# ALAS2023-2026-3196: Security update for 18 packages ALAS2023-2026-3196, released November 7, 2026, fixes 432 CVEs across 18 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/alas2023-2026-3196 - Platform: Linux - Released: Nov 7, 2026 - Priority: Urgent (Closes CVE-2026-99999, rated Critical) - CVEs: 432, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-3196.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [bpftool6.12](https://patchblox.com/security/data/product/linux/bpftool6.12.md) | amzn 2023 | 1:6.12.110-135.201.amzn2023 | | [bpftool6.12-debuginfo](https://patchblox.com/security/data/product/linux/bpftool6.12-debuginfo.md) | amzn 2023 | 1:6.12.110-135.201.amzn2023 | | [kernel-livepatch-6.12.110-135.201](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.12.110-135.201.md) | amzn 2023 | 1:1.0-0.amzn2023 | | [kernel6.12](https://patchblox.com/security/data/product/linux/kernel6.12.md) | amzn 2023 | 1:6.12.110-135.201.amzn2023 | | [kernel6.12-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo.md) | amzn 2023 | 1:6.12.110-135.201.amzn2023 | | [kernel6.12-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.12.110-135.201.amzn2023 | | [kernel6.12-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.12.110-135.201.amzn2023 | | [kernel6.12-devel](https://patchblox.com/security/data/product/linux/kernel6.12-devel.md) | amzn 2023 | 1:6.12.110-135.201.amzn2023 | | [kernel6.12-headers](https://patchblox.com/security/data/product/linux/kernel6.12-headers.md) | amzn 2023 | 1:6.12.110-135.201.amzn2023 | | [kernel6.12-modules-extra](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra.md) | amzn 2023 | 1:6.12.110-135.201.amzn2023 | | [kernel6.12-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra-common.md) | amzn 2023 | 1:6.12.110-135.201.amzn2023 | | [kernel6.12-tools](https://patchblox.com/security/data/product/linux/kernel6.12-tools.md) | amzn 2023 | 1:6.12.110-135.201.amzn2023 | | [kernel6.12-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-tools-debuginfo.md) | amzn 2023 | 1:6.12.110-135.201.amzn2023 | | [kernel6.12-tools-devel](https://patchblox.com/security/data/product/linux/kernel6.12-tools-devel.md) | amzn 2023 | 1:6.12.110-135.201.amzn2023 | | [perf6.12](https://patchblox.com/security/data/product/linux/perf6.12.md) | amzn 2023 | 1:6.12.110-135.201.amzn2023 | | [perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/perf6.12-debuginfo.md) | amzn 2023 | 1:6.12.110-135.201.amzn2023 | | [python3-perf6.12](https://patchblox.com/security/data/product/linux/python3-perf6.12.md) | amzn 2023 | 1:6.12.110-135.201.amzn2023 | | [python3-perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf6.12-debuginfo.md) | amzn 2023 | 1:6.12.110-135.201.amzn2023 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-99999](https://patchblox.com/security/data/cve/CVE-2026-99999.md) | Urgent | ipv4: validate checksum_start before completing checksum | 9.3 | 0.0079 | | | [CVE-2026-90151](https://patchblox.com/security/data/cve/CVE-2026-90151.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: NFSv4: remove callback IDR entry on client alloc... | 9.8 | 0.0075 | | | [CVE-2026-89688](https://patchblox.com/security/data/cve/CVE-2026-89688.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on s... | 9.8 | 0.0074 | | | [CVE-2026-90048](https://patchblox.com/security/data/cve/CVE-2026-90048.md) | Urgent | fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() | 9.8 | 0.0072 | | | [CVE-2026-80976](https://patchblox.com/security/data/cve/CVE-2026-80976.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: seg6: reset IP6CB after IPv6 decapsulation deca... | 9.8 | 0.0071 | | | [CVE-2026-89485](https://patchblox.com/security/data/cve/CVE-2026-89485.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file across nlm_inspect_file loc... | 9.8 | 0.0071 | | | [CVE-2026-89655](https://patchblox.com/security/data/cve/CVE-2026-89655.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in __kick_flushing_caps() on cf en... | 9.8 | 0.0071 | | | [CVE-2026-89712](https://patchblox.com/security/data/cve/CVE-2026-89712.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: NFSD: restart ssc_expire_umount walk after dropp... | 9.8 | 0.0071 | | | [CVE-2026-89783](https://patchblox.com/security/data/cve/CVE-2026-89783.md) | Urgent | xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full | 9.8 | 0.0071 | | | [CVE-2026-89778](https://patchblox.com/security/data/cve/CVE-2026-89778.md) | Urgent | isofs: fix out-of-bounds page array access on empty zisofs block | 9.8 | 0.0070 | | | [CVE-2026-89555](https://patchblox.com/security/data/cve/CVE-2026-89555.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: mpls: reload header after pskb_may_pull() mpls_... | 9.8 | 0.0069 | | | [CVE-2026-89634](https://patchblox.com/security/data/cve/CVE-2026-89634.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN() overflow in symlink_dat... | 9.8 | 0.0069 | | | [CVE-2026-89713](https://patchblox.com/security/data/cve/CVE-2026-89713.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock... | 9.1 | 0.0067 | | | [CVE-2026-89636](https://patchblox.com/security/data/cve/CVE-2026-89636.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce->tgthint in free_tgts() W... | 9.8 | 0.0066 | | | [CVE-2026-63979](https://patchblox.com/security/data/cve/CVE-2026-63979.md) | Urgent | net/handshake: hand off the pinned file reference to accept_doit | 9.8 | 0.0064 | | | [CVE-2026-89536](https://patchblox.com/security/data/cve/CVE-2026-89536.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake... | 9.8 | 0.0064 | | | [CVE-2026-89558](https://patchblox.com/security/data/cve/CVE-2026-89558.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix still_degraded being inverted in... | 9.8 | 0.0064 | | | [CVE-2026-89651](https://patchblox.com/security/data/cve/CVE-2026-89651.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fs_name decode i... | 9.8 | 0.0064 | | | [CVE-2026-90012](https://patchblox.com/security/data/cve/CVE-2026-90012.md) | Urgent | spi: Fix DMA mapping ownership on partial map failure | 9.8 | 0.0063 | | | [CVE-2026-89658](https://patchblox.com/security/data/cve/CVE-2026-89658.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during NFSv4... | 9.8 | 0.0062 | | | [CVE-2026-89703](https://patchblox.com/security/data/cve/CVE-2026-89703.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_... | 9.8 | 0.0062 | | | [CVE-2026-90110](https://patchblox.com/security/data/cve/CVE-2026-90110.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: inetpeer: randomize RB-tree node comparison usin... | 9.4 | 0.0061 | | | [CVE-2026-89990](https://patchblox.com/security/data/cve/CVE-2026-89990.md) | Urgent | ceph: lock mutex in ceph_mds_check_access() | 9.8 | 0.0061 | | | [CVE-2026-80557](https://patchblox.com/security/data/cve/CVE-2026-80557.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decode_watchers() via m... | 9.8 | 0.0053 | | | [CVE-2026-89478](https://patchblox.com/security/data/cve/CVE-2026-89478.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed... | 9.8 | 0.0051 | | | [CVE-2026-89541](https://patchblox.com/security/data/cve/CVE-2026-89541.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_unwrap_resp_priv length check... | 9.8 | 0.0051 | | | [CVE-2026-89542](https://patchblox.com/security/data/cve/CVE-2026-89542.md) | Urgent | SUNRPC: harden gss_krb5_unwrap_v2 against short tokens | 9.8 | 0.0051 | | | [CVE-2026-89551](https://patchblox.com/security/data/cve/CVE-2026-89551.md) | Urgent | SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow | 9.8 | 0.0051 | | | [CVE-2026-89652](https://patchblox.com/security/data/cve/CVE-2026-89652.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS exp... | 9.8 | 0.0051 | | | [CVE-2026-89653](https://patchblox.com/security/data/cve/CVE-2026-89653.md) | Urgent | ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode | 9.8 | 0.0050 | | | [CVE-2026-89702](https://patchblox.com/security/data/cve/CVE-2026-89702.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: size fh_verify server sockaddr slot by xpt... | 9.8 | 0.0050 | | | [CVE-2026-89479](https://patchblox.com/security/data/cve/CVE-2026-89479.md) | Urgent | sctp: stop processing a packet once its association is deleted | 9.8 | 0.0050 | | | [CVE-2026-93207](https://patchblox.com/security/data/cve/CVE-2026-93207.md) | Urgent | SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry | 9.8 | 0.0047 | | | [CVE-2026-80725](https://patchblox.com/security/data/cve/CVE-2026-80725.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation... | 9.8 | 0.0046 | | | [CVE-2026-64216](https://patchblox.com/security/data/cve/CVE-2026-64216.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential UAF in netfs_unlock_abandon... | 9.8 | 0.0046 | | | [CVE-2026-74665](https://patchblox.com/security/data/cve/CVE-2026-74665.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP... | 9.1 | 0.0037 | | | [CVE-2026-68132](https://patchblox.com/security/data/cve/CVE-2026-68132.md) | Urgent | super: fix emergency thaw deadlock on frozen block devices | 9.8 | 0.0018 | | | [CVE-2026-80715](https://patchblox.com/security/data/cve/CVE-2026-80715.md) | Urgent | igc: remove napi_synchronize() in igc_down() | 9.8 | 0.0016 | | | [CVE-2026-80671](https://patchblox.com/security/data/cve/CVE-2026-80671.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix register_pid() overflow, strcpy,... | 9.3 | 0.0016 | | | [CVE-2026-74517](https://patchblox.com/security/data/cve/CVE-2026-74517.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Cancel delayed I/O APIC EOI handling b... | 9.3 | 0.0014 | | | [CVE-2026-64078](https://patchblox.com/security/data/cve/CVE-2026-64078.md) | Urgent | netfilter: x_tables: add and use xtables_unregister_table_exit | 9.8 | 0.0013 | | | [CVE-2026-64079](https://patchblox.com/security/data/cve/CVE-2026-64079.md) | Urgent | netfilter: x_tables: allocate hook ops while under mutex | 9.8 | 0.0012 | | | [CVE-2026-90011](https://patchblox.com/security/data/cve/CVE-2026-90011.md) | High | scsi: target: iscsi: Reserve a terminator byte for the login payload | 9.8 | 0.0084 | | | [CVE-2026-89696](https://patchblox.com/security/data/cve/CVE-2026-89696.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH t... | 7.5 | 0.0075 | | | [CVE-2026-68159](https://patchblox.com/security/data/cve/CVE-2026-68159.md) | High | libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE | 9.8 | 0.0075 | | | [CVE-2026-89680](https://patchblox.com/security/data/cve/CVE-2026-89680.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd_file leak on inter-server COPY se... | 7.5 | 0.0074 | | | [CVE-2026-74268](https://patchblox.com/security/data/cve/CVE-2026-74268.md) | High | tcp: clear sock_ops cb flags before force-closing a child socket | 9.8 | 0.0071 | | | [CVE-2026-89482](https://patchblox.com/security/data/cve/CVE-2026-89482.md) | High | nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone | 9.8 | 0.0071 | | | [CVE-2026-89538](https://patchblox.com/security/data/cve/CVE-2026-89538.md) | High | SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field | 9.8 | 0.0071 | | | [CVE-2026-89643](https://patchblox.com/security/data/cve/CVE-2026-89643.md) | High | audit: avoid dropping live tree ref on fsnotify rule autoremove | 9.8 | 0.0071 | | | [CVE-2026-89549](https://patchblox.com/security/data/cve/CVE-2026-89549.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svc_pool_fo... | 8.1 | 0.0071 | | | [CVE-2026-89779](https://patchblox.com/security/data/cve/CVE-2026-89779.md) | High | fs/ntfs3: validate ef->size covers the record's name and value | 9.1 | 0.0070 | | | [CVE-2026-89786](https://patchblox.com/security/data/cve/CVE-2026-89786.md) | High | ext4: fix out-of-bounds read in ext4_read_inline_dir() | 9.1 | 0.0070 | | | [CVE-2026-89476](https://patchblox.com/security/data/cve/CVE-2026-89476.md) | High | sctp: fix stream->outcnt underflow on duplicate RECONF responses | 7.8 | 0.0070 | | | [CVE-2026-89707](https://patchblox.com/security/data/cve/CVE-2026-89707.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on follow_down() error... | 7.5 | 0.0070 | | | [CVE-2026-90102](https://patchblox.com/security/data/cve/CVE-2026-90102.md) | High | NFSv4/pnfs: key the data server cache on the NFS version | 7.5 | 0.0070 | | | [CVE-2026-90103](https://patchblox.com/security/data/cve/CVE-2026-90103.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion... | 7.5 | 0.0070 | | | [CVE-2026-97557](https://patchblox.com/security/data/cve/CVE-2026-97557.md) | High | smb: client: avoid leaking refcount in cifs_queue_oplock_break() | 7.5 | 0.0070 | | | [CVE-2026-89662](https://patchblox.com/security/data/cve/CVE-2026-89662.md) | High | NFSD: Prevent lock owner use-after-free during client teardown | 9.8 | 0.0069 | | | [CVE-2026-89669](https://patchblox.com/security/data/cve/CVE-2026-89669.md) | High | nfsd: initialize copy-notify stateid before publishing it | 9.8 | 0.0069 | | | [CVE-2026-90067](https://patchblox.com/security/data/cve/CVE-2026-90067.md) | High | libceph: validate banner payload length | 7.5 | 0.0068 | | | [CVE-2026-89649](https://patchblox.com/security/data/cve/CVE-2026-89649.md) | High | ceph: bound xattr value length in __build_xattrs() | 9.1 | 0.0068 | | | [CVE-2026-89647](https://patchblox.com/security/data/cve/CVE-2026-89647.md) | High | ceph: do not repeat ceph_trim_dentries() if no progress possible | 7.8 | 0.0068 | | | [CVE-2026-90235](https://patchblox.com/security/data/cve/CVE-2026-90235.md) | High | sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE | 9.8 | 0.0066 | | | [CVE-2026-89973](https://patchblox.com/security/data/cve/CVE-2026-89973.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: check the data direction of a C2HData... | 9.8 | 0.0062 | | | [CVE-2026-89586](https://patchblox.com/security/data/cve/CVE-2026-89586.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes... | 8.2 | 0.0062 | | | [CVE-2026-89657](https://patchblox.com/security/data/cve/CVE-2026-89657.md) | High | libceph: validate OSD extent maps before cursor advance | 7.5 | 0.0061 | | | [CVE-2026-89554](https://patchblox.com/security/data/cve/CVE-2026-89554.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix uninitialized local_id in syncookie M... | 9.8 | 0.0060 | | | [CVE-2026-80590](https://patchblox.com/security/data/cve/CVE-2026-80590.md) | High | inet: frags: strip GSO state from fragments before reassembly | 8.8 | 0.0058 | | | [CVE-2026-89483](https://patchblox.com/security/data/cve/CVE-2026-89483.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvme_setup... | 7.5 | 0.0057 | | | [CVE-2026-89547](https://patchblox.com/security/data/cve/CVE-2026-89547.md) | High | SUNRPC: Check svc pool percpu counter allocation | 8.1 | 0.0056 | | | [CVE-2026-89671](https://patchblox.com/security/data/cve/CVE-2026-89671.md) | High | nfsd: gate nfs3 setacl by argp->mask | 9.1 | 0.0055 | | | [CVE-2026-74597](https://patchblox.com/security/data/cve/CVE-2026-74597.md) | High | ip6_tunnel: clear skb2->cb[] in ip6ip6_err() | 9.8 | 0.0054 | | | [CVE-2026-74743](https://patchblox.com/security/data/cve/CVE-2026-74743.md) | High | macvlan: inherit needed_headroom and needed_tailroom from lowerdev | 9.8 | 0.0054 | | | [CVE-2026-74746](https://patchblox.com/security/data/cve/CVE-2026-74746.md) | High | netfilter: flowtable: publish GC-visible tuple last | 9.8 | 0.0054 | | | [CVE-2026-89706](https://patchblox.com/security/data/cve/CVE-2026-89706.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY write... | 8.2 | 0.0053 | | | [CVE-2026-89704](https://patchblox.com/security/data/cve/CVE-2026-89704.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async... | 7.5 | 0.0053 | | | [CVE-2026-80587](https://patchblox.com/security/data/cve/CVE-2026-80587.md) | High | mptcp: avoid combining some incoming suboptions | 9.8 | 0.0052 | | | [CVE-2026-74662](https://patchblox.com/security/data/cve/CVE-2026-74662.md) | High | inet: frags: publish queues before arming timer | 9.8 | 0.0051 | | | [CVE-2026-74669](https://patchblox.com/security/data/cve/CVE-2026-74669.md) | High | ipvs: clear IPv4 options after rebasing tunnel ICMP errors | 9.8 | 0.0051 | | | [CVE-2026-80528](https://patchblox.com/security/data/cve/CVE-2026-80528.md) | High | ceph: avoid fs reclaim while using current->journal_info | 9.8 | 0.0051 | | | [CVE-2026-80558](https://patchblox.com/security/data/cve/CVE-2026-80558.md) | High | libceph: Avoid using invalid osd indices from primary_temp | 9.8 | 0.0051 | | | [CVE-2026-80561](https://patchblox.com/security/data/cve/CVE-2026-80561.md) | High | libceph: fix multiple unsafe decodes in decode_locker() | 9.8 | 0.0051 | | | [CVE-2026-81002](https://patchblox.com/security/data/cve/CVE-2026-81002.md) | High | xdp: fix zero-copy frame layout | 9.8 | 0.0051 | | | [CVE-2026-89656](https://patchblox.com/security/data/cve/CVE-2026-89656.md) | High | libceph: reject buckets with mismatched CRUSH ids | 9.8 | 0.0051 | | | [CVE-2026-89650](https://patchblox.com/security/data/cve/CVE-2026-89650.md) | High | ceph: bound num_export_targets array for mds info v2/v3 | 9.1 | 0.0051 | | | [CVE-2026-74616](https://patchblox.com/security/data/cve/CVE-2026-74616.md) | High | xdp: reject clones that overrun skb_shared_info tailroom | 9.8 | 0.0051 | | | [CVE-2026-74744](https://patchblox.com/security/data/cve/CVE-2026-74744.md) | High | ipvlan: inherit needed_headroom and needed_tailroom from phy_dev | 9.8 | 0.0051 | | | [CVE-2026-74730](https://patchblox.com/security/data/cve/CVE-2026-74730.md) | High | NFS: Pin the 'struct nfs_server' during a FREE_STATEID call | 9.8 | 0.0051 | | | [CVE-2026-89684](https://patchblox.com/security/data/cve/CVE-2026-89684.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4_init_cp_sta... | 9.8 | 0.0050 | | | [CVE-2026-80527](https://patchblox.com/security/data/cve/CVE-2026-80527.md) | High | ceph: fix hanging __ceph_get_caps() with stale mds_wanted | 7.8 | 0.0050 | | | [CVE-2026-74717](https://patchblox.com/security/data/cve/CVE-2026-74717.md) | High | net/mlx5: fw_tracer, return NULL on create error | 7.5 | 0.0050 | | | [CVE-2026-89477](https://patchblox.com/security/data/cve/CVE-2026-89477.md) | High | sctp: fix NULL deref on untransmitted RECONF completion | 7.5 | 0.0050 | | | [CVE-2026-89699](https://patchblox.com/security/data/cve/CVE-2026-89699.md) | High | nfsd: validate symlink target length in NFSv4 CREATE | 7.5 | 0.0050 | | | [CVE-2026-74705](https://patchblox.com/security/data/cve/CVE-2026-74705.md) | High | udp: fix potential use-after-free in tunnel segmentation | 10.0 | 0.0050 | | | [CVE-2026-74586](https://patchblox.com/security/data/cve/CVE-2026-74586.md) | High | sctp: clear new_transport when removing a peer | 9.8 | 0.0050 | | | [CVE-2026-74587](https://patchblox.com/security/data/cve/CVE-2026-74587.md) | High | sctp: fix use-after-free of cached ASCONF chunk | 9.8 | 0.0050 | | | [CVE-2026-74588](https://patchblox.com/security/data/cve/CVE-2026-74588.md) | High | sctp: keep chunk->transport in step with the list it is queued on | 9.8 | 0.0050 | | | [CVE-2026-74688](https://patchblox.com/security/data/cve/CVE-2026-74688.md) | High | sctp: clear control chunk transport if it is being removed | 9.8 | 0.0050 | | | [CVE-2026-68082](https://patchblox.com/security/data/cve/CVE-2026-68082.md) | High | libceph: fix two unsafe bare decodes in decode_lockers() | 9.8 | 0.0050 | | | [CVE-2026-74612](https://patchblox.com/security/data/cve/CVE-2026-74612.md) | High | veth: fix skb length accounting after XDP frag adjustment | 10.0 | 0.0049 | | | [CVE-2026-74474](https://patchblox.com/security/data/cve/CVE-2026-74474.md) | High | vxlan: use pskb_network_may_pull() for transmit path header pulls | 9.8 | 0.0049 | | | [CVE-2026-89550](https://patchblox.com/security/data/cve/CVE-2026-89550.md) | High | SUNRPC: svcauth_gss: enforce krb5 token minimum length | 9.8 | 0.0049 | | | [CVE-2026-74696](https://patchblox.com/security/data/cve/CVE-2026-74696.md) | High | tcp: fix TFO max_qlen accounting across reuseport migration | 7.5 | 0.0049 | | | [CVE-2026-74624](https://patchblox.com/security/data/cve/CVE-2026-74624.md) | High | netfilter: nf_conntrack: defer invalid log until after unlock | 7.5 | 0.0048 | | | [CVE-2026-74608](https://patchblox.com/security/data/cve/CVE-2026-74608.md) | High | smb: client: Fix use-after-free in cifs_try_adding_channels() | 9.8 | 0.0048 | | | [CVE-2026-74742](https://patchblox.com/security/data/cve/CVE-2026-74742.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to wake the peer txq... | 7.5 | 0.0046 | | | [CVE-2026-92489](https://patchblox.com/security/data/cve/CVE-2026-92489.md) | High | xfrm: Fix skb double-free in xfrm_dev_direct_output() | 9.8 | 0.0046 | | | [CVE-2026-89663](https://patchblox.com/security/data/cve/CVE-2026-89663.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before droppin... | 9.8 | 0.0046 | | | [CVE-2026-90141](https://patchblox.com/security/data/cve/CVE-2026-90141.md) | High | ipvs: fix integer overflow in ftp helper port/address parsing | 9.8 | 0.0045 | | | [CVE-2026-74704](https://patchblox.com/security/data/cve/CVE-2026-74704.md) | High | net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter | 8.2 | 0.0044 | | | [CVE-2026-89711](https://patchblox.com/security/data/cve/CVE-2026-89711.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_... | 8.2 | 0.0044 | | | [CVE-2026-89481](https://patchblox.com/security/data/cve/CVE-2026-89481.md) | High | nvme-tcp: fix host memory disclosure on R2T for a read command | 8.8 | 0.0043 | | | [CVE-2026-89480](https://patchblox.com/security/data/cve/CVE-2026-89480.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few... | 8.8 | 0.0043 | | | [CVE-2026-74598](https://patchblox.com/security/data/cve/CVE-2026-74598.md) | High | ipv6: fix Route Information option length validation | 7.5 | 0.0043 | | | [CVE-2026-89616](https://patchblox.com/security/data/cve/CVE-2026-89616.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompre... | 7.5 | 0.0042 | | | [CVE-2026-68118](https://patchblox.com/security/data/cve/CVE-2026-68118.md) | High | tcp: challenge ACK for non-exact RST in SYN-RECEIVED | 8.2 | 0.0041 | | | [CVE-2026-72493](https://patchblox.com/security/data/cve/CVE-2026-72493.md) | High | net: serialize netif_running() check in enqueue_to_backlog() | 9.9 | 0.0040 | | | [CVE-2026-80586](https://patchblox.com/security/data/cve/CVE-2026-80586.md) | High | mptcp: options: reset DSS fields in case of unexpected size | 9.8 | 0.0040 | | | [CVE-2026-80589](https://patchblox.com/security/data/cve/CVE-2026-80589.md) | High | block: stop the timeout timer when releasing a never added disk | 9.8 | 0.0037 | | | [CVE-2026-64210](https://patchblox.com/security/data/cve/CVE-2026-64210.md) | High | net/mlx5e: xsk: Fix unlocked writing to ICOSQ | 7.5 | 0.0037 | | | [CVE-2026-89995](https://patchblox.com/security/data/cve/CVE-2026-89995.md) | High | dma-direct: return struct page from dma_direct_alloc_from_pool() | 8.8 | 0.0035 | | | [CVE-2026-90329](https://patchblox.com/security/data/cve/CVE-2026-90329.md) | High | HID: synchronize input before cleaning up a failed probe | 8.8 | 0.0034 | | | [CVE-2026-74592](https://patchblox.com/security/data/cve/CVE-2026-74592.md) | High | ima: Instantiate file_truncate and path_truncate hooks | 8.1 | 0.0034 | | | [CVE-2026-93189](https://patchblox.com/security/data/cve/CVE-2026-93189.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: HID: core: quiesce input in hid_hw_stop() to pre... | 9.8 | 0.0032 | | | [CVE-2026-80585](https://patchblox.com/security/data/cve/CVE-2026-80585.md) | High | mptcp: fastopen: only mark MPTFO subflows with SYN data | 9.4 | 0.0031 | | | [CVE-2026-89645](https://patchblox.com/security/data/cve/CVE-2026-89645.md) | High | btrfs: drop recovered reloc root refs on recovery failure | 7.0 | 0.0025 | | | [CVE-2026-93240](https://patchblox.com/security/data/cve/CVE-2026-93240.md) | High | memcg: make the v1 soft limit knob inert | 7.8 | 0.0023 | | | [CVE-2026-90200](https://patchblox.com/security/data/cve/CVE-2026-90200.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix integer overflow in MFT cluster va... | n/a | 0.0023 | | | [CVE-2026-90150](https://patchblox.com/security/data/cve/CVE-2026-90150.md) | High | pnfs/blocklayout: Fix device leaks on parse failure | 9.8 | 0.0022 | | | [CVE-2026-89694](https://patchblox.com/security/data/cve/CVE-2026-89694.md) | High | nfsd: check client ownership when cancelling a copy-notify stateid | 8.8 | 0.0022 | | | [CVE-2026-90073](https://patchblox.com/security/data/cve/CVE-2026-90073.md) | High | net/sched: hhf: clamp quantum before hhf_change() to avoid overflow | 7.8 | 0.0022 | | | [CVE-2026-90081](https://patchblox.com/security/data/cve/CVE-2026-90081.md) | High | net/rds: use wq_has_sleeper() in rds_cong_map_updated() | 7.8 | 0.0022 | | | [CVE-2026-90284](https://patchblox.com/security/data/cve/CVE-2026-90284.md) | High | firmware_loader: do not queue completed sysfs fallback requests | 7.8 | 0.0022 | | | [CVE-2026-90334](https://patchblox.com/security/data/cve/CVE-2026-90334.md) | High | tty: clear cdev pointer after cdev_add() failure | 7.8 | 0.0022 | | | [CVE-2026-93239](https://patchblox.com/security/data/cve/CVE-2026-93239.md) | High | arm64: mm: Fix the lockless page-table walk in show_pte() | 7.8 | 0.0022 | | | [CVE-2026-89984](https://patchblox.com/security/data/cve/CVE-2026-89984.md) | High | perf/x86/intel: Fix kernel address leakages in LBR stack | 7.1 | 0.0022 | | | [CVE-2026-90318](https://patchblox.com/security/data/cve/CVE-2026-90318.md) | High | fat: release buffer head after rebuilding parent | 7.1 | 0.0022 | | | [CVE-2026-90076](https://patchblox.com/security/data/cve/CVE-2026-90076.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: fq: add overflow bounds to quantum an... | 7.8 | 0.0021 | | | [CVE-2026-89484](https://patchblox.com/security/data/cve/CVE-2026-89484.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: lockd: fix NULL dereference on lockowner allocat... | 7.5 | 0.0021 | | | [CVE-2026-93163](https://patchblox.com/security/data/cve/CVE-2026-93163.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: hwrng: core - fix rng list on registration error... | 7.0 | 0.0021 | | | [CVE-2026-90063](https://patchblox.com/security/data/cve/CVE-2026-90063.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don't overfl... | 7.8 | 0.0021 | | | [CVE-2026-90139](https://patchblox.com/security/data/cve/CVE-2026-90139.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fuse: check for NULL root inode in fuse_fill_sup... | 7.8 | 0.0021 | | | [CVE-2026-90140](https://patchblox.com/security/data/cve/CVE-2026-90140.md) | High | cuse: wait for pending RCU callbacks on module exit | 7.8 | 0.0021 | | | [CVE-2026-90248](https://patchblox.com/security/data/cve/CVE-2026-90248.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: fix teardown of an adopted p... | 7.8 | 0.0021 | | | [CVE-2026-93109](https://patchblox.com/security/data/cve/CVE-2026-93109.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Drain RCU callbacks during module tea... | 7.8 | 0.0021 | | | [CVE-2026-89785](https://patchblox.com/security/data/cve/CVE-2026-89785.md) | High | fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init | 7.1 | 0.0021 | | | [CVE-2026-90313](https://patchblox.com/security/data/cve/CVE-2026-90313.md) | High | bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed | 7.1 | 0.0021 | | | [CVE-2026-89983](https://patchblox.com/security/data/cve/CVE-2026-89983.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix debugfs UAF on adapter removal i... | 7.0 | 0.0021 | | | [CVE-2026-89451](https://patchblox.com/security/data/cve/CVE-2026-89451.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle->dev before the SVA handle... | 7.8 | 0.0021 | | | [CVE-2026-89502](https://patchblox.com/security/data/cve/CVE-2026-89502.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Free cpu_buffer::free_page with sub... | 7.8 | 0.0021 | | | [CVE-2026-90115](https://patchblox.com/security/data/cve/CVE-2026-90115.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: xsk: fix NULL pointer dereference in __xsk_rcv()... | 7.8 | 0.0021 | | | [CVE-2026-90184](https://patchblox.com/security/data/cve/CVE-2026-90184.md) | High | null_blk: serialize configfs attribute updates with device setup | 7.8 | 0.0021 | | | [CVE-2026-90187](https://patchblox.com/security/data/cve/CVE-2026-90187.