# ALAS2023-2026-3192: Security update for 19 packages ALAS2023-2026-3192, released November 7, 2026, fixes 481 CVEs across 19 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/alas2023-2026-3192 - Platform: Linux - Released: Nov 7, 2026 - Priority: Urgent (Closes CVE-2026-99999, rated Critical) - CVEs: 481, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-3192.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [bpftool6.18](https://patchblox.com/security/data/product/linux/bpftool6.18.md) | amzn 2023 | 1:6.18.54-121.166.amzn2023 | | [bpftool6.18-debuginfo](https://patchblox.com/security/data/product/linux/bpftool6.18-debuginfo.md) | amzn 2023 | 1:6.18.54-121.166.amzn2023 | | [kernel-livepatch-6.18.54-121.166](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.18.54-121.166.md) | amzn 2023 | 1:1.0-0.amzn2023 | | [kernel6.18](https://patchblox.com/security/data/product/linux/kernel6.18.md) | amzn 2023 | 1:6.18.54-121.166.amzn2023 | | [kernel6.18-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo.md) | amzn 2023 | 1:6.18.54-121.166.amzn2023 | | [kernel6.18-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.18.54-121.166.amzn2023 | | [kernel6.18-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.18.54-121.166.amzn2023 | | [kernel6.18-devel](https://patchblox.com/security/data/product/linux/kernel6.18-devel.md) | amzn 2023 | 1:6.18.54-121.166.amzn2023 | | [kernel6.18-headers](https://patchblox.com/security/data/product/linux/kernel6.18-headers.md) | amzn 2023 | 1:6.18.54-121.166.amzn2023 | | [kernel6.18-modules-extra](https://patchblox.com/security/data/product/linux/kernel6.18-modules-extra.md) | amzn 2023 | 1:6.18.54-121.166.amzn2023 | | [kernel6.18-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel6.18-modules-extra-common.md) | amzn 2023 | 1:6.18.54-121.166.amzn2023 | | [kernel6.18-tools](https://patchblox.com/security/data/product/linux/kernel6.18-tools.md) | amzn 2023 | 1:6.18.54-121.166.amzn2023 | | [kernel6.18-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.18-tools-debuginfo.md) | amzn 2023 | 1:6.18.54-121.166.amzn2023 | | [kernel6.18-tools-devel](https://patchblox.com/security/data/product/linux/kernel6.18-tools-devel.md) | amzn 2023 | 1:6.18.54-121.166.amzn2023 | | [microvm-kernel6.18](https://patchblox.com/security/data/product/linux/microvm-kernel6.18.md) | amzn 2023 | 1:6.18.54-121.166.amzn2023 | | [perf6.18](https://patchblox.com/security/data/product/linux/perf6.18.md) | amzn 2023 | 1:6.18.54-121.166.amzn2023 | | [perf6.18-debuginfo](https://patchblox.com/security/data/product/linux/perf6.18-debuginfo.md) | amzn 2023 | 1:6.18.54-121.166.amzn2023 | | [python3-perf6.18](https://patchblox.com/security/data/product/linux/python3-perf6.18.md) | amzn 2023 | 1:6.18.54-121.166.amzn2023 | | [python3-perf6.18-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf6.18-debuginfo.md) | amzn 2023 | 1:6.18.54-121.166.amzn2023 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-99999](https://patchblox.com/security/data/cve/CVE-2026-99999.md) | Urgent | ipv4: validate checksum_start before completing checksum | 9.3 | 0.0079 | | | [CVE-2026-90151](https://patchblox.com/security/data/cve/CVE-2026-90151.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: NFSv4: remove callback IDR entry on client alloc... | 9.8 | 0.0075 | | | [CVE-2026-89783](https://patchblox.com/security/data/cve/CVE-2026-89783.md) | Urgent | xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full | 9.8 | 0.0071 | | | [CVE-2026-89778](https://patchblox.com/security/data/cve/CVE-2026-89778.md) | Urgent | isofs: fix out-of-bounds page array access on empty zisofs block | 9.8 | 0.0070 | | | [CVE-2026-72355](https://patchblox.com/security/data/cve/CVE-2026-72355.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix barriering when walking subrequest li... | 9.8 | 0.0064 | | | [CVE-2026-90110](https://patchblox.com/security/data/cve/CVE-2026-90110.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: inetpeer: randomize RB-tree node comparison usin... | 9.4 | 0.0061 | | | [CVE-2026-98171](https://patchblox.com/security/data/cve/CVE-2026-98171.md) | Urgent | smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs | 9.8 | 0.0054 | | | [CVE-2026-72463](https://patchblox.com/security/data/cve/CVE-2026-72463.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resum... | 9.8 | 0.0044 | | | [CVE-2026-98174](https://patchblox.com/security/data/cve/CVE-2026-98174.md) | Urgent | smb: client: fix rlist race and missing initialization | 9.8 | 0.0033 | | | [CVE-2026-98167](https://patchblox.com/security/data/cve/CVE-2026-98167.md) | Urgent | smb: client: fix server->total_read for compound encrypted PDUs | 9.8 | 0.0022 | | | [CVE-2026-98170](https://patchblox.com/security/data/cve/CVE-2026-98170.md) | Urgent | smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() | 9.8 | 0.0022 | | | [CVE-2026-98214](https://patchblox.com/security/data/cve/CVE-2026-98214.md) | Urgent | selinux: recheck intermediate backing files on mprotect() | 9.8 | 0.0022 | | | [CVE-2026-98168](https://patchblox.com/security/data/cve/CVE-2026-98168.md) | Urgent | smb: client: fix reparse buffer bounds in cifs_query_reparse_point() | 9.8 | 0.0021 | | | [CVE-2026-98215](https://patchblox.com/security/data/cve/CVE-2026-98215.md) | Urgent | selinux: preserve user SID across nested backing files | 9.8 | 0.0021 | | | [CVE-2026-89915](https://patchblox.com/security/data/cve/CVE-2026-89915.md) | Urgent | KVM: arm64: Remove VM-wide VNCR mapping counter | 9.3 | 0.0019 | | | [CVE-2026-98319](https://patchblox.com/security/data/cve/CVE-2026-98319.md) | Urgent | drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr | 9.8 | 0.0018 | | | [CVE-2026-98322](https://patchblox.com/security/data/cve/CVE-2026-98322.md) | Urgent | netfilter: nft_nat: fully initialise new_addr in netmap setup | 9.8 | 0.0018 | | | [CVE-2026-98301](https://patchblox.com/security/data/cve/CVE-2026-98301.md) | Urgent | net: bridge: mst: move switchdev call outside rcu | 9.8 | 0.0018 | | | [CVE-2026-98303](https://patchblox.com/security/data/cve/CVE-2026-98303.md) | Urgent | ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup | 9.8 | 0.0018 | | | [CVE-2026-98233](https://patchblox.com/security/data/cve/CVE-2026-98233.md) | Urgent | net/packet: clear RX owner on VNET header error | 9.8 | 0.0018 | | | [CVE-2026-98255](https://patchblox.com/security/data/cve/CVE-2026-98255.md) | Urgent | tcp: exclude old ACKs from tcp fast path | 9.8 | 0.0018 | | | [CVE-2026-98317](https://patchblox.com/security/data/cve/CVE-2026-98317.md) | Urgent | neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS. | 9.8 | 0.0018 | | | [CVE-2026-98221](https://patchblox.com/security/data/cve/CVE-2026-98221.md) | Urgent | KEYS: trusted: Fix tpm2_load_cmd() boundary check | 9.8 | 0.0017 | | | [CVE-2026-98249](https://patchblox.com/security/data/cve/CVE-2026-98249.md) | Urgent | arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc | 9.8 | 0.0017 | | | [CVE-2026-98321](https://patchblox.com/security/data/cve/CVE-2026-98321.md) | Urgent | netfilter: nf_nat: unregister and release hooks on error | 9.8 | 0.0017 | | | [CVE-2026-98363](https://patchblox.com/security/data/cve/CVE-2026-98363.md) | Urgent | firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS | 9.8 | 0.0017 | | | [CVE-2026-98222](https://patchblox.com/security/data/cve/CVE-2026-98222.md) | Urgent | KEYS: encrypted: fix integer overflow of datablob_len | 9.8 | 0.0017 | | | [CVE-2026-98232](https://patchblox.com/security/data/cve/CVE-2026-98232.md) | Urgent | scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() | 9.8 | 0.0017 | | | [CVE-2026-98269](https://patchblox.com/security/data/cve/CVE-2026-98269.md) | Urgent | btrfs: abort transaction on failure to update inode for hole punching and reflinking | 9.8 | 0.0017 | | | [CVE-2026-98289](https://patchblox.com/security/data/cve/CVE-2026-98289.md) | Urgent | af_unix: Unify scc_index when finalising SCC in __unix_walk_scc(). | 9.8 | 0.0017 | | | [CVE-2026-98320](https://patchblox.com/security/data/cve/CVE-2026-98320.md) | Urgent | netfilter: flowtable: hold reference on ct until flow is released | 9.8 | 0.0014 | | | [CVE-2026-98251](https://patchblox.com/security/data/cve/CVE-2026-98251.md) | Urgent | openvswitch: avoid reallocating confirmed conntrack labels | 9.8 | 0.0013 | | | [CVE-2026-98253](https://patchblox.com/security/data/cve/CVE-2026-98253.md) | Urgent | RDMA/ucma: Serialize join and leave on copy_to_user failure | 9.8 | 0.0013 | | | [CVE-2026-98252](https://patchblox.com/security/data/cve/CVE-2026-98252.md) | Urgent | RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() | 9.8 | 0.0012 | | | [CVE-2026-98368](https://patchblox.com/security/data/cve/CVE-2026-98368.md) | Urgent | esp: downgrade zerocopy managed frags before mutating skb frags | 9.8 | 0.0012 | | | [CVE-2026-97524](https://patchblox.com/security/data/cve/CVE-2026-97524.md) | High | mptcp: avoid unneeded actions on subflow reset | 9.8 | 0.0075 | | | [CVE-2026-97523](https://patchblox.com/security/data/cve/CVE-2026-97523.md) | High | mptcp: close race between scheduler and state change | 7.5 | 0.0073 | | | [CVE-2026-89779](https://patchblox.com/security/data/cve/CVE-2026-89779.md) | High | fs/ntfs3: validate ef->size covers the record's name and value | 9.1 | 0.0070 | | | [CVE-2026-89786](https://patchblox.com/security/data/cve/CVE-2026-89786.md) | High | ext4: fix out-of-bounds read in ext4_read_inline_dir() | 9.1 | 0.0070 | | | [CVE-2026-90102](https://patchblox.com/security/data/cve/CVE-2026-90102.md) | High | NFSv4/pnfs: key the data server cache on the NFS version | 7.5 | 0.0070 | | | [CVE-2026-90103](https://patchblox.com/security/data/cve/CVE-2026-90103.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion... | 7.5 | 0.0070 | | | [CVE-2026-90067](https://patchblox.com/security/data/cve/CVE-2026-90067.md) | High | libceph: validate banner payload length | 7.5 | 0.0068 | | | [CVE-2026-90149](https://patchblox.com/security/data/cve/CVE-2026-90149.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: fix NULL dereference for NFSv4.... | 7.5 | 0.0067 | | | [CVE-2026-90235](https://patchblox.com/security/data/cve/CVE-2026-90235.md) | High | sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE | 9.8 | 0.0066 | | | [CVE-2026-89971](https://patchblox.com/security/data/cve/CVE-2026-89971.md) | High | nvme: skip the zoned limits update if the zone info query failed | 7.5 | 0.0061 | | | [CVE-2026-98056](https://patchblox.com/security/data/cve/CVE-2026-98056.md) | High | nvme: remove stale namespaces by NSID range during scan | 7.5 | 0.0061 | | | [CVE-2026-98401](https://patchblox.com/security/data/cve/CVE-2026-98401.md) | High | net: iptunnel: fix stale transport header during tunnel decapsulation | 7.5 | 0.0060 | | | [CVE-2026-97555](https://patchblox.com/security/data/cve/CVE-2026-97555.md) | High | smb: client: fix heap overflow in DACL owner/group rewrite | 9.8 | 0.0058 | | | [CVE-2026-98069](https://patchblox.com/security/data/cve/CVE-2026-98069.md) | High | net/rds: acquire the fastpath locks in rds_conn_shutdown() | 8.1 | 0.0056 | | | [CVE-2026-98096](https://patchblox.com/security/data/cve/CVE-2026-98096.md) | High | ipv6: sr: restore network header before routing and forwarding | 7.8 | 0.0051 | | | [CVE-2026-72438](https://patchblox.com/security/data/cve/CVE-2026-72438.md) | High | md/raid10: fix writes_pending and barrier reference leaks on discard failures | 7.5 | 0.0050 | | | [CVE-2026-97417](https://patchblox.com/security/data/cve/CVE-2026-97417.md) | High | netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() | 8.8 | 0.0049 | | | [CVE-2026-98070](https://patchblox.com/security/data/cve/CVE-2026-98070.md) | High | net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() | 8.1 | 0.0047 | | | [CVE-2026-92489](https://patchblox.com/security/data/cve/CVE-2026-92489.md) | High | xfrm: Fix skb double-free in xfrm_dev_direct_output() | 9.8 | 0.0046 | | | [CVE-2026-98130](https://patchblox.com/security/data/cve/CVE-2026-98130.md) | High | sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START | 8.1 | 0.0045 | | | [CVE-2026-98169](https://patchblox.com/security/data/cve/CVE-2026-98169.md) | High | smb: client: fix potential OOB read in smb3_enum_snapshots() | 7.1 | 0.0045 | | | [CVE-2026-90141](https://patchblox.com/security/data/cve/CVE-2026-90141.md) | High | ipvs: fix integer overflow in ftp helper port/address parsing | 9.8 | 0.0045 | | | [CVE-2026-97562](https://patchblox.com/security/data/cve/CVE-2026-97562.md) | High | smb: client: pin DFS superblock in iterator callback | 7.8 | 0.0041 | | | [CVE-2026-98261](https://patchblox.com/security/data/cve/CVE-2026-98261.md) | High | cifs: Fix server use-after-free in cifs_chan_skip_or_disable() | 8.1 | 0.0041 | | | [CVE-2026-64210](https://patchblox.com/security/data/cve/CVE-2026-64210.md) | High | net/mlx5e: xsk: Fix unlocked writing to ICOSQ | 7.5 | 0.0037 | | | [CVE-2026-98173](https://patchblox.com/security/data/cve/CVE-2026-98173.md) | High | smb: client: fix use-after-free of iface in cifs_try_adding_channels() | 7.5 | 0.0035 | | | [CVE-2026-93787](https://patchblox.com/security/data/cve/CVE-2026-93787.md) | High | smb: client: bound dirent name against end of SMB response in cifs_filldir | 9.8 | 0.0034 | | | [CVE-2026-90329](https://patchblox.com/security/data/cve/CVE-2026-90329.md) | High | HID: synchronize input before cleaning up a failed probe | 8.8 | 0.0034 | | | [CVE-2026-93189](https://patchblox.com/security/data/cve/CVE-2026-93189.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: HID: core: quiesce input in hid_hw_stop() to pre... | 9.8 | 0.0032 | | | [CVE-2026-98175](https://patchblox.com/security/data/cve/CVE-2026-98175.md) | High | smb: client: cancel reconnect work in clean_demultiplex_info() | 8.1 | 0.0032 | | | [CVE-2026-97433](https://patchblox.com/security/data/cve/CVE-2026-97433.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nvme: validate FDP configuration descriptor size... | 8.2 | 0.0032 | | | [CVE-2026-89796](https://patchblox.com/security/data/cve/CVE-2026-89796.md) | High | mm/damon/core: avoid infinite kdamond_merge_regions() internal loop | 7.8 | 0.0023 | | | [CVE-2026-97558](https://patchblox.com/security/data/cve/CVE-2026-97558.md) | High | smb: client: fix cifsFileInfo reference leak in deferred close | 7.1 | 0.0023 | | | [CVE-2026-90200](https://patchblox.com/security/data/cve/CVE-2026-90200.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix integer overflow in MFT cluster va... | n/a | 0.0023 | | | [CVE-2026-98417](https://patchblox.com/security/data/cve/CVE-2026-98417.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp trans... | n/a | 0.0022 | | | [CVE-2026-90150](https://patchblox.com/security/data/cve/CVE-2026-90150.md) | High | pnfs/blocklayout: Fix device leaks on parse failure | 9.8 | 0.0022 | | | [CVE-2026-92500](https://patchblox.com/security/data/cve/CVE-2026-92500.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ext4: use fsdata to track inline data write stat... | n/a | 0.0022 | | | [CVE-2026-97616](https://patchblox.com/security/data/cve/CVE-2026-97616.md) | High | net/sched: act_api: release all action references on NEWACTION failure | 7.1 | 0.0022 | | | [CVE-2026-97901](https://patchblox.com/security/data/cve/CVE-2026-97901.md) | High | genetlink: pin family module during policy dump | 7.1 | 0.0022 | | | [CVE-2026-90073](https://patchblox.com/security/data/cve/CVE-2026-90073.md) | High | net/sched: hhf: clamp quantum before hhf_change() to avoid overflow | 7.8 | 0.0022 | | | [CVE-2026-90081](https://patchblox.com/security/data/cve/CVE-2026-90081.md) | High | net/rds: use wq_has_sleeper() in rds_cong_map_updated() | 7.8 | 0.0022 | | | [CVE-2026-90284](https://patchblox.com/security/data/cve/CVE-2026-90284.md) | High | firmware_loader: do not queue completed sysfs fallback requests | 7.8 | 0.0022 | | | [CVE-2026-90334](https://patchblox.com/security/data/cve/CVE-2026-90334.md) | High | tty: clear cdev pointer after cdev_add() failure | 7.8 | 0.0022 | | | [CVE-2026-97564](https://patchblox.com/security/data/cve/CVE-2026-97564.md) | High | smb: client: reject userspace cifs.idmap descriptions | 7.8 | 0.0022 | | | [CVE-2026-97598](https://patchblox.com/security/data/cve/CVE-2026-97598.md) | High | ipv4: fib: bound automatic table ID allocation | 7.8 | 0.0022 | | | [CVE-2026-97998](https://patchblox.com/security/data/cve/CVE-2026-97998.md) | High | netfilter: nfnetlink_log: cope with concurrent instance destruction | 7.8 | 0.0022 | | | [CVE-2026-98076](https://patchblox.com/security/data/cve/CVE-2026-98076.md) | High | tracing/probes: Fix use-after-free on field name/type of events with multiple probes | 7.8 | 0.0022 | | | [CVE-2026-90318](https://patchblox.com/security/data/cve/CVE-2026-90318.md) | High | fat: release buffer head after rebuilding parent | 7.1 | 0.0022 | | | [CVE-2026-97568](https://patchblox.com/security/data/cve/CVE-2026-97568.md) | High | mptcp: syncookies: remember the request backup flag | 7.1 | 0.0022 | | | [CVE-2026-97904](https://patchblox.com/security/data/cve/CVE-2026-97904.md) | High | cpufreq: initialize policy rwsem before sysfs publication | 7.0 | 0.0022 | | | [CVE-2026-97533](https://patchblox.com/security/data/cve/CVE-2026-97533.md) | High | x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF | n/a | 0.0022 | | | [CVE-2026-98047](https://patchblox.com/security/data/cve/CVE-2026-98047.md) | High | bpf: Check ancestor frames for rbtree callbacks | n/a | 0.0022 | | | [CVE-2026-90247](https://patchblox.com/security/data/cve/CVE-2026-90247.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix mmap_lock leak in irq_work path stack_... | n/a | 0.0022 | | | [CVE-2026-93146](https://patchblox.com/security/data/cve/CVE-2026-93146.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: time/namespace: Validate nanosecond field in pro... | n/a | 0.0022 | | | [CVE-2026-90076](https://patchblox.com/security/data/cve/CVE-2026-90076.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: fq: add overflow bounds to quantum an... | 7.8 | 0.0021 | | | [CVE-2026-97559](https://patchblox.com/security/data/cve/CVE-2026-97559.md) | High | smb: client: fail DACL rewrite when the new DACL exceeds 64K | 7.8 | 0.0021 | | | [CVE-2026-97619](https://patchblox.com/security/data/cve/CVE-2026-97619.md) | High | io_uring/rw: end write accounting from ->ki_complete | 7.1 | 0.0021 | | | [CVE-2026-93163](https://patchblox.com/security/data/cve/CVE-2026-93163.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: hwrng: core - fix rng list on registration error... | 7.0 | 0.0021 | | | [CVE-2026-90097](https://patchblox.com/security/data/cve/CVE-2026-90097.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Skip VMBus module cleanup fo... | n/a | 0.0021 | | | [CVE-2026-90259](https://patchblox.com/security/data/cve/CVE-2026-90259.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix a wrong length calculation in... | n/a | 0.0021 | | | [CVE-2026-97556](https://patchblox.com/security/data/cve/CVE-2026-97556.md) | High | smb: client: avoid leaking refcount when cifs_sb_tlink() fails | 8.8 | 0.0021 | | | [CVE-2026-90063](https://patchblox.com/security/data/cve/CVE-2026-90063.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don't overfl... | 7.8 | 0.0021 | | | [CVE-2026-90139](https://patchblox.com/security/data/cve/CVE-2026-90139.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fuse: check for NULL root inode in fuse_fill_sup... | 7.8 | 0.0021 | | | [CVE-2026-90140](https://patchblox.com/security/data/cve/CVE-2026-90140.md) | High | cuse: wait for pending RCU callbacks on module exit | 7.8 | 0.0021 | | | [CVE-2026-90248](https://patchblox.com/security/data/cve/CVE-2026-90248.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: fix teardown of an adopted p... | 7.8 | 0.0021 | | | [CVE-2026-93109](https://patchblox.com/security/data/cve/CVE-2026-93109.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Drain RCU callbacks during module tea... | 7.8 | 0.0021 | | | [CVE-2026-89785](https://patchblox.com/security/data/cve/CVE-2026-89785.md) | High | fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init | 7.1 | 0.0021 | | | [CVE-2026-90313](https://patchblox.com/security/data/cve/CVE-2026-90313.md) | High | bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed | 7.1 | 0.0021 | | | [CVE-2026-90086](https://patchblox.com/security/data/cve/CVE-2026-90086.md) | High | xsk: honor XDP_TX_METADATA in zero-copy path | n/a | 0.0021 | | | [CVE-2026-98414](https://patchblox.com/security/data/cve/CVE-2026-98414.md) | High | memcg: avoid charging the root memcg from obj_cgroup_charge_pages() | n/a | 0.0021 | | | [CVE-2026-90115](https://patchblox.com/security/data/cve/CVE-2026-90115.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: xsk: fix NULL pointer dereference in __xsk_rcv()... | 7.8 | 0.0021 | | | [CVE-2026-90184](https://patchblox.com/security/data/cve/CVE-2026-90184.md) | High | null_blk: serialize configfs attribute updates with device setup | 7.8 | 0.0021 | | | [CVE-2026-90187](https://patchblox.com/security/data/cve/CVE-2026-90187.