CVE-2026-90101

A flaw was found in the Linux kernel's Broadcom NetXtreme-C/E bnxten network adapter driver. The driver incorrectly calls the hardware monitoring event handler function hwmonnotifyevent with an incorrect parameter. This improper function call can lead to undefined behavior and may result in a...

CVE-2026-90100

A flaw was found in the Linux kernel's Precision Time Protocol PTP netc driver. An issue with period calculation can lead to a value being truncated to zero. This truncated value can then cause a divide-by-zero error in the netctimersetperoutalarm function, resulting in a system crash and a Denia...

CVE-2026-90099

A flaw was found in the Linux kernel's network scheduler. An unprivileged user can exploit a memory accounting vulnerability in the traffic control tc classifier. By creating a large number of filters, an attacker can cause the kernel to pin memory outside of memory cgroup memcg limits, leading t...

CVE-2026-90098

A flaw was found in the Linux kernel's net: sparx5 driver. The sparx5setrxmode function attempts to acquire a mutex and poll a register while operating in an atomic context, which is not allowed. This improper operation can lead to a "sleep in atomic context" bug, causing system instability or a...

CVE-2026-90096

A flaw was found in the Linux kernel's FUSE Filesystem in Userspace component. When performing direct writes with the OAPPEND flag, the fusedirectwriteiter function incorrectly invalidates the page cache. This can lead to data inconsistency, where concurrent readers may access stale data from the...

CVE-2026-90094

A flaw was found in the Linux kernel, affecting the arm64 architecture's process context switching. When a user enables the Memory Tagging Extension MTE store-only tag check mode, the associated security setting SCTLREL1.TCSO0 is not properly reset during a task switch. This oversight allows the...

CVE-2026-90093

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. This vulnerability allows for a Use-After-Free UAF condition when handling getsockopt and setsockopt operations. An attacker could exploit this by causing the system to attempt to access...

CVE-2026-90092

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol implementation. A race condition can occur when a new connection is established while a parent L2CAP channel is being torn down, due to inconsistent locking. This can lead to a Use-After-Free UAF...

CVE-2026-90091

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. A race condition, a situation where multiple operations occur at the same time and interfere with each other, exists between internal functions. This can lead to a null pointer...

CVE-2026-90090

A flaw was found in the Linux kernel's Bluetooth MTK SDIO Secure Digital Input Output driver. The btmtksdiotxpacket function, which handles data transmission, incorrectly calculates the transfer size. This leads to an out-of-bounds read of uninitialized memory, which is then sent to the Bluetooth...

CVE-2026-90089

A flaw was found in the Bluetooth btnxpuart driver in the Linux kernel. This vulnerability occurs because the nxpprocessfwdump function does not properly validate the length of the firmware dump header. A remote attacker could send a specially crafted, truncated Bluetooth frame, leading to an...

CVE-2026-90088

A flaw was found in the Linux kernel's Bluetooth RFCOMM Radio Frequency Communication component. A remote attacker can exploit this by sending a specially crafted Parameter Negotiation PN frame with a zero Maximum Transmission Unit MTU value. This can lead to an infinite loop during data...

CVE-2026-90083

A flaw was found in the Linux kernel. The actife Ingress/Egress Forwarding Engine component, which is designed to operate exclusively with Ethernet network frames, can improperly handle non-Ethernet packets. If a non-Ethernet packet is redirected to an Ethernet device configured with actife, the...

CVE-2026-90081

A flaw was found in the Linux kernel's Reliable Datagram Sockets RDS component. This vulnerability occurs due to a synchronization issue in the congestion control mechanism. A remote attacker could exploit this by causing a sender to become indefinitely blocked on a congested port, leading to a...

CVE-2026-90076

A flaw was found in the Linux kernel's fq Fair Queue packet scheduler. An integer overflow can occur in the fqinit function when calculating quantum and initialquantum values if a device is configured with an extremely large Maximum Transmission Unit MTU. This overflow leads to a zero value for...

CVE-2026-90075

A flaw was found in the Linux kernel's fqcodel network scheduler. A local attacker with CAPNETADMIN capabilities in a user namespace could exploit this by configuring a network device with an extremely large Maximum Transmission Unit MTU. This can lead to an integer overflow, causing an infinite...

