CVE-2026-98167

A flaw was found in the Linux kernel's SMB client. When processing compound encrypted Protocol Data Units PDUs, the client incorrectly validates the length of individual messages within the compound frame. A malicious or compromised SMB server can exploit this flaw by returning truncated sub-PDUs...

CVE-2026-98168

A flaw was found in the Linux kernel's Server Message Block SMB client. In the reparse point query handling logic, the client fails to properly validate response buffer boundaries before accessing data structures. A malicious or compromised SMB server can exploit this by returning a crafted...

CVE-2026-98169

A flaw was found in the Linux kernel's Server Message Block SMB client. This issue leads to information disclosure caused by an out-of-bounds memory read during snapshot enumeration. A malicious SMB server can provide an unexpectedly short response, causing the kernel client to read beyond the...

CVE-2026-98166

A flaw was found in the Linux kernel's DRM TTM Direct Rendering Manager Translation Table Manager subsystem. Due to an improper status check during memory swapout operations, swapped-out buffer resources are not properly untracked, leaving stale pointers referencing freed memory. A local user cou...

CVE-2026-80810

A flaw was found in the Linux kernel. An integer overflow vulnerability in the iouring/rsrc component, specifically within the iovecfillbvec function, can lead to incorrect memory calculations when handling very large memory pages. This error causes the kernel to access memory outside of its...

CVE-2026-80887

A flaw was found in the drm/vmwgfx component of the Linux kernel. An integer overflow vulnerability exists in the vmwshaderdefine function due to improper validation of user-supplied shader window size and offset. When the offset value is close to its maximum, an unsigned addition can wrap around...

CVE-2026-80852

A flaw was found in the Linux kernel's TLS device driver. A local attacker could exploit an out-of-bounds write vulnerability in the tlsappendfrag function when handling TLSTXZEROCOPYRO with spliceSPLICEFMORE operations. This flaw allows an attacker to cause memory corruption, leading to a denial...

CVE-2026-80842

A flaw was found in the Linux kernel's bridge multicast mcast component. A race condition in the handling of a master VLAN's multicast context during teardown can allow a network attacker to trigger a use-after-free vulnerability. This could lead to system instability or a denial of service DoS...

CVE-2026-80850

A flaw was found in the Linux kernel's TCP Authentication Option TCP-AO implementation. An unprivileged local attacker could exploit a race condition when a network device is detached from its Virtual Routing and Forwarding VRF interface. This could lead to a use-after-free vulnerability, causing...

CVE-2026-81003

A flaw was found in the Linux kernel's AFIUCV Advanced Program-to-Program Communication over IUCV network protocol implementation. The afiucvhsrcv function, responsible for receiving frames, does not properly filter incoming frames based on the ingress network device. This oversight allows a loca...

CVE-2026-80878

A flaw was found in the Linux kernel's AFS Andrew File System implementation. This issue occurs when afslookupvolumercu fails to acquire a volume, leading to a resource leak. A local attacker could potentially exploit this flaw to cause a denial of service due to resource exhaustion. Mitigation...

CVE-2026-80837

A flaw was found in the Linux kernel. A race condition exists in the netfilter's nftables subsystem when handling packet path object notifications. This can lead to a use-after-free vulnerability, allowing a local or remote attacker to send specially crafted packets, potentially causing a denial ...

CVE-2026-80841

A flaw was found in the Linux kernel's net/packet component, specifically within the AFPACKET transmission ring. This vulnerability occurs because virtual memory allocated for network packet handling is prematurely released while active network buffers socket kernel buffers, or skbs still hold...

CVE-2026-80780

A flaw was found in the Linux kernel's Human Interface Device HID pidff driver. A remote attacker, by plugging in a specially crafted malicious USB device, can trigger an out-of-bounds write in the hidpidffinitwithquirks function. This occurs because the function fails to validate if the input li...

CVE-2026-80848

A flaw was found in the xfrm: espintcp component of the Linux kernel. A race condition exists during the closure of espintcp sockets, where a memory buffer skb can be freed while still being accessed by another process. This Use-After-Free UAF vulnerability could allow a local attacker to cause...

CVE-2026-80849

A flaw was found in the Linux kernel's TCP Authentication Option TCP-AO implementation. When a network connection using TCP-AO is re-established with a different server, a timing issue can cause the system to attempt to use memory that has already been released. This 'use-after-free' vulnerabilit...

CVE-2026-80840

A flaw was found in the Linux kernel's IPv6 Segment Routing over IPv6 SRv6 implementation. A remote attacker can exploit this vulnerability by sending specially crafted IPv6 packets that are then decapsulated as IPv4 packets. Due to improper handling of data during this process, the system attemp...

CVE-2026-80778

A flaw was found in the Linux kernel. A race condition exists in the futex/pi Fast Userspace Mutexes / Priority Inheritance subsystem. When a private futex key borrows a waiter's memory management mm structure without proper referencing, the attachtopiowner function can accept an owner from a...

CVE-2026-72366

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfscreatewritereq to handle async cache object creation netfscreatewritereq will skip caching if the fscache cookie is disabled, but this is a problem because async cache object creation might not have got far enough...

CVE-2026-90136

A flaw was found in the Linux kernel's AMD HSMP Host System Management Port hardware monitoring hwmon driver. A local user can trigger an issue by attempting to set a negative power cap value. Due to an incorrect conversion of this negative input, a nonsensical, extremely high power limit is sent...