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: null_blk: free zones array on device power-off... | 7.8 | 0.0021 | | | [CVE-2026-90188](https://patchblox.com/security/data/cve/CVE-2026-90188.md) | High | null_blk: free global tag_set on init error path | 7.8 | 0.0021 | | | [CVE-2026-90201](https://patchblox.com/security/data/cve/CVE-2026-90201.md) | High | net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race | 7.8 | 0.0021 | | | [CVE-2026-90385](https://patchblox.com/security/data/cve/CVE-2026-90385.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: md/raid1: create serial pool adding rdev to arra... | 7.8 | 0.0021 | | | [CVE-2026-93134](https://patchblox.com/security/data/cve/CVE-2026-93134.md) | High | printk: Fix possible console use-after-free | 7.8 | 0.0021 | | | [CVE-2026-93182](https://patchblox.com/security/data/cve/CVE-2026-93182.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix overflow in update_tg_cfs_runnab... | 7.8 | 0.0021 | | | [CVE-2026-93150](https://patchblox.com/security/data/cve/CVE-2026-93150.md) | High | cgroup/cpuset: Make nr_deadline_tasks an atomic_t | 7.0 | 0.0021 | | | [CVE-2026-80840](https://patchblox.com/security/data/cve/CVE-2026-80840.md) | High | ipv6: seg6: clear IPv4 control block on IPIP decapsulation | 7.8 | 0.0021 | | | [CVE-2026-93117](https://patchblox.com/security/data/cve/CVE-2026-93117.md) | High | usb: fix UAF when probe runs concurrent to dyn ID removal | 7.8 | 0.0021 | | | [CVE-2026-90389](https://patchblox.com/security/data/cve/CVE-2026-90389.md) | High | md: scope memalloc_noio to allocation critical sections | 7.1 | 0.0020 | | | [CVE-2026-90426](https://patchblox.com/security/data/cve/CVE-2026-90426.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Free the error IRQ before... | n/a | 0.0020 | | | [CVE-2026-80824](https://patchblox.com/security/data/cve/CVE-2026-80824.md) | High | usb: usbfs: fix use-after-free of usb_device in usbdev_release() | 8.8 | 0.0020 | | | [CVE-2026-80792](https://patchblox.com/security/data/cve/CVE-2026-80792.md) | High | ipv6: fix use-after-free in ip6_finish_output2() | 8.1 | 0.0020 | | | [CVE-2026-80808](https://patchblox.com/security/data/cve/CVE-2026-80808.md) | High | ext4: stop retrying saturated xattr cache entries | 7.0 | 0.0020 | | | [CVE-2026-89930](https://patchblox.com/security/data/cve/CVE-2026-89930.md) | High | KVM: nVMX: Service local TLB flushes on failed nested VM-Enter | 9.3 | 0.0019 | | | [CVE-2026-89588](https://patchblox.com/security/data/cve/CVE-2026-89588.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length account... | 8.4 | 0.0019 | | | [CVE-2026-89781](https://patchblox.com/security/data/cve/CVE-2026-89781.md) | High | fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() | 8.4 | 0.0019 | | | [CVE-2026-80852](https://patchblox.com/security/data/cve/CVE-2026-80852.md) | High | tls: device: fix out-of-bounds write in tls_append_frag() | 7.8 | 0.0018 | | | [CVE-2026-89782](https://patchblox.com/security/data/cve/CVE-2026-89782.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject restart table growth beyond U16... | 8.4 | 0.0018 | | | [CVE-2026-89992](https://patchblox.com/security/data/cve/CVE-2026-89992.md) | High | cpuidle: dt_idle_genpd: kfree() the original name allocation | 8.4 | 0.0018 | | | [CVE-2026-89927](https://patchblox.com/security/data/cve/CVE-2026-89927.md) | High | KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock | 7.8 | 0.0018 | | | [CVE-2026-93073](https://patchblox.com/security/data/cve/CVE-2026-93073.md) | High | dax: read holder_ops once in dax_holder_notify_failure() | 7.1 | 0.0018 | | | [CVE-2026-80842](https://patchblox.com/security/data/cve/CVE-2026-80842.md) | High | net: bridge: mcast: fix use-after-free of a master VLAN's multicast context | 7.8 | 0.0018 | | | [CVE-2026-89552](https://patchblox.com/security/data/cve/CVE-2026-89552.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: params: fix charp corruption on allocation failu... | 7.8 | 0.0018 | | | [CVE-2026-93055](https://patchblox.com/security/data/cve/CVE-2026-93055.md) | High | UDF symlink pathComponent header OOB read | 7.1 | 0.0018 | | | [CVE-2026-74672](https://patchblox.com/security/data/cve/CVE-2026-74672.md) | High | mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF | 7.0 | 0.0018 | | | [CVE-2026-92521](https://patchblox.com/security/data/cve/CVE-2026-92521.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ACPI: PCI: Clear driver_data on all paths that f... | 7.0 | 0.0018 | | | [CVE-2026-93138](https://patchblox.com/security/data/cve/CVE-2026-93138.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix vmlinux BTF prep race in bpf_get_btf_vm... | 7.8 | 0.0018 | | | [CVE-2026-90241](https://patchblox.com/security/data/cve/CVE-2026-90241.md) | High | iommu/vt-d: Tear down scalable-mode context on probe failure | 8.2 | 0.0018 | | | [CVE-2026-89618](https://patchblox.com/security/data/cve/CVE-2026-89618.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: eventfs: Initialize ei->children and ei->list in... | 7.0 | 0.0018 | | | [CVE-2026-90199](https://patchblox.com/security/data/cve/CVE-2026-90199.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject out-of-range evcn in mi_enum_at... | 7.8 | 0.0017 | | | [CVE-2026-89666](https://patchblox.com/security/data/cve/CVE-2026-89666.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETA... | 9.8 | 0.0017 | | | [CVE-2026-80837](https://patchblox.com/security/data/cve/CVE-2026-80837.md) | High | netfilter: nf_tables: don't queue packet path object notifications | 7.8 | 0.0017 | | | [CVE-2026-90189](https://patchblox.com/security/data/cve/CVE-2026-90189.md) | High | null_blk: register configfs subsystem after creating default devices | 7.8 | 0.0017 | | | [CVE-2026-92509](https://patchblox.com/security/data/cve/CVE-2026-92509.md) | High | RDMA/core: Fix potential use after free in counter_release() | 7.8 | 0.0017 | | | [CVE-2026-92512](https://patchblox.com/security/data/cve/CVE-2026-92512.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix use after free in ib_query_qp()... | 7.8 | 0.0017 | | | [CVE-2026-89710](https://patchblox.com/security/data/cve/CVE-2026-89710.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: fix layout segment leak on the pnfs_lay... | 7.5 | 0.0017 | | | [CVE-2026-93205](https://patchblox.com/security/data/cve/CVE-2026-93205.md) | High | iommu/arm-smmu-v3: Manage teardown with devm | 7.0 | 0.0017 | | | [CVE-2026-90049](https://patchblox.com/security/data/cve/CVE-2026-90049.md) | High | net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() | 9.3 | 0.0017 | | | [CVE-2026-80994](https://patchblox.com/security/data/cve/CVE-2026-80994.md) | High | net: openvswitch: fix flow mask use-after-free on flow deletion | 7.8 | 0.0017 | | | [CVE-2026-90203](https://patchblox.com/security/data/cve/CVE-2026-90203.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: Squashfs: check block offset is not negative If... | 7.1 | 0.0017 | | | [CVE-2026-89932](https://patchblox.com/security/data/cve/CVE-2026-89932.md) | High | KVM: nVMX: Always flush vpid02 on first use | 9.8 | 0.0017 | | | [CVE-2026-89557](https://patchblox.com/security/data/cve/CVE-2026-89557.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: md: do overflow check for sb->bblog_shift in sup... | 7.8 | 0.0017 | | | [CVE-2026-89559](https://patchblox.com/security/data/cve/CVE-2026-89559.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in __... | 7.8 | 0.0017 | | | [CVE-2026-89574](https://patchblox.com/security/data/cve/CVE-2026-89574.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read... | 7.8 | 0.0017 | | | [CVE-2026-89741](https://patchblox.com/security/data/cve/CVE-2026-89741.md) | High | Revert "media: v4l2-dev: fix error handling in __video_register_device()" | 7.8 | 0.0017 | | | [CVE-2026-89823](https://patchblox.com/security/data/cve/CVE-2026-89823.md) | High | drm: fix race between partial drm_dev_register() failure and ioctl | 7.8 | 0.0017 | | | [CVE-2026-89965](https://patchblox.com/security/data/cve/CVE-2026-89965.md) | High | nvdimm/btt: reject an arena whose nfree is below the lane count | 7.8 | 0.0017 | | | [CVE-2026-89988](https://patchblox.com/security/data/cve/CVE-2026-89988.md) | High | kprobes: Protect kprobe_blacklist with RCU | 7.8 | 0.0017 | | | [CVE-2026-89998](https://patchblox.com/security/data/cve/CVE-2026-89998.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: dm: fix race when loading and unloading a table... | 7.8 | 0.0017 | | | [CVE-2026-90358](https://patchblox.com/security/data/cve/CVE-2026-90358.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix trampoline stack size for 128-bit... | 7.8 | 0.0017 | | | [CVE-2026-90388](https://patchblox.com/security/data/cve/CVE-2026-90388.md) | High | iommu/dma: Check atomic pool allocation result directly | 7.8 | 0.0017 | | | [CVE-2026-90392](https://patchblox.com/security/data/cve/CVE-2026-90392.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF when reading bpf link inf... | 7.8 | 0.0017 | | | [CVE-2026-89929](https://patchblox.com/security/data/cve/CVE-2026-89929.md) | High | KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU | 8.8 | 0.0017 | | | [CVE-2026-90227](https://patchblox.com/security/data/cve/CVE-2026-90227.md) | High | nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() | 8.8 | 0.0017 | | | [CVE-2026-80838](https://patchblox.com/security/data/cve/CVE-2026-80838.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: vxlan: keep the last remote linked during FDB fl... | 7.8 | 0.0017 | | | [CVE-2026-89501](https://patchblox.com/security/data/cve/CVE-2026-89501.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Hold cpu_buffer::lock when resizing... | 7.8 | 0.0017 | | | [CVE-2026-93212](https://patchblox.com/security/data/cve/CVE-2026-93212.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: guard nfsd_serv deref in nfsd_file_net_dis... | 7.5 | 0.0017 | | | [CVE-2026-90428](https://patchblox.com/security/data/cve/CVE-2026-90428.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't run the error ISR be... | n/a | 0.0017 | | | [CVE-2026-89579](https://patchblox.com/security/data/cve/CVE-2026-89579.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on... | 7.8 | 0.0017 | | | [CVE-2026-89777](https://patchblox.com/security/data/cve/CVE-2026-89777.md) | High | vfio/pci: clear vdev->msi_perm after freeing it on init failure | 8.8 | 0.0016 | | | [CVE-2026-89997](https://patchblox.com/security/data/cve/CVE-2026-89997.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: dm: fix resume-vs-remove race If the user issue... | 7.8 | 0.0016 | | | [CVE-2026-90071](https://patchblox.com/security/data/cve/CVE-2026-90071.md) | High | net/sched: sch_teql: restore skb->dev on the slave failure path | 7.8 | 0.0016 | | | [CVE-2026-90325](https://patchblox.com/security/data/cve/CVE-2026-90325.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: skip dying blkg in blkcg_activate_po... | 7.8 | 0.0016 | | | [CVE-2026-92507](https://patchblox.com/security/data/cve/CVE-2026-92507.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ib_de... | 7.8 | 0.0016 | | | [CVE-2026-92508](https://patchblox.com/security/data/cve/CVE-2026-92508.md) | High | RDMA/core: Fix potential use after free in ib_free_cq() | 7.8 | 0.0016 | | | [CVE-2026-90062](https://patchblox.com/security/data/cve/CVE-2026-90062.md) | High | netfilter: nf_tables: move hardware offload step after building the chain blob | 7.1 | 0.0016 | | | [CVE-2026-89690](https://patchblox.com/security/data/cve/CVE-2026-89690.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpc_sta... | 8.8 | 0.0016 | | | [CVE-2026-89747](https://patchblox.com/security/data/cve/CVE-2026-89747.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in trace_pipe read o... | 7.8 | 0.0016 | | | [CVE-2026-89986](https://patchblox.com/security/data/cve/CVE-2026-89986.md) | High | mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave() | 7.8 | 0.0016 | | | [CVE-2026-93250](https://patchblox.com/security/data/cve/CVE-2026-93250.md) | High | vxlan: mdb: Fix use-after-free in vxlan_mdb_flush() | 7.8 | 0.0016 | | | [CVE-2026-80904](https://patchblox.com/security/data/cve/CVE-2026-80904.md) | High | net/tls: Fail tls_sw_splice_read() after a failed async decrypt | 7.8 | 0.0016 | | | [CVE-2026-93137](https://patchblox.com/security/data/cve/CVE-2026-93137.md) | High | bpf: Fix use-after-free on mm_struct in bpf_find_vma() | 7.8 | 0.0016 | | | [CVE-2026-90243](https://patchblox.com/security/data/cve/CVE-2026-90243.md) | High | iommu/vt-d: Clear Present bit before tearing down copied context entry | 8.1 | 0.0016 | | | [CVE-2026-80862](https://patchblox.com/security/data/cve/CVE-2026-80862.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix usage of page_frag_cache nvme use... | 9.8 | 0.0016 | | | [CVE-2026-93262](https://patchblox.com/security/data/cve/CVE-2026-93262.md) | High | md/raid5-ppl: fix use-after-free in ppl_do_flush() | 8.8 | 0.0015 | | | [CVE-2026-89615](https://patchblox.com/security/data/cve/CVE-2026-89615.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound page_lcns[] index by the log rec... | 8.4 | 0.0015 | | | [CVE-2026-93046](https://patchblox.com/security/data/cve/CVE-2026-93046.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: software node: Fix software_node_get_reference_a... | 7.0 | 0.0015 | | | [CVE-2026-93054](https://patchblox.com/security/data/cve/CVE-2026-93054.md) | High | uio: Fix stale info pointer in failed registration path | 7.0 | 0.0015 | | | [CVE-2026-74684](https://patchblox.com/security/data/cve/CVE-2026-74684.md) | High | net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() | 7.1 | 0.0015 | | | [CVE-2026-89448](https://patchblox.com/security/data/cve/CVE-2026-89448.md) | High | iommu/vt-d: Force requesting ACS when tboot is enabled | 9.3 | 0.0014 | | | [CVE-2026-74614](https://patchblox.com/security/data/cve/CVE-2026-74614.md) | High | vsock/virtio: read virtqueues under worker locks | 8.4 | 0.0014 | | | [CVE-2026-80536](https://patchblox.com/security/data/cve/CVE-2026-80536.md) | High | xfs: bounds-check buffer log item's dirty bitmap | 8.4 | 0.0014 | | | [CVE-2026-89744](https://patchblox.com/security/data/cve/CVE-2026-89744.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnode_for... | 8.4 | 0.0014 | | | [CVE-2026-80731](https://patchblox.com/security/data/cve/CVE-2026-80731.md) | High | net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header | 7.8 | 0.0014 | | | [CVE-2026-89743](https://patchblox.com/security/data/cve/CVE-2026-89743.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response le... | 7.7 | 0.0014 | | | [CVE-2026-74739](https://patchblox.com/security/data/cve/CVE-2026-74739.md) | High | net/sched: cls_u32: skip hash tables in u32_bind_class() | 7.8 | 0.0014 | | | [CVE-2026-74748](https://patchblox.com/security/data/cve/CVE-2026-74748.md) | High | netfilter: ipset: fix refcount race between list:set GC and swap | 7.8 | 0.0014 | | | [CVE-2026-89563](https://patchblox.com/security/data/cve/CVE-2026-89563.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()... | 7.8 | 0.0014 | | | [CVE-2026-89617](https://patchblox.com/security/data/cve/CVE-2026-89617.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log repla... | 7.8 | 0.0014 | | | [CVE-2026-74589](https://patchblox.com/security/data/cve/CVE-2026-74589.md) | High | bpf, sockmap: Fix sk_redir use-after-free in send verdict | 8.4 | 0.0014 | | | [CVE-2026-80932](https://patchblox.com/security/data/cve/CVE-2026-80932.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order v... | 8.4 | 0.0014 | | | [CVE-2026-74736](https://patchblox.com/security/data/cve/CVE-2026-74736.md) | High | net/sched: cls_bpf: reject dev-bound programs bound to a different device | 7.8 | 0.0014 | | | [CVE-2026-92522](https://patchblox.com/security/data/cve/CVE-2026-92522.md) | High | ACPI: processor: validate MADT IOAPIC entry bounds | 7.3 | 0.0014 | | | [CVE-2026-74601](https://patchblox.com/security/data/cve/CVE-2026-74601.md) | High | ring-buffer: Use current_context for safe per-CPU buffer swap | 7.8 | 0.0014 | | | [CVE-2026-74667](https://patchblox.com/security/data/cve/CVE-2026-74667.md) | High | net/packet: reset the MAC header on the packet-socket transmit path | 7.8 | 0.0014 | | | [CVE-2026-80530](https://patchblox.com/security/data/cve/CVE-2026-80530.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing is... | 7.8 | 0.0013 | | | [CVE-2026-80574](https://patchblox.com/security/data/cve/CVE-2026-80574.md) | High | Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet | 8.4 | 0.0013 | | | [CVE-2026-64520](https://patchblox.com/security/data/cve/CVE-2026-64520.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS... | 8.4 | 0.0013 | | | [CVE-2026-74701](https://patchblox.com/security/data/cve/CVE-2026-74701.md) | High | net/openvswitch: check Ethernet header length in key_extract() | 7.8 | 0.0013 | | | [CVE-2026-89580](https://patchblox.com/security/data/cve/CVE-2026-89580.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in __bpf_get_stack get_... | 7.8 | 0.0013 | | | [CVE-2026-74753](https://patchblox.com/security/data/cve/CVE-2026-74753.md) | High | perf: Reject exited events as group leaders | 8.8 | 0.0013 | | | [CVE-2026-74334](https://patchblox.com/security/data/cve/CVE-2026-74334.md) | High | RDMA/nldev: Fix locking when accessing mr->pd | 7.8 | 0.0013 | | | [CVE-2026-74594](https://patchblox.com/security/data/cve/CVE-2026-74594.md) | High | sched/psi: Shut down rtpoll_timer in psi_cgroup_free() | 7.8 | 0.0013 | | | [CVE-2026-74610](https://patchblox.com/security/data/cve/CVE-2026-74610.md) | High | tls: don't leave a full plaintext sk_msg ring unpushed | 7.8 | 0.0013 | | | [CVE-2026-74632](https://patchblox.com/security/data/cve/CVE-2026-74632.md) | High | mm/huge_memory: fix huge_zero_pfn race | 7.8 | 0.0013 | | | [CVE-2026-74635](https://patchblox.com/security/data/cve/CVE-2026-74635.md) | High | fbdev: bitblit: bound-check glyph index in bit_cursor() | 7.8 | 0.0013 | | | [CVE-2026-74663](https://patchblox.com/security/data/cve/CVE-2026-74663.md) | High | net/sched: reject overly deep qdisc hierarchies | 7.8 | 0.0013 | | | [CVE-2026-74666](https://patchblox.com/security/data/cve/CVE-2026-74666.md) | High | packet: synchronize pressure clearing with ring reconfiguration | 7.8 | 0.0013 | | | [CVE-2026-74668](https://patchblox.com/security/data/cve/CVE-2026-74668.md) | High | packet: use consistent hard_header_len in TX_RING send path | 7.8 | 0.0013 | | | [CVE-2026-74670](https://patchblox.com/security/data/cve/CVE-2026-74670.md) | High | ipvs: stop estimator after disabled calc phase | 7.8 | 0.0013 | | | [CVE-2026-74675](https://patchblox.com/security/data/cve/CVE-2026-74675.md) | High | vt: stabilize tty reference in kbd_keycode with tty_port_tty_get | 7.8 | 0.0013 | | | [CVE-2026-74710](https://patchblox.com/security/data/cve/CVE-2026-74710.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: xsk: require at least 16 bytes of TX metadata A... | 7.8 | 0.0013 | | | [CVE-2026-74720](https://patchblox.com/security/data/cve/CVE-2026-74720.md) | High | bpf: Preserve pointer state for commuted arithmetic | 7.8 | 0.0013 | | | [CVE-2026-80737](https://patchblox.com/security/data/cve/CVE-2026-80737.md) | High | serial: amba-pl011: synchronize DMA teardown | 7.8 | 0.0013 | | | [CVE-2026-80977](https://patchblox.com/security/data/cve/CVE-2026-80977.md) | High | net: skbuff: don't touch shared zerocopy state in skb_tx_error() | 7.8 | 0.0013 | | | [CVE-2026-80978](https://patchblox.com/security/data/cve/CVE-2026-80978.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunne... | 7.8 | 0.0013 | | | [CVE-2026-89487](https://patchblox.com/security/data/cve/CVE-2026-89487.md) | High | openvswitch: only skb_tx_error() a packet we are about to drop | 7.8 | 0.0013 | | | [CVE-2026-89540](https://patchblox.com/security/data/cve/CVE-2026-89540.md) | High | sunrpc: init gssp_lock before publishing proc entry | 7.8 | 0.0013 | | | [CVE-2026-89562](https://patchblox.com/security/data/cve/CVE-2026-89562.md) | High | ip6_gre: fix hardware header length for NBMA tunnels | 7.8 | 0.0013 | | | [CVE-2026-89573](https://patchblox.com/security/data/cve/CVE-2026-89573.md) | High | dm array: reject an array block whose value size is not the caller's | 7.8 | 0.0013 | | | [CVE-2026-89581](https://patchblox.com/security/data/cve/CVE-2026-89581.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an... | 7.8 | 0.0013 | | | [CVE-2026-90435](https://patchblox.com/security/data/cve/CVE-2026-90435.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix integer overflow of user QP buffe... | 7.8 | 0.0013 | | | [CVE-2026-93045](https://patchblox.com/security/data/cve/CVE-2026-93045.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Reject arena frees below the arena base bp... | 7.8 | 0.0013 | | | [CVE-2026-74630](https://patchblox.com/security/data/cve/CVE-2026-74630.md) | High | ipv6: prevent in6_dev_get() from resurrecting inet6_dev | 7.8 | 0.0013 | | | [CVE-2026-74615](https://patchblox.com/security/data/cve/CVE-2026-74615.md) | High | vxlan: do not arm the ageing timer on a device that is down | 8.8 | 0.0013 | | | [CVE-2026-89488](https://patchblox.com/security/data/cve/CVE-2026-89488.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-fre... | 8.8 | 0.0013 | | | [CVE-2026-89560](https://patchblox.com/security/data/cve/CVE-2026-89560.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG fo... | 8.4 | 0.0013 | | | [CVE-2026-74609](https://patchblox.com/security/data/cve/CVE-2026-74609.md) | High | tipc: read le->link under the node lock in tipc_node_link_down() | 7.8 | 0.0013 | | | [CVE-2026-74613](https://patchblox.com/security/data/cve/CVE-2026-74613.md) | High | vsock/virtio: avoid refilling the RX queue after teardown | 7.8 | 0.0013 | | | [CVE-2026-74637](https://patchblox.com/security/data/cve/CVE-2026-74637.md) | High | perf/core: Fix group leader use-after-free after sibling detach | 7.8 | 0.0013 | | | [CVE-2026-74656](https://patchblox.com/security/data/cve/CVE-2026-74656.md) | High | ipv4: fix use-after-free in fib_nhc_update_mtu() | 7.8 | 0.0013 | | | [CVE-2026-74660](https://patchblox.com/security/data/cve/CVE-2026-74660.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: ebt_nflog: pin the NFLOG backend nf_... | 7.8 | 0.0013 | | | [CVE-2026-74700](https://patchblox.com/security/data/cve/CVE-2026-74700.md) | High | net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers | 7.8 | 0.0013 | | | [CVE-2026-74714](https://patchblox.com/security/data/cve/CVE-2026-74714.md) | High | bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() | 7.8 | 0.0013 | | | [CVE-2026-89508](https://patchblox.com/security/data/cve/CVE-2026-89508.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma_set_ib_path(... | 7.8 | 0.0013 | | | [CVE-2026-89548](https://patchblox.com/security/data/cve/CVE-2026-89548.md) | High | SUNRPC: always drain cache_cleaner before destroying a cache_detail | 7.8 | 0.0013 | | | [CVE-2026-92510](https://patchblox.com/security/data/cve/CVE-2026-92510.md) | High | RDMA/core: Fix potential use after free in ib_destroy_srq_user() | 7.8 | 0.0013 | | | [CVE-2026-92511](https://patchblox.com/security/data/cve/CVE-2026-92511.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ib_de... | 7.8 | 0.0013 | | | [CVE-2026-74726](https://patchblox.com/security/data/cve/CVE-2026-74726.md) | High | bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor | 7.3 | 0.0013 | | | [CVE-2026-89640](https://patchblox.com/security/data/cve/CVE-2026-89640.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: cifs: fix loff_t underflow in cifs_remap_file_ra... | 7.1 | 0.0013 | | | [CVE-2026-89691](https://patchblox.com/security/data/cve/CVE-2026-89691.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to pre... | 8.1 | 0.0013 | | | [CVE-2026-74606](https://patchblox.com/security/data/cve/CVE-2026-74606.md) | High | eventfs: Fix use-after-free in eventfs_remove_rec() | 7.8 | 0.0013 | | | [CVE-2026-74634](https://patchblox.com/security/data/cve/CVE-2026-74634.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when re... | 7.8 | 0.0013 | | | [CVE-2026-89593](https://patchblox.com/security/data/cve/CVE-2026-89593.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: hugetlb: only adjust reservation during unmappin... | 7.1 | 0.0013 | | | [CVE-2026-93229](https://patchblox.com/security/data/cve/CVE-2026-93229.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpc_status_get... | 7.1 | 0.0013 | | | [CVE-2026-74724](https://patchblox.com/security/data/cve/CVE-2026-74724.md) | High | ipvs: avoid out-of-bounds write in ip_vs_nat_icmp | 7.8 | 0.0012 | | | [CVE-2026-74582](https://patchblox.com/security/data/cve/CVE-2026-74582.md) | High | packet: use consistent hard_header_len in non-ring send paths | 9.8 | 0.0012 | | | [CVE-2026-80572](https://patchblox.com/security/data/cve/CVE-2026-80572.md) | High | Input: byd - synchronize timer deletion before freeing private data | 7.8 | 0.0012 | | | [CVE-2026-89771](https://patchblox.com/security/data/cve/CVE-2026-89771.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring bu... | 7.8 | 0.0012 | | | [CVE-2026-74583](https://patchblox.com/security/data/cve/CVE-2026-74583.md) | High | net/sched: cls_route: fix fastmap use-after-free on filter | 8.8 | 0.0012 | | | [CVE-2026-80578](https://patchblox.com/security/data/cve/CVE-2026-80578.md) | High | fbdev: core: Fix pointer desynchronization in fb_io_read() | 7.3 | 0.0012 | | | [CVE-2026-63858](https://patchblox.com/security/data/cve/CVE-2026-63858.md) | High | netfilter: nf_tables: add hook transactions for device deletions | 7.8 | 0.0010 | | | [CVE-2026-74595](https://patchblox.com/security/data/cve/CVE-2026-74595.md) | High | fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() | 7.8 | 0.0009 | | | [CVE-2026-89603](https://patchblox.com/security/data/cve/CVE-2026-89603.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: s... | 9.8 | n/a | | | [CVE-2026-80726](https://patchblox.com/security/data/cve/CVE-2026-80726.md) | High | KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page | 9.3 | n/a | | | [CVE-2026-89575](https://patchblox.com/security/data/cve/CVE-2026-89575.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: dm raid1: reserve space for NUL-terminator in bu... | 6.7 | 0.0023 | | | [CVE-2026-90393](https://patchblox.com/security/data/cve/CVE-2026-90393.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF in bpf_netns_link_update_... | 6.7 | 0.0023 | | | [CVE-2026-90109](https://patchblox.com/security/data/cve/CVE-2026-90109.md) | Routine | net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue | 5.5 | 0.0023 | | | [CVE-2026-90283](https://patchblox.com/security/data/cve/CVE-2026-90283.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: hugetlbfs: release subpool on fill_super failure... | 6.7 | 0.0023 | | | [CVE-2026-90138](https://patchblox.com/security/data/cve/CVE-2026-90138.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: vsock: don't check the listener's sk_err in vsoc... | 4.4 | 0.0023 | | | [CVE-2026-90157](https://patchblox.com/security/data/cve/CVE-2026-90157.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative optlen in cgroup getsockopt... | 6.7 | 0.0022 | | | [CVE-2026-90015](https://patchblox.com/security/data/cve/CVE-2026-90015.md) | Routine | xhci: fix lost bounce buffers on TDs spanning several ring segments | 6.5 | 0.0022 | | | [CVE-2026-90202](https://patchblox.com/security/data/cve/CVE-2026-90202.md) | Routine | scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers | 6.4 | 0.0022 | | | [CVE-2026-89784](https://patchblox.com/security/data/cve/CVE-2026-89784.md) | Routine | SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 | 5.5 | 0.0022 | | | [CVE-2026-89816](https://patchblox.com/security/data/cve/CVE-2026-89816.md) | Routine | drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used | 5.5 | 0.0022 | | | [CVE-2026-90072](https://patchblox.com/security/data/cve/CVE-2026-90072.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum to avoid signed ov... | 5.5 | 0.0022 | | | [CVE-2026-90075](https://patchblox.com/security/data/cve/CVE-2026-90075.md) | Routine | net/sched: fq_codel: clamp default quantum and mtu | 5.5 | 0.0022 | | | [CVE-2026-90218](https://patchblox.com/security/data/cve/CVE-2026-90218.md) | Routine | RDMA/cma: Fix WARNING in res_to_rt | 5.5 | 0.0022 | | | [CVE-2026-93048](https://patchblox.com/security/data/cve/CVE-2026-93048.md) | Routine | mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() | 5.5 | 0.0022 | | | [CVE-2026-93140](https://patchblox.com/security/data/cve/CVE-2026-93140.