CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- linuxBluetooth: btrtl: Don't leak return code when parsing firmware format v2No score
- linuxbootconfig: Fix integer overflow in initrd size check7.1 High
- linuxcpufreq: zero-initialize policy cpumask before sysfs publicationNo score
- linuxcpufreq: initialize policy rwsem before sysfs publicationNo score
- linuxexit: hold a reference to thread_pid across proc_flush_pid7.8 High
- linuxfs: don't return -EINVAL for successful nested thawNo score
- linuxgenetlink: pin family module during policy dump9.8 Critical
- linuxdrm/drm_exec: fix up contended obj when num_objects is 0No score
- linuxdrm/i915: Fix memory leak in query_perf_config_list()No score
- linuxdrm/rockchip: analogix_dp: fix unchecked bound endpoint name lengthNo score
- linuxdrm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batchesNo score
- linuxio_uring/rw: end write accounting from ->ki_completeNo score
- linuxring-buffer: Check resize_disabled before publishing the new subbuf orderNo score
- linuxnet/sched: act_api: release all action references on NEWACTION failureNo score
- linuxnet: bridge: use option bits for CFM/MRP frame handlers7.3 High
- linuxnet: dsa: tag_brcm: legacy FCS: request needed tailroomNo score
- linuxnet: mana: Reserve extra CQ slot for the fence completion CQENo score
- linuxnet: mpls: clear inner_protocol when the last label is popped7.8 High
- linuxnet: openvswitch: fix use-after-free of the flow table mask array7.8 High
- linuxnetfs: Fix uninitialized return value in netfs_unbuffered_write()No score
- linuxnetfilter: cttimeout: prevent UAF during module unload7.0 High
- linuxnetfilter: nf_log: unregister loggers before per-net teardown7.0 High
- linuxvdpa: ifcvf: Put device on unsupported feature errorNo score
- linuxfs: autofs: fix memory leak in autofs_fill_super()No score
- linuxerofs: preserve LZMA decoders on resize failureNo score
- linuxfbdev: vfb: defer cleanup until the last referenceNo score
- linuxidpf: disable DIM work before freeing q_vectors7.1 High
- linuxinet: frags: invalidate queues before flushing them7.8 High
- linuxieee802154: 6lowpan: fix NULL dereference in lowpan_newlinkNo score
- linuxieee802154: cc2520: fix FIFOP work use-after-freeNo score
- linuxieee802154: hwsim: serialize pib updates to fix double-freeNo score
- linuxipv4: fib: bound automatic table ID allocationNo score
- linuxipv6: flowlabel: cap duplicate leases per socket6.8 Medium
- linuxipvs: reject invalid states in connection template sync recordsNo score
- linuxmac802154: fix use-after-free of sdata via queued RX frames7.5 High
- linuxlandlock: Fix use-after-free of the source's parent directory7.8 High
- linuxiommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFXNo score
- linuxs390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithmNo score
- linuxs390/crypto: Fix handling of EBUSY in PHMAC when req is pushed to crypto engineNo score
- linuxs390/crypto: Fix missing scrub of temp buffers with PAES algorithmNo score
- linuxs390/crypto: Fix wrong return code to engine in asynch callbacks7.0 High
- linuxs390/crypto: Map EBUSY to EIO when key conversion fails repeatedlyNo score
- linuxperf: RISC-V: store available counter mask as bitmapNo score
- linuxafs: Fix missing kunmap in afs_dir_search_bucket()No score
- linuxafs: Fix double-unmap of directory blockNo score
- linuxafs: Fix incorrect free in candidate cleanup in afs_lookup_server()7.8 High
- linuxafs: Clear stale peer app data after address list changes7.5 High
- linuxhwmon: (gpio-fan) Fix use-after-free in alarm workNo score
- linuxmedia: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity7.1 High
- linuxmedia: rkvdec: bound HEVC tile loops and PPS id to the array capacity7.8 High
- Show moreLoading…