CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- linuxnet: hinic: fix mailbox segment buffer overflow8.8 High
- linuxnet: net_failover: Fix the deadlock in net_failover_slave_name_change()No score
- linuxnet: mana: restore the XDP program pointer when pre-allocation failsNo score
- linuxnet/rds: fix tcp stream corruption with large pagesNo score
- linuxnet: stmmac: fix TX descriptor availability check for TSO traffic7.0 High
- linuxsunvdc: unmap LDC cookies when the descriptor send failsNo score
- linuxscsi: target: iscsi: Fix hang for aborted WRITE_PENDING commandsNo score
- linuxconfigfs: pin the symlink target's dirent instead of chasing ->ci_dentryNo score
- linuxconfigfs: unhash the dentry before dropping the item in rmdirNo score
- linuxpowerpc/eeh: Fix recursive locking on devices without EEH sensitive driverNo score
- linuxx86/amd_node: Fix potential NULL pointer dereferenceNo score
- linuxx86/amd_node: Fix PCI device reference counting in amd_smn_init()No score
- linuxx86/mm: Fix user-space data loss with MADV_FREE and THPNo score
- linuxx86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()No score
- linuxx86/mm/pat: Acquire init_mm write lock on collapse to avoid UAFNo score
- linuxx86/alternatives: Exclude text poking against change_page_attr()No score
- linuxmm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race7.8 High
- linuxipv6: fix fib6 walker UAF on seq stop7.8 High
- linuxipmr: account multicast table and route memory6.8 Medium
- linuxreboot: fix cad_pid use-after-free raceNo score
- linuxftrace: fork: Initialize function graph state before copy_exec_state()7.8 High
- linuxtracing: Fix memory corruption from the histogram stacktrace modifierNo score
- linuxtracing: Set the trace clock before registering the histogram trigger9.8 Critical
- linuxtracing: Fix memory corruption from a "STACKTRACE" histogram keyNo score
- linuxtracing: Take trace_array reference when opening a tracer options fileNo score
- linuxtracing: Don't dereference trace_event_file in deferred trigger freeNo score
- linuxALSA: us122l: Prevent write upgrades for read mappings7.0 High
- linuxALSA: usbusx2y: fix in04_last array size mismatch with in04_bufNo score
- linuxALSA: usbusx2y: validate URB actual_length in interrupt callback2.4 Low
- linuxdrm/amdgpu: skip the VMID 0 flush for VRAMNo score
- linuxufs: create the root dentry after loading cylinder metadataNo score
- linuxufs: validate cylinder group metadata before caching it7.0 High
- linuxtick/broadcast: Plug clockevents replacement raceNo score
- linuxtracing/user_events: Don't destroy fields when event removal failsNo score
- linuxtracing: Free histogram the var ref when its initialization failsNo score
- linuxtracing: Free histogram var refs regardless of how often they are referencedNo score
- linuxtracing: Free histogram the field rejected for a bad modifierNo score
- linuxtracing: Keep the entry count when the histogram stats allocation failsNo score
- linuxtracing: Take the reference before publishing the named histogram triggerNo score
- linuxtracing: Undo the registration when enabling the histogram trigger failsNo score
- linuxaccel/ivpu: Validate full buffer range in ivpu_to_cpu_addrNo score
- linuxaccel/ivpu: Validate firmware log buffer metadataNo score
- linuxaccel/ivpu: Limit firmware log name prints to field sizeNo score
- linuxaccel: ethosu: Fix ethosu_job_open() return valueNo score
- linuxaccel: ethosu: Ensure cmd stream ends with a stop opNo score
- linuxaccel: ethosu: Ensure SRAM size is 0 on mapping failureNo score
- linuxaccel: ethosu: Ensure SRAM region size matches job7.8 High
- linuxASoC: sprd: validate compress buffer sizes against fixed allocations7.8 High
- linuxASoC: sti: initialize IRQ lock before requesting IRQNo score
- linuxBluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_devNo score
- Show moreLoading…