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: udf: Mark LVID buffer as uptodate before marking... | 5.5 | 0.0022 | | | [CVE-2026-90114](https://patchblox.com/security/data/cve/CVE-2026-90114.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel range... | 5.3 | 0.0022 | | | [CVE-2026-92524](https://patchblox.com/security/data/cve/CVE-2026-92524.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent leak in its_vpe_irq_... | 5.2 | 0.0022 | | | [CVE-2026-90054](https://patchblox.com/security/data/cve/CVE-2026-90054.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: tcp: fix corruption of urgent data on multi-segm... | 4.4 | 0.0022 | | | [CVE-2026-90434](https://patchblox.com/security/data/cve/CVE-2026-90434.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: isofs: release zisofs block pointer buffer head... | 4.4 | 0.0022 | | | [CVE-2026-93256](https://patchblox.com/security/data/cve/CVE-2026-93256.md) | Routine | arm64: hibernate: mask DAIF before restoring hibernated kernel | 4.1 | 0.0022 | | | [CVE-2026-89595](https://patchblox.com/security/data/cve/CVE-2026-89595.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: fsnotify: Fix stale object mask after concurrent... | 3.3 | 0.0022 | | | [CVE-2026-90058](https://patchblox.com/security/data/cve/CVE-2026-90058.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: bound qdisc_pkt_len to prevent qdisc... | 3.3 | 0.0022 | | | [CVE-2026-90416](https://patchblox.com/security/data/cve/CVE-2026-90416.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix stack out-of-bounds read in cc_pa... | 3.3 | 0.0022 | | | [CVE-2026-90290](https://patchblox.com/security/data/cve/CVE-2026-90290.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: Restore DAIF state on error S... | 3.0 | 0.0022 | | | [CVE-2026-90160](https://patchblox.com/security/data/cve/CVE-2026-90160.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: lwt_bpf: Restore reserved headroom after xmit pr... | 2.3 | 0.0022 | | | [CVE-2026-90148](https://patchblox.com/security/data/cve/CVE-2026-90148.md) | Routine | NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease() | 5.5 | 0.0021 | | | [CVE-2026-89604](https://patchblox.com/security/data/cve/CVE-2026-89604.md) | Routine | efivarfs: Rate limit statfs() handler | 5.5 | 0.0021 | | | [CVE-2026-89822](https://patchblox.com/security/data/cve/CVE-2026-89822.md) | Routine | drm/i915: Guard against NULL driver_data in i915_pci_probe() | 5.5 | 0.0021 | | | [CVE-2026-89989](https://patchblox.com/security/data/cve/CVE-2026-89989.md) | Routine | ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() | 5.5 | 0.0021 | | | [CVE-2026-90053](https://patchblox.com/security/data/cve/CVE-2026-90053.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_htb: limit htb_classify inner-cla... | 5.5 | 0.0021 | | | [CVE-2026-92494](https://patchblox.com/security/data/cve/CVE-2026-92494.md) | Routine | ext4: fix buffer_head leak in ext4_init_orphan_info | 5.5 | 0.0021 | | | [CVE-2026-89539](https://patchblox.com/security/data/cve/CVE-2026-89539.md) | Routine | SUNRPC: reject duplicate CREDS_VALUE options | 4.4 | 0.0021 | | | [CVE-2026-89776](https://patchblox.com/security/data/cve/CVE-2026-89776.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: enforce exact length of GROUP/... | 3.3 | 0.0021 | | | [CVE-2026-90185](https://patchblox.com/security/data/cve/CVE-2026-90185.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: null_blk: serialize configfs attribute stores wi... | 6.7 | 0.0021 | | | [CVE-2026-89566](https://patchblox.com/security/data/cve/CVE-2026-89566.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: jbd2: check need_resched() when skipping busy ch... | 5.5 | 0.0021 | | | [CVE-2026-89567](https://patchblox.com/security/data/cve/CVE-2026-89567.md) | Routine | jbd2: bound shrinker scans by examined checkpoint buffers | 5.5 | 0.0021 | | | [CVE-2026-90186](https://patchblox.com/security/data/cve/CVE-2026-90186.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: null_blk: reject per-device queue resize for sha... | 5.5 | 0.0021 | | | [CVE-2026-90250](https://patchblox.com/security/data/cve/CVE-2026-90250.md) | Routine | bpf, cgroup: Fix storage null-ptr-deref after replacing prog | 5.5 | 0.0021 | | | [CVE-2026-90364](https://patchblox.com/security/data/cve/CVE-2026-90364.md) | Routine | ACPI: processor: Unregister cpufreq notifier on init failure | 5.5 | 0.0021 | | | [CVE-2026-89453](https://patchblox.com/security/data/cve/CVE-2026-89453.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR fau... | 4.4 | 0.0021 | | | [CVE-2026-93172](https://patchblox.com/security/data/cve/CVE-2026-93172.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: mm/mm_init: handle alloc_percpu failure in free_... | 4.4 | 0.0021 | | | [CVE-2026-90190](https://patchblox.com/security/data/cve/CVE-2026-90190.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: null_blk: use DEFINE_MUTEX for the file-scope mu... | 4.7 | 0.0021 | | | [CVE-2026-90194](https://patchblox.com/security/data/cve/CVE-2026-90194.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ACPI: scan: fix bus ID cleanup on device_add() f... | 4.5 | 0.0021 | | | [CVE-2026-93268](https://patchblox.com/security/data/cve/CVE-2026-93268.md) | Routine | ext4: skip extra isize expansion during mount to prevent deadlock | 6.4 | 0.0020 | | | [CVE-2026-92515](https://patchblox.com/security/data/cve/CVE-2026-92515.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve unique-field state across nested s... | 6.7 | 0.0020 | | | [CVE-2026-97547](https://patchblox.com/security/data/cve/CVE-2026-97547.md) | Routine | xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN | 5.3 | 0.0020 | | | [CVE-2026-90147](https://patchblox.com/security/data/cve/CVE-2026-90147.md) | Routine | clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate() | 3.6 | 0.0020 | | | [CVE-2026-90159](https://patchblox.com/security/data/cve/CVE-2026-90159.md) | Routine | bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks | 3.4 | 0.0020 | | | [CVE-2026-90390](https://patchblox.com/security/data/cve/CVE-2026-90390.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: md/bitmap: resume array on backlog_store() error... | 2.3 | 0.0020 | | | [CVE-2026-80755](https://patchblox.com/security/data/cve/CVE-2026-80755.md) | Routine | selinux: reject a permission value exceeding the class permission count | 6.7 | 0.0020 | | | [CVE-2026-89756](https://patchblox.com/security/data/cve/CVE-2026-89756.md) | Routine | mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() | 4.7 | 0.0020 | | | [CVE-2026-93269](https://patchblox.com/security/data/cve/CVE-2026-93269.md) | Routine | ext4: fix circular lock dependency in ext4_ext_migrate | 4.7 | 0.0020 | | | [CVE-2026-80830](https://patchblox.com/security/data/cve/CVE-2026-80830.md) | Routine | usb: core: Add lock to usb_wakeup_notification() | 6.6 | 0.0020 | | | [CVE-2026-80793](https://patchblox.com/security/data/cve/CVE-2026-80793.md) | Routine | ipv4: reject undersized MTUs in ip_do_fragment() | 5.5 | 0.0020 | | | [CVE-2026-80781](https://patchblox.com/security/data/cve/CVE-2026-80781.md) | Routine | HID: core: fix OOB read of field->usage in hid_set_field() | 5.3 | 0.0020 | | | [CVE-2026-80765](https://patchblox.com/security/data/cve/CVE-2026-80765.md) | Routine | HID: hyperv: validate initial device info bounds | 4.5 | 0.0020 | | | [CVE-2026-80805](https://patchblox.com/security/data/cve/CVE-2026-80805.md) | Routine | xfs: validate attr entry pointer before field access | 4.4 | 0.0020 | | | [CVE-2026-80843](https://patchblox.com/security/data/cve/CVE-2026-80843.md) | Routine | xfrm: fix xfrm_state_construct() auth-trunc leak | 4.4 | 0.0020 | | | [CVE-2026-89768](https://patchblox.com/security/data/cve/CVE-2026-89768.md) | Routine | fs: fix user path of nested backing files | 3.3 | 0.0019 | | | [CVE-2026-74683](https://patchblox.com/security/data/cve/CVE-2026-74683.md) | Routine | Input: evdev - sanitize event type index when fetching event masks | 5.5 | 0.0019 | | | [CVE-2026-93206](https://patchblox.com/security/data/cve/CVE-2026-93206.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: PCI/proc: Use file_ns_capable() when checking co... | 3.4 | 0.0019 | | | [CVE-2026-93275](https://patchblox.com/security/data/cve/CVE-2026-93275.md) | Routine | perf/x86/intel/pt: Fix stop/start with no update | 2.5 | 0.0019 | | | [CVE-2026-89525](https://patchblox.com/security/data/cve/CVE-2026-89525.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count... | 6.7 | 0.0018 | | | [CVE-2026-80855](https://patchblox.com/security/data/cve/CVE-2026-80855.md) | Routine | fuse: fix invalidate lock leak on open O_TRUNC DAX failure | 4.7 | 0.0018 | | | [CVE-2026-80856](https://patchblox.com/security/data/cve/CVE-2026-80856.md) | Routine | fuse: fix invalidate lock leak on setattr writeback failure | 4.7 | 0.0018 | | | [CVE-2026-80918](https://patchblox.com/security/data/cve/CVE-2026-80918.md) | Routine | HID: core: fix number/pointer type confusion on long items | 3.3 | 0.0018 | | | [CVE-2026-74740](https://patchblox.com/security/data/cve/CVE-2026-74740.md) | Routine | net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain | 5.5 | 0.0018 | | | [CVE-2026-93110](https://patchblox.com/security/data/cve/CVE-2026-93110.