CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- linuxnet: macb: fix NULL pointer dereference on unbind with fixed-linkNo score
- linuxbpf: Reject non-scalar bpf_loop iteration countsNo score
- linuxALSA: caiaq: Decoupling ep1_in_urb in caiaq devNo score
- linuxerofs: delimit inode_share cache key componentsNo score
- linuxiommu/riscv: Serialize command queue publishingNo score
- linuxiommu/amd: Do not reallocate GA log buffers on resumeNo score
- linuxiommu/amd: Fix ineffective error check in nested domain allocation7.8 High
- linuxhwmon: (ltc4282) Make sure clk_init_data is fully initializedNo score
- linuxhwmon: Fix potential UAF in pec_storeNo score
- linuxnetfilter: nfnetlink_log: cope with concurrent instance destructionNo score
- linuxvirtio_ring: fix stale descriptor flags after a failed packed add5.7 Medium
- linuxvirtio: fix use-after-free in unregister_virtio_device()No score
- linuxvirtio_console: do not free control-out buffers on removeNo score
- linuxvhost/vdpa: reject VRING_NUM larger than device maxNo score
- linuxvhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctxNo score
- linuxvhost-vdpa: protect config_ctx from being freed under the config callbackNo score
- linuxvdpa_sim_blk: reject out-of-range sector starts7.8 High
- linuxvdpa_sim_net: check TX pull result before RX copy7.5 High
- linuxvduse: validate virtqueue alignmentNo score
- linuxvhost: invalidate vring access on IOTLB transitions8.4 High
- linuxvirtio_input: reset device if input_register_device() failsNo score
- linuxvirtio_input: stop callbacks before unregistering input deviceNo score
- linuxaf_unix: Update last skb marker in manage_oob().6.8 Medium
- linuxnet: ipv6: Fix UDP length overflow with PMTU discover and big MTU4.8 Medium
- linuxvduse: return compat ioctl results directlyNo score
- linuxnet: ethernet: cortina: Fix budget accountingNo score
- linuxnet: ethernet: cortina: Count dropped frames as NAPI workNo score
- linuxs390/debug: Fix NULL pointer dereference in debug_set_level()No score
- linuxice: add missing xa_destroy for sched_node_idsNo score
- linuxeth: ice: don't dereference pointers from TP_printk()No score
- linuxBluetooth: btusb: Fix UAF of btusb_data by rx_workNo score
- linuxBluetooth: btintel_pcie: validate packet_len before skb_put_dataNo score
- linuxBluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()5.6 Medium
- linuxipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()No score
- linuxnet: macb: destroy the phylink instance on the probe error pathNo score
- linuxnet: macb: put the "mdio" child node reference on successNo score
- linuxnstree: check listing permission before taking a namespace reference7.8 High
- linuxwatchdog: msc313e: Avoid division by zeroNo score
- linuxwatchdog: msc313e: Fix clock leak and spurious timer in settimeout()No score
- linuxhwmon: (corsair-cpro) Create debugfs entries after hwmon registrationNo score
- linuxhwmon: (corsair-cpro) Remove debugfs entries when probe failsNo score
- linuxocteontx2-pf: reset HTB scheduler topology before freeing queuesNo score
- linuxvxlan: initialize _md in vxlan_xmit_one()4.8 Medium
- linuxppp_synctty: ensure a writeable skb headerNo score
- linuxnet: stmmac: initialize ptp_lock at probe timeNo score
- linuxnet/mlx5e: Move representor vnic reporter to eswitch devlink portNo score
- linuxperf/core: Allow list_del during perf_event_overflow()No score
- linuxperf/x86/intel: Prevent drain_pebs() reentry7.3 High
- linuxnet/sched: cls_route: free emptied bucket on filter moveNo score
- linuxnet/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().No score
- Show moreLoading…