CVE-2026-118485

Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding httpdecode on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f URL-encoded ../ sequences in the URL path. These sequences survive the URL...

CVE-2026-117556

zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in readpreface in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing read...

CVE-2026-117526

A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is the function evalAction of the component Remotedev Server. The manipulation of the argument action results in code injection. The attack is only possible with local access. The exploit has been made publi...

CVE-2026-99191

In the Linux kernel, the following vulnerability has been resolved: calipso: keep BIG TCP payloadlen in calipsoskbuffsetattr calipsoskbuffsetattr adjusts payloadlen by the length of the option it inserts or resizes: payload = ntohsip6hdr-payloadlen; ip6hdr-payloadlen = htonspayload + lendelta; GR...

CVE-2026-99216

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error/exit paths In two places, current code forces vmbusconnection.connstate to DISCONNECTED prior to calling vmbusdisconnect. But vmbusdisconnect calls vmbusinitiateunload, whi...

CVE-2026-99202

In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix SMP IO deadlock during HA resume smpexecutetasksg calls pmruntimegetsync on the host before issuing an SMP command. When that command is itself issued from the HA resume path, the getsync deadlocks: it waits for...

CVE-2026-99203

In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure FSETFL and FIOASYNC decide whether to invoke -fasync before pipefasync takes pipe-mutex. Two enables of one ORDWR FIFO can therefore both enter the callback...

CVE-2026-99204

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: Protect the recovery list during debugfs reads Recovery participant records must remain alive while debugstateprint walks reco.nodedata and formats their fields. The formatter holds dlm-spinlock, but the recovery...

CVE-2026-99205

In the Linux kernel, the following vulnerability has been resolved: sched/core: Call wakeuppreempt for queued tasks during class change Paul reported recent RCU changes exposed a lost resched where CPU idles with a rcutorture thread waiting while being completely runnable. Dumping the rq state at...

CVE-2026-99206

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix race in discovery auth updates Separate configfs opens can concurrently update the discovery AuthMethod parameter. Both callers may free the same value in iscsiupdateparamvalue, causing a double-free...

CVE-2026-99207

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Disable interrupts while holding delayedcmdlock targetdodelayedwork takes dev-delayedcmdlock with a plain spinlock. It runs from systempercpuwq, so interrupts stay enabled while the lock is held. Every other...

CVE-2026-99208

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Zero OA buffer at allocation ttmbotypekernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale kern...

CVE-2026-99209

In the Linux kernel, the following vulnerability has been resolved: drm/xe: skip eviction of a BO with no resource xeevictflags switches on tbo-resource-memtype to choose an eviction placement. An xe BO can reach eviction with no ttm.resource, e.g. an imported dma-buf BO whose resource was freed...

CVE-2026-99210

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: clear rdev on device init failure rocketprobe stores the return value from rocketdeviceinit in the file-scoped rdev pointer before checking whether it is an error pointer. If rocketdeviceinit fails, rdev is left as ...

CVE-2026-99212

In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdmacm destroy an id RDS still owns on route failure rdsrdmacmeventhandlercmn hands the return value of rdmaresolveroute straight back to the rdmacm on RDMACMEVENTADDRRESOLVED. A synchronous failure there -...

CVE-2026-99213

In the Linux kernel, the following vulnerability has been resolved: vsock: treat TCPCLOSING as once-established Handle the TCPESTABLISHED - TCPCLOSING transition on OPRST, which can race with the connect loop. Immediately break and return 0 on ESTABLISHED/CLOSING. The return value of connect shou...

CVE-2026-99215

In the Linux kernel, the following vulnerability has been resolved: power: supply: core: prevent unregistering a power supply while a callback runs Once a power supply is registered, its callbacks can immediately start firing from other contexts, such as externalpowerchanged triggered by the TCPM...

CVE-2026-99186

In the Linux kernel, the following vulnerability has been resolved: x86/insn-eval: Fix shadowed segment index in getsegregoverrideidx Commit 45e1dccc0653 "x86/insn: Simplify foreachinsnprefix" made foreachinsnprefix declare its own loop counter named idx. getsegregoverrideidx keeps its result in ...

CVE-2026-99193

In the Linux kernel, the following vulnerability has been resolved: net: ti: icssm-prueth: Move setting of netops to fix crash icssmpruethnetdevinit calls ofphygetandconnect before ndev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since...

CVE-2026-99194

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: aeroflex: move setting of netops to fix crash grethofprobe calls grethmdioinit, which connects the PHY, before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through...

CVE-2026-99197

In the Linux kernel, the following vulnerability has been resolved: net: mv643xx: move setting of netops to fix crash mv643xxethprobe connects the PHY before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since the commit in question, ...

CVE-2026-99200

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hisifemac: Move setting of netops to fix crash hisifemacdrvprobe connects the PHY before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since the commi...

CVE-2026-99187

In the Linux kernel, the following vulnerability has been resolved: perf: Fix perfpmumigratecontext leaving events behind perfpmuremove walks the group leaders of a CPU and PMU with perfeventgroupsforcpupmu, removing each one as it goes. perfremovefromcontext takes the leader out of the groups...

CVE-2026-99189

In the Linux kernel, the following vulnerability has been resolved: gpio: mxc: fix race between chained IRQ handler install and probe completion mxcupdateirqchainedhandler is called before the IRQ domain, the generic IRQ chip, and the port list entry are set up. If an interrupt arrives in that...

