# ALAS2023-2026-3335: Security update for 18 packages

ALAS2023-2026-3335, released November 7, 2026, fixes 272 CVEs across 18 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/alas2023-2026-3335
- Platform: Linux
- Released: Nov 7, 2026
- Priority: Urgent (Closes CVE-2026-89633, rated Critical)
- CVEs: 272, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-3335.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [bpftool6.12](https://patchblox.com/security/data/product/linux/bpftool6.12.md) | amzn 2023 | 1:6.12.113-138.209.amzn2023 |
| [bpftool6.12-debuginfo](https://patchblox.com/security/data/product/linux/bpftool6.12-debuginfo.md) | amzn 2023 | 1:6.12.113-138.209.amzn2023 |
| [kernel-livepatch-6.12.113-138.209](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.12.113-138.209.md) | amzn 2023 | 1:1.0-0.amzn2023 |
| [kernel6.12](https://patchblox.com/security/data/product/linux/kernel6.12.md) | amzn 2023 | 1:6.12.113-138.209.amzn2023 |
| [kernel6.12-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo.md) | amzn 2023 | 1:6.12.113-138.209.amzn2023 |
| [kernel6.12-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.12.113-138.209.amzn2023 |
| [kernel6.12-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.12.113-138.209.amzn2023 |
| [kernel6.12-devel](https://patchblox.com/security/data/product/linux/kernel6.12-devel.md) | amzn 2023 | 1:6.12.113-138.209.amzn2023 |
| [kernel6.12-headers](https://patchblox.com/security/data/product/linux/kernel6.12-headers.md) | amzn 2023 | 1:6.12.113-138.209.amzn2023 |
| [kernel6.12-modules-extra](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra.md) | amzn 2023 | 1:6.12.113-138.209.amzn2023 |
| [kernel6.12-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra-common.md) | amzn 2023 | 1:6.12.113-138.209.amzn2023 |
| [kernel6.12-tools](https://patchblox.com/security/data/product/linux/kernel6.12-tools.md) | amzn 2023 | 1:6.12.113-138.209.amzn2023 |
| [kernel6.12-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-tools-debuginfo.md) | amzn 2023 | 1:6.12.113-138.209.amzn2023 |
| [kernel6.12-tools-devel](https://patchblox.com/security/data/product/linux/kernel6.12-tools-devel.md) | amzn 2023 | 1:6.12.113-138.209.amzn2023 |
| [perf6.12](https://patchblox.com/security/data/product/linux/perf6.12.md) | amzn 2023 | 1:6.12.113-138.209.amzn2023 |
| [perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/perf6.12-debuginfo.md) | amzn 2023 | 1:6.12.113-138.209.amzn2023 |
| [python3-perf6.12](https://patchblox.com/security/data/product/linux/python3-perf6.12.md) | amzn 2023 | 1:6.12.113-138.209.amzn2023 |
| [python3-perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf6.12-debuginfo.md) | amzn 2023 | 1:6.12.113-138.209.amzn2023 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-89633](https://patchblox.com/security/data/cve/CVE-2026-89633.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  smb: client: fix OOB read/write from unvalidated... | 9.8 | 0.0055 |  |
| [CVE-2026-98171](https://patchblox.com/security/data/cve/CVE-2026-98171.md) | Urgent | smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs | 9.8 | 0.0054 |  |
| [CVE-2026-99078](https://patchblox.com/security/data/cve/CVE-2026-99078.md) | Urgent | net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry | 9.8 | 0.0046 |  |
| [CVE-2026-99079](https://patchblox.com/security/data/cve/CVE-2026-99079.md) | Urgent | net/mlx5e: Prevent stale XSK buffer release on refill retry | 9.8 | 0.0046 |  |
