Skip to content

Technology

Linux Kernel vulnerabilities

The Linux kernel, including distribution kernel packages. 23,099 published CVES affecting Linux Kernel, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
23,099
Critical
853
High
8,082
Medium
12,744
Low
849
Unscored
571
CISA KEV
38
Atom feed of Linux Kernel alerts

Latest Linux Kernel CVEs

Newest publication first · page 6 of 40 · showing the latest 1,000

  2. CVE-2026-99162 gpio: shared: fix use-after-free bug when adding shared proxies

    Published
    MediumCVSS 5.5 EPSS 0.16%

    In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix use-after-free bug when adding shared proxies The GPIO lookup table can stay alive for longer than the kobject whose name string's address we're assigning to lookup->dev_id. Fix a potential UAF...

  3. CVE-2026-99160 ring-buffer: Do not show buffer_meta for CPUs without a buffer

    Published
    MediumCVSS 5.5 EPSS 0.17%

    In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not show buffer_meta for CPUs without a buffer The per_cpu/cpuN/buffer_meta files are created for every possible CPU, but buffer->buffers[cpu] is only allocated once that CPU comes online. Reading...

  4. CVE-2026-99161 i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()

    Published
    HighCVSS 7.1 EPSS 0.19%

    In the Linux kernel, the following vulnerability has been resolved: i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe() In wmt_i2c_probe(), i2c->clk is acquired using of_clk_get(). If any subsequent operation fails or when the module is unloaded, the clock reference count is never...

  5. CVE-2026-99159 ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()

    Published
    MediumCVSS 4.4 EPSS 0.18%

    In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx() On a persistent ring buffer, rb_meta_subbuf_idx() can return an index one sub-buffer too high. rb_setup_ids_meta_page() then fills subbuf_ids[] s...

  6. CVE-2026-99158 ring-buffer: Fix false warning in ring_buffer_map_get_reader()

    Published
    MediumCVSS 4.1 EPSS 0.17%

    In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix false warning in ring_buffer_map_get_reader() The mmap reader can warn when it catches up with a writer that is still committing events. rb_get_reader_page() returns NULL in this case, but ring_b...

  10. CVE-2026-99154 scsi: libiscsi: Reject a negative task index from parse_pdu_itt

    Published
    CriticalCVSS 9.8 EPSS 0.51%

    In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Reject a negative task index from parse_pdu_itt A transport that implements parse_pdu_itt hands libiscsi an index taken from the PDU, and both lookups bound it from above only: if (i >= session->c...

  11. CVE-2026-99153 scsi: libiscsi: Validate the ITT reflected in a Reject PDU

    Published
    CriticalCVSS 9.8 EPSS 0.55%

    In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy to find the task to clean up: memcpy(&reje...

  12. CVE-2026-99152 scsi: libiscsi: Validate the task named by a management response

    Published
    HighCVSS 7.5 EPSS 0.52%

    In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response __iscsi_complete_pdu() fetches the task for five response types from one place and checks only that the index resolved: case ISCSI_OP_LOGOUT_RSP: c...

  14. CVE-2026-99149 drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl

    Published
    LowCVSS 2.5 EPSS 0.16%

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl When amdgpu_hmm_range_alloc() fails amdgpu_gem_userptr_ioctl() returns -ENOMEM right away and skips the cleanup every other error path goes through. The...

  19. CVE-2026-99146 drm/i915/dmc: Add sanity check for DMC load address

    Published
    LowCVSS 3.0 EPSS 0.17%

    In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Add sanity check for DMC load address For DMC firmware header version 3, the firmware load address is stored in dmc_info->start_mmioaddr and later used by dmc_load_program(). Unlike the MMIO address...

  21. CVE-2026-99143 tracing: Keep the predicate limit separate from program capacity

    Published
    HighCVSS 7.8 EPSS 0.13%

    In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the predicate limit separate from program capacity predicate_parse() adds two to nr_preds to reserve the terminal TRUE and FALSE entries. It also uses that increased value as the limit for parsed pr...

  22. CVE-2026-99142 tracing: Check operator stack capacity before pushing

    Published
    HighCVSS 7.1 EPSS 0.14%

    In the Linux kernel, the following vulnerability has been resolved: tracing: Check operator stack capacity before pushing predicate_parse() uses the first operator stack entry before processing any opening parentheses. A push then increments top before writing. The existing check...

  23. CVE-2026-99141 tracing: Fix crash in print_graph_function_event()

    Published
    MediumCVSS 4.4 EPSS 0.16%

    In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash in print_graph_function_event() tracing_set_tracer() assigns the flags of the newly selected tracer with: tr->current_trace_flags = t->flags ? : t->tracer->flags; If the new tracer defines neit...

  24. CVE-2026-99140 tracing: Fix hist trigger timestamps for buffered events

    Published
    MediumCVSS 5.5 EPSS 0.17%

    In the Linux kernel, the following vulnerability has been resolved: tracing: Fix hist trigger timestamps for buffered events Syzkaller triggered a WARN_ON_ONCE(!nest) warning: WARNING: kernel/trace/ring_buffer.c:821 at ring_buffer_event_time_stamp Call trace: ring_buffer_event_ti...

  25. CVE-2026-99139 tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)

    Published
    HighCVSS 7.8 EPSS 0.17%

    In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION) do_tcp_getsockopt() reads icsk->icsk_ca_ops->name without holding rcu_read_lock(). Since commit 0baf26b0fcd7 ("bpf: tcp: Support tcp_congestion_ops in...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.