Skip to contentLinux Kernel vulnerabilities
- linux, linux kernel +1 morebtrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref()CVE-2026-31666Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenetfilter: nft_ct: fix use-after-free in timeout object destroyCVE-2026-31665Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morexfrm: clear trailing padding in build_polexpire()CVE-2026-31664Fix available5.5 Medium
- linux, linux kernel, red hat enterprise linux 10 +4 more +6 morexfrm: hold dev ref until after transport_finish NF_HOOKCVE-2026-31663Fix available7.8 High
- linux, linux kernel +1 moretipc: fix bc_ackers underflow on duplicate GRP_ACK_MSGCVE-2026-31662Fix available7.5 High
- linux, linux kernel +1 morewifi: brcmsmac: Fix dma_free_coherent() sizeCVE-2026-31661Fix available5.5 Medium
- linux, linux kernel +1 morenfc: pn533: allocate rx skb before consuming bytesCVE-2026-31660Fix available5.5 Medium
- linux, linux kernel +1 morebatman-adv: reject oversized global TT response buffersCVE-2026-31659Fix available9.8 Critical
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenet: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()CVE-2026-31658Fix available5.5 Medium
- linux, linux kernel +1 morebatman-adv: hold claim backbone gateways by referenceCVE-2026-31657Fix available9.8 Critical
- linux, linux kernel +1 moredrm/i915/gt: fix refcount underflow in intel_engine_park_heartbeatCVE-2026-31656Fix available7.8 High
- linux, linux kernel +1 morepmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabledCVE-2026-31655Fix available5.5 Medium
- linux, linux kernel +1 moremm/vma: fix memory leak in __mmap_region()CVE-2026-31654Fix available5.5 Medium
- linux, linux kernel +1 moremm/damon/sysfs: dealloc repeat_call_control if damon_call() failsCVE-2026-31653Fix available5.5 Medium
- linux, linux kernel +1 moremm/damon/stat: deallocate damon_call() failure leaking damon_ctxCVE-2026-31652Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moremmc: vub300: fix NULL-deref on disconnectCVE-2026-31651Fix available5.5 Medium
- linux, linux kernel +1 moremmc: vub300: fix use-after-free on disconnectCVE-2026-31650Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenet: stmmac: fix integer underflow in chain modeCVE-2026-31649Fix available9.8 Critical
- linux, linux kernel +1 moremm: filemap: fix nr_pages calculation overflow in filemap_map_pages()CVE-2026-31648Fix available7.8 High
- linux, linux kernel +1 moreidpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handlingCVE-2026-31647Fix available5.5 Medium
- linux, linux kernel +1 morenet: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()CVE-2026-31646Fix available5.5 Medium
- linux, linux kernel +1 morenet: lan966x: fix page pool leak in error pathsCVE-2026-31645Fix available5.5 Medium
- linux, linux kernel +1 morenet: lan966x: fix use-after-free and leak in lan966x_fdma_reload()CVE-2026-31644Fix available7.8 High
- linux, linux kernel +1 morerxrpc: Fix key parsing memleakCVE-2026-31643Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morerxrpc: Fix call removal to use RCU safe deletionCVE-2026-31642Fix available5.5 Medium
- linux, linux kernel, red hat enterprise linux 10 +4 more +6 morerxrpc: Fix RxGK token loading to check boundsCVE-2026-31641Fix available7.8 High
- linux, linux kernel +1 morerxrpc: Fix use of wrong skb when comparing queued RESP challenge serialCVE-2026-31640Fix available7.5 High
- linux, linux kernel +1 morerxrpc: Fix key reference count leak from call->keyCVE-2026-31639Fix available5.5 Medium
- linux, linux kernel +1 morerxrpc: Only put the call ref if one was acquiredCVE-2026-31638Fix available7.5 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morerxrpc: reject undecryptable rxkad response ticketsCVE-2026-31637Fix available9.8 Critical
- linux, linux kernel +1 morerxrpc: fix RESPONSE authenticator parser OOB readCVE-2026-31636Fix available9.1 Critical
- linux, linux kernel +1 morerxrpc: fix oversized RESPONSE authenticator length checkCVE-2026-31635Public exploitFix available7.5 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morerxrpc: fix reference count leak in rxrpc_server_keyring()CVE-2026-31634Fix available5.5 Medium
- linux, linux kernel +1 morerxrpc: Fix integer overflow in rxgk_verify_response()CVE-2026-31633Fix available9.8 Critical
- linux, linux kernel +1 morerxrpc: Fix leak of rxgk context in rxgk_verify_response()CVE-2026-31632Fix available5.5 Medium
- linux, linux kernel +1 morerxrpc: Fix buffer overread in rxgk_do_verify_authenticator()CVE-2026-31631Fix available8.2 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morerxrpc: proc: size address buffers for %pISpc outputCVE-2026-31630Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morenfc: llcp: add missing return after LLCP_CLOSED checksCVE-2026-31629Fix available8.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morex86/CPU: Fix FPDSS on Zen1CVE-2026-31628Fix available5.5 Medium
- linux, linux kernel +1 morei2c: s3c24xx: check the size of the SMBUS message before using itCVE-2026-31627Fix available7.8 High
- linux, linux kernel +1 morestaging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()CVE-2026-31626Fix available7.1 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreHID: alps: fix NULL pointer dereference in alps_raw_event()CVE-2026-31625Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreHID: core: clamp report_size in s32ton() to avoid undefined shiftCVE-2026-31624Fix available5.5 Medium
- linux, linux kernel +1 morenet: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()CVE-2026-31623Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreNFC: digital: Bounds check NFC-A cascade depth in SDD response handlerCVE-2026-31622Fix available8.8 High
- linux, linux kernel +1 morebnge: return after auxiliary_device_uninit() in error pathCVE-2026-31621Fix available5.5 Medium
- linux, linux kernel +1 moreALSA: usx2y: us144mkii: fix NULL deref on missing interface 0CVE-2026-31620Fix available4.6 Medium
- linux, linux kernel +1 moreALSA: fireworks: bound device-supplied status before string array lookupCVE-2026-31619Fix available5.5 Medium
- linux, linux kernel +1 morefbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFOCVE-2026-31618Fix available5.5 Medium
- linux, linux kernel, red hat enterprise linux 10 +5 more +7 moreusb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()CVE-2026-31617Fix available5.5 Medium
- Show moreLoading…