| [CVE-2026-72463](https://patchblox.com/security/data/cve/CVE-2026-72463.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  xfrm: Fix dev use-after-free in xfrm async resum... | 9.8 | 0.0044 |  |
| [CVE-2026-98174](https://patchblox.com/security/data/cve/CVE-2026-98174.md) | Urgent | smb: client: fix rlist race and missing initialization | 9.8 | 0.0033 |  |
| [CVE-2026-98167](https://patchblox.com/security/data/cve/CVE-2026-98167.md) | Urgent | smb: client: fix server->total_read for compound encrypted PDUs | 9.8 | 0.0022 |  |
| [CVE-2026-98794](https://patchblox.com/security/data/cve/CVE-2026-98794.md) | Urgent | ipvs: filter some flags received in the backup server | 9.1 | 0.0022 |  |
| [CVE-2026-98170](https://patchblox.com/security/data/cve/CVE-2026-98170.md) | Urgent | smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() | 9.8 | 0.0022 |  |
| [CVE-2026-98214](https://patchblox.com/security/data/cve/CVE-2026-98214.md) | Urgent | selinux: recheck intermediate backing files on mprotect() | 9.8 | 0.0022 |  |
| [CVE-2026-98573](https://patchblox.com/security/data/cve/CVE-2026-98573.md) | Urgent | net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() | 9.4 | 0.0022 |  |
| [CVE-2026-98621](https://patchblox.com/security/data/cve/CVE-2026-98621.md) | Urgent | net: gue: reject invalid REMCSUM offsets | 9.1 | 0.0022 |  |
| [CVE-2026-98168](https://patchblox.com/security/data/cve/CVE-2026-98168.md) | Urgent | smb: client: fix reparse buffer bounds in cifs_query_reparse_point() | 9.8 | 0.0021 |  |
| [CVE-2026-98215](https://patchblox.com/security/data/cve/CVE-2026-98215.md) | Urgent | selinux: preserve user SID across nested backing files | 9.8 | 0.0021 |  |
| [CVE-2026-98319](https://patchblox.com/security/data/cve/CVE-2026-98319.md) | Urgent | drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr | 9.8 | 0.0018 |  |
| [CVE-2026-98322](https://patchblox.com/security/data/cve/CVE-2026-98322.md) | Urgent | netfilter: nft_nat: fully initialise new_addr in netmap setup | 9.8 | 0.0018 |  |
| [CVE-2026-98301](https://patchblox.com/security/data/cve/CVE-2026-98301.md) | Urgent | net: bridge: mst: move switchdev call outside rcu | 9.8 | 0.0018 |  |
| [CVE-2026-98303](https://patchblox.com/security/data/cve/CVE-2026-98303.md) | Urgent | ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup | 9.8 | 0.0018 |  |
| [CVE-2026-98233](https://patchblox.com/security/data/cve/CVE-2026-98233.md) | Urgent | net/packet: clear RX owner on VNET header error | 9.8 | 0.0018 |  |
| [CVE-2026-98255](https://patchblox.com/security/data/cve/CVE-2026-98255.md) | Urgent | tcp: exclude old ACKs from tcp fast path | 9.8 | 0.0018 |  |
| [CVE-2026-98221](https://patchblox.com/security/data/cve/CVE-2026-98221.md) | Urgent | KEYS: trusted: Fix tpm2_load_cmd() boundary check | 9.8 | 0.0017 |  |
| [CVE-2026-98249](https://patchblox.com/security/data/cve/CVE-2026-98249.md) | Urgent | arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc | 9.8 | 0.0017 |  |
| [CVE-2026-68399](https://patchblox.com/security/data/cve/CVE-2026-68399.md) | Urgent | bpf: Fix UAF in sock clone early bailouts | 9.8 | 0.0017 |  |
| [CVE-2026-98363](https://patchblox.com/security/data/cve/CVE-2026-98363.md) | Urgent | firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS | 9.8 | 0.0017 |  |
| [CVE-2026-98222](https://patchblox.com/security/data/cve/CVE-2026-98222.md) | Urgent | KEYS: encrypted: fix integer overflow of datablob_len | 9.8 | 0.0017 |  |
