CVE-2026-74275

A flaw was found in the Linux kernel. A vulnerability exists in the cxlcancelautoattach function where an invalid negative index can be used to access an array. This out-of-bounds memory access could allow a local attacker to cause system instability or a denial of service DoS...

CVE-2026-74273

A flaw was found in the Linux kernel's cxl/region component. A local user could exploit a race condition during the creation and deletion of regions. This could lead to the kernel becoming confused about the state of a region, potentially causing system instability or a denial of service DoS...

CVE-2026-74272

A flaw was found in the Linux kernel's cxl/region module. Multiple race conditions exist during the deletion of CXL Compute Express Link regions. A local attacker could exploit these race conditions by repeatedly attempting to delete a region via the sysfs interface or by racing with kernel...

CVE-2026-74283

A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC version 2 component. This vulnerability allows a local unprivileged attacker to bypass administrative permission checks when performing network link operations. Consequently, the attacker can modify critical TIPC...

CVE-2026-20319

creationtimestamp| type| source ---|---|--- 2026-08-20 14:25:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtjh6z3l4k26 2026-08-24 16:45:29+00:00| seen| https://www.cert.dk/news/2026-08-24/Cisco-lapper-seks-kritiske-saarbaarheder-med-maksimal-CVSS-score...

CVE-2026-74267

A flaw was found in the Linux kernel's schcodel Controlled Delay component, which manages network packet queues. When schcodel processes packets, it can incorrectly reduce the queue's size before it is properly updated. This error can lead to the premature deactivation of a parent queue, such as...

CVE-2026-74266

A flaw was found in the Linux kernel's schdualpi2 network scheduler. When the scheduler processes network packets, it can incorrectly manage its internal queue length. This mismanagement can lead to a system crash, making the system unavailable Denial of Service...

CVE-2026-72389

A flaw was found in the Linux kernel's bridge Spanning Tree Protocol STP module. A missing check in the brtopologychangedetection function allows a topology change timer to be armed while a bridge is administratively down. This can be exploited by an attacker to trigger a use-after-free...

CVE-2026-74269

A flaw was found in the bnxt driver, a component of the Linux kernel responsible for network card operations. This vulnerability involves a memory corruption issue that occurs during specific network data processing XDP head-grow operations. An underflow in the driver's code can lead to incorrect...

CVE-2026-66609

creationtimestamp| type| source ---|---|--- 2026-08-20 13:30:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtje4cvrcx2e 2026-08-20 14:08:11+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtjgagqgjv2m...

OESA-2026-3455 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: xfs: remove xfsattrleafhasname The calling convention of xfsattrleafhasname is problematic, because it returns a NULL buffer when xfsattr3leafread fails, a valid...

OESA-2026-3453 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel rfkillblock work in wiphyunregister There is a use-after-free error in cfg80211shutdownallinterfaces found by syzkaller: BUG: KASAN:...

kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice()

A flaw was found in the Linux kernel's nfconntrackh323 helper. A remote attacker could exploit this by sending a specially crafted Q.931 SETUP message to port 1720 through a firewall with the nfconntrackh323 helper active. This memory corruption vulnerability leads to an out-of-bounds read, which...

kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()

A flaw was found in the Linux kernel's drm/amdkfd component. An unprivileged local user can exploit an out-of-bounds write vulnerability in the kfdeventpageset function. This occurs because the function writes data without properly validating the buffer size, allowing a small buffer to trigger a...

kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size

A flaw was found in the Linux kernel's AMD display driver. This vulnerability occurs when the driver processes malformed VBIOS Video Basic Input/Output System data. Specifically, unvalidated register counts in the VBIOS can lead to an out-of-bounds memory write during the driver's initialization...

kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot

A flaw was found in the Linux kernel's Server-Message-Block Direct SMC-D client. A remote attacker can exploit this vulnerability by sending a specially crafted SMC-Dv2 proposal with a Channel Identifier CHID of 0. This malicious proposal can cause a null pointer dereference in the kernel's SMC...

kernel: drm/i915: Fix potential UAF in TTM object purge

A flaw was found in the Linux kernel's Intel i915 graphics driver drm/i915. This use-after-free UAF vulnerability occurs during the TTM object purge operation. An attacker could potentially exploit this to cause a system crash, leading to a denial of service...

kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why&How dcprocessdmubauxtransferasync copies payload-length bytes into a 16-byte stack buffer dpaux.data16 guarded only by an ASSERT, which i...

kernel: smb: client: validate DFS referral PathConsumed

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote attacker could send a specially crafted SMB response containing a malformed Distributed File System DFS referral. This could cause the PathConsumed value to exceed the search name length, leading to an out-of-bounds...

kernel: smb: client: fix query_info() replay double-free

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a double-free error, occurs when the queryinfo replay mechanism attempts to free a response buffer that has already been released. This can happen if an error occurs during the initialization of an SMB2...