CVE-2026-90074

A flaw was found in the Linux kernel's fqpie network scheduler. A local attacker with CAPNETADMIN capabilities in a user namespace could exploit this by configuring a network device with a specially crafted large Maximum Transmission Unit MTU value. This can lead to a signed integer overflow,...

CVE-2026-90073

A flaw was found in the Linux kernel. An integer overflow vulnerability exists in the Hierarchical Heavy-Hitter Filter hhf network scheduler when processing a device with a very large Maximum Transmission Unit MTU. A local attacker with CAPNETADMIN capabilities in a user namespace could exploit...

CVE-2026-90071

A flaw was found in the Linux kernel's network scheduler component schteql. An issue exists where the skb-dev pointer is not correctly restored after a slave device transmit failure. This can result in a Use-After-Free UAF vulnerability if the associated network device is subsequently freed while...

CVE-2026-90069

A flaw was found in the Linux kernel's cryptographic acceleration acomp component. This vulnerability arises when the system attempts to clone a cryptographic request, but insufficient memory is allocated for asynchronous operations. This can lead to an out-of-bounds write, where data is written...

CVE-2026-90068

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA System on Chip ASoC Dynamic Audio Power Management DAPM component. An off-by-one error in the sndsocdapmputenumdouble function allows an out-of-bounds read when handling the second enum channel. This can lead to reading...

CVE-2026-90063

A flaw was found in virtio-net, a network virtualization driver in the Linux kernel. A local user could exploit this vulnerability by crafting a specially designed TCP packet with a small gsosize value. This action could lead to an integer overflow in the gsosegs field during packet processing,...

CVE-2026-90061

A flaw was found in the netfilter nftables component of the Linux kernel. When new elements are inserted into a set without providing override expressions, a double cloning of existing set expressions occurs. This can lead to a module reference count imbalance, potentially causing system...

CVE-2026-90059

A flaw was found in the Linux kernel's stmmac network driver. The driver's receive RX path, after being converted to zero-copy, failed to correctly align IP packet headers. This misalignment, particularly on ARM32 architectures, can cause the system to panic when processing certain network packet...

CVE-2026-109976

A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AFUNIX client connects to the data socket without a bound address, due to an integer underflow in the getpeername result handling. This causes a denial of service, preventing LUKS disk...

CVE-2026-90055

A flaw was found in the Linux kernel's USB ATM Asynchronous Transfer Mode driver. An invalid initialization of the cirange fields, specifically vpibits and vcibits, to a negative sentinel value can lead to a shift-out-of-bounds error. This undefined behavior can be triggered by a local user...

CVE-2026-90053

A flaw was found in the Linux kernel's Hierarchical Token Bucket HTB scheduler. An unprivileged local user, by sending a specially crafted network packet, can trigger an infinite loop in the packet classification path. This can cause the system to soft lockup or panic, resulting in a Denial of...

CVE-2026-105274

A flaw was found in hexcore. A malicious repository mirror or server can cause a Denial of Service DoS by returning highly compressed data that expands excessively upon decompression. Because incoming responses are unpacked without enforcing limits on the uncompressed size, handling these crafted...

CVE-2026-90056

A flaw was found in the Linux kernel's net: fec component. The fecptpstop function is unconditionally called during device initialization failure or device removal, even if the Precision Time Protocol PTP was not previously initialized. This incorrect state transition could lead to system...

CVE-2026-90054

A flaw was found in the Linux kernel's Transmission Control Protocol TCP urgent data handling. When TCP retransmits multi-segment packets while in urgent mode, the urgent pointer urgptr is incorrectly copied across segments. This error causes the receiver to misinterpret the urgent data's positio...

CVE-2026-90052

A flaw was found in the Linux kernel's dm-integrity component. This vulnerability arises from an incorrect checksum calculation during the discard operation, specifically when the tag size is smaller than the digest size. This can lead to a buffer overflow, where data is written beyond the...

CVE-2026-90051

A flaw was found in the Linux kernel's TCP networking component. A local attacker could craft a malicious iouring request with dmabufid and zero-copy flags, but without the necessary binding. This improper handling of non-zero-copy devmem transmit could lead to the breaking of internal data...

CVE-2026-49265

A flaw was found in oauthlib. A timing side-channel vulnerability in the Proof Key for Code Exchange PKCE validation process allows a remote attacker to recover secret verification codes. Because comparison operations do not execute in constant time, an attacker who has intercepted an authorizati...

