Linux Kernel LPE Router (CVE-2026)

From a low-privilege Linux shell, scores public 2026 kernel LPE modules Copy Fail, badepoll, nftables catch-all, ptrace, PackageKit, etc. and optionally runs the highest-priority eligible module on this session. !/usr/bin/env python3 -- coding: utf-8 -- """Probe Linux kernel LPE candidates 2026 a...

CVE-2026-80728

A flaw was found in the Linux kernel's AMD GPU amdgpu driver. During device teardown, a timing issue can occur where memory used by the driver is released prematurely. This can happen during a device probe failure or rollback. This premature release leads to the driver attempting to write to an...

CVE-2026-98897

A flaw was found in the Linux kernel's ksmbd Kernel Server Message Block daemon. An authenticated remote user can cause a Denial of Service DoS by initiating conflicting file access requests on cached file leases. Because ksmbd holds an internal read lock while waiting for a lease break...

CVE-2026-99081

A flaw was found in the Linux kernel's Broadcom NetXtreme-E bnxten network driver, which can lead to a Denial of Service DoS. When transmitting small network packets that require padding, the driver fails to update the Direct Memory Access DMA mapping length to account for the padded size. As a...

CVE-2026-98900

A flaw was found in the Linux kernel's Xen grant allocation driver. A local user can exploit this vulnerability by submitting an excessively large grant allocation request before the driver validates it against global limits. This flaw allows excessive kernel memory consumption and integer...

CVE-2026-98898

A flaw was found in the Linux kernel's AMD GPU driver. When dynamic power management DPM is disabled, the driver attempts to schedule thermal management tasks on an uninitialized work queue upon receiving an interrupt. A local user could exploit this condition to trigger a kernel crash, resulting...

CVE-2026-80838

A flaw was found in the Linux kernel's Virtual Extensible LAN VXLAN component. During certain network operations, specifically a filtered bulk flush, the system can incorrectly handle remote entries. This can lead to a memory corruption vulnerability where a read-copy update RCU reader attempts t...

CVE-2026-98896

A flaw was found in the Linux kernel's Thunderbolt driver. A race condition can occur when a device hotplug event is processed concurrently with driver removal, resulting in a use-after-free condition where freed memory is accessed. A local user could exploit this flaw to cause a Denial of Servic...

CVE-2026-93237

A flaw was found in the Linux kernel. An incorrect physical memory boundary check on LoongArch systems allows device memory allocations to fall outside the supported virtual memory mapping space. When the kernel attempts to map this out-of-bounds memory, an address wraparound occurs that silently...

CVE-2026-98894

A flaw was found in the AMD GPU driver within the Linux kernel. When handling overflow conditions in the Common Platform Error Record CPER ring buffer, the driver relies on parsed entry sizes from the buffer contents without verifying that the read pointer advances. Corrupt error record data can...

CVE-2026-98895

A flaw was found in the Linux kernel's mlx5 network driver. When destroying a hardware steering table configured with a default miss table, the driver fails to remove the entry from the associated miss table tracking list, leaving behind an invalid pointer. A local privileged user could exploit...

DEBIAN-CVE-2026-99099

In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Fix AMD TLBI Erratum 1718 The processor may fail to invalidate a TLB entry while executing an INVLPGB/TLBSYNC instruction pair. Detect the erratum and apply a software workaround when a microcode fix is not present...

DEBIAN-CVE-2026-99095

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the jobdonework that the render-done interrupt queues, at teardown: vc4irqdisable cancels only...

AZL-111128 CVE-2026-99095 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the jobdonework that the render-done interrupt queues, at teardown: vc4irqdisable cancels only...

DEBIAN-CVE-2026-99093

In the Linux kernel, the following vulnerability has been resolved: mm: don't schedule deferred kernel page table freeing while booting Booting with a boot-time function tracer and a filter, for example ftrace=function ftracefilter=pudfreepmdpage panics on 7.3-rc4 as soon as the tracer starts:...

DEBIAN-CVE-2026-99092

In the Linux kernel, the following vulnerability has been resolved: riscv: patch: fix handling of bpf-jit execmem addresses Commit 8718e5a3090b "riscv: patch: skip fixmap mapping when kernel text is already writable" gated the corekerneltext branch of patchmap on CONFIGSTRICTKERNELRWX, and...

DEBIAN-CVE-2026-99098

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow in inline mode with large tag size In inline mode, dmintegritycheck and dmintegrityinlinerecheck compute the checksum of each block into an on-stack buffer of HASHMAXDIGESTSIZE bytes...

DEBIAN-CVE-2026-99096

In the Linux kernel, the following vulnerability has been resolved: iouring/register: don't exempt disabled rings from task restrictions A ring created with IORINGSETUPRDISABLED is exempt from its register restrictions until it is enabled. This lets the creator register the restrictions and then...

DEBIAN-CVE-2026-99097

In the Linux kernel, the following vulnerability has been resolved: tee: shm: reject zero-sized allocations in teedynshmallochelper teedynshmallochelper derives nrpages from a caller-supplied size and passes it to allocpagesexact without checking it. For size == 0 nrpages is 0, and allocpagesexac...

DEBIAN-CVE-2026-99094

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix TX descriptor bounds check btintelpciepreparetx uses tfdindex to access the TFD and data buffer arrays before the index is advanced modulo txq-count. An index equal to txq-count is one past the end of...