CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- linuxnetconsole: take target_cleanup_list_lock in drop_netconsole_target()No score
- linuxnvme-fc: Do not cancel requests in io target before it is initialized8.8 High
- linuxBluetooth: L2CAP: validate connectionless PSM lengthNo score
- linuxASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmtNo score
- linuxnet: stmmac: xgmac2: disable RBUE in default RX interrupt mask7.5 High
- linuxsmb: client: fix races in cifsd thread creationNo score
- linuxexfat: fix handling of damaged volume in exfat_create_upcase_table()7.1 High
- linuxvirtio-fs: avoid double-free on failed queue setup8.4 High
- linuxHID: hidpp: fix potential UAF in hidpp_connect_event()7.5 High
- linuxspi: Add NULL check for spi_get_device_id() in spi_get_device_match_data()No score
- linuxtls: reject the combination of TLS and sockmap8.4 High
- linuxdrm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl6.8 Medium
- linuxPCI: iproc: Protect root bus removal with rescan lockNo score
- x.org libxiOut-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes()6.5 Medium
- linuxPCI: altera: Protect root bus removal with rescan lockNo score
- linuxPCI: rockchip: Protect root bus removal with rescan lockNo score
- linuxPCI: mediatek: Protect root bus removal with rescan lockNo score
- linuxPCI: plda: Protect root bus removal with rescan lockNo score
- linuxperf: Fix addr_filter_ranges lifetime7.8 High
- linuxf2fs: validate inline dentry name lengths before conversion7.1 High
- linuxnet: au1000: move free_irq out of the close-time spinlocked sectionNo score
- linuxspi: core: Abort active target transfer on controller suspendNo score
- linuxbtrfs: tree-checker: validate INODE_REF's namelen7.8 High
- linuxksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattrNo score
- termix-ssh termixTermix: Authenticated SSRF via `/homepage/proxy` — No Destination Allowlist7.7 High
- linuxksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handlingNo score
- linuxcachefiles: Fix double fput7.0 High
- linuxdrm/amdgpu: flush pending RCU callbacks on module unloadNo score
- linuxALSA: usb-audio: caiaq: validate EP1 reply lengthsNo score
- linuxwifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphersNo score
- linuxwifi: cfg80211: validate assoc response length before status and IE access8.8 High
- linuxwifi: cfg80211: validate rx/tx MLME callback frame lengths before accessNo score
- linuxwifi: mac80211: ibss: wait for in-flight TX on disconnect6.0 Medium
- linuxwifi: libipw: fix key index receive bound checksNo score
- linuxwifi: rsi: validate beacon length before fixed buffer copyNo score
- linuxsmb/client: zero-initialize stack-allocated cifs_open_info_data7.0 High
- linuxbtrfs: fix use-after-free on reloc root after error in insert_dirty_subvol()No score
- linuxwifi: iwlwifi: mvm: validate sta_id in BA window status notif8.8 High
- linuxbtrfs: fix reloc root cleanup in merge_reloc_roots()7.8 High
- linuxwifi: iwlwifi: mvm: fix an off-by-1 boundary checkNo score
- linuxwifi: iwlwifi: pcie: null RX pointers after free7.0 High
- linuxblk-cgroup: fix leaks and online flag on radix_tree_insert failureNo score
- linuxsmb/client: flush dirty data before punching a hole4.8 Medium
- linuxwifi: iwlwifi: mvm: validate TX_CMD response layout8.8 High
- linuxwifi: iwlwifi: mvm: fix a possible underflow7.7 High
- linuxwifi: iwlwifi: mvm: add a check on the tid coming from the firmware6.0 Medium
- linuxwifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif8.8 High
- linuxwifi: iwlwifi: bound aligned TLV advance in FW parserNo score
- linuxwifi: iwlwifi: acpi: validate WGDS table revision indexNo score
- linuxsmb: client: bound dirent name against end of SMB response in cifs_filldir8.1 High
- Show moreLoading…