| [CVE-2026-98232](https://patchblox.com/security/data/cve/CVE-2026-98232.md) | Urgent | scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() | 9.8 | 0.0017 |  |
| [CVE-2026-98269](https://patchblox.com/security/data/cve/CVE-2026-98269.md) | Urgent | btrfs: abort transaction on failure to update inode for hole punching and reflinking | 9.8 | 0.0017 |  |
| [CVE-2026-98320](https://patchblox.com/security/data/cve/CVE-2026-98320.md) | Urgent | netfilter: flowtable: hold reference on ct until flow is released | 9.8 | 0.0014 |  |
| [CVE-2026-98251](https://patchblox.com/security/data/cve/CVE-2026-98251.md) | Urgent | openvswitch: avoid reallocating confirmed conntrack labels | 9.8 | 0.0013 |  |
| [CVE-2026-98253](https://patchblox.com/security/data/cve/CVE-2026-98253.md) | Urgent | RDMA/ucma: Serialize join and leave on copy_to_user failure | 9.8 | 0.0013 |  |
| [CVE-2026-98252](https://patchblox.com/security/data/cve/CVE-2026-98252.md) | Urgent | RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() | 9.8 | 0.0012 |  |
| [CVE-2026-98368](https://patchblox.com/security/data/cve/CVE-2026-98368.md) | Urgent | esp: downgrade zerocopy managed frags before mutating skb frags | 9.8 | 0.0012 |  |
| [CVE-2026-98432](https://patchblox.com/security/data/cve/CVE-2026-98432.md) | High | ipv4: free inet_opt and ireq_opt after an RCU grace period | 9.8 | 0.0076 |  |
| [CVE-2026-98490](https://patchblox.com/security/data/cve/CVE-2026-98490.md) | High | net: openvswitch: conntrack: fix helper UAF due to extensions realloc | 9.8 | 0.0070 |  |
| [CVE-2026-98548](https://patchblox.com/security/data/cve/CVE-2026-98548.md) | High | sctp: discard the rest of the packet on a stale-cookie error | 9.8 | 0.0069 |  |
| [CVE-2026-98550](https://patchblox.com/security/data/cve/CVE-2026-98550.md) | High | tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow | 7.5 | 0.0068 |  |
| [CVE-2026-89648](https://patchblox.com/security/data/cve/CVE-2026-89648.md) | High | ceph: cap delegated inode count in ceph_parse_deleg_inos() | 7.5 | 0.0068 |  |
| [CVE-2026-98532](https://patchblox.com/security/data/cve/CVE-2026-98532.md) | High | ipv6: do not let ipv6_find_hdr() return an offset past the packet end | 8.1 | 0.0061 |  |
| [CVE-2026-89971](https://patchblox.com/security/data/cve/CVE-2026-89971.md) | High | nvme: skip the zoned limits update if the zone info query failed | 7.5 | 0.0061 |  |
| [CVE-2026-98959](https://patchblox.com/security/data/cve/CVE-2026-98959.md) | High | btrfs: fix xattr replace when multiple xattrs are packed in the same item | 9.8 | 0.0061 |  |
| [CVE-2026-98549](https://patchblox.com/security/data/cve/CVE-2026-98549.md) | High | tcp: prevent collapsing skbs across boundary in rtx queue | 9.1 | 0.0056 |  |
| [CVE-2026-99064](https://patchblox.com/security/data/cve/CVE-2026-99064.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  cipso: adjust cached option offsets when removin... | 8.1 | 0.0052 |  |
| [CVE-2026-99059](https://patchblox.com/security/data/cve/CVE-2026-99059.md) | High | wireguard: noise: reject response consumption after intermediate initiation | 7.7 | 0.0051 |  |
| [CVE-2026-99030](https://patchblox.com/security/data/cve/CVE-2026-99030.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  net: skbuff: don't leave stale bytes in skb_copy... | 7.5 | 0.0046 |  |
| [CVE-2026-98169](https://patchblox.com/security/data/cve/CVE-2026-98169.md) | High | smb: client: fix potential OOB read in smb3_enum_snapshots() | 7.1 | 0.0045 |  |
