CVE-2026-98864

A flaw was found in the Linux kernel's extensible scheduler schedext subsystem. A race condition occurs when a task is re-enqueued before a prior dispatch operation has completed, allowing internal scheduling states to be improperly overwritten. A local user could trigger this flaw to cause...

CVE-2026-98863

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem. When running nested virtual machines, the hypervisor fails to properly re-queue a memory page request if retrieving state pages for a nested guest fails during execution. A local user controlling virtual machine...

CVE-2026-98862

A flaw was found in the Linux kernel's audit subsystem. A race condition can occur when an audit directory tree is removed while another process evaluates executable audit rules, causing the kernel to access memory after it has been released a use-after-free condition. A local user with audit...

CVE-2026-98860

A flaw was found in the Linux kernel's Human Interface Device HID subsystem. This flaw can lead to information disclosure when hardware communication errors occur. Due to an improper integer comparison in the Berkeley Packet Filter BPF handler, negative error return codes are mistakenly treated a...

CVE-2026-98858

A flaw was found in the Linux kernel's iouring subsystem. When submission queue polling SQPOLL is enabled, a race condition can cause the polling thread to free the ring context while another operation is still accessing it. A local user can exploit this use-after-free flaw to crash the system,...

CVE-2026-98857

A flaw was found in the Linux kernel's IP Virtual Server IPVS module. The load-balancing cache fails to enforce strict bounds on table growth when entries remain continuously active. A remote attacker can exploit this vulnerability by transmitting network traffic to unique destination addresses,...

CVE-2026-89854

A flaw was found in the kernel's qla2xxx SCSI driver. A use-after-free vulnerability exists due to a race condition during host teardown. When a host is being removed, the cs84xx object can be freed before its corresponding sysfs attribute is removed. A local attacker, by concurrently reading thi...

CVE-2026-80777

A flaw was found in the Linux kernel. A race condition exists in the futex/pi component during the exec system call. This vulnerability occurs because the memory management mm check is incorrect when a task's memory is being swapped out and freed, while still being referenced by private futexes...

CVE-2026-80791

A flaw was found in the Linux kernel's nvmet-auth subsystem. During the pre-authentication handshake, a remote attacker can exploit an issue where the system allocates a response buffer but only partially initializes it. The uninitialized portion of this buffer is then transmitted to the remote...

CVE-2026-80829

A flaw was found in the Linux kernel's ALSA USB audio driver. A local attacker with a specially crafted USB device could exploit this vulnerability. By providing a malformed wMaxPacketSize value, the device can trigger an out-of-bounds write in the kernel's memory. This memory corruption could le...

CVE-2026-80854

A flaw was found in the Linux kernel's ftcm USB gadget module. A race condition can occur during the teardown of a Logical Unit Number LUN when it overlaps with a session removal. This timing issue can lead to a use-after-free vulnerability, causing the system to crash and resulting in a Denial o...

CVE-2026-80862

A flaw was found in the Linux kernel's nvme-tcp component. When block devices are created in parallel threads, the pagefragcache is used in a manner that is not thread-safe. This can lead to incorrect reference counting of memory pages and premature freeing, potentially causing a system crash...

CVE-2026-80880

A flaw was found in the Linux kernel's IB/mlx5 component. Improper handling of implicit On-Demand Paging ODP memory registration reregmr and interactions with child memory keys can lead to a race condition. This occurs because changes to a parent memory key necessitate a complete rebuild, and...

CVE-2026-80891

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine s390 PCI component. This vulnerability arises from insufficient validation of the Adapter Interrupt Block Vector AIBV and Adapter Interrupt Summary Block AISB parameters before pinning guest pages. An attacker, by providing...

CVE-2026-80894

A flaw was found in the Linux kernel's iommufd component. During the replacement of a device's I/O Memory Management Unit IOMMU domain, a parameter mismatch occurs where the iommufdhwptreplacedevice function incorrectly uses a new hardware page table hwpt with the handle of the old domain. This...

CVE-2026-80900

A flaw was found in the Linux kernel, specifically within the Advanced Linux Sound Architecture ALSA System on Chip ASoC SoundWire Digital Control Adapter SDCA component. This vulnerability arises from an improper validation of User Mode Protocol UMP message sizes. If a message offset exceeds the...

CVE-2026-80907

A flaw was found in the AMD GPU driver within the Linux kernel. This vulnerability involves an incorrect calculation of the minimum size for the Unified Video Decoder UVD decoded picture buffer DPB when processing H264 video. Instead of using the actual number of references from the video's decod...

