CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- linuxksmbd: preserve VFS inherited POSIX ACL mask8.1 High
- linuxcifs: validate idmap key payload lengthNo score
- linuxwifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()No score
- linuxBluetooth: RFCOMM: validate skb length in rfcomm_recv_frameNo score
- linuxvhost-scsi: flush backend after device ioctls7.8 High
- linuxscsi: core: Do not block on tag allocation in scsi_eh_lock_door()5.7 Medium
- linuxnetfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state7.8 High
- linuxi2c: smbus: reject oversized block transfers in the common path7.8 High
- linuxnet: appletalk: fix NULL pointer dereference in aarp_send_ddp()No score
- linuxf2fs: embed f2fs_gc_kthread in f2fs_sb_infoNo score
- linuxdrm/pagemap: dma-unmap pages before handling migration errors8.8 High
- termix-ssh termixTermix: Hardcoded default key encrypts all OIDC/WebAuthn users' stored SSH credentials — full offline decryption from a database copy5.5 Medium
- termix-ssh termixTermix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email9.1 Critical
- termix-ssh termixTermix: Cross-User Information Disclosure via Missing Ownership Check in deploy-to-host Endpoint4.3 Medium
- x.org libxiOut-of-bounds read in libXi's XQueryDeviceState()6.5 Medium
- termix-ssh termixTermix: Command injection in SSH key deployment verification6.6 Medium
- termix-ssh termixTermix: Authenticated users can read other users' host status and clear global SSH connections5.4 Medium
- norwegian cruise line door access controlCVE-2026-759077.5 High
- linuxi3c: master: Fix device_register() error pathNo score
- linuxksmbd: fix maximum allowed access checks8.1 High
- linuxwifi: rtw89: fix HE extended capability length checkNo score
- linuxgreybus: audio: bound the topology section sizes against the fetched size8.8 High
- linuxstaging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdownNo score
- linuxstaging: octeon: add missing napi_disable in cvm_oct_rx_shutdownNo score
- linuxRDMA/bnxt_re: Validate udata before executing commands7.8 High
- linuxphy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulatorNo score
- linuxperf/x86/intel/pt: Fix stop/start with no update4.8 Medium
- linuxpinctrl: bcm2835: Don't remove an unregistered GPIO chipNo score
- linuxregulator: tps6594: Fix device node reference leaks in multiphase loopNo score
- linuxremoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3No score
- linuxwifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rateNo score
- linuxbpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insnNo score
- linuxext4: fix circular lock dependency in ext4_ext_migrate5.7 Medium
- linuxext4: skip extra isize expansion during mount to prevent deadlockNo score
- linuxRDMA/core: Fix potential use after free in uverbs_free_dmah()No score
- linuxarm64: RSI: fix field-spanning write warning in attestation token initNo score
- linuxPCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node7.7 High
- linuxRDMA/efa: Fix PBL chunk length computationNo score
- linuxclk: eswin: Zero-initialize stack-allocated clk_init_dataNo score
- linuxmd/raid5-ppl: fix use-after-free in ppl_do_flush()7.8 High
- linuxlocking/lockdep: Fix NULL pointer dereference in __lock_set_class()No score
- linuxpowerpc/xive: propagate IPI init errors to prevent use-after-free7.4 High
- linuxpowerpc/irq: Fix missing r2 clobber in PCREL inline assemblyNo score
- linuxocfs2: do not use make_bad_inode() in ocfs2_read_inode_block_full()No score
- linuxblock: handle nogenerate/noverify properly in fs-integrityNo score
- linuxarm64: hibernate: mask DAIF before restoring hibernated kernelNo score
- linuxbtrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lockNo score
- linuxarm64: entry: Avoid unnecessary local_irq_disable() on kernel exitNo score
- linuxsched/isolation: Defer freeing of cpumask memblock memory to initcallNo score
- linuxocfs2: fix circular locking dependency in ocfs2_init_acl()No score
- Show moreLoading…