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: null_blk: free zones array on device power-off... | 7.8 | 0.0021 | | | [CVE-2026-90188](https://patchblox.com/security/data/cve/CVE-2026-90188.md) | High | null_blk: free global tag_set on init error path | 7.8 | 0.0021 | | | [CVE-2026-90201](https://patchblox.com/security/data/cve/CVE-2026-90201.md) | High | net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race | 7.8 | 0.0021 | | | [CVE-2026-90385](https://patchblox.com/security/data/cve/CVE-2026-90385.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: md/raid1: create serial pool adding rdev to arra... | 7.8 | 0.0021 | | | [CVE-2026-93134](https://patchblox.com/security/data/cve/CVE-2026-93134.md) | High | printk: Fix possible console use-after-free | 7.8 | 0.0021 | | | [CVE-2026-93182](https://patchblox.com/security/data/cve/CVE-2026-93182.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix overflow in update_tg_cfs_runnab... | 7.8 | 0.0021 | | | [CVE-2026-97617](https://patchblox.com/security/data/cve/CVE-2026-97617.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Check resize_disabled before publis... | 7.8 | 0.0021 | | | [CVE-2026-97938](https://patchblox.com/security/data/cve/CVE-2026-97938.md) | High | reboot: fix cad_pid use-after-free race | 7.8 | 0.0021 | | | [CVE-2026-97950](https://patchblox.com/security/data/cve/CVE-2026-97950.md) | High | configfs: pin the symlink target's dirent instead of chasing ->ci_dentry | 7.8 | 0.0021 | | | [CVE-2026-98104](https://patchblox.com/security/data/cve/CVE-2026-98104.md) | High | net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted | 7.8 | 0.0021 | | | [CVE-2026-98248](https://patchblox.com/security/data/cve/CVE-2026-98248.md) | High | arm64: percpu: Fix LSE operations on {8,16}-bit types | 7.8 | 0.0021 | | | [CVE-2026-98231](https://patchblox.com/security/data/cve/CVE-2026-98231.md) | High | xfrm: serialize state GC with device state flush | 7.1 | 0.0021 | | | [CVE-2026-93150](https://patchblox.com/security/data/cve/CVE-2026-93150.md) | High | cgroup/cpuset: Make nr_deadline_tasks an atomic_t | 7.0 | 0.0021 | | | [CVE-2026-80729](https://patchblox.com/security/data/cve/CVE-2026-80729.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: initialise workingset state befo... | n/a | 0.0021 | | | [CVE-2026-89790](https://patchblox.com/security/data/cve/CVE-2026-89790.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid divide by zero in rt6_multipath_reba... | n/a | 0.0021 | | | [CVE-2026-89917](https://patchblox.com/security/data/cve/CVE-2026-89917.md) | High | KVM: arm64: Handle VNCR TLB invalidation race with vcpu_put() VNCR unmapping | n/a | 0.0021 | | | [CVE-2026-90077](https://patchblox.com/security/data/cve/CVE-2026-90077.md) | High | net: fix a resource leak in copy_net_ns() error handling path | n/a | 0.0021 | | | [CVE-2026-90094](https://patchblox.com/security/data/cve/CVE-2026-90094.md) | High | arm64: process: Fix context switching MTE store-only tag check | n/a | 0.0021 | | | [CVE-2026-90113](https://patchblox.com/security/data/cve/CVE-2026-90113.md) | High | netdevsim: update queue NAPI association on queue reset | n/a | 0.0021 | | | [CVE-2026-90129](https://patchblox.com/security/data/cve/CVE-2026-90129.md) | High | virtio_balloon: quiesce balloon work before device shutdown | n/a | 0.0021 | | | [CVE-2026-90233](https://patchblox.com/security/data/cve/CVE-2026-90233.md) | High | nvme-pci: release descriptor pools on probe failure | n/a | 0.0021 | | | [CVE-2026-90269](https://patchblox.com/security/data/cve/CVE-2026-90269.md) | High | bpf: Reject load-acquire from pointers requiring fault protection | n/a | 0.0021 | | | [CVE-2026-90272](https://patchblox.com/security/data/cve/CVE-2026-90272.md) | High | perf: arm_pmuv3: Zero initialize hw_id branch stack field | n/a | 0.0021 | | | [CVE-2026-90278](https://patchblox.com/security/data/cve/CVE-2026-90278.md) | High | md: wait for behind writes before destroying bitmap | n/a | 0.0021 | | | [CVE-2026-90338](https://patchblox.com/security/data/cve/CVE-2026-90338.md) | High | serial: amba-pl011: keep console clock enabled for atomic writes | n/a | 0.0021 | | | [CVE-2026-90396](https://patchblox.com/security/data/cve/CVE-2026-90396.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: block: fix dio leak on metadata mapping error A... | n/a | 0.0021 | | | [CVE-2026-92516](https://patchblox.com/security/data/cve/CVE-2026-92516.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix offset warn check for bpf_res_spin_lock... | n/a | 0.0021 | | | [CVE-2026-98398](https://patchblox.com/security/data/cve/CVE-2026-98398.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: locking/lockdep: Invalidate stale class_cache en... | n/a | 0.0021 | | | [CVE-2026-93117](https://patchblox.com/security/data/cve/CVE-2026-93117.md) | High | usb: fix UAF when probe runs concurrent to dyn ID removal | 7.8 | 0.0021 | | | [CVE-2026-97942](https://patchblox.com/security/data/cve/CVE-2026-97942.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: x86/alternatives: Exclude text poking against ch... | n/a | 0.0020 | | | [CVE-2026-97943](https://patchblox.com/security/data/cve/CVE-2026-97943.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Acquire init_mm write lock on collap... | n/a | 0.0020 | | | [CVE-2026-98390](https://patchblox.com/security/data/cve/CVE-2026-98390.md) | High | x86/amd_node: Avoid divide by zero on virtualized systems | n/a | 0.0020 | | | [CVE-2026-97560](https://patchblox.com/security/data/cve/CVE-2026-97560.md) | High | smb: client: fix one-byte OOB read in smb2_parse_native_symlink() | 8.8 | 0.0020 | | | [CVE-2026-90279](https://patchblox.com/security/data/cve/CVE-2026-90279.md) | High | md/raid5: round bitmap stripes with sector division | 7.8 | 0.0020 | | | [CVE-2026-90389](https://patchblox.com/security/data/cve/CVE-2026-90389.md) | High | md: scope memalloc_noio to allocation critical sections | 7.1 | 0.0020 | | | [CVE-2026-90426](https://patchblox.com/security/data/cve/CVE-2026-90426.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Free the error IRQ before... | n/a | 0.0020 | | | [CVE-2026-90430](https://patchblox.com/security/data/cve/CVE-2026-90430.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Publish an LVCMDQ only aft... | n/a | 0.0020 | | | [CVE-2026-97565](https://patchblox.com/security/data/cve/CVE-2026-97565.md) | High | smb: client: reject short READ responses in CIFSSMBRead() | 8.1 | 0.0020 | | | [CVE-2026-92499](https://patchblox.com/security/data/cve/CVE-2026-92499.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ext4: validate readdir offset before accessing d... | n/a | 0.0020 | | | [CVE-2026-97610](https://patchblox.com/security/data/cve/CVE-2026-97610.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix uninitialized return value in netfs_u... | n/a | 0.0020 | | | [CVE-2026-97946](https://patchblox.com/security/data/cve/CVE-2026-97946.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: x86/amd_node: Fix PCI device reference counting... | n/a | 0.0020 | | | [CVE-2026-97947](https://patchblox.com/security/data/cve/CVE-2026-97947.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: x86/amd_node: Fix potential NULL pointer derefer... | n/a | 0.0020 | | | [CVE-2026-98060](https://patchblox.com/security/data/cve/CVE-2026-98060.md) | High | bpf: Reject resilient lock operations in rbtree callbacks | n/a | 0.0020 | | | [CVE-2026-98061](https://patchblox.com/security/data/cve/CVE-2026-98061.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Reject tail calls directly from callback fr... | n/a | 0.0020 | | | [CVE-2026-98258](https://patchblox.com/security/data/cve/CVE-2026-98258.md) | High | posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list | 7.8 | 0.0019 | | | [CVE-2026-98260](https://patchblox.com/security/data/cve/CVE-2026-98260.md) | High | exec: Cleanup POSIX timers right after de_thread() | 8.8 | 0.0019 | | | [CVE-2026-89781](https://patchblox.com/security/data/cve/CVE-2026-89781.md) | High | fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() | 8.4 | 0.0019 | | | [CVE-2026-89791](https://patchblox.com/security/data/cve/CVE-2026-89791.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: perf: Fix use-after-free when perf mmap() reviva... | 7.8 | 0.0018 | | | [CVE-2026-98240](https://patchblox.com/security/data/cve/CVE-2026-98240.md) | High | net: ip_tunnel: initialize `options_len` before referencing options | n/a | 0.0018 | | | [CVE-2026-89782](https://patchblox.com/security/data/cve/CVE-2026-89782.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject restart table growth beyond U16... | 8.4 | 0.0018 | | | [CVE-2026-93073](https://patchblox.com/security/data/cve/CVE-2026-93073.md) | High | dax: read holder_ops once in dax_holder_notify_failure() | 7.1 | 0.0018 | | | [CVE-2026-68289](https://patchblox.com/security/data/cve/CVE-2026-68289.md) | High | tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() | 7.0 | 0.0018 | | | [CVE-2026-98900](https://patchblox.com/security/data/cve/CVE-2026-98900.md) | High | xen/gntalloc: validate grant count before allocation | 7.8 | 0.0018 | | | [CVE-2026-98881](https://patchblox.com/security/data/cve/CVE-2026-98881.md) | High | net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() | 7.1 | 0.0018 | | | [CVE-2026-98902](https://patchblox.com/security/data/cve/CVE-2026-98902.md) | High | md/raid5: let stripe batch bm_seq comparison wrap-safe | 7.1 | 0.0018 | | | [CVE-2026-97959](https://patchblox.com/security/data/cve/CVE-2026-97959.md) | High | net/sched: cls_route: free emptied bucket on filter move | 9.1 | 0.0018 | | | [CVE-2026-97995](https://patchblox.com/security/data/cve/CVE-2026-97995.md) | High | virtio_console: do not free control-out buffers on remove | 7.8 | 0.0018 | | | [CVE-2026-98011](https://patchblox.com/security/data/cve/CVE-2026-98011.md) | High | net/sched: hhf: clamp quantum in change and init paths | 7.8 | 0.0018 | | | [CVE-2026-98015](https://patchblox.com/security/data/cve/CVE-2026-98015.md) | High | net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put | 7.8 | 0.0018 | | | [CVE-2026-98074](https://patchblox.com/security/data/cve/CVE-2026-98074.md) | High | bonding: do not clear curr_active_slave prematurely when releasing all slaves | 7.8 | 0.0018 | | | [CVE-2026-98342](https://patchblox.com/security/data/cve/CVE-2026-98342.md) | High | dmaengine: wait for RCU readers before releasing dma_device | 7.8 | 0.0018 | | | [CVE-2026-98343](https://patchblox.com/security/data/cve/CVE-2026-98343.md) | High | dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() | 7.8 | 0.0018 | | | [CVE-2026-97951](https://patchblox.com/security/data/cve/CVE-2026-97951.md) | High | scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands | 7.5 | 0.0018 | | | [CVE-2026-93055](https://patchblox.com/security/data/cve/CVE-2026-93055.md) | High | UDF symlink pathComponent header OOB read | 7.1 | 0.0018 | | | [CVE-2026-98063](https://patchblox.com/security/data/cve/CVE-2026-98063.md) | High | bpf: Fix NULL-ptr-deref in btf_var_show() | 7.1 | 0.0018 | | | [CVE-2026-98064](https://patchblox.com/security/data/cve/CVE-2026-98064.md) | High | bpf: Fix NULL-ptr-deref when showing a void BTF type | 7.1 | 0.0018 | | | [CVE-2026-98072](https://patchblox.com/security/data/cve/CVE-2026-98072.md) | High | net/rds: use wq_has_sleeper() in release_in_xmit() | 7.1 | 0.0018 | | | [CVE-2026-98201](https://patchblox.com/security/data/cve/CVE-2026-98201.md) | High | Input: zero ff_effect before compat copy in input_ff_effect_from_user | 7.1 | 0.0018 | | | [CVE-2026-98234](https://patchblox.com/security/data/cve/CVE-2026-98234.md) | High | net/sched: hhf: cap hh_flows_limit at change time | 7.1 | 0.0018 | | | [CVE-2026-92521](https://patchblox.com/security/data/cve/CVE-2026-92521.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ACPI: PCI: Clear driver_data on all paths that f... | 7.0 | 0.0018 | | | [CVE-2026-98068](https://patchblox.com/security/data/cve/CVE-2026-98068.md) | High | net/rds: don't let rds_conn_shutdown() consume a concurrent drop | 7.0 | 0.0018 | | | [CVE-2026-93138](https://patchblox.com/security/data/cve/CVE-2026-93138.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix vmlinux BTF prep race in bpf_get_btf_vm... | 7.8 | 0.0018 | | | [CVE-2026-98021](https://patchblox.com/security/data/cve/CVE-2026-98021.md) | High | net: reject oversized tx_queue_len at netlink parse time | 7.8 | 0.0018 | | | [CVE-2026-90161](https://patchblox.com/security/data/cve/CVE-2026-90161.md) | High | erofs: fix interlaced ztailpacking pclusters | 7.1 | 0.0018 | | | [CVE-2026-90241](https://patchblox.com/security/data/cve/CVE-2026-90241.md) | High | iommu/vt-d: Tear down scalable-mode context on probe failure | 8.2 | 0.0018 | | | [CVE-2026-72315](https://patchblox.com/security/data/cve/CVE-2026-72315.md) | High | smb: client: fix busy dentry warning on unmount after DIO | 7.8 | 0.0018 | | | [CVE-2026-90199](https://patchblox.com/security/data/cve/CVE-2026-90199.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject out-of-range evcn in mi_enum_at... | 7.8 | 0.0017 | | | [CVE-2026-90425](https://patchblox.com/security/data/cve/CVE-2026-90425.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Require exactly one Stream... | 8.8 | 0.0017 | | | [CVE-2026-98089](https://patchblox.com/security/data/cve/CVE-2026-98089.md) | High | bonding: alb: fix uninitialized transport header access in alb_determine_nd() | 8.1 | 0.0017 | | | [CVE-2026-89815](https://patchblox.com/security/data/cve/CVE-2026-89815.md) | High | drm/ttm: Drop tt->restore after successful restore | 7.8 | 0.0017 | | | [CVE-2026-90189](https://patchblox.com/security/data/cve/CVE-2026-90189.md) | High | null_blk: register configfs subsystem after creating default devices | 7.8 | 0.0017 | | | [CVE-2026-90244](https://patchblox.com/security/data/cve/CVE-2026-90244.md) | High | iommu/dma: Restore locking around msi_page_list | 7.8 | 0.0017 | | | [CVE-2026-92509](https://patchblox.com/security/data/cve/CVE-2026-92509.md) | High | RDMA/core: Fix potential use after free in counter_release() | 7.8 | 0.0017 | | | [CVE-2026-92512](https://patchblox.com/security/data/cve/CVE-2026-92512.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix use after free in ib_query_qp()... | 7.8 | 0.0017 | | | [CVE-2026-93785](https://patchblox.com/security/data/cve/CVE-2026-93785.md) | High | cifs: validate idmap key payload length | 7.8 | 0.0017 | | | [CVE-2026-97441](https://patchblox.com/security/data/cve/CVE-2026-97441.md) | High | ata: ahci: fail probe if BAR too small for claimed ports | 7.8 | 0.0017 | | | [CVE-2026-97964](https://patchblox.com/security/data/cve/CVE-2026-97964.md) | High | ppp_synctty: ensure a writeable skb header | 7.8 | 0.0017 | | | [CVE-2026-98016](https://patchblox.com/security/data/cve/CVE-2026-98016.md) | High | net/mlx5e: Fix use-after-free race in sample_restore_put() | 7.8 | 0.0017 | | | [CVE-2026-98245](https://patchblox.com/security/data/cve/CVE-2026-98245.md) | High | btrfs: take commit root semaphore when iterating in mark_block_group_to_copy() | 7.8 | 0.0017 | | | [CVE-2026-98014](https://patchblox.com/security/data/cve/CVE-2026-98014.md) | High | net/mlx5: E-Switch, prevent mc_list repopulation during vport disable | 7.1 | 0.0017 | | | [CVE-2026-98046](https://patchblox.com/security/data/cve/CVE-2026-98046.md) | High | bpf: Mark bpf_btf_find_by_name_kind() as sleepable | 7.1 | 0.0017 | | | [CVE-2026-98075](https://patchblox.com/security/data/cve/CVE-2026-98075.md) | High | bpf: reject BPF_PSEUDO_FUNC reference to the main program | 7.1 | 0.0017 | | | [CVE-2026-97430](https://patchblox.com/security/data/cve/CVE-2026-97430.md) | High | xhci: Prevent queuing new commands if xhci is inaccessible | 7.0 | 0.0017 | | | [CVE-2026-98088](https://patchblox.com/security/data/cve/CVE-2026-98088.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid out-of-bounds cpumask_of_no... | 7.0 | 0.0017 | | | [CVE-2026-97447](https://patchblox.com/security/data/cve/CVE-2026-97447.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ACPICA: Enhance OEM ID and Table ID validation i... | 7.0 | 0.0017 | | | [CVE-2026-90326](https://patchblox.com/security/data/cve/CVE-2026-90326.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix race between policy activation a... | 7.8 | 0.0017 | | | [CVE-2026-90203](https://patchblox.com/security/data/cve/CVE-2026-90203.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: Squashfs: check block offset is not negative If... | 7.1 | 0.0017 | | | [CVE-2026-90002](https://patchblox.com/security/data/cve/CVE-2026-90002.md) | High | ftrace: Take trace_array reference before accessing its ftrace_ops | 7.8 | 0.0017 | | | [CVE-2026-90146](https://patchblox.com/security/data/cve/CVE-2026-90146.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf, xdp: move offload check into dev_xdp_instal... | 7.8 | 0.0017 | | | [CVE-2026-90358](https://patchblox.com/security/data/cve/CVE-2026-90358.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix trampoline stack size for 128-bit... | 7.8 | 0.0017 | | | [CVE-2026-90388](https://patchblox.com/security/data/cve/CVE-2026-90388.md) | High | iommu/dma: Check atomic pool allocation result directly | 7.8 | 0.0017 | | | [CVE-2026-90392](https://patchblox.com/security/data/cve/CVE-2026-90392.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF when reading bpf link inf... | 7.8 | 0.0017 | | | [CVE-2026-97612](https://patchblox.com/security/data/cve/CVE-2026-97612.md) | High | net: mpls: clear inner_protocol when the last label is popped | 7.8 | 0.0017 | | | [CVE-2026-97940](https://patchblox.com/security/data/cve/CVE-2026-97940.md) | High | ipv6: fix fib6 walker UAF on seq stop | 7.8 | 0.0017 | | | [CVE-2026-98899](https://patchblox.com/security/data/cve/CVE-2026-98899.md) | High | netfilter: ipset: mark the rcu locked areas properly | 7.8 | 0.0017 | | | [CVE-2026-93112](https://patchblox.com/security/data/cve/CVE-2026-93112.md) | High | bpf: Require a BPF cpumask for bpf_cpumask_populate() | 7.1 | 0.0017 | | | [CVE-2026-97984](https://patchblox.com/security/data/cve/CVE-2026-97984.md) | High | net: ipv6: Fix UDP length overflow with PMTU discover and big MTU | 9.1 | 0.0017 | | | [CVE-2026-90227](https://patchblox.com/security/data/cve/CVE-2026-90227.md) | High | nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() | 8.8 | 0.0017 | | | [CVE-2026-97525](https://patchblox.com/security/data/cve/CVE-2026-97525.md) | High | x86/mm/pat: Allocate split page tables as kernel page tables | 8.2 | 0.0017 | | | [CVE-2026-74258](https://patchblox.com/security/data/cve/CVE-2026-74258.md) | High | bpf: Guard __get_user acesss with access_ok for uprobe_multi data | 7.8 | 0.0017 | | | [CVE-2026-97949](https://patchblox.com/security/data/cve/CVE-2026-97949.md) | High | configfs: unhash the dentry before dropping the item in rmdir | 7.8 | 0.0017 | | | [CVE-2026-97978](https://patchblox.com/security/data/cve/CVE-2026-97978.md) | High | eth: ice: don't dereference pointers from TP_printk() | 7.8 | 0.0017 | | | [CVE-2026-98026](https://patchblox.com/security/data/cve/CVE-2026-98026.md) | High | net: bridge: mcast: properly convert mglist to rcu | 7.8 | 0.0017 | | | [CVE-2026-98101](https://patchblox.com/security/data/cve/CVE-2026-98101.md) | High | ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() | 7.8 | 0.0017 | | | [CVE-2026-98102](https://patchblox.com/security/data/cve/CVE-2026-98102.md) | High | ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src() | 7.8 | 0.0017 | | | [CVE-2026-98103](https://patchblox.com/security/data/cve/CVE-2026-98103.md) | High | igmp: convert struct ip_sf_list to RCU | 7.8 | 0.0017 | | | [CVE-2026-98229](https://patchblox.com/security/data/cve/CVE-2026-98229.md) | High | xfrm: save input state data before secpath resets | 7.8 | 0.0017 | | | [CVE-2026-68337](https://patchblox.com/security/data/cve/CVE-2026-68337.md) | High | bpf: Reject redirect helpers without a bpf_net_context | 7.3 | 0.0017 | | | [CVE-2026-97961](https://patchblox.com/security/data/cve/CVE-2026-97961.md) | High | perf/core: Allow list_del during perf_event_overflow() | 7.1 | 0.0017 | | | [CVE-2026-97962](https://patchblox.com/security/data/cve/CVE-2026-97962.md) | High | net/mlx5e: Move representor vnic reporter to eswitch devlink port | 7.1 | 0.0017 | | | [CVE-2026-97965](https://patchblox.com/security/data/cve/CVE-2026-97965.md) | High | vxlan: initialize _md in vxlan_xmit_one() | 7.1 | 0.0017 | | | [CVE-2026-98044](https://patchblox.com/security/data/cve/CVE-2026-98044.md) | High | bpf: Reject legacy packet loads from callbacks | 7.1 | 0.0017 | | | [CVE-2026-90424](https://patchblox.com/security/data/cve/CVE-2026-90424.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix VINTF0 leak on the ini... | n/a | 0.0017 | | | [CVE-2026-90428](https://patchblox.com/security/data/cve/CVE-2026-90428.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't run the error ISR be... | n/a | 0.0017 | | | [CVE-2026-93066](https://patchblox.com/security/data/cve/CVE-2026-93066.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Take cpa_lock around large-page coll... | n/a | 0.0017 | | | [CVE-2026-97956](https://patchblox.com/security/data/cve/CVE-2026-97956.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: net_failover: Fix the deadlock in net_failo... | n/a | 0.0017 | | | [CVE-2026-97974](https://patchblox.com/security/data/cve/CVE-2026-97974.md) | High | ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings() | n/a | 0.0017 | | | [CVE-2026-98000](https://patchblox.com/security/data/cve/CVE-2026-98000.md) | High | hwmon: Fix potential UAF in pec_store | n/a | 0.0017 | | | [CVE-2026-98223](https://patchblox.com/security/data/cve/CVE-2026-98223.md) | High | mm: filemap: retain mapped dropbehind folios | n/a | 0.0017 | | | [CVE-2026-98224](https://patchblox.com/security/data/cve/CVE-2026-98224.md) | High | mm/vma: correctly unaccount on mmap_prepare() failure | n/a | 0.0017 | | | [CVE-2026-98226](https://patchblox.com/security/data/cve/CVE-2026-98226.md) | High | mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count | n/a | 0.0017 | | | [CVE-2026-98244](https://patchblox.com/security/data/cve/CVE-2026-98244.md) | High | btrfs: clear free space tree creation state on rebuild failure | n/a | 0.0017 | | | [CVE-2026-98259](https://patchblox.com/security/data/cve/CVE-2026-98259.md) | High | fs/dax: check zero or empty entry before converting xarray entry | n/a | 0.0017 | | | [CVE-2026-98274](https://patchblox.com/security/data/cve/CVE-2026-98274.md) | High | net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb() | n/a | 0.0017 | | | [CVE-2026-89777](https://patchblox.com/security/data/cve/CVE-2026-89777.md) | High | vfio/pci: clear vdev->msi_perm after freeing it on init failure | 8.8 | 0.0016 | | | [CVE-2026-90240](https://patchblox.com/security/data/cve/CVE-2026-90240.md) | High | iommu/vt-d: Flush context cache with correct SID when tearing down aliases | 8.8 | 0.0016 | | | [CVE-2026-90013](https://patchblox.com/security/data/cve/CVE-2026-90013.md) | High | tracing: Take trace_array reference when opening options file | 7.8 | 0.0016 | | | [CVE-2026-90071](https://patchblox.com/security/data/cve/CVE-2026-90071.md) | High | net/sched: sch_teql: restore skb->dev on the slave failure path | 7.8 | 0.0016 | | | [CVE-2026-90325](https://patchblox.com/security/data/cve/CVE-2026-90325.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: skip dying blkg in blkcg_activate_po... | 7.8 | 0.0016 | | | [CVE-2026-92507](https://patchblox.com/security/data/cve/CVE-2026-92507.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ib_de... | 7.8 | 0.0016 | | | [CVE-2026-92508](https://patchblox.com/security/data/cve/CVE-2026-92508.md) | High | RDMA/core: Fix potential use after free in ib_free_cq() | 7.8 | 0.0016 | | | [CVE-2026-97594](https://patchblox.com/security/data/cve/CVE-2026-97594.md) | High | landlock: Fix use-after-free of the source's parent directory | 7.8 | 0.0016 | | | [CVE-2026-97611](https://patchblox.com/security/data/cve/CVE-2026-97611.md) | High | net: openvswitch: fix use-after-free of the flow table mask array | 7.8 | 0.0016 | | | [CVE-2026-90062](https://patchblox.com/security/data/cve/CVE-2026-90062.md) | High | netfilter: nf_tables: move hardware offload step after building the chain blob | 7.1 | 0.0016 | | | [CVE-2026-93250](https://patchblox.com/security/data/cve/CVE-2026-93250.md) | High | vxlan: mdb: Fix use-after-free in vxlan_mdb_flush() | 7.8 | 0.0016 | | | [CVE-2026-90051](https://patchblox.com/security/data/cve/CVE-2026-90051.md) | High | tcp: reject non zerocopy devmem tx | 7.8 | 0.0016 | | | [CVE-2026-90312](https://patchblox.com/security/data/cve/CVE-2026-90312.md) | High | bpf: Check load-acquire src ptr type before the load | 7.8 | 0.0016 | | | [CVE-2026-98883](https://patchblox.com/security/data/cve/CVE-2026-98883.md) | High | serial: 8250_port: recognize UPIO_AU | 7.1 | 0.0016 | | | [CVE-2026-98907](https://patchblox.com/security/data/cve/CVE-2026-98907.md) | High | btrfs: protect sb_write_pointer() with invalidate lock | 7.1 | 0.0016 | | | [CVE-2026-93137](https://patchblox.com/security/data/cve/CVE-2026-93137.md) | High | bpf: Fix use-after-free on mm_struct in bpf_find_vma() | 7.8 | 0.0016 | | | [CVE-2026-90260](https://patchblox.com/security/data/cve/CVE-2026-90260.md) | High | btrfs: zoned: don't clobber the extent buffer when zeroing it out | 7.1 | 0.0016 | | | [CVE-2026-90243](https://patchblox.com/security/data/cve/CVE-2026-90243.md) | High | iommu/vt-d: Clear Present bit before tearing down copied context entry | 8.1 | 0.0016 | | | [CVE-2026-90429](https://patchblox.com/security/data/cve/CVE-2026-90429.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Synchronize the error ISR... | 7.8 | 0.0016 | | | [CVE-2026-97505](https://patchblox.com/security/data/cve/CVE-2026-97505.md) | High | PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() | 7.3 | 0.0016 | | | [CVE-2026-97445](https://patchblox.com/security/data/cve/CVE-2026-97445.md) | High | ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() | 7.7 | 0.0016 | | | [CVE-2026-97602](https://patchblox.com/security/data/cve/CVE-2026-97602.md) | High | inet: frags: invalidate queues before flushing them | 7.8 | 0.0016 | | | [CVE-2026-98078](https://patchblox.com/security/data/cve/CVE-2026-98078.md) | High | ipvs: fix reversed sequence option serialization | 7.8 | 0.0016 | | | [CVE-2026-93262](https://patchblox.com/security/data/cve/CVE-2026-93262.md) | High | md/raid5-ppl: fix use-after-free in ppl_do_flush() | 8.8 | 0.0015 | | | [CVE-2026-98895](https://patchblox.com/security/data/cve/CVE-2026-98895.md) | High | net/mlx5: HWS, Handle destroying table that has a miss table | 7.0 | 0.0015 | | | [CVE-2026-97608](https://patchblox.com/security/data/cve/CVE-2026-97608.md) | High | netfilter: nf_log: unregister loggers before per-net teardown | 7.8 | 0.0015 | | | [CVE-2026-93046](https://patchblox.com/security/data/cve/CVE-2026-93046.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: software node: Fix software_node_get_reference_a... | 7.0 | 0.0015 | | | [CVE-2026-93054](https://patchblox.com/security/data/cve/CVE-2026-93054.md) | High | uio: Fix stale info pointer in failed registration path | 7.0 | 0.0015 | | | [CVE-2026-98041](https://patchblox.com/security/data/cve/CVE-2026-98041.md) | High | bpf: Don't predict JMP32 pointer vs zero comparisons | 7.0 | 0.0015 | | | [CVE-2026-97609](https://patchblox.com/security/data/cve/CVE-2026-97609.md) | High | netfilter: cttimeout: prevent UAF during module unload | 7.0 | 0.0015 | | | [CVE-2026-98256](https://patchblox.com/security/data/cve/CVE-2026-98256.md) | High | signal: Prevent exec() race | 8.8 | 0.0014 | | | [CVE-2026-97450](https://patchblox.com/security/data/cve/CVE-2026-97450.md) | High | ACPICA: validate handler object type in two places | 8.4 | 0.0014 | | | [CVE-2026-97451](https://patchblox.com/security/data/cve/CVE-2026-97451.md) | High | ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) | 8.4 | 0.0014 | | | [CVE-2026-97452](https://patchblox.com/security/data/cve/CVE-2026-97452.md) | High | ACPICA: Prevent adding invalid references | 8.4 | 0.0014 | | | [CVE-2026-97444](https://patchblox.com/security/data/cve/CVE-2026-97444.md) | High | ACPICA: add boundary checks in two places | 7.7 | 0.0014 | | | [CVE-2026-97454](https://patchblox.com/security/data/cve/CVE-2026-97454.md) | High | ACPICA: add boundary checks in acpi_ps_get_next_field() | 7.7 | 0.0014 | | | [CVE-2026-97455](https://patchblox.com/security/data/cve/CVE-2026-97455.md) | High | ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() | 8.4 | 0.0014 | | | [CVE-2026-93827](https://patchblox.com/security/data/cve/CVE-2026-93827.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: virtio-fs: avoid double-free on failed queue setu... | 9.8 | 0.0014 | | | [CVE-2026-98156](https://patchblox.com/security/data/cve/CVE-2026-98156.md) | High | drm/virtio: use the DMA API for resource backing on Xen | 7.8 | 0.0014 | | | [CVE-2026-97448](https://patchblox.com/security/data/cve/CVE-2026-97448.md) | High | ACPICA: Add validation for node in acpi_ns_build_normalized_path() | 7.8 | 0.0014 | | | [CVE-2026-97437](https://patchblox.com/security/data/cve/CVE-2026-97437.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in ntfs_dir_emit()... | 7.1 | 0.0014 | | | [CVE-2026-92522](https://patchblox.com/security/data/cve/CVE-2026-92522.md) | High | ACPI: processor: validate MADT IOAPIC entry bounds | 7.3 | 0.0014 | | | [CVE-2026-98369](https://patchblox.com/security/data/cve/CVE-2026-98369.md) | High | xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() | 7.8 | 0.0014 | | | [CVE-2026-98080](https://patchblox.com/security/data/cve/CVE-2026-98080.md) | High | btrfs: do not force reloc root creation during qgroup_account_snapshot() | 7.8 | 0.0013 | | | [CVE-2026-97415](https://patchblox.com/security/data/cve/CVE-2026-97415.md) | High | btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF | 7.8 | 0.0013 | | | [CVE-2026-97438](https://patchblox.com/security/data/cve/CVE-2026-97438.md) | High | fs/ntfs3: validate index entry key bounds | 7.1 | 0.0013 | | | [CVE-2026-98127](https://patchblox.com/security/data/cve/CVE-2026-98127.md) | High | smb/client: validate new EOF for insert range | 7.8 | 0.0013 | | | [CVE-2026-93288](https://patchblox.com/security/data/cve/CVE-2026-93288.md) | High | netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state | 8.8 | 0.0013 | | | [CVE-2026-93817](https://patchblox.com/security/data/cve/CVE-2026-93817.md) | High | perf: Fix addr_filter_ranges lifetime | 8.8 | 0.0013 | | | [CVE-2026-74334](https://patchblox.com/security/data/cve/CVE-2026-74334.md) | High | RDMA/nldev: Fix locking when accessing mr->pd | 7.8 | 0.0013 | | | [CVE-2026-74347](https://patchblox.com/security/data/cve/CVE-2026-74347.md) | High | netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount | 7.8 | 0.0013 | | | [CVE-2026-90435](https://patchblox.com/security/data/cve/CVE-2026-90435.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix integer overflow of user QP buffe... | 7.8 | 0.0013 | | | [CVE-2026-93045](https://patchblox.com/security/data/cve/CVE-2026-93045.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Reject arena frees below the arena base bp... | 7.8 | 0.0013 | | | [CVE-2026-93125](https://patchblox.com/security/data/cve/CVE-2026-93125.md) | High | bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max | 7.8 | 0.0013 | | | [CVE-2026-93287](https://patchblox.com/security/data/cve/CVE-2026-93287.md) | High | i2c: smbus: reject oversized block transfers in the common path | 7.8 | 0.0013 | | | [CVE-2026-93798](https://patchblox.com/security/data/cve/CVE-2026-93798.md) | High | btrfs: fix reloc root cleanup in merge_reloc_roots() | 7.8 | 0.0013 | | | [CVE-2026-93813](https://patchblox.com/security/data/cve/CVE-2026-93813.md) | High | btrfs: tree-checker: validate INODE_REF's namelen | 7.8 | 0.0013 | | | [CVE-2026-97421](https://patchblox.com/security/data/cve/CVE-2026-97421.md) | High | RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() | 7.8 | 0.0013 | | | [CVE-2026-98017](https://patchblox.com/security/data/cve/CVE-2026-98017.md) | High | net/sched: defer qdisc freeing after failed creation | 7.8 | 0.0013 | | | [CVE-2026-98241](https://patchblox.com/security/data/cve/CVE-2026-98241.md) | High | ipv6: xfrm: use full sockets in local error paths | 7.8 | 0.0013 | | | [CVE-2026-98117](https://patchblox.com/security/data/cve/CVE-2026-98117.md) | High | cachefiles: Fix potential UAF/KASAN warning | 7.8 | 0.0013 | | | [CVE-2026-98281](https://patchblox.com/security/data/cve/CVE-2026-98281.md) | High | futex: Also allocate private hash on vfork() | 7.8 | 0.0013 | | | [CVE-2026-74496](https://patchblox.com/security/data/cve/CVE-2026-74496.md) | High | fou: Fix use-after-free in fou_create() | 9.8 | 0.0013 | | | [CVE-2026-74289](https://patchblox.com/security/data/cve/CVE-2026-74289.md) | High | ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). | 7.8 | 0.0013 | | | [CVE-2026-92510](https://patchblox.com/security/data/cve/CVE-2026-92510.md) | High | RDMA/core: Fix potential use after free in ib_destroy_srq_user() | 7.8 | 0.0013 | | | [CVE-2026-92511](https://patchblox.com/security/data/cve/CVE-2026-92511.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ib_de... | 7.8 | 0.0013 | | | [CVE-2026-98023](https://patchblox.com/security/data/cve/CVE-2026-98023.md) | High | vxlan: reject dynamic fdb entries that reference a nexthop id | 7.8 | 0.0013 | | | [CVE-2026-98276](https://patchblox.com/security/data/cve/CVE-2026-98276.md) | High | net: lock the socket in sock_gettstamp() | 7.8 | 0.0013 | | | [CVE-2026-93801](https://patchblox.com/security/data/cve/CVE-2026-93801.md) | High | smb/client: zero-initialize stack-allocated cifs_open_info_data | 7.0 | 0.0013 | | | [CVE-2026-98122](https://patchblox.com/security/data/cve/CVE-2026-98122.md) | High | vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del() | 7.8 | 0.0013 | | | [CVE-2026-97903](https://patchblox.com/security/data/cve/CVE-2026-97903.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: exit: hold a reference to thread_pid across proc... | 7.8 | 0.0012 | | | [CVE-2026-98095](https://patchblox.com/security/data/cve/CVE-2026-98095.md) | High | af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). | 7.1 | 0.0012 | | | [CVE-2026-98082](https://patchblox.com/security/data/cve/CVE-2026-98082.md) | High | btrfs: fix the possible bioc_list memory leak during error | 7.0 | 0.0012 | | | [CVE-2026-93810](https://patchblox.com/security/data/cve/CVE-2026-93810.md) | High | cachefiles: Fix double fput | 7.8 | 0.0012 | | | [CVE-2026-98098](https://patchblox.com/security/data/cve/CVE-2026-98098.md) | High | tipc: fix NULL deref in tipc_named_node_up() on empty publication list | 7.8 | 0.0012 | | | [CVE-2026-98083](https://patchblox.com/security/data/cve/CVE-2026-98083.md) | High | btrfs: fix transaction use-after-free in raid stripe insertion | 7.8 | 0.0012 | | | [CVE-2026-98230](https://patchblox.com/security/data/cve/CVE-2026-98230.md) | High | xfrm: use hlist_del_init_rcu for state_cache and state_cache_input | 7.0 | 0.0012 | | | [CVE-2026-98359](https://patchblox.com/security/data/cve/CVE-2026-98359.md) | High | RDMA/core: Reject unregistering netdevs in ib_get_eth_speed | 7.8 | 0.0012 | | | [CVE-2026-98158](https://patchblox.com/security/data/cve/CVE-2026-98158.md) | High | ppp_async: drop the errored frame instead of resetting its headroom | 9.8 | 0.0011 | | | [CVE-2026-81010](https://patchblox.com/security/data/cve/CVE-2026-81010.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: honor task_work cancellation i... | 7.8 | n/a | | | [CVE-2026-98405](https://patchblox.com/security/data/cve/CVE-2026-98405.md) | Routine | smb: client: fix missing iov bounds check in parse_posix_sids() | 5.4 | 0.0048 | | | [CVE-2026-98097](https://patchblox.com/security/data/cve/CVE-2026-98097.md) | Routine | tipc: Dont send random pad bytes in RESET/ACTIVATE messages | 5.3 | 0.0031 | | | [CVE-2026-93243](https://patchblox.com/security/data/cve/CVE-2026-93243.md) | Routine | mm/secretmem: properly account locked pages | 5.5 | 0.0025 | | | [CVE-2026-90393](https://patchblox.com/security/data/cve/CVE-2026-90393.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF in bpf_netns_link_update_... | 6.7 | 0.0023 | | | [CVE-2026-90109](https://patchblox.com/security/data/cve/CVE-2026-90109.md) | Routine | net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue | 5.5 | 0.0023 | | | [CVE-2026-90283](https://patchblox.com/security/data/cve/CVE-2026-90283.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: hugetlbfs: release subpool on fill_super failure... | 6.7 | 0.0023 | | | [CVE-2026-90138](https://patchblox.com/security/data/cve/CVE-2026-90138.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: vsock: don't check the listener's sk_err in vsoc... | 4.4 | 0.0023 | | | [CVE-2026-97597](https://patchblox.com/security/data/cve/CVE-2026-97597.md) | Routine | ipv6: flowlabel: cap duplicate leases per socket | 5.5 | 0.0022 | | | [CVE-2026-98413](https://patchblox.com/security/data/cve/CVE-2026-98413.md) | Routine | selinux: always fill AVC decision in avc_has_perm_noaudit() | 6.1 | 0.0022 | | | [CVE-2026-97939](https://patchblox.com/security/data/cve/CVE-2026-97939.md) | Routine | ipmr: account multicast table and route memory | 6.5 | 0.0022 | | | [CVE-2026-89987](https://patchblox.com/security/data/cve/CVE-2026-89987.md) | Routine | mm/huge_memory: transfer the pmd dirty bit to the folio on zap | 5.5 | 0.0022 | | | [CVE-2026-97906](https://patchblox.com/security/data/cve/CVE-2026-97906.md) | Routine | bootconfig: Fix integer overflow in initrd size check | 5.5 | 0.0022 | | | [CVE-2026-90157](https://patchblox.com/security/data/cve/CVE-2026-90157.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative optlen in cgroup getsockopt... | 6.7 | 0.0022 | | | [CVE-2026-90202](https://patchblox.com/security/data/cve/CVE-2026-90202.md) | Routine | scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers | 6.4 | 0.0022 | | | [CVE-2026-89784](https://patchblox.com/security/data/cve/CVE-2026-89784.md) | Routine | SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 | 5.5 | 0.0022 | | | [CVE-2026-90072](https://patchblox.com/security/data/cve/CVE-2026-90072.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum to avoid signed ov... | 5.5 | 0.0022 | | | [CVE-2026-90075](https://patchblox.com/security/data/cve/CVE-2026-90075.md) | Routine | net/sched: fq_codel: clamp default quantum and mtu | 5.5 | 0.0022 | | | [CVE-2026-90218](https://patchblox.com/security/data/cve/CVE-2026-90218.md) | Routine | RDMA/cma: Fix WARNING in res_to_rt | 5.5 | 0.0022 | | | [CVE-2026-93048](https://patchblox.com/security/data/cve/CVE-2026-93048.md) | Routine | mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() | 5.5 | 0.0022 | | | [CVE-2026-93140](https://patchblox.com/security/data/cve/CVE-2026-93140.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: udf: Mark LVID buffer as uptodate before marking... | 5.5 | 0.0022 | | | [CVE-2026-97905](https://patchblox.com/security/data/cve/CVE-2026-97905.md) | Routine | cpufreq: zero-initialize policy cpumask before sysfs publication | 5.5 | 0.0022 | | | [CVE-2026-98077](https://patchblox.com/security/data/cve/CVE-2026-98077.md) | Routine | netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() | 5.5 | 0.0022 | | | [CVE-2026-98388](https://patchblox.com/security/data/cve/CVE-2026-98388.md) | Routine | exec: do_close_on_exec() before taking exec_update_lock | 5.5 | 0.0022 | | | [CVE-2026-90114](https://patchblox.com/security/data/cve/CVE-2026-90114.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel range... | 5.3 | 0.0022 | | | [CVE-2026-92524](https://patchblox.com/security/data/cve/CVE-2026-92524.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent leak in its_vpe_irq_... | 5.2 | 0.0022 | | | [CVE-2026-97596](https://patchblox.com/security/data/cve/CVE-2026-97596.md) | Routine | ipvs: reject invalid states in connection template sync records | 4.8 | 0.0022 | | | [CVE-2026-98404](https://patchblox.com/security/data/cve/CVE-2026-98404.md) | Routine | drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() | 4.7 | 0.0022 | | | [CVE-2026-90054](https://patchblox.com/security/data/cve/CVE-2026-90054.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: tcp: fix corruption of urgent data on multi-segm... | 4.4 | 0.0022 | | | [CVE-2026-90434](https://patchblox.com/security/data/cve/CVE-2026-90434.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: isofs: release zisofs block pointer buffer head... | 4.4 | 0.0022 | | | [CVE-2026-93256](https://patchblox.com/security/data/cve/CVE-2026-93256.md) | Routine | arm64: hibernate: mask DAIF before restoring hibernated kernel | 4.1 | 0.0022 | | | [CVE-2026-90058](https://patchblox.com/security/data/cve/CVE-2026-90058.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: bound qdisc_pkt_len to prevent qdisc... | 3.3 | 0.0022 | | | [CVE-2026-90416](https://patchblox.com/security/data/cve/CVE-2026-90416.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix stack out-of-bounds read in cc_pa... | 3.3 | 0.0022 | | | [CVE-2026-90290](https://patchblox.com/security/data/cve/CVE-2026-90290.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: Restore DAIF state on error S... | 3.0 | 0.0022 | | | [CVE-2026-90160](https://patchblox.com/security/data/cve/CVE-2026-90160.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: lwt_bpf: Restore reserved headroom after xmit pr... | 2.3 | 0.0022 | | | [CVE-2026-98429](https://patchblox.com/security/data/cve/CVE-2026-98429.md) | Routine | RDMA/efa: Keep EQ resources alive while IRQ is registered | 4.7 | 0.0022 | | | [CVE-2026-98538](https://patchblox.com/security/data/cve/CVE-2026-98538.md) | Routine | writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes | 4.1 | 0.0022 | | | [CVE-2026-90148](https://patchblox.com/security/data/cve/CVE-2026-90148.md) | Routine | NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease() | 5.5 | 0.0021 | | | [CVE-2026-90265](https://patchblox.com/security/data/cve/CVE-2026-90265.md) | Routine | btrfs: defrag: fix deadlock between defrag and delalloc space reservation | 5.5 | 0.0021 | | | [CVE-2026-89996](https://patchblox.com/security/data/cve/CVE-2026-89996.