| [CVE-2026-98261](https://patchblox.com/security/data/cve/CVE-2026-98261.md) | High | cifs: Fix server use-after-free in cifs_chan_skip_or_disable() | 8.1 | 0.0041 |  |
| [CVE-2026-98451](https://patchblox.com/security/data/cve/CVE-2026-98451.md) | High | smb: client: use finish_no_open() for non-regular inodes | 8.8 | 0.0040 |  |
| [CVE-2026-98479](https://patchblox.com/security/data/cve/CVE-2026-98479.md) | High | scsi: libiscsi_tcp: Check the data direction of a Data-In PDU | 7.5 | 0.0039 |  |
| [CVE-2026-98454](https://patchblox.com/security/data/cve/CVE-2026-98454.md) | High | smb: client: fix create context out-of-bounds reads | 8.1 | 0.0039 |  |
| [CVE-2026-98173](https://patchblox.com/security/data/cve/CVE-2026-98173.md) | High | smb: client: fix use-after-free of iface in cifs_try_adding_channels() | 7.5 | 0.0035 |  |
| [CVE-2026-98175](https://patchblox.com/security/data/cve/CVE-2026-98175.md) | High | smb: client: cancel reconnect work in clean_demultiplex_info() | 8.1 | 0.0032 |  |
| [CVE-2026-98374](https://patchblox.com/security/data/cve/CVE-2026-98374.md) | High | tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() | 8.8 | 0.0029 |  |
| [CVE-2026-97558](https://patchblox.com/security/data/cve/CVE-2026-97558.md) | High | smb: client: fix cifsFileInfo reference leak in deferred close | 7.1 | 0.0023 |  |
| [CVE-2026-97901](https://patchblox.com/security/data/cve/CVE-2026-97901.md) | High | genetlink: pin family module during policy dump | 7.1 | 0.0022 |  |
| [CVE-2026-98375](https://patchblox.com/security/data/cve/CVE-2026-98375.md) | High | xen/netfront: drop RX packets with a short Ethernet header | 7.0 | 0.0022 |  |
| [CVE-2026-97559](https://patchblox.com/security/data/cve/CVE-2026-97559.md) | High | smb: client: fail DACL rewrite when the new DACL exceeds 64K | 7.8 | 0.0021 |  |
| [CVE-2026-97619](https://patchblox.com/security/data/cve/CVE-2026-97619.md) | High | io_uring/rw: end write accounting from ->ki_complete | 7.1 | 0.0021 |  |
| [CVE-2026-98626](https://patchblox.com/security/data/cve/CVE-2026-98626.md) | High | bpf: Restrict CO-RE poisoning to relocatable instructions | 7.1 | 0.0021 |  |
| [CVE-2026-97933](https://patchblox.com/security/data/cve/CVE-2026-97933.md) | High | tracing: Take trace_array reference when opening a tracer options file | 7.8 | 0.0021 |  |
| [CVE-2026-97938](https://patchblox.com/security/data/cve/CVE-2026-97938.md) | High | reboot: fix cad_pid use-after-free race | 7.8 | 0.0021 |  |
| [CVE-2026-97950](https://patchblox.com/security/data/cve/CVE-2026-97950.md) | High | configfs: pin the symlink target's dirent instead of chasing ->ci_dentry | 7.8 | 0.0021 |  |
| [CVE-2026-98248](https://patchblox.com/security/data/cve/CVE-2026-98248.md) | High | arm64: percpu: Fix LSE operations on {8,16}-bit types | 7.8 | 0.0021 |  |
| [CVE-2026-98231](https://patchblox.com/security/data/cve/CVE-2026-98231.md) | High | xfrm: serialize state GC with device state flush | 7.1 | 0.0021 |  |
| [CVE-2026-98034](https://patchblox.com/security/data/cve/CVE-2026-98034.md) | High | bpf: Mark NULL kptr stores precise | 7.1 | 0.0020 |  |
| [CVE-2026-93244](https://patchblox.com/security/data/cve/CVE-2026-93244.md) | High | drm/sysfb: simpledrm: Improve stride validation | 7.0 | 0.0020 |  |
| [CVE-2026-98260](https://patchblox.com/security/data/cve/CVE-2026-98260.md) | High | exec: Cleanup POSIX timers right after de_thread() | 8.8 | 0.0019 |  |