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Wait for RCU callbacks before unloadi... | 6.4 | 0.0018 | | | [CVE-2026-74487](https://patchblox.com/security/data/cve/CVE-2026-74487.md) | Routine | binfmt_misc: restore write access when removing an entry | 5.5 | 0.0018 | | | [CVE-2026-74620](https://patchblox.com/security/data/cve/CVE-2026-74620.md) | Routine | net/sched: act_gact, act_police: range check the fallback control action | 5.5 | 0.0018 | | | [CVE-2026-74654](https://patchblox.com/security/data/cve/CVE-2026-74654.md) | Routine | serial: 8250_dma: Clear stale RX state on shutdown | 5.5 | 0.0018 | | | [CVE-2026-74657](https://patchblox.com/security/data/cve/CVE-2026-74657.md) | Routine | ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops | 5.5 | 0.0018 | | | [CVE-2026-74658](https://patchblox.com/security/data/cve/CVE-2026-74658.md) | Routine | futex: Prevent robust futex exit race some more | 5.5 | 0.0018 | | | [CVE-2026-74664](https://patchblox.com/security/data/cve/CVE-2026-74664.md) | Routine | net: openvswitch: reallocate update replies for mismatched IDs | 5.5 | 0.0018 | | | [CVE-2026-74671](https://patchblox.com/security/data/cve/CVE-2026-74671.md) | Routine | ima: fix out-of-bounds read in xattr_verify() | 5.5 | 0.0018 | | | [CVE-2026-74673](https://patchblox.com/security/data/cve/CVE-2026-74673.md) | Routine | Input: evdev - fix information leak in evdev_pass_values() | 5.5 | 0.0018 | | | [CVE-2026-74676](https://patchblox.com/security/data/cve/CVE-2026-74676.md) | Routine | vt: add permission check for KDSKBMETA ioctl | 5.5 | 0.0018 | | | [CVE-2026-80534](https://patchblox.com/security/data/cve/CVE-2026-80534.md) | Routine | xfs: fix ilock leak on error in xfs_dq_get_next_id | 5.5 | 0.0018 | | | [CVE-2026-80733](https://patchblox.com/security/data/cve/CVE-2026-80733.md) | Routine | net: remove WARN_ON_ONCE() from sk_mc_loop() | 5.5 | 0.0018 | | | [CVE-2026-80742](https://patchblox.com/security/data/cve/CVE-2026-80742.md) | Routine | af_packet: Don't send zero-byte data in tpacket_snd(). | 5.5 | 0.0018 | | | [CVE-2026-80963](https://patchblox.com/security/data/cve/CVE-2026-80963.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu d... | 5.5 | 0.0018 | | | [CVE-2026-81005](https://patchblox.com/security/data/cve/CVE-2026-81005.md) | Routine | ipmi: si: Fix NULL pointer dereference after failed registration | 5.5 | 0.0018 | | | [CVE-2026-92501](https://patchblox.com/security/data/cve/CVE-2026-92501.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ext4: drain in-flight DIO before buffered write... | 5.3 | 0.0018 | | | [CVE-2026-89753](https://patchblox.com/security/data/cve/CVE-2026-89753.md) | Routine | mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() | 4.7 | 0.0018 | | | [CVE-2026-89726](https://patchblox.com/security/data/cve/CVE-2026-89726.md) | Routine | lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() | 4.4 | 0.0018 | | | [CVE-2026-93222](https://patchblox.com/security/data/cve/CVE-2026-93222.md) | Routine | signal: avoid shared siginfo namespace rewrites | 4.4 | 0.0018 | | | [CVE-2026-93226](https://patchblox.com/security/data/cve/CVE-2026-93226.md) | Routine | ipv6: use RCU iterator to dump route exceptions | 4.2 | 0.0018 | | | [CVE-2026-89752](https://patchblox.com/security/data/cve/CVE-2026-89752.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: mm: memcg: stop reclaim when a limit update is s... | 3.4 | 0.0018 | | | [CVE-2026-80744](https://patchblox.com/security/data/cve/CVE-2026-80744.md) | Routine | netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path | 3.3 | 0.0018 | | | [CVE-2026-89515](https://patchblox.com/security/data/cve/CVE-2026-89515.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fill in DMA padding bytes in scsi_al... | 3.3 | 0.0018 | | | [CVE-2026-93213](https://patchblox.com/security/data/cve/CVE-2026-93213.md) | Routine | of: fix out-of-bounds read in of_alias_scan() stem parser | 3.0 | 0.0018 | | | [CVE-2026-89683](https://patchblox.com/security/data/cve/CVE-2026-89683.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dentry ref leak on V4ROOT export fileh... | 6.5 | 0.0018 | | | [CVE-2026-80529](https://patchblox.com/security/data/cve/CVE-2026-80529.md) | Routine | xfs: don't swallow dquot recovery verification errors | 6.3 | 0.0017 | | | [CVE-2026-74636](https://patchblox.com/security/data/cve/CVE-2026-74636.md) | Routine | tracing: Fix race between update_event_fields and, event_define_fields | 5.5 | 0.0017 | | | [CVE-2026-74722](https://patchblox.com/security/data/cve/CVE-2026-74722.md) | Routine | btrfs: fix memory leak in btrfs_do_encoded_write() | 5.5 | 0.0017 | | | [CVE-2026-80739](https://patchblox.com/security/data/cve/CVE-2026-80739.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, Check if flow is PEER before acqu... | 5.5 | 0.0017 | | | [CVE-2026-80806](https://patchblox.com/security/data/cve/CVE-2026-80806.md) | Routine | ext4: don't enable DAX on new encrypted files | 5.5 | 0.0017 | | | [CVE-2026-92523](https://patchblox.com/security/data/cve/CVE-2026-92523.md) | Routine | RDMA/nldev: validate dynamic counter attribute length | 5.5 | 0.0017 | | | [CVE-2026-93210](https://patchblox.com/security/data/cve/CVE-2026-93210.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid ta... | 5.5 | 0.0017 | | | [CVE-2026-80784](https://patchblox.com/security/data/cve/CVE-2026-80784.md) | Routine | mptcp: pm: fix memory leak from alloc-during-teardown race | 4.4 | 0.0017 | | | [CVE-2026-89565](https://patchblox.com/security/data/cve/CVE-2026-89565.md) | Routine | ipip: fix skb leak in collect_md mode when metadata_dst allocation fails | 3.7 | 0.0017 | | | [CVE-2026-93174](https://patchblox.com/security/data/cve/CVE-2026-93174.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Copy per-CPU map value padding in copy_map_... | 3.3 | 0.0017 | | | [CVE-2026-80727](https://patchblox.com/security/data/cve/CVE-2026-80727.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: x86/mce: Set up the polling timer before CMCI di... | 6.4 | 0.0017 | | | [CVE-2026-74483](https://patchblox.com/security/data/cve/CVE-2026-74483.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: don't leak the user namespace when... | 5.5 | 0.0017 | | | [CVE-2026-74602](https://patchblox.com/security/data/cve/CVE-2026-74602.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Initialise reader page order in rb_... | 5.5 | 0.0017 | | | [CVE-2026-74618](https://patchblox.com/security/data/cve/CVE-2026-74618.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: don't warn when the mount is comple... | 5.5 | 0.0017 | | | [CVE-2026-74619](https://patchblox.com/security/data/cve/CVE-2026-74619.md) | Routine | ovl: don't warn when the mount is completed from another user namespace | 5.5 | 0.0017 | | | [CVE-2026-74653](https://patchblox.com/security/data/cve/CVE-2026-74653.md) | Routine | serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx | 5.5 | 0.0017 | | | [CVE-2026-74718](https://patchblox.com/security/data/cve/CVE-2026-74718.md) | Routine | devlink: fix net namespace reference leak in reload | 5.5 | 0.0017 | | | [CVE-2026-80845](https://patchblox.com/security/data/cve/CVE-2026-80845.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: xfrm: avoid lock inversion in nat keepalive work... | 5.5 | 0.0017 | | | [CVE-2026-90400](https://patchblox.com/security/data/cve/CVE-2026-90400.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: md: recheck spare changes before starting sync... | 5.5 | 0.0017 | | | [CVE-2026-92502](https://patchblox.com/security/data/cve/CVE-2026-92502.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ext4: clear stale xarray tags on folios skipped... | 5.5 | 0.0017 | | | [CVE-2026-90275](https://patchblox.com/security/data/cve/CVE-2026-90275.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: md/raid1: don't set array_frozen in raid1_takeov... | 4.4 | 0.0017 | | | [CVE-2026-93173](https://patchblox.com/security/data/cve/CVE-2026-93173.md) | Routine | bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks | 4.4 | 0.0017 | | | [CVE-2026-93211](https://patchblox.com/security/data/cve/CVE-2026-93211.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize DRC hash table before registeri... | 4.4 | 0.0017 | | | [CVE-2026-90178](https://patchblox.com/security/data/cve/CVE-2026-90178.md) | Routine | hwmon: (coretemp) Fix core_data leak on CPUs without PTS | 2.3 | 0.0017 | | | [CVE-2026-80757](https://patchblox.com/security/data/cve/CVE-2026-80757.md) | Routine | selinux: reject a class permission count below its inherited common | 6.7 | 0.0017 | | | [CVE-2026-80756](https://patchblox.com/security/data/cve/CVE-2026-80756.md) | Routine | selinux: do not cancel a policy conversion that never started | 4.4 | 0.0017 | | | [CVE-2026-80906](https://patchblox.com/security/data/cve/CVE-2026-80906.md) | Routine | net: packet: fix wrong transport_header when sending VLAN-tagged frame | 4.4 | 0.0017 | | | [CVE-2026-80912](https://patchblox.com/security/data/cve/CVE-2026-80912.md) | Routine | selinux: reject an unclaimed class value in security_get_classes() | 4.4 | 0.0017 | | | [CVE-2026-80913](https://patchblox.com/security/data/cve/CVE-2026-80913.md) | Routine | selinux: require every boolean value to be defined | 4.4 | 0.0017 | | | [CVE-2026-98164](https://patchblox.com/security/data/cve/CVE-2026-98164.md) | Routine | KVM: x86/mmu: Check write tracking in all address spaces | 5.5 | 0.0015 | | | [CVE-2026-100070](https://patchblox.com/security/data/cve/CVE-2026-100070.md) | Routine | netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet | 6.5 | 0.0012 | | --- Data as of 2026-11-10T07:50:38Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.