CVE-2026-77206

A null pointer dereference flaw was found in Libreswan's IKEv2 state-machine handling. A remote, unauthenticated attacker can trigger the flaw by sending a malicious IKEv2 IKEAUTH packet, causing the pluto daemon to crash and restart. Repeated exploitation may result in a denial of service. The...

CVE-2026-90050

A flaw was found in the Linux kernel's Fair Queueing fq scheduler. A local attacker with network administration capabilities CAPNETADMIN could manipulate the quantum and initialquantum parameters. This manipulation allows overriding internal safeguards, potentially leading to a "small-quantum...

CVE-2026-109833

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS read path, partial consumption of the internal peek buffer incorrectly moves remaining peeked bytes into the caller-supplied buffer instead of compacting the peek buffer. A remote attacker who can reac...

CVE-2026-109240

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can cause a Denial of Service DoS by sending a specially crafted request with an unvalidated buffer size over the USB redirection channel. This missing bounds check triggers an internal assertion failure that immediately...

CVE-2026-109241

A flaw was found in FreeRDP. A malicious server can cause a Denial of Service DoS by triggering a NULL pointer dereference in the client video redirection channel. By sending messages out of sequence, specifically clearing geometry data before transmitting video data, the server causes the client...

CVE-2026-109247

A flaw was found in FreeRDP's clipboard handling component. A malicious Remote Desktop Protocol RDP server can supply crafted file names containing directory traversal sequences in clipboard data. When a user pastes content into a local file manager, the client improperly resolves the path, causi...

CVE-2026-109256

A flaw was found in FreeRDP. A remote attacker acting as a malicious Remote Desktop Protocol RDP clipboard peer can cause a Denial of Service DoS by sending a specially crafted image over the clipboard channel. When the client converts the image to the PNG format, a memory reallocation failure...

CVE-2026-109253

A flaw was found in FreeRDP. When processing authentication data for Remote Credential Guard, the client checks data lengths before accounting for byte alignment padding. A malicious or compromised Remote Desktop Protocol RDP server can exploit this flaw by sending a crafted payload to a connecte...

CVE-2026-109251

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can cause a Denial of Service DoS on a connecting client by supplying invalid geometry coordinates when video redirection is enabled. Because FreeRDP does not properly validate server-provided video coordinates, an intege...

CVE-2026-109250

A flaw was found in FreeRDP. This vulnerability allows a local attacker with access to a physical smartcard or token to trigger a heap-based buffer overflow during smartcard key enumeration. By presenting more public key objects across multiple slots than the internal storage buffer can hold, an...

CVE-2026-109249

A flaw was found in FreeRDP. An out-of-bounds read vulnerability in the Remote Assistance file parser allows an attacker to cause a Denial of Service DoS. By convincing a user to open a specially crafted Remote Assistance invitation file, the application mishandles memory bounds while processing...

CVE-2026-109246

A flaw was found in FreeRDP. An authenticated client can trigger a Denial of Service DoS by sending a specially crafted frame acknowledgment message to the shadow server. Due to missing input validation on the frame identifier, an arithmetic error causes a divide-by-zero condition. This terminate...

CVE-2026-109245

A flaw was found in FreeRDP. This vulnerability leads to information disclosure because the internal HTTP client fails to verify Transport Layer Security TLS server certificates or hostnames. An on-path network attacker positioned between the client and identity provider can exploit this flaw by...

CVE-2026-109244

A flaw was found in FreeRDP. The winpr-makecert utility creates unencrypted private key and certificate archive files without restricting permissions to the file owner, and it assigns a hardcoded default password to exported archives. A local user on a multi-user system can exploit this flaw to...

CVE-2026-109243

A flaw was found in FreeRDP. When software-based smartcard authentication is used on multi-user systems, FreeRDP writes a temporary copy of the private key to a shared directory without enforcing owner-only file permissions. A local, unprivileged attacker can access this shared directory and read...

CVE-2026-77207

A null pointer dereference flaw was found in Libreswan's PKCS7 certificate payload handling. When processing a crafted IKEv2 IKEAUTH packet containing a PKCS7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash...

CVE-2026-109832

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results GNUTLSEAGAIN and GNUTLSEINTERRUPTED are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC...