CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- linuxmedia: mediatek: vcodec: bound AV1 tile-start copy to the array capacity7.8 High
- linuxmedia: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer7.8 High
- linuxmedia: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity7.8 High
- linuxmedia: v4l2-ctrls: validate HEVC tile counts7.8 High
- linuxmedia: v4l2-ctrls: validate AV1 tile counts7.8 High
- linuxbnxt_en: Don't free the live ring's TPA state on queue restart failureNo score
- linuxbnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()8.1 High
- linuxbnxt_en: Propagate RX ring init failures in bnxt_init_nic()No score
- linuxbnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()No score
- linuxbnxt_en: Bound SW TPA IDs to prevent crashes8.1 High
- linuxbnxt_en: Prevent queue stop with deferred completionsNo score
- linuxmptcp: syncookies: remember the request backup flagNo score
- linuxmptcp: prevent race between disconnect() and rtx5.8 Medium
- linuxmptcp: pm: kernel: drop pending ADD_ADDR when removing ID04.8 Medium
- linuxsmb: client: reject short READ responses in CIFSSMBRead()7.1 High
- linuxsmb: client: reject userspace cifs.idmap descriptions8.5 High
- linuxsmb: client: reject out-of-bounds DataOffset in CIFSSMBRead()6.0 Medium
- linuxsmb: client: pin DFS superblock in iterator callback7.5 High
- linuxsmb: client: honor forceuid/forcegid when mapping SIDs to uid/gid5.3 Medium
- linuxsmb: client: fix one-byte OOB read in smb2_parse_native_symlink()No score
- linuxsmb: client: fail DACL rewrite when the new DACL exceeds 64K2.0 Low
- linuxsmb: client: fix cifsFileInfo reference leak in deferred close5.7 Medium
- linuxsmb: client: avoid leaking refcount in cifs_queue_oplock_break()7.5 High
- linuxsmb: client: avoid leaking refcount when cifs_sb_tlink() failsNo score
- linuxsmb: client: fix heap overflow in DACL owner/group rewrite8.8 High
- linuxsmb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()2.3 Low
- linuxxfs: lock the healthmon when inserting unmount eventNo score
- linuxxfs: initialise error in xfs_defer_finish_one()No score
- linuxxfs: initialise args->total for parent pointer updatesNo score
- linuxxfs: fix unit conversions in per_binval computationNo score
- linuxxfs: fix under-reservation of blocks when repairing sf directoriesNo score
- linuxxfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions7.8 High
- linuxxfs: fix exchange-range reflink flag clearing issue with INO1_WRITTENNo score
- linuxxfs: don't spin forever on zero-length dirents when salvaging themNo score
- linuxxfs: don't leak new_bp if xfs_btree_bload_drop_buf failsNo score
- linuxxfs: don't leak dqacct if rhashtable insertion failsNo score
- linuxxfs: destroy seen inode bitmap when we fail to add a dirpathNo score
- linuxxfs: bail out on bitmap errors in xrep_agfl_fillNo score
- linuxwifi: ath9k_htc: don't store usb_device_idNo score
- linuxnet: usb: pegasus: don't rely on id table pointer arithmeticNo score
- linuxusb: xusbatm: don't rely on id table pointer arithmeticNo score
- linuxhwmon: (asus_rog_ryujin) Validate HID report lengthsNo score
- linuxscsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap lockingNo score
- linuxscsi: qla2xxx: Fix use-after-free of qpair work on queue teardown7.5 High
- linuxscsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap sizeNo score
- linuxf2fs: accurately adjust free_sections during free_segment_rangeNo score
- linuxx86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAFNo score
- linuxscsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error pathNo score
- linuxscsi: qla2xxx: Skip vport under deletion in report ID acquisition7.5 High
- linuxscsi: qla2xxx: Fix soft lockup polling continuation IOCB signature7.1 High
- Show moreLoading…