Skip to content

Technology

Linux Kernel vulnerabilities

The Linux kernel, including distribution kernel packages. 23,099 published CVES affecting Linux Kernel, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
23,099
Critical
853
High
8,082
Medium
12,744
Low
849
Unscored
571
CISA KEV
38
Atom feed of Linux Kernel alerts

Latest Linux Kernel CVEs

Newest publication first · page 11 of 40 · showing the latest 1,000

  2. CVE-2026-99037 dm-crypt: reject the lmk IV mode with AEAD ciphers

    Published
    MediumCVSS 6.0 EPSS 0.18%

    In the Linux kernel, the following vulnerability has been resolved: dm-crypt: reject the lmk IV mode with AEAD ciphers A "capi:" table line that pairs an AEAD cipher with the lmk IV mode, for example "capi:gcm(aes)-lmk" with the integrity:28:aead option, causes an oops when it is...

  3. CVE-2026-99036 dm: fix reading free memory in do_resume

    Published
    MediumCVSS 4.1 EPSS 0.22%

    In the Linux kernel, the following vulnerability has been resolved: dm: fix reading free memory in do_resume When do_resume calls dm_table_get_mode(new_map), the call is done without holding any locks (it only holds a reference to the md). It may be possible that another concurre...

  4. CVE-2026-99035 mmc: mtk-sd: Cancel request timeout work on remove

    Published
    MediumCVSS 4.7 EPSS 0.18%

    In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues req_timeout while a request is active. msdc_request_done() uses cancel_delayed_work(), which does not wait for a timeout callback that has alre...

  5. CVE-2026-99034 mmc: sdhci-sprd: disable runtime PM on remove

    Published
    LowCVSS 2.3 EPSS 0.18%

    In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhci_sprd_probe() enables runtime PM, while sdhci_sprd_remove() does not perform the corresponding runtime PM cleanup. The probe failure path disables runtime PM bef...

  6. CVE-2026-99033 net/packet: guard the ll header push in packet_rcv_spkt()

    Published
    MediumCVSS 4.4 EPSS 0.19%

    In the Linux kernel, the following vulnerability has been resolved: net/packet: guard the ll header push in packet_rcv_spkt() packet_rcv_spkt() restores the link layer header with skb_push(skb, skb->data - skb_mac_header(skb)); That subtraction is only meaningful when the device...

  7. CVE-2026-99032 net/smc: protect clcsock lifetime in smc_getname

    Published
    HighCVSS 7.8 EPSS 0.16%

    In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smc_getname smc_getname() dereferences smc->clcsock without holding clcsock_release_lock. Link-group termination can release the CLC socket through smc_close_active_abort() wh...

  8. CVE-2026-99031 net: bridge: avoid recursive multicast port cleanup

    Published
    MediumCVSS 4.4 EPSS 0.18%

    In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup br_multicast_sg_del_exclude_ports() removes automatically added STAR_EXCL port groups by calling br_multicast_del_pg(). For S,G entries, that deletion calls bac...

  9. CVE-2026-99030 net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()

    Published
    HighCVSS 7.5 EPSS 0.46%

    In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() When skb_copy_and_csum_bits() reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left...

  10. CVE-2026-99029 net: sparx5: free the matchall entry on destroy

    Published
    LowCVSS 2.3 EPSS 0.17%

    In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5_tc_matchall_replace() allocates a struct sparx5_mall_entry for every offloaded matchall filter and adds it to sparx5->mall_entries. sparx5_tc_matchall_destro...

  12. CVE-2026-99027 net: team: stop reusing skb after queue override

    Published
    MediumCVSS 6.0 EPSS 0.19%

    In the Linux kernel, the following vulnerability has been resolved: net: team: stop reusing skb after queue override A nonzero dev_queue_xmit() result does not return ownership of the skb. When an override port's qdisc drops it, the queue override helper used to try another port...

  13. CVE-2026-99026 net: team: free skb when broadcast has no txable port

    Published
    LowCVSS 2.3 EPSS 0.18%

    In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bc_transmit() sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but team_xmit() still r...

  14. CVE-2026-99025 openvswitch: fix soft lockup in the netlink flow dump

    Published
    MediumCVSS 4.1 EPSS 0.18%

    In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix soft lockup in the netlink flow dump A production compute node carrying a few thousand datapath flows hit a soft lockup inside a single netlink flow dump and panicked. ovs_flow_cmd_dump() calls o...

  15. CVE-2026-99024 optee: register TEE devices only once fully initialized

    Published
    MediumCVSS 5.3 EPSS 0.18%

    In the Linux kernel, the following vulnerability has been resolved: optee: register TEE devices only once fully initialized optee_probe() called tee_device_register() on both the client and the supplicant device before the rest of struct optee had been initialized. tee_device_reg...

  18. CVE-2026-99021 regulator: of: fill in supply names in of_regulator_bulk_get_all()

    Published
    MediumCVSS 4.1 EPSS 0.17%

    In the Linux kernel, the following vulnerability has been resolved: regulator: of: fill in supply names in of_regulator_bulk_get_all() of_regulator_bulk_get_all() returns an array it allocated itself, and fills in only the consumer of each entry. Every other way of getting a bulk...

  20. CVE-2026-99019 scsi: ch: Do not keep references to data transfer element devices

    Published
    LowCVSS 2.3 EPSS 0.19%

    In the Linux kernel, the following vulnerability has been resolved: scsi: ch: Do not keep references to data transfer element devices ch_readconfig() looks up the scsi_device of every data transfer element whose SCSI id the changer reports in READ ELEMENT STATUS, and stores it in...

  23. CVE-2026-99016 riscv: futex: untag the user pointer before the atomic access

    Published
    HighCVSS 7.8 EPSS 0.17%

    In the Linux kernel, the following vulnerability has been resolved: riscv: futex: untag the user pointer before the atomic access access_ok() checks untagged_addr(uaddr), but arch_futex_atomic_op_inuser() and futex_atomic_cmpxchg_inatomic() hand the raw uaddr to the inline asm am...

  24. CVE-2026-99015 Bluetooth: hci_sock: Serialize dead-device detachment

    Published
    MediumCVSS 6.3 EPSS 0.18%

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Serialize dead-device detachment Rebinding an HCI socket after its controller is unregistered can race monitor control replay and crash the kernel. hci_sock_bind() clears hci_pi(sk)->hdev and...

  25. CVE-2026-99014 Bluetooth: hci_sync: Fix command skb lifetime during scan setup

    Published
    HighCVSS 7.8 EPSS 0.16%

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix command skb lifetime during scan setup During PA sync scan setup, hci_le_set_ext_scan_param_sync() gets the address used for the PA_LINK lookup from hci_sent_cmd_data(). The returned poin...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.