CVE-2026-99192

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: unshare the skb before writing the control block bcmgenet stores firstcb, lastcb and bytessent in the skb control block and reads them back on completion to free the skb and credit BQL. ethersetup leaves...

CVE-2026-99195

In the Linux kernel, the following vulnerability has been resolved: net: ethoc: move setting of netops to fix crash ethocprobe calls ethocmdioprobe, which connects the PHY, before netdev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since...

CVE-2026-99198

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: actions: Move setting of netops to fix crash owlemacprobe calls owlemacphyinit, which connects the PHY, before netdev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through...

CVE-2026-99199

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hip04eth: Move setting of netops to fix crash hip04macprobe calls ofphyconnect before ndev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since the commit ...

CVE-2026-99201

In the Linux kernel, the following vulnerability has been resolved: netlink: avoid hashing the network namespace pointer The netlink rhashtable key includes a raw struct net pointer and a user-controlled port ID. Both /proc/net/netlink and socket diagnostics expose the table's bucket order. By...

CVE-2026-99196

In the Linux kernel, the following vulnerability has been resolved: net: au1000: move setting of netops to fix crash au1000probe calls au1000miiprobe, which connects the PHY, before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since...

CVE-2026-99190

In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix memory leak in gpiodsetarrayvaluecomplex on error paths A drive-by review by Sashiko reports that, after a failed call to gpiochipsetmultiple, gpiodsetarrayvalue returns abruptly, bypassing the freeing of possibly...

CVE-2026-99211

In the Linux kernel, the following vulnerability has been resolved: netlink: reset skb headers before unicast and multicast filtering Socket filters can use SKFNETOFF and SKFLLOFF to read relative to an skb's network and MAC headers. Netlink producers may reserve headroom without resetting those...

CVE-2026-99188

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac1000: clear the RGMII status interrupt Since commit 2e2c878a3141 "net: stmmac: remove SGMII/RGMII/SMII interrupt handling" nothing on the RGMII path reads GMACRGSMIIIS, so RGSMIIIS stays pending behind GMACINTMA...

CVE-2026-99214

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hdmi: Move packet RAM enable to PM runtime Audio can be triggered by the HPD handler and start up before video has been restored, calling vc4hdmiwriteinfoframe for the audio infoframe. vc4hdmiwriteinfoframe needs Packet...

CVE-2026-99156

In the Linux kernel, the following vulnerability has been resolved: scsi: st: Fix use-after-free race between stremove and stopen stremove drops the probe reference on the scsitape with krefput and only afterwards removes its index from stindexidr. If that was the last reference, scsitaperelease...

CVE-2026-99158

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix false warning in ringbuffermapgetreader The mmap reader can warn when it catches up with a writer that is still committing events. rbgetreaderpage returns NULL in this case, but ringbuffermapgetreader treats that...

CVE-2026-99159

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix the sub-buffer array base in rbmetasubbufidx On a persistent ring buffer, rbmetasubbufidx can return an index one sub-buffer too high. rbsetupidsmetapage then fills subbufids shifted by one and leaves subbufids0...

CVE-2026-99160

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not show buffermeta for CPUs without a buffer The percpu/cpuN/buffermeta files are created for every possible CPU, but buffer-bufferscpu is only allocated once that CPU comes online. Reading the file of a CPU that...

CVE-2026-99164

In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e "spi: imx: support dynamic burst length for ECSPI DMA mode", the driver allocates its private DMA TX/RX buffers with kzallocdmalen, where...

CVE-2026-99167

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in tcfactionput tcfactionput decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to...

CVE-2026-99169

In the Linux kernel, the following vulnerability has been resolved: futex: Fix mm reuse handling for FUTOFFMMSHARED A FUTOFFMMSHARED futex is a shared futex that refers to an MM. It is possible for a process to wait on a shared futex with a different MM because a FUTOFFINODE waiter can be requeue...

CVE-2026-99171

In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the "nocase" mount option ntfs3 uses custom hash and dentry compare functions. Both access ntfs3 superblock private information in rcu pathwalk. ntfsputsuper and ntfs3killsb drop the in...

CVE-2026-99173

In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfsinode after an rcu grace period too tracefsdrevalidate reads -isfreed of the eventfsinode that dentry-dfsdata points to, and -drevalidate is called in rcu pathwalk mode with nothing but rcureadlock held...

CVE-2026-99176

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry Reset the vCPU's MMU pointer back to the root MMU if loading L2 state fails in the "not from VM-Entry" case, i.e. when emulating RSM or handling...

CVE-2026-99177

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sevgmempostpopulate setpagedirty requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got from...

CVE-2026-99178

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async PF flags on a kernel PF in NMI context An async PF "page not present" event arrives through the PF vector, and its reason sits in the per-CPU apfreason.flags until kvmhandleasyncpf reads and clears it...

CVE-2026-99181

In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced pipe autofsnotifydaemon takes a reference to the current notification pipe under wqmutex, then drops the mutex before writing the request. The write can block while the daemon...

CVE-2026-99183

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when looking up a scheduler schedtocore walks rdev-cores up to rdev-numcores, and rocketremove decrements numcores for every core it removes. Unbind a core that is not the last one and the cor...

CVE-2026-99184

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when a core is removed rocketremove decrements rdev-numcores for each core it removes, while findcorefordev searches slots 0 to numcores - 1. Unbinding the cores in the order they were bound...

CVE-2026-99157

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...