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-heap: don't publish fd before copy_... | 5.3 | 0.0021 | | | [CVE-2026-97567](https://patchblox.com/security/data/cve/CVE-2026-97567.md) | Routine | mptcp: prevent race between disconnect() and rtx | 4.7 | 0.0021 | | | [CVE-2026-97566](https://patchblox.com/security/data/cve/CVE-2026-97566.md) | Routine | mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0 | 3.3 | 0.0021 | | | [CVE-2026-97925](https://patchblox.com/security/data/cve/CVE-2026-97925.md) | Routine | tick/broadcast: Plug clockevents replacement race | 6.7 | 0.0021 | | | [CVE-2026-72413](https://patchblox.com/security/data/cve/CVE-2026-72413.md) | Routine | sctp: fix err_chunk memory leaks in INIT handling | 5.9 | 0.0021 | | | [CVE-2026-72402](https://patchblox.com/security/data/cve/CVE-2026-72402.md) | Routine | bpf: Mask pseudo pointer values in verifier logs | 5.5 | 0.0021 | | | [CVE-2026-90053](https://patchblox.com/security/data/cve/CVE-2026-90053.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_htb: limit htb_classify inner-cla... | 5.5 | 0.0021 | | | [CVE-2026-92494](https://patchblox.com/security/data/cve/CVE-2026-92494.md) | Routine | ext4: fix buffer_head leak in ext4_init_orphan_info | 5.5 | 0.0021 | | | [CVE-2026-98402](https://patchblox.com/security/data/cve/CVE-2026-98402.md) | Routine | net: icmp: avoid invalid transport header access in icmp_send tracepoint | 3.7 | 0.0021 | | | [CVE-2026-89776](https://patchblox.com/security/data/cve/CVE-2026-89776.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: enforce exact length of GROUP/... | 3.3 | 0.0021 | | | [CVE-2026-98424](https://patchblox.com/security/data/cve/CVE-2026-98424.md) | Routine | wifi: cfg80211: undo netns switch if renaming the wiphy fails | 3.0 | 0.0021 | | | [CVE-2026-90185](https://patchblox.com/security/data/cve/CVE-2026-90185.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: null_blk: serialize configfs attribute stores wi... | 6.7 | 0.0021 | | | [CVE-2026-97945](https://patchblox.com/security/data/cve/CVE-2026-97945.md) | Routine | x86/mm: Fix user-space data loss with MADV_FREE and THP | 6.1 | 0.0021 | | | [CVE-2026-90186](https://patchblox.com/security/data/cve/CVE-2026-90186.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: null_blk: reject per-device queue resize for sha... | 5.5 | 0.0021 | | | [CVE-2026-90250](https://patchblox.com/security/data/cve/CVE-2026-90250.md) | Routine | bpf, cgroup: Fix storage null-ptr-deref after replacing prog | 5.5 | 0.0021 | | | [CVE-2026-90264](https://patchblox.com/security/data/cve/CVE-2026-90264.md) | Routine | btrfs: always wait for ordered extents to avoid OE races | 5.5 | 0.0021 | | | [CVE-2026-90364](https://patchblox.com/security/data/cve/CVE-2026-90364.md) | Routine | ACPI: processor: Unregister cpufreq notifier on init failure | 5.5 | 0.0021 | | | [CVE-2026-97522](https://patchblox.com/security/data/cve/CVE-2026-97522.md) | Routine | mptcp: fix bad accounting in __mptcp_subflow_push_pending() | 5.5 | 0.0021 | | | [CVE-2026-93172](https://patchblox.com/security/data/cve/CVE-2026-93172.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: mm/mm_init: handle alloc_percpu failure in free_... | 4.4 | 0.0021 | | | [CVE-2026-97902](https://patchblox.com/security/data/cve/CVE-2026-97902.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: fs: don't return -EINVAL for successful nested t... | 3.4 | 0.0021 | | | [CVE-2026-97606](https://patchblox.com/security/data/cve/CVE-2026-97606.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: fs: autofs: fix memory leak in autofs_fill_super... | 2.3 | 0.0021 | | | [CVE-2026-90190](https://patchblox.com/security/data/cve/CVE-2026-90190.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: null_blk: use DEFINE_MUTEX for the file-scope mu... | 4.7 | 0.0021 | | | [CVE-2026-90194](https://patchblox.com/security/data/cve/CVE-2026-90194.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ACPI: scan: fix bus ID cleanup on device_add() f... | 4.5 | 0.0021 | | | [CVE-2026-98393](https://patchblox.com/security/data/cve/CVE-2026-98393.md) | Routine | net: ipv4: Fix UDP length overflow with PMTU discover and big MTU | 1.9 | 0.0020 | | | [CVE-2026-98037](https://patchblox.com/security/data/cve/CVE-2026-98037.md) | Routine | bpf: Reject untrusted allocated-object pointers | 6.7 | 0.0020 | | | [CVE-2026-93268](https://patchblox.com/security/data/cve/CVE-2026-93268.md) | Routine | ext4: skip extra isize expansion during mount to prevent deadlock | 6.4 | 0.0020 | | | [CVE-2026-92515](https://patchblox.com/security/data/cve/CVE-2026-92515.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve unique-field state across nested s... | 6.7 | 0.0020 | | | [CVE-2026-97551](https://patchblox.com/security/data/cve/CVE-2026-97551.md) | Routine | xfs: initialise args->total for parent pointer updates | 5.5 | 0.0020 | | | [CVE-2026-98079](https://patchblox.com/security/data/cve/CVE-2026-98079.md) | Routine | btrfs: zstd: fix lost wakeup when waiting for a workspace | 5.5 | 0.0020 | | | [CVE-2026-90147](https://patchblox.com/security/data/cve/CVE-2026-90147.md) | Routine | clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate() | 3.6 | 0.0020 | | | [CVE-2026-90159](https://patchblox.com/security/data/cve/CVE-2026-90159.md) | Routine | bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks | 3.4 | 0.0020 | | | [CVE-2026-98394](https://patchblox.com/security/data/cve/CVE-2026-98394.md) | Routine | af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer. | 2.5 | 0.0020 | | | [CVE-2026-90390](https://patchblox.com/security/data/cve/CVE-2026-90390.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: md/bitmap: resume array on backlog_store() error... | 2.3 | 0.0020 | | | [CVE-2026-93269](https://patchblox.com/security/data/cve/CVE-2026-93269.md) | Routine | ext4: fix circular lock dependency in ext4_ext_migrate | 4.7 | 0.0020 | | | [CVE-2026-98878](https://patchblox.com/security/data/cve/CVE-2026-98878.md) | Routine | irqchip/gic-v5: Immediately exec priority drop following activate | 5.5 | 0.0019 | | | [CVE-2026-93275](https://patchblox.com/security/data/cve/CVE-2026-93275.md) | Routine | perf/x86/intel/pt: Fix stop/start with no update | 2.5 | 0.0019 | | | [CVE-2026-98888](https://patchblox.com/security/data/cve/CVE-2026-98888.md) | Routine | arm64: kprobes: Allow reentering kprobes while single-stepping | 5.5 | 0.0019 | | | [CVE-2026-98306](https://patchblox.com/security/data/cve/CVE-2026-98306.md) | Routine | seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation | 6.5 | 0.0018 | | | [CVE-2026-98877](https://patchblox.com/security/data/cve/CVE-2026-98877.md) | Routine | irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed | 6.5 | 0.0018 | | | [CVE-2026-98873](https://patchblox.com/security/data/cve/CVE-2026-98873.md) | Routine | netfilter: nf_conntrack_expect: zero at allocation time | 6.1 | 0.0018 | | | [CVE-2026-92520](https://patchblox.com/security/data/cve/CVE-2026-92520.md) | Routine | bpf: Zero queue and stack outputs on lock failure | 5.5 | 0.0018 | | | [CVE-2026-98879](https://patchblox.com/security/data/cve/CVE-2026-98879.md) | Routine | isofs: handle set_blocksize failures | 5.5 | 0.0018 | | | [CVE-2026-98885](https://patchblox.com/security/data/cve/CVE-2026-98885.md) | Routine | ima: return error early if file xattr cannot be changed | 5.5 | 0.0018 | | | [CVE-2026-93110](https://patchblox.com/security/data/cve/CVE-2026-93110.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Wait for RCU callbacks before unloadi... | 6.4 | 0.0018 | | | [CVE-2026-98010](https://patchblox.com/security/data/cve/CVE-2026-98010.md) | Routine | net/sched: drr: clamp quantum in change class | 6.1 | 0.0018 | | | [CVE-2026-98205](https://patchblox.com/security/data/cve/CVE-2026-98205.md) | Routine | Input: evdev - zero absinfo before partial copy in EVIOCSABS | 6.1 | 0.0018 | | | [CVE-2026-97899](https://patchblox.com/security/data/cve/CVE-2026-97899.md) | Routine | drm/i915: Fix memory leak in query_perf_config_list() | 5.5 | 0.0018 | | | [CVE-2026-97958](https://patchblox.com/security/data/cve/CVE-2026-97958.md) | Routine | net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). | 5.5 | 0.0018 | | | [CVE-2026-98012](https://patchblox.com/security/data/cve/CVE-2026-98012.md) | Routine | net/sched: sfq: clamp quantum in change path | 5.5 | 0.0018 | | | [CVE-2026-98022](https://patchblox.com/security/data/cve/CVE-2026-98022.md) | Routine | net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations | 5.5 | 0.0018 | | | [CVE-2026-98071](https://patchblox.com/security/data/cve/CVE-2026-98071.md) | Routine | net/rds: clear cp_flags bits individually in rds_conn_path_reset() | 5.5 | 0.0018 | | | [CVE-2026-98262](https://patchblox.com/security/data/cve/CVE-2026-98262.md) | Routine | ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY | 5.5 | 0.0018 | | | [CVE-2026-98299](https://patchblox.com/security/data/cve/CVE-2026-98299.md) | Routine | tcp: do not let tcp_rmem be set below 4096 | 5.5 | 0.0018 | | | [CVE-2026-98300](https://patchblox.com/security/data/cve/CVE-2026-98300.md) | Routine | tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). | 5.5 | 0.0018 | | | [CVE-2026-98344](https://patchblox.com/security/data/cve/CVE-2026-98344.md) | Routine | dmaengine: Fix device kref underflow in dma_chan_put() | 5.5 | 0.0018 | | | [CVE-2026-92501](https://patchblox.com/security/data/cve/CVE-2026-92501.