en
The Linux kernel project is a global, open-source operating-system kernel initiative managed by the Linux Kernel Organization with Linux Foundation support. It serves as the core layer for many Linux-based systems and distributions, coordinated by a large network of maintainers and contributors.
As of 10/05/2026, Linux recorded 2,176 security vulnerabilities in the last 90 days across 1 products, including 792 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Linux had the most security vulnerabilities in the Linux ecosystem, with 2,176 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-98164KVM: x86/mmu: Check write tracking in all address spaces | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/29/2026 | SeverityUnknown |
CVE-2026-98163cgroup: Avoid iteration of dying tasks with zero refcount | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/26/2026 | SeverityUnknown |
CVE-2026-98162smb/server: fix tree connection leak in smb2_tree_connect() | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98161nvdimm: pmem: keep PREFLUSH before data writes | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98160staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-100079usb: typec: ucsi: unregister debugfs entries on teardown | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-100078wifi: iwlwifi: mei: pass correct argument to function | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-100077drm/msm: Recover HW before retire hung submit | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-100076staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-100075RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityCritical |
CVE-2026-100074bpf: Mark bpf_refcount field as unique | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-100073ext4: fix transaction overflow during writeback | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-100072ACPI: platform: Use acpi_bus_get_primary_device() | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-100071net: hsr: free learned nodes on device setup failure | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-100070netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98159wifi: mt76: mt7921: validate CLC firmware records | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98158ppp_async: drop the errored frame instead of resetting its headroom | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98157EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98156drm/virtio: use the DMA API for resource backing on Xen | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityHigh |
CVE-2026-98155accel/qaic: Address potential out-of-bounds read in resp_worker() | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98154nvme-rdma: fix -EIO cleanup order in queue_rq | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityHigh |
CVE-2026-98153nvme: fix racy access to FDP placement id array | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98152nvmet-rdma: fix queue leak when connect backlog is exceeded | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98151bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98150bpf: Fix BPF_F_CPU validation for sparse CPU IDs | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityHigh |
CVE-2026-98149bpf: Fix percpu map update indexing with sparse CPU IDs | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98148drm/gud: validate GUD_ROTATION_0 is present in supported rotations | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98147printk: Don't WARN on kthread_run failure. | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98146accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98145accel/amdxdna: reject a command chain that carries no commands | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98144accel/amdxdna: put the chained BO when its mapping fails | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98143accel: ethosu: Don't read the U65 rounding mode as a storage mode | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityHigh |
CVE-2026-98142drm/cirrus-qemu: Validate BAR0 size during probe | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98141ntfs: propagate reparse index insertion failure | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98140ntfs: fix kmap_local leak in write_mft_record_nolock() error paths | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98139ntfs: only count successfully cleared runs when freeing clusters | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98138ntfs: do not mark the volume clean in sync_fs when errors were recorded | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98137ntfs: treat any nonzero dio zero-range return as an error | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98136ntfs: bound $AttrDef table walk to the loaded table size | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98135ntfs: reject invalid sectors_per_cluster in the boot sector | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98134bpf: check_cond_jmp_op(): properly infer if register is null | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98133ntfs: leave HasEA flag untouched on setxattr failure | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98132bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98131net: stmmac: fix dma mapping leak in stmmac_tso_xmit() | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98130sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityHigh |
CVE-2026-98129scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add() | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98128scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add() | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98127smb/client: validate new EOF for insert range | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98126smb/client: validate new EOF for zero range | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98125smb/client: fix stale page cache in insert/collapse range | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98124smb/client: invalidate fscache for fallocate range operations | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98123sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98122vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del() | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityHigh |
CVE-2026-98121watchdog: msc313e: Fix NULL pointer dereference in PM callbacks | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98120netfs: Fix subreq ref leak | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98119netfs: break unbuffered write when netfs_alloc_subrequest() fails | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98118netfs: Fix readahead synchronisation issues by loading all folios upfront | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98117cachefiles: Fix potential UAF/KASAN warning | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98116ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityHigh |
CVE-2026-98115ksmbd: safely drain sessions during logoff | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityHigh |
CVE-2026-98114ksmbd: propagate DACL parsing errors | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98113ksmbd: rate limit unmapped SID errors | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98112ksmbd: fix listener task lifetime on netdev events | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityHigh |
CVE-2026-98111Bluetooth: btintel: validate version TLV value lengths | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98110Bluetooth: btintel: bound firmware ID by TLV length | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98109Bluetooth: hci_core: Fix race condition during device registration | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98108Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityHigh |
CVE-2026-98107Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98106drm/pagemap: Prevent double migration of device pages | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98105net: ethernet: oa_tc6: Improve the error recovery | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98104net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98103igmp: convert struct ip_sf_list to RCU | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98102ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src() | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98101ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98099ipv6: mcast: use rcu_assign_pointer() for __rcu list updates | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98098tipc: fix NULL deref in tipc_named_node_up() on empty publication list | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98097tipc: Dont send random pad bytes in RESET/ACTIVATE messages | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98096ipv6: sr: restore network header before routing and forwarding | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityHigh |
CVE-2026-98095af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98094staging: fbtft: make dirty_lock IRQ-safe | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98093ASoC: fsl_micfil: balance mclk enable/disable | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98092ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98091btrfs: detach failed sprout device from transaction update list | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98090btrfs: restore active device pointers after failed sprout | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98089bonding: alb: fix uninitialized transport header access in alb_determine_nd() | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98088scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues() | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98087sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98086ALSA: ump: do not touch legacy_rmidi before it exists | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98085bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98084bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98083btrfs: fix transaction use-after-free in raid stripe insertion | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityHigh |
CVE-2026-98082btrfs: fix the possible bioc_list memory leak during error | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98081btrfs: zoned: finish active block group cleanup if call_zone_finish() fails | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98080btrfs: do not force reloc root creation during qgroup_account_snapshot() | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98079btrfs: zstd: fix lost wakeup when waiting for a workspace | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98078ipvs: fix reversed sequence option serialization | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98077netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98076tracing/probes: Fix use-after-free on field name/type of events with multiple probes | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98075bpf: reject BPF_PSEUDO_FUNC reference to the main program | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CVE-2026-98074bonding: do not clear curr_active_slave prematurely when releasing all slaves | Exploitation statusNot confirmed | FixYes | Affected productLinux | Published09/25/2026 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
