Lucene search
+L
UbuntucveRecent

80179 matches found

UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.15 views

CVE-2026-89640

In the Linux kernel, the following vulnerability has been resolved: cifs: fix lofft underflow in cifsremapfilerange when len == 0 With len == 0 clone to EOF, the effective length is computed as: len = srcinode-isize - off; If off isize, this is a negative lofft, corrupting the ByteCount in the...

7.1CVSS5.8AI score0.00126EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.15 views

CVE-2026-89646

In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount cephdirtyfolio takes a wrbuffer claim on each newly dirtied folio: it bumps iwrbufferref taking an ihold on the 0-1 transition and attaches the snapcontext to...

7.8CVSS5.8AI score0.00173EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.15 views

CVE-2026-89663

In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before dropping their reference Copy-notify stateids live in the s2scpstateids IDR and on their parent stid's sccplist, pinned by a single membership reference. freecpntfstatelocked only unlinks ...

8.8CVSS6.3AI score0.00455EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.15 views

CVE-2026-89672

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp-mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvcdecodesetaclargs fills in argp-aclaccess only when NFSACL is set in the request mask and argp-acldefault...

9.1CVSS5.9AI score0.00522EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.15 views

CVE-2026-89518

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix thisrq assumptions in dispatch kfuncs Under core scheduling, dispatch runs from within the core-wide pick and can target a sibling rq, so ops.dispatch may execute on a CPU different from the dispatched rq's. Several...

5.9AI score0.00189EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.13 views

CVE-2026-89523

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel pending mlopmwork If the device is reset, suspended or unregistered within that window, the pending work can still run and access vif/bss data that may already be freed, or send MCU commands while the...

7.8CVSS5.8AI score0.00136EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.15 views

CVE-2026-89522

In the Linux kernel, the following vulnerability has been resolved: media: staging/ipu7: fix async notifier UAF on probe error path isysregisterdevices registers the V4L2 async notifier via isysnotifierinit. If a subsequent probe step such as isysfwloginit fails, isysprobe jumps to the outcleanup...

7.8CVSS6.7AI score0.00133EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.15 views

CVE-2026-89560

In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCKACCESSFSMAKEREG for whiteout creation Whiteout objects are used in the upper layer of an OverlayFS to indicate that the file with this name does not exist in the unified view, even if it is present in on...

8.4CVSS5.8AI score0.00126EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.15 views

CVE-2026-89562

In the Linux kernel, the following vulnerability has been resolved: ip6gre: fix hardware header length for NBMA tunnels ip6gretnllinkconfigroute accumulates the lower device's hardware header length into dev-hardheaderlen whenever headerops is set. This is incorrect for both users of headerops...

7.8CVSS5.8AI score0.00129EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.16 views

CVE-2026-89565

In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collectmd mode when metadatadst allocation fails In collectmd mode ipiptunnelrcv returns 0 without freeing the skb when iptunrxdst fails to allocate the metadatadst. ipiprcv and mplsiprcv are registered as...

5.7AI score0.00172EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.11 views

CVE-2026-89520

In the Linux kernel, the following vulnerability has been resolved: sched/core: Make core-sched flips wait for in-flight selections Core scheduling's picknexttask operates on all sibling rqs under one acquisition of the shared core-wide lock. A -picktask that releases the rq lock leaves every...

7.8CVSS5.8AI score0.00161EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.14 views

CVE-2026-89572

In the Linux kernel, the following vulnerability has been resolved: cpufreq: apple-soc: Fix OPP table cleanup applesoccpufreqinit adds OPP tables from firmware, but some failure paths do not remove them. The driver also uses devpmoppremovealldynamic, which is not the right cleanup helper for OPP...

5.8AI score0.00168EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.14 views

CVE-2026-89581

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX.R, but the REX prefix is built with add1mod, which sets REX.B. REX.B...

7.8CVSS5.7AI score0.00128EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.13 views

CVE-2026-89576

In the Linux kernel, the following vulnerability has been resolved: dm-era: fix shadowed superblock leak on take-snap failure metadatatakesnap bumps the live superblock refcount and then dmtmshadowblock allocates a new block for the metadata snapshot. If the subsequent dmsmincblock of...

5.6AI score0.0021EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.12 views

CVE-2026-89577

In the Linux kernel, the following vulnerability has been resolved: dm-io: report non-retryable errors separatedly The error codes BLKSTSNOTSUPP and BLKSTSINVAL should not cause leg failure on dm-raid1. This patch changes the interface to dm-io, so that it reports two error bitmaps - errorbits an...

5.8AI score0.00198EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.15 views

CVE-2026-89655

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in kickflushingcaps on cf entry freed during unlock listforeachentry iterates ci-icapflushlist but drops icephlock to send cap messages. During the unlock window, handlecapflushack can acquire icephlock, detach cf...

