU buffer swap7.8 High
- linuxmm/page_table_check: skip special zero mappings5.7 Medium
- linuxmm/ptdump: always stabilise against page table freeing using init_mmNo score
- linuxipv6: fix Route Information option length validation7.5 High
- linuxip6_tunnel: clear skb2->cb[] in ip6ip6_err()9.8 Critical
- linuxfs,fsverity: remove check for fsverity being enabled in setattr_prepare()2.0 Low
- linuxfscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()7.8 High
- Show moreLoading…