| [CVE-2026-89912](https://patchblox.com/security/data/cve/CVE-2026-89912.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  KVM: arm64: vgic-its: Don't dereference a NULL c... | 7.1 | 0.0018 |  |
| [CVE-2026-89638](https://patchblox.com/security/data/cve/CVE-2026-89638.md) | High | smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions | 8.8 | 0.0018 |  |
| [CVE-2026-98342](https://patchblox.com/security/data/cve/CVE-2026-98342.md) | High | dmaengine: wait for RCU readers before releasing dma_device | 7.8 | 0.0018 |  |
| [CVE-2026-98343](https://patchblox.com/security/data/cve/CVE-2026-98343.md) | High | dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() | 7.8 | 0.0018 |  |
| [CVE-2026-98201](https://patchblox.com/security/data/cve/CVE-2026-98201.md) | High | Input: zero ff_effect before compat copy in input_ff_effect_from_user | 7.1 | 0.0018 |  |
| [CVE-2026-98234](https://patchblox.com/security/data/cve/CVE-2026-98234.md) | High | net/sched: hhf: cap hh_flows_limit at change time | 7.1 | 0.0018 |  |
| [CVE-2026-98933](https://patchblox.com/security/data/cve/CVE-2026-98933.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  usb: hub: use shorter 120ms post resume hold for... | n/a | 0.0018 |  |
| [CVE-2026-98716](https://patchblox.com/security/data/cve/CVE-2026-98716.md) | High | KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted | 7.8 | 0.0018 |  |
| [CVE-2026-98953](https://patchblox.com/security/data/cve/CVE-2026-98953.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  devlink: fix devlink_rel reference leak when not... | n/a | 0.0018 |  |
| [CVE-2026-98980](https://patchblox.com/security/data/cve/CVE-2026-98980.md) | High | namei: don't reveal overmounted entries in refwalk | 8.8 | 0.0018 |  |
| [CVE-2026-72315](https://patchblox.com/security/data/cve/CVE-2026-72315.md) | High | smb: client: fix busy dentry warning on unmount after DIO | 7.8 | 0.0018 |  |
| [CVE-2026-98245](https://patchblox.com/security/data/cve/CVE-2026-98245.md) | High | btrfs: take commit root semaphore when iterating in mark_block_group_to_copy() | 7.8 | 0.0017 |  |
| [CVE-2026-98485](https://patchblox.com/security/data/cve/CVE-2026-98485.md) | High | netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read | 7.1 | 0.0017 |  |
| [CVE-2026-98686](https://patchblox.com/security/data/cve/CVE-2026-98686.md) | High | smb: client: discard post-EOF pagecache when extending a file via zero range | 7.1 | 0.0017 |  |
| [CVE-2026-99053](https://patchblox.com/security/data/cve/CVE-2026-99053.md) | High | tipc: hold a reference to nodes found by link name | 7.8 | 0.0017 |  |
| [CVE-2026-98846](https://patchblox.com/security/data/cve/CVE-2026-98846.md) | High | sctp: check RCV_SHUTDOWN after the sendmsg connect wait | 7.5 | 0.0017 |  |
| [CVE-2026-90002](https://patchblox.com/security/data/cve/CVE-2026-90002.md) | High | ftrace: Take trace_array reference before accessing its ftrace_ops | 7.8 | 0.0017 |  |
| [CVE-2026-89520](https://patchblox.com/security/data/cve/CVE-2026-89520.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  sched/core: Make core-sched flips wait for in-fl... | 7.8 | 0.0017 |  |
| [CVE-2026-90146](https://patchblox.com/security/data/cve/CVE-2026-90146.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  bpf, xdp: move offload check into dev_xdp_instal... | 7.8 | 0.0017 |  |
| [CVE-2026-98491](https://patchblox.com/security/