CVE-2026-89810

A flaw was found in the Linux kernel's drm/amdkfd component. When page migration from a device to system RAM fails, the driver incorrectly uses a DMA Direct Memory Access address instead of a physical address to release and unlock allocated system pages. This improper handling of memory resources...

CVE-2026-89823

A flaw was found in the Linux kernel's Direct Rendering Manager DRM subsystem. A race condition exists during the partial failure of drmdevregister when a minor device is registered but the primary minor fails. A local user could exploit this by opening the registered minor device and initiating ...

CVE-2026-89844

A flaw was found in the Linux kernel's qla2xxx SCSI driver. The qla24xxreportidacquisition function does not properly hold a lock vportslock when updating the host map btree. This oversight creates a race condition, allowing multiple concurrent updates to the host map. An attacker could exploit...

CVE-2026-89847

A flaw was found in the Linux kernel's qla2xxx SCSI driver. A double completion scenario can occur during the asynchronous I/O control block IOCB timeout handling. This can lead to a use-after-free vulnerability, where the system attempts to write to memory that has already been released. A local...

CVE-2026-89848

A flaw was found in the Linux kernel's qla2xxx SCSI driver. This vulnerability occurs during the process of deleting a storage device's queue, where memory is released prematurely while the system can still attempt to access it. This timing issue, known as a use-after-free, could allow a local...

CVE-2026-89853

A flaw was found in the Linux kernel's qla2xxx SCSI driver. A use-after-free vulnerability occurs due to a race condition between freeing the FCE trace buffer and its use during a firmware dump. A local attacker could potentially exploit this by disabling the debugfs FCE trace, leading to system...

CVE-2026-89857

A flaw was found in the Linux kernel's qla2xxx SCSI driver. This vulnerability occurs because a specific function responsible for sending NVMe Local-Scope LS rejects does not properly acquire a necessary lock. This oversight allows for concurrent operations, which can corrupt the internal state o...

CVE-2026-89858

A flaw was found in the Linux kernel's qla2xxx driver. A local user could exploit this vulnerability by sending a specially crafted Block SCSI Generic BSG request with an excessively large image count. This could cause the system to read beyond the intended memory buffer, leading to the disclosur...

CVE-2026-89860

A flaw was found in the Linux kernel's qla2xxx SCSI driver. This vulnerability occurs when an abort operation is initiated multiple times for the same command, leading to a race condition. During this race, a work item can be reinitialized while it is still active in the kernel's processing queue...

CVE-2026-89861

A flaw was found in the Linux kernel's qla2xxx SCSI driver. This vulnerability occurs in the qla24xxreportidacquisition function where a virtual port reference is not properly maintained. A local attacker could exploit this timing issue, allowing a concurrent operation to free the virtual port...

CVE-2026-89864

A flaw was found in the qla2xxx SCSI driver in the Linux kernel. This vulnerability allows a local attacker, with CAPSYSRAWIO capabilities, to cause heap and kernel stack corruption due to unbounded length fields in I2C bsg handlers. Successful exploitation could lead to privilege escalation or...

CVE-2026-89879

A flaw was found in the Linux kernel's s2255 media driver. The driver fails to properly validate the size of JPEG frames received from a device. A malicious or malfunctioning device can provide an oversized jpgsize value, causing a buffer overflow when the data is copied. This could allow an...

CVE-2026-89891

A flaw was found in the em28xx media driver of the Linux kernel. When a specific type of device is disconnected, a programming error can occur where a pointer to freed memory remains in an active list. This "use-after-free" vulnerability can be triggered by a local attacker or a malicious USB...

CVE-2026-89897

A flaw was found in the Linux kernel's media subsystem, specifically within the Consumer Electronics Control CEC framework. The cecreceivenotify function reads the exclusive follower pointer without proper locking, creating a race condition. This lack of serialization during exclusive follower...

CVE-2026-89892

A flaw was found in the Linux kernel's em28xx media driver. This vulnerability occurs because the audio-only path incorrectly registers extensions during device probing, leading to a duplicate device entry in an internal list. This duplicate entry can be freed while still being referenced,...

CVE-2026-89899

A flaw was found in the Linux kernel's Consumer Electronics Control CEC subsystem. This vulnerability occurs when a transmit operation is interrupted, leading to a delayed work item remaining active after its associated data has been freed. A local attacker could potentially exploit this...

