CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- linuxmshv_vtl: Check per-CPU register page before mmapNo score
- linuxnet/sched: fix use-after-free in __tcf_action_put()7.8 High
- linuxnet: rds: fix uninitialized trans dereference in CM event handlerNo score
- linuxsctp: revalidate output stream after association connect waitNo score
- linuxspi: imx: fix slab corruption from undersized DMA bounce buffers7.8 High
- linuxtracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields7.8 High
- linuxgpio: shared: fix use-after-free bug when adding shared proxiesNo score
- linuxi2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()No score
- linuxring-buffer: Do not show buffer_meta for CPUs without a bufferNo score
- linuxring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()No score
- linuxring-buffer: Fix false warning in ring_buffer_map_get_reader()No score
- linuxscsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB repliesNo score
- linuxscsi: st: Fix use-after-free race between st_remove() and st_open()7.8 High
- linuxscsi: xen/scsifront: Check for a NULL shadow entry on a backend responseNo score
- linuxscsi: libiscsi: Reject a negative task index from parse_pdu_itt9.8 Critical
- linuxscsi: libiscsi: Validate the ITT reflected in a Reject PDU9.8 Critical
- linuxscsi: libiscsi: Validate the task named by a management response7.5 High
- linuxdrm/amd/display: Fix NULL sink dereference in USB4 bandwidth functionsNo score
- linuxdrm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gprNo score
- linuxdrm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctlNo score
- linuxdrm/amdgpu: keep the eviction fence until the last handle is closed7.0 High
- linuxdrm/exec: don't immediately add prelocked obj to array of locked objsNo score
- linuxdrm/i915/dmc: Add sanity check for DMC load addressNo score
- linuxdrm/xe: Don't transfer shrinker pages for pinned bos on purgeable state changeNo score
- linuxsched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueueNo score
- linuxtracing: Keep the predicate limit separate from program capacity7.8 High
- linuxtracing: Check operator stack capacity before pushing7.1 High
- linuxtracing: Fix crash in print_graph_function_event()No score
- linuxtracing: Fix hist trigger timestamps for buffered eventsNo score
- linuxtcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)No score
- linuxtcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)No score
- linuxcifs: don't update i_size in cifs_do_truncate without a cached handleNo score
- linuxdm-crypt: fix a tiny race condition in crypt_dec_pending7.0 High
- linuxdm-integrity: fix infinite loop on discard with large tag sizeNo score
- linuxmac802154: fix data race and NULL deref on local->assoc_devNo score
- linuxnet/iucv: fix the recvmsg window updateNo score
- linuxxfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_bufNo score
- linuxxfs: fix capability check in xfs8.2 High
- linuxio_uring/cancel: don't spin on local work the task can't runNo score
- linuxselinux: fix BPF token permission checksNo score
- linuxsctp: validate chunk length in the inqueue parserNo score
- linuxpage_pool: keep frag_offset aligned for odd-sized requestsNo score
- linuxs390/ctcm: Prevent XID null dereferenceNo score
- linuxs390/pai: Handle multiple PMU stop callback invocationsNo score
- linuxs390/pci: Fix leak of uninitialized kernel data in SCLP reportNo score
- linuxvsock/virtio: validate packet source for connected sockets7.1 High
- linuxvsock/vmci: validate packet source for connected sockets7.3 High
- linuxipv4: avoid divide by zero in fib_rebalanceNo score
- linuxKVM: x86/mmu: Cope with the SS bit being set in #NPF exit codesNo score
- linuxdrm/amdgpu/userq: actually validate userq BOsNo score
- Show moreLoading…