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ext4: drain in-flight DIO before buffered write... | 5.3 | 0.0018 | | | [CVE-2026-90333](https://patchblox.com/security/data/cve/CVE-2026-90333.md) | Routine | dm-integrity: replace forgeable discard filler with a keyed sector marker | 5.5 | 0.0017 | | | [CVE-2026-98880](https://patchblox.com/security/data/cve/CVE-2026-98880.md) | Routine | ntfs3: handle set_blocksize failures | 5.5 | 0.0017 | | | [CVE-2026-97480](https://patchblox.com/security/data/cve/CVE-2026-97480.md) | Routine | tty: serial: 8250: protect against NULL uart->port.dev in register | 4.4 | 0.0017 | | | [CVE-2026-97477](https://patchblox.com/security/data/cve/CVE-2026-97477.md) | Routine | RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() | 3.6 | 0.0017 | | | [CVE-2026-93800](https://patchblox.com/security/data/cve/CVE-2026-93800.md) | Routine | btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() | 6.7 | 0.0017 | | | [CVE-2026-97416](https://patchblox.com/security/data/cve/CVE-2026-97416.md) | Routine | btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() | 6.7 | 0.0017 | | | [CVE-2026-97476](https://patchblox.com/security/data/cve/CVE-2026-97476.md) | Routine | rds: filter RDS_INFO_* getsockopt by caller's netns | 6.5 | 0.0017 | | | [CVE-2026-97439](https://patchblox.com/security/data/cve/CVE-2026-97439.md) | Routine | fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib | 5.7 | 0.0017 | | | [CVE-2026-97456](https://patchblox.com/security/data/cve/CVE-2026-97456.md) | Routine | ACPICA: Fix condition check in acpi_ps_parse_loop() | 5.6 | 0.0017 | | | [CVE-2026-92523](https://patchblox.com/security/data/cve/CVE-2026-92523.md) | Routine | RDMA/nldev: validate dynamic counter attribute length | 5.5 | 0.0017 | | | [CVE-2026-93825](https://patchblox.com/security/data/cve/CVE-2026-93825.md) | Routine | spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() | 5.5 | 0.0017 | | | [CVE-2026-97481](https://patchblox.com/security/data/cve/CVE-2026-97481.md) | Routine | serial: 8250: fix possible ISR soft lockup | 5.5 | 0.0017 | | | [CVE-2026-97483](https://patchblox.com/security/data/cve/CVE-2026-97483.md) | Routine | usb: core: hcd: fix possible deadlock in rh control transfers | 5.5 | 0.0017 | | | [CVE-2026-97979](https://patchblox.com/security/data/cve/CVE-2026-97979.md) | Routine | ice: add missing xa_destroy for sched_node_ids | 5.5 | 0.0017 | | | [CVE-2026-98031](https://patchblox.com/security/data/cve/CVE-2026-98031.md) | Routine | nexthop: Initialize extack in remove_nh_grp_entry() | 5.5 | 0.0017 | | | [CVE-2026-97453](https://patchblox.com/security/data/cve/CVE-2026-97453.md) | Routine | ACPICA: validate byte_count in acpi_ps_get_next_package_length() | 5.1 | 0.0017 | | | [CVE-2026-97484](https://patchblox.com/security/data/cve/CVE-2026-97484.md) | Routine | usbip: vhci_hcd: fix NULL deref in status_show_vhci | 5.1 | 0.0017 | | | [CVE-2026-93795](https://patchblox.com/security/data/cve/CVE-2026-93795.md) | Routine | blk-cgroup: fix leaks and online flag on radix_tree_insert failure | 4.7 | 0.0017 | | | [CVE-2026-97446](https://patchblox.com/security/data/cve/CVE-2026-97446.md) | Routine | ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() | 4.7 | 0.0017 | | | [CVE-2026-97420](https://patchblox.com/security/data/cve/CVE-2026-97420.md) | Routine | bpf: NUL-terminate replaced sysctl value | 4.4 | 0.0017 | | | [CVE-2026-97472](https://patchblox.com/security/data/cve/CVE-2026-97472.md) | Routine | ipv6: addrconf: fix temp address generation after prefix deprecation | 4.4 | 0.0017 | | | [CVE-2026-97449](https://patchblox.com/security/data/cve/CVE-2026-97449.md) | Routine | ACPICA: Add package limit checks in parser functions | 4.0 | 0.0017 | | | [CVE-2026-93174](https://patchblox.com/security/data/cve/CVE-2026-93174.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Copy per-CPU map value padding in copy_map_... | 3.3 | 0.0017 | | | [CVE-2026-93824](https://patchblox.com/security/data/cve/CVE-2026-93824.md) | Routine | tls: reject the combination of TLS and sockmap | 6.7 | 0.0017 | | | [CVE-2026-93828](https://patchblox.com/security/data/cve/CVE-2026-93828.md) | Routine | exfat: fix handling of damaged volume in exfat_create_upcase_table() | 6.7 | 0.0017 | | | [CVE-2026-93829](https://patchblox.com/security/data/cve/CVE-2026-93829.md) | Routine | smb: client: fix races in cifsd thread creation | 6.7 | 0.0017 | | | [CVE-2026-98039](https://patchblox.com/security/data/cve/CVE-2026-98039.md) | Routine | bpf: Require MEM_PERCPU for percpu kptr stores | 6.7 | 0.0017 | | | [CVE-2026-98045](https://patchblox.com/security/data/cve/CVE-2026-98045.md) | Routine | bpf: Mark faultable stack helpers as sleepable | 6.7 | 0.0017 | | | [CVE-2026-98271](https://patchblox.com/security/data/cve/CVE-2026-98271.md) | Routine | net: skbuff: do not leave stale header offsets after pskb_carve() | 6.1 | 0.0017 | | | [CVE-2026-90400](https://patchblox.com/security/data/cve/CVE-2026-90400.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: md: recheck spare changes before starting sync... | 5.5 | 0.0017 | | | [CVE-2026-92502](https://patchblox.com/security/data/cve/CVE-2026-92502.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ext4: clear stale xarray tags on folios skipped... | 5.5 | 0.0017 | | | [CVE-2026-93781](https://patchblox.com/security/data/cve/CVE-2026-93781.md) | Routine | scsi: core: Do not block on tag allocation in scsi_eh_lock_door() | 5.5 | 0.0017 | | | [CVE-2026-97900](https://patchblox.com/security/data/cve/CVE-2026-97900.md) | Routine | drm/drm_exec: fix up contended obj when num_objects is 0 | 5.5 | 0.0017 | | | [CVE-2026-97960](https://patchblox.com/security/data/cve/CVE-2026-97960.md) | Routine | perf/x86/intel: Prevent drain_pebs() reentry | 5.5 | 0.0017 | | | [CVE-2026-97985](https://patchblox.com/security/data/cve/CVE-2026-97985.md) | Routine | af_unix: Update last skb marker in manage_oob(). | 5.5 | 0.0017 | | | [CVE-2026-98003](https://patchblox.com/security/data/cve/CVE-2026-98003.md) | Routine | iommu/amd: Do not reallocate GA log buffers on resume | 5.5 | 0.0017 | | | [CVE-2026-98007](https://patchblox.com/security/data/cve/CVE-2026-98007.md) | Routine | bpf: Reject non-scalar bpf_loop iteration counts | 5.5 | 0.0017 | | | [CVE-2026-98067](https://patchblox.com/security/data/cve/CVE-2026-98067.md) | Routine | erofs: disable LZ4 rolling decompression for now | 5.5 | 0.0017 | | | [CVE-2026-98081](https://patchblox.com/security/data/cve/CVE-2026-98081.md) | Routine | btrfs: zoned: finish active block group cleanup if call_zone_finish() fails | 5.5 | 0.0017 | | | [CVE-2026-98235](https://patchblox.com/security/data/cve/CVE-2026-98235.md) | Routine | net/sched: act_api: release tail references on DELACTION failure | 5.5 | 0.0017 | | | [CVE-2026-90275](https://patchblox.com/security/data/cve/CVE-2026-90275.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: md/raid1: don't set array_frozen in raid1_takeov... | 4.4 | 0.0017 | | | [CVE-2026-93173](https://patchblox.com/security/data/cve/CVE-2026-93173.md) | Routine | bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks | 4.4 | 0.0017 | | | [CVE-2026-93794](https://patchblox.com/security/data/cve/CVE-2026-93794.md) | Routine | smb/client: flush dirty data before punching a hole | 3.3 | 0.0017 | | | [CVE-2026-90178](https://patchblox.com/security/data/cve/CVE-2026-90178.md) | Routine | hwmon: (coretemp) Fix core_data leak on CPUs without PTS | 2.3 | 0.0017 | | | [CVE-2026-97479](https://patchblox.com/security/data/cve/CVE-2026-97479.md) | Routine | driver core: Avoid warning when removing a device while its supplier is unbinding | 1.9 | 0.0017 | | | [CVE-2026-98087](https://patchblox.com/security/data/cve/CVE-2026-98087.md) | Routine | sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate | 5.5 | 0.0017 | | | [CVE-2026-98273](https://patchblox.com/security/data/cve/CVE-2026-98273.md) | Routine | x86/kprobes: Fix crash when probing CS CALL instructions | 5.5 | 0.0017 | | | [CVE-2026-97443](https://patchblox.com/security/data/cve/CVE-2026-97443.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: perf/ftrace: Fix WARNING in __unregister_ftrace_... | 2.3 | 0.0017 | | | [CVE-2026-98354](https://patchblox.com/security/data/cve/CVE-2026-98354.md) | Routine | RDMA/mad: Fix receive buffer leak when PKey enforcement fails | 5.5 | 0.0017 | | | [CVE-2026-97503](https://patchblox.com/security/data/cve/CVE-2026-97503.md) | Routine | genirq/proc: Size interrupt directory names for 10-digit interrupt numbers | 6.4 | 0.0016 | | | [CVE-2026-100074](https://patchblox.com/security/data/cve/CVE-2026-100074.md) | Routine | bpf: Mark bpf_refcount field as unique | 5.5 | 0.0016 | | | [CVE-2026-98062](https://patchblox.com/security/data/cve/CVE-2026-98062.md) | Routine | bpf: Mark signal tracepoint siginfo arguments as scalar | 5.5 | 0.0016 | | | [CVE-2026-98119](https://patchblox.com/security/data/cve/CVE-2026-98119.md) | Routine | netfs: break unbuffered write when netfs_alloc_subrequest() fails | 5.5 | 0.0014 | | | [CVE-2026-98090](https://patchblox.com/security/data/cve/CVE-2026-98090.md) | Routine | btrfs: restore active device pointers after failed sprout | 6.7 | 0.0012 | | | [CVE-2026-98091](https://patchblox.com/security/data/cve/CVE-2026-98091.md) | Routine | btrfs: detach failed sprout device from transaction update list | 6.7 | 0.0012 | | | [CVE-2026-98128](https://patchblox.com/security/data/cve/CVE-2026-98128.md) | Routine | scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add() | 5.5 | 0.0012 | | | [CVE-2026-98129](https://patchblox.com/security/data/cve/CVE-2026-98129.md) | Routine | scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add() | 5.5 | 0.0012 | | | [CVE-2026-98059](https://patchblox.com/security/data/cve/CVE-2026-98059.md) | Routine | bpf: Mark sched_process_wait argument as nullable | 5.5 | 0.0012 | | | [CVE-2026-98126](https://patchblox.com/security/data/cve/CVE-2026-98126.md) | Routine | smb/client: validate new EOF for zero range | 5.5 | 0.0012 | | | [CVE-2026-98120](https://patchblox.com/security/data/cve/CVE-2026-98120.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix subreq ref leak Fix a subrequest ref... | 5.5 | 0.0012 | | | [CVE-2026-100070](https://patchblox.com/security/data/cve/CVE-2026-100070.md) | Routine | netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet | 6.5 | 0.0012 | | | [CVE-2026-98157](https://patchblox.com/security/data/cve/CVE-2026-98157.md) | Routine | EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation | 5.5 | 0.0012 | | | [CVE-2026-98151](https://patchblox.com/security/data/cve/CVE-2026-98151.md) | Routine | bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic | 6.7 | 0.0011 | | | [CVE-2026-98161](https://patchblox.com/security/data/cve/CVE-2026-98161.md) | Routine | nvdimm: pmem: keep PREFLUSH before data writes | 5.5 | 0.0011 | | | [CVE-2026-98123](https://patchblox.com/security/data/cve/CVE-2026-98123.md) | Routine | sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration | 6.5 | 0.0010 | | | [CVE-2026-97618](https://patchblox.com/security/data/cve/CVE-2026-97618.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/net: don't overconsume buffers when usi... | 4.4 | n/a | | --- Data as of 2026-11-10T01:44:33Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.