116 results · Clear filters · Feed
-
Critical 9.1CVE-2025-10263 Public exploit
Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X…
-
High 7.1CVE-2026-46243 Public exploit
smb: client: reject userspace cifs.spnego descriptions
In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as ke…
-
High 7.8CVE-2026-46242 Public exploit
eventpoll: fix ep_remove struct eventpoll / struct file UAF
In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_…
-
High 7.8
net: skbuff: preserve shared-frag marker during coalescing
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain t…
KEV Oct 28, 2026 -
Critical 9.8CVE-2026-43501 Public exploit
ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps the next segment into ipv6_hdr->daddr, recompresses, t…
-
High 7.8CVE-2026-43499 Public exploit
rtmutex: Use waiter::task instead of current in remove_waiter()
In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when …
-
High 7.8CVE-2026-43074 Public exploit
eventpoll: defer struct eventpoll free to RCU grace period
In the Linux kernel, the following vulnerability has been resolved: eventpoll: defer struct eventpoll free to RCU grace period In certain situations, ep_free() in eventpoll.c will kfree the epi->ep eventpoll struct while it still being used by another concurr…
-
Unscored —CVE-2026-31721 Public exploit
usb: gadget: f_hid: move list and spinlock inits from bind to alloc
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_hid: move list and spinlock inits from bind to alloc There was an issue when you did the following: - setup and bind an hid gadget - open /dev/hidg0 - use the resulting fd in E…
-
Unscored —CVE-2026-31720 Public exploit
usb: gadget: f_uac1_legacy: validate control request size
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_uac1_legacy: validate control request size f_audio_complete() copies req->length bytes into a 4-byte stack variable: u32 data = 0; memcpy(&data, req->buf, req->length); req->le…
-
High 7.8CVE-2026-31694 Public exploit
fuse: reject oversized dirents in page cache
In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuse_add_dirent_to_cache() computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cac…
-
Unscored —CVE-2026-31787 Public exploit
xen/privcmd: fix double free via VMA splitting
In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting privcmd_vm_ops defines .close (privcmd_close), but neither .may_split nor .open. When userspace does a partial munmap() on a privcmd mapping, th…
-
Low 2.0CVE-2025-54505 Public exploit
A transient execution vulnerability within AMD CPUs may allow a local user-privileged attacker to leak data via the flo…
-
Critical 9.8CVE-2026-31402 Public exploit
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses. This size…
-
Unscored —CVE-2026-23398 Public exploit
icmp: fix NULL pointer dereference in icmp_tag_validation()
In the Linux kernel, the following vulnerability has been resolved: icmp: fix NULL pointer dereference in icmp_tag_validation() icmp_tag_validation() unconditionally dereferences the result of rcu_dereference(inet_protos[proto]) without checking for NULL. The…
-
High 7.8CVE-2026-23111 Public exploit
netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() nft_map_catchall_activate() has an inverted element activity check compared to its non-catchall counterpart nft…
-
High 7.8CVE-2026-23004 Public exploit
dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()
In the Linux kernel, the following vulnerability has been resolved: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() syzbot was able to crash the kernel in rt6_uncached_list_flush_dev() in an interesting way [1] Crash happens in list_del_i…
-
High 7.8CVE-2025-40123 Public exploit
bpf: Enforce expected_attach_type for tailcall compatibility
In the Linux kernel, the following vulnerability has been resolved: bpf: Enforce expected_attach_type for tailcall compatibility Yinhao et al. recently reported: Our fuzzer tool discovered an uninitialized pointer issue in the bpf_prog_test_run_xdp() function…
-
High 7.5CVE-2025-38501 Public exploit
ksmbd: limit repeated connections from clients with the same IP
In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit repeated connections from clients with the same IP Repeated connections from clients with the same IP address may exhaust the max connections and prevent other normal client conn…
-
Critical 9.1CVE-2025-27558 Public exploit
IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected A…
-
High 8.8CVE-2025-37947 Public exploit
ksmbd: prevent out-of-bounds stream writes by validating *pos
In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds stream writes by validating *pos ksmbd_vfs_stream_write() did not validate whether the write offset (*pos) was within the bounds of the existing stream data lengt…
-
Unscored —CVE-2025-37928 Public exploit
dm-bufio: don't schedule in atomic context
In the Linux kernel, the following vulnerability has been resolved: dm-bufio: don't schedule in atomic context A BUG was reported as below when CONFIG_DEBUG_ATOMIC_SLEEP and try_verify_in_tasklet are enabled. [ 129.444685][ T934] BUG: sleeping function called…
-
High 8.8CVE-2025-37899 Public exploit
ksmbd: fix use-after-free in session logoff
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in session logoff The sess->user object can currently be in use by another thread, for example if another connection has sent a session setup request to bind to the …
-
Medium 5.7CVE-2024-2193 Public exploit
Speculative Race Condition impacts modern CPU architectures that support speculative execution, also known as GhostRace.
A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative execution (related to Spectre V1) has been disclosed. An unauthenticated attacker can exploit this vulnerability to disclose arbitrary data from the …
-
Medium 5.3CVE-2022-2588 Public exploit
It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the …
-
High 7.0CVE-2023-3640 Public exploit
Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and prefetcht2 instructions being used for the per-cpu entry area mapping to the user space
A possible unauthorized memory access flaw was found in the Linux kernel's cpu_entry_area mapping of X86 CPU data to memory, where a user may guess the location of exception stacks or other important data. Based on the previous CVE-2023-0597, the 'Randomize p…
-
Medium 6.5CVE-2023-3338 Public exploit
Crash due to a null pointer dereference in the dn_nsp_send function
A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol. This issue could allow a remote user to crash the system.
-
Unscored —CVE-2023-0179 Public exploit
A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the le…
-
High 7.8
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities w…
KEV Jun 17, 2025 -
High 8.1CVE-2023-20938 Public exploit
In binder_transaction_buffer_release of binder.c, there is a possible use after free due to improper input validation. …
-
Medium 5.5CVE-2022-4543 Public exploit
A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local att…
-
Unscored —CVE-2021-3864 Public exploit
A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. …
-
Unscored —CVE-2022-29900 Public exploit
Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain mic…
-
Unscored —CVE-2022-20009 Public exploit
In various functions of the USB gadget subsystem, there is a possible out of bounds write due to a missing bounds check…
-
High 7.8
An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This…
KEV Aug 26, 2026 -
Medium 6.5CVE-2022-0001 Public exploit
Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authori…
-
Unscored —CVE-2022-25265 Public exploit
In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approxi…
-
Unscored —CVE-2021-3773 Public exploit
A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for furth…
-
Unscored —CVE-2021-45485 Public exploit
In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of…
-
Unscored —CVE-2020-27815 Public exploit
A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set e…
-
Unscored —CVE-2021-33034 Public exploit
In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-…