CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- linux, linux kernel +1 morebpf: Mark syscall helpers as sleepable5.5 Medium
- linuxring-buffer: Add checking nr_subbufs to persistent ring buffer validationNo score
- linuxnvme: remove stale namespaces by NSID range during scan7.5 High
- linuxASoC: Intel: avs: Clean up the bus when fetching ML caps failsNo score
- linux, linux kernel +1 moreASoC: Intel: avs: Fix unbalanced module reference count5.5 Medium
- linux, linux kernel +1 moreASoC: Intel: avs: Refactor and fix init_config access5.5 Medium
- linux, linux kernel +1 morenet: bcmasp: clear txcb->last before writing each descriptor7.8 High
- linux, linux kernel +1 morenet: bcmasp: fix tx_spb_ring_full() checking same slot cnt times5.5 Medium
- linux, linux kernel +1 moremlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context7.5 High
- linux, linux kernel +1 morebpf: zero extend the result of an arena 32-bit cmpxchg5.5 Medium
- linuxbpf: don't rewrite bpf_fastcall patterns entered by a jumpNo score
- linuxbpf: Check ancestor frames for rbtree callbacksNo score
- linuxbpf: Mark bpf_btf_find_by_name_kind() as sleepableNo score
- linuxbpf: Mark faultable stack helpers as sleepableNo score
- linuxbpf: Reject legacy packet loads from callbacks4.6 Medium
- linuxbpf: Don't infer non-NULL from a pointer with an unbounded offset6.8 Medium
- linuxbpf: Don't resurrect a scalar id dropped by collect_linked_regs()No score
- linuxbpf: Don't predict JMP32 pointer vs zero comparisons7.0 High
- linuxbpf: Mark the zero register precise for a register-form NULL checkNo score
- linuxbpf: Require MEM_PERCPU for percpu kptr storesNo score
- linuxbpf: Keep refcount_acquire nullable for borrowed RCU kptrs6.7 Medium
- linuxbpf: Reject untrusted allocated-object pointersNo score
- linuxbpf: Preserve special fields in recycled rhtab elementsNo score
- linuxbpf: Cancel special fields when recycling rhtab elementsNo score
- linuxbpf: Mark NULL kptr stores precise8.5 High
- linuxbpf: Preserve inner map identity in callback frames7.1 High
- linuxtracing: Fix subbuf resize races with trace_pipe_raw readersNo score
- linuxnexthop: Initialize extack in remove_nh_grp_entry()No score
- linuxnet: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size7.0 High
- linuxeth: nfp: bound the ntuple rule dump by the caller's buffer size7.0 High
- linuxeth: nfp: drop the replaced rule from the list when reprogramming failsNo score
- linuxnet: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size7.0 High
- linuxnet: bridge: mcast: properly convert mglist to rcu5.8 Medium
- linuxnet: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflowNo score
- linuxs390/ism: folio_put() after errorNo score
- linuxvxlan: reject dynamic fdb entries that reference a nexthop id7.8 High
- linuxnet: cap tx_queue_len at S16_MAX to prevent oversized ring allocationsNo score
- linuxnet: reject oversized tx_queue_len at netlink parse time6.8 Medium
- linuxpds_core: fix cmd_regs access racing BAR unmap on resetNo score
- linuxbpf: mark a NULL call argument precise8.4 High
- linuxnet: mctp: i3c: serialize probe with bus removalNo score
- linuxnet/sched: defer qdisc freeing after failed creation7.8 High
- linuxnet/mlx5e: Fix use-after-free race in sample_restore_put()No score
- linuxnet/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_putNo score
- linuxnet/mlx5: E-Switch, prevent mc_list repopulation during vport disableNo score
- linuxnet/sched: fq_pie: clamp quantum in change pathNo score
- linuxnet/sched: sfq: clamp quantum in change pathNo score
- linuxnet/sched: hhf: clamp quantum in change and init pathsNo score
- linuxnet/sched: drr: clamp quantum in change classNo score
- linuxnet/sched: ets: clamp quantum in parse and fallback pathsNo score
- Show moreLoading…