CVE-2026-89911

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine component. A guest operating system can trigger an integer overflow in the TLB Translation Lookaside Buffer Invalidation by Range mechanism. This occurs when the hypervisor incorrectly handles a large range value provided by...

CVE-2026-98847

A flaw was found in the Linux kernel's SPEAr Real-Time Clock RTC driver. The driver requests and enables an alarm interrupt before completing device initialization, specifically prior to setting up the memory-mapped I/O MMIO address and spinlock. If an interrupt triggers while device probing is i...

CVE-2026-89913

A flaw was found in the KVM Kernel-based Virtual Machine arm64 vgic-v3 component of the Linux kernel. A race condition exists where the vgicv3savependingtables function can dereference a freed vgicirq structure due to improper handling of LPI Locality-sensitive Paging Interrupt references. This...

CVE-2026-98846

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP subsystem. A race condition can occur when an SCTP socket is shut down concurrently while waiting for a connection, causing an association structure to be freed while still in use. A local user could exploit this fla...

CVE-2026-89915

A flaw was found in the Kernel-based Virtual Machine KVM for ARM64 architectures. The VM-wide VNCR mapping counter, a mechanism designed to optimize Translation Lookaside Buffer TLB invalidations, contained several issues. These flaws could lead to situations where TLB entries are not correctly...

CVE-2026-98845

A flaw was found in the Linux kernel's Trusted Platform Module TPM subsystem. This vulnerability allows an attacker to bypass TPM reset protections because the driver fails to disable the device when a null key integrity check fails. Consequently, the TPM continues serving requests and...

CVE-2026-89917

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM for ARM64 architectures. A race condition exists between the Virtual Nested Cache Register VNCR Translation Lookaside Buffer TLB invalidation and the vcpuput function's unmapping of the VNCR page. This time-of-check to...

CVE-2026-98844

A flaw was found in the Linux kernel's network filesystem netfs subsystem. When a file is extended through write operations after previous writes were performed via memory mapping, the system fails to clear stale cache data located beyond the original end of the file. A local user could exploit...

CVE-2026-89919

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM component for s390 architecture. This vulnerability occurs due to improper synchronization when handling memory management unit MMU locks. Specifically, concurrent operations related to key operations and virtual machine memo...

CVE-2026-115897

A flaw was found in serialize-javascript. This vulnerability allows an attacker to conduct Cross-Site Scripting XSS by supplying crafted function source text that bypasses escaping logic. When the resulting serialized data is rendered inside an HTML script block on a web page, the unneutralized...

CVE-2026-115892

A flaw was found in Wasmtime. A malicious WebAssembly guest can cause a Denial of Service DoS by triggering an unhandled host runtime panic. When handling asynchronous streams or futures exchanged between the host and guest, Wasmtime fails to properly validate payload data types upon their return...

CVE-2026-98843

A flaw was found in the Linux kernel's Network Filesystem netfs subsystem. When reading data gaps around modified memory regions during streaming write operations, truncated or incomplete read responses from a remote server fail to clear unread memory buffers. As a result, stale memory contents c...

CVE-2026-98842

A flaw was found in the Linux kernel's module loading subsystem. When an error occurs during module initialization, the kernel fails to propagate the error code and incorrectly reports a successful load after the module has already been cleaned up. A local privileged user could trigger this...

CVE-2026-115895

A flaw was found in happy-dom. This vulnerability allows an attacker to achieve arbitrary code execution within the host Node.js environment. When JavaScript evaluation is enabled, the module compiler fails to validate named ECMAScript Module ESM import aliases before inserting them into generate...

CVE-2026-98841

A flaw was found in the Linux kernel's Virtual Machine Generation ID vmgenid driver. The driver registers interrupt and notification handlers before fully initializing driver data during startup. If an interrupt or notification is received immediately—such as when restoring a virtual machine from...

CVE-2026-98839

A flaw was found in the Linux kernel's virtual terminal selection subsystem. When pasting console selections, a race condition can occur if another process concurrently replaces the selection buffer with shorter content while the operation is temporarily paused. This situation causes an integer...

CVE-2026-115886

A flaw was found in MLflow. An unauthenticated remote attacker can conduct Server-Side Request Forgery SSRF, where the application is tricked into making unauthorized network requests to arbitrary internal or external systems. By submitting crafted serialized scorer data to affected endpoints, an...