9.8CVSS6.2AI score0.00704EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.15 views

CVE-2026-89673

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR padding calculation in ffencodegetdeviceinfo nfsd4ffencodegetdeviceinfo computes the daaddrbody reservation as 16 + netidlen + addrlen, but the subsequent xdrencodeopaque calls emit 8 + roundupnetidlen, 4 +...

5.8AI score0.002EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.17 views

CVE-2026-89677

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible fhcompose of wrong dentry in nfsd4createfile dentrycreate can hypothetically provide a different dentry than the one passed in. This could happen, for example, if the exported filesystem is NFS, and the server...

9.8CVSS5.8AI score0.00407EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.14 views

CVE-2026-89681

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix layout fence worker double-reference race The workqueue core clears WORKSTRUCTPENDING before the callback is invoked, so delayedworkpending in lmbreakertimedout can return false while the fence worker is already running...

9.8CVSS5.8AI score0.00379EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.17 views

CVE-2026-89661

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent post-shutdown use-after-free in unlockfilesystem Writing a filesystem path to /proc/fs/nfsd/unlockfilesystem runs nfsd4cancelcopybysb before nfsdmutex is held and before the handler confirms that nn-nfsdserv is set...

6.4AI score0.00189EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.13 views

CVE-2026-89668

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...

7.8CVSS5.8AI score0.00171EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.13 views

CVE-2026-89629

In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Check size of status and firmware events before reading them Malformed status and firmware events could cause an out-of-bounds read since the size wasn't being checked. Check the size and warn on unexpected...

5.8AI score0.00198EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.16 views

CVE-2026-89598

In the Linux kernel, the following vulnerability has been resolved: fbdev: ssd1307fb: defer I2C transfers from damage callbacks The fbdev damage callbacks may run from fbcon while printk has disabled preemption. They currently update the display synchronously, which enters the sleeping I2C transf...

5.8AI score0.00168EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.13 views

CVE-2026-89601

In the Linux kernel, the following vulnerability has been resolved: ext2: Fix lost inode updates for ISSYNC inodes ext2setsize and ext2xattrset2 had a construct like: if ISSYNCinode syncinodemetadatainode, 1; else markinodedirtyinode; which leads to lost inode updates for ISSYNC inodes because...

8.8CVSS5.8AI score0.00348EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.13 views

CVE-2026-89584

In the Linux kernel, the following vulnerability has been resolved: block: validate user space vectors during extraction The bio-based drivers don't necessarily check the alignment split, and stacking block drivers don't always handle a misalignment detected after submitting the bio. Validate use...

7.8CVSS5.7AI score0.00154EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.15 views

CVE-2026-89586

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes atascsiwritesamexlat translates a SCSI WRITE SAME command with the UNMAP bit set into an ATA DATA SET MANAGEMENT TRIM command. The TRIM descriptor is built by...

8.2CVSS5.8AI score0.00607EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.12 views

CVE-2026-89588

In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In gheshandlearmhwerror, after skipping the cpersecprocarm header with err + 1, the remaining length was reduced by sizeoferr pointer size instead of sizeoferr...

8.4CVSS5.8AI score0.00182EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.13 views

CVE-2026-89593

In the Linux kernel, the following vulnerability has been resolved: hugetlb: only adjust reservation during unmapping if mapcount is 0 Since df7a6d1f6405, unmaphugepagerange can adjust reservations. In the case of folio mapped in both a parent and a child, if the parent unmaps the range first, th...

7.1CVSS5.8AI score0.00125EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.18 views

CVE-2026-89585

In the Linux kernel, the following vulnerability has been resolved: auxdisplay: charlcd: cancel backlight work on registration failure With CONFIGCHARLCDBLFLASH, charlcdinit schedules blwork before charlcdregister calls miscregister. If registration fails, the caller frees the charlcd object whil...

7.8CVSS5.8AI score0.00164EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.15 views

CVE-2026-89587

In the Linux kernel, the following vulnerability has been resolved: ACPI: pfrupdate: fix stack buffer overflow in querycapability querycapability copies four ACPI buffer objects returned by the firmware DSM into fixed-size u816 fields in struct pfruupdatecapinfo using memcpy with the...

7.8CVSS6.1AI score0.00142EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.14 views

CVE-2026-89589

In the Linux kernel, the following vulnerability has been resolved: acpi/apei/ghes: Use rawspinlockt for CXL CPER work locks The CXL CPER work registration and unregistration helpers acquire cxlcperworklock and cxlcperproterrworklock with a spinlock guard, which leaves local interrupts enabled. T...

5.9AI score0.00175EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.14 views

CVE-2026-89532

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix pclforeachsegment for empty chunks When a parsed chunk list contains a chunk whose chsegcount is zero, pclforeachsegment computes its inclusive upper bound as &chunk-chsegmentschsegcount - 1. chsegcount is u32, so th...

9.1CVSS5.9AI score0.00509EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.15 views

CVE-2026-89533

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in readchunkrange svcrdmareadchunkrange walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmetic...

9.8CVSS5.8AI score0.00509EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.13 views

CVE-2026-89459

In the Linux kernel, the following vulnerability has been resolved: s390/percpu: Fix MVIYPERCPU with older binutils Commit a737737cdb9c "s390/percpu: Infrastructure for more efficient thiscpu operations" introduced MVIYPERCPU, which stringifies arguments that are already C string literals. This...

7CVSS5.7AI score0.00108EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.13 views

CVE-2026-89455

In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Fix use-after-free of event IRQs during teardown pldapcieirqdomaindeinit removes pcie-eventdomain via irqdomainremove, but the per-event IRQs mapped from that domain are requested with devmrequestirq in...

6.3AI score0.002EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.14 views

CVE-2026-89456

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Propagate partial completion length across ERP recovery dasddefaulterppostaction copies the timing and device state from the finished ERP request back to the original request but drops procbytes. A request that was...

7CVSS5.8AI score0.00145EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.16 views

CVE-2026-89446

In the Linux kernel, the following vulnerability has been resolved: iommufd: Release current IOAS on xastore failure iommufdtakealliovarwsem takes an object reference and the iovarwsem write lock before storing the IOAS in the temporary ioaslist xarray. If xastore fails, the current IOAS has not...

5.8AI score0.00198EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.15 views

CVE-2026-89449

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix deviommu memory leak when deviceadd fails in iommumockdeviceadd iommumockdeviceadd first calls iommufwspecinit, which on success allocates both dev-iommu via deviommuget and dev-iommu-fwspec. If the subsequent...

5.6AI score0.00166EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.14 views

CVE-2026-81002

In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdpconvertzctoxdpframe clones an XSK packet into an order-0 page and advertises PAGESIZE as its frame size. It allows the copied frame to occupy the page tail needed by skbsharedinfo and records ze...

9.8CVSS6.2AI score0.00521EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.14 views

CVE-2026-81003

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

8.1CVSS5.7AI score0.00313EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.14 views

CVE-2026-81005

In the Linux kernel, the following vulnerability has been resolved: ipmi: si: Fix NULL pointer dereference after failed registration trysmiinit allocates newsmi-sism and later calls ipmiregistersmimod, which maps to ipmiaddsmi. During ipmiaddsmi, the upper IPMI message handler obtains the initial...

5.6AI score0.00176EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.15 views

CVE-2026-89494

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlmmiglockreshandler A node receiving a DLMMIGLOCKRES message trusts several fields of the peer-supplied dlmmigratablelockres without validation. numlocks and locknamelen are bounded only on the sending...

9.8CVSS6AI score0.00704EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.12 views

CVE-2026-89496

In the Linux kernel, the following vulnerability has been resolved: ocfs2: always run deallocs on copy-on-write completion Local fuzzing of 6.12.94 has found the following memory leak caused by doing 'copyfilerange' within the same filesystem: unreferenced object 0xffff88812192c980 size 32: comm...

5.8AI score0.00176EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.15 views

CVE-2026-89486

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix use-after-free of cmdrcvr in ipmidestroyuser Commit 9e91f8a6c868 "ipmi:msghandler: Remove srcu for the ipmiinterfaces list" dropped the synchronizercu between unlinking the command receivers from intf-cmdrcvrs and freei...

7.8CVSS6.2AI score0.00124EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.9 views

CVE-2026-80945

In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - unmap dst before software fallback on decompress On a hardware analytics error, decompress retries through the software fallback, which writes req-dst with the CPU while it is still mapped DMAFROMDEVICE. With SWIOTL...

9.1CVSS6AI score0.00487EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.15 views

CVE-2026-80989

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Mark the connection down when bringing it up fails Every failure path in tbnetconnectedwork undoes its own work and returns without clearing loginsent, so the connection still looks established. The next...

8.8CVSS5.8AI score0.00338EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.12 views

CVE-2026-89466

In the Linux kernel, the following vulnerability has been resolved: power: supply: qcombattmgr: terminate the strings from firmware The qcombattmgrsc8280xpstrcpy takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGRSTRINGLEN bytes and leaves the destination...

7.7CVSS5.8AI score0.00144EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.13 views

CVE-2026-89441

In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: cancel card-detect work on remove Disabling the device interrupt and freeing the IRQ prevents new card-detect work from being queued, but carddetwork already queued by the handler can still run after viasdremove...

7.8CVSS5.8AI score0.00127EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.15 views

CVE-2026-89443

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isstifgetperflevelmask and isstifgetbasefreqmask use the user-provided level as an index into perflevels via readpplevelinfo and readbflevelinfo, but neither helper validates...

7.1CVSS5.8AI score0.00159EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.13 views

CVE-2026-89445

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGERIOPF borrows an attach handle from group-pasidarray without synchronizing against PASID detach, then a concurrent iommureportdevicefault can dereference that...

8.8CVSS6.1AI score0.00161EPSS
SaveExploits0References5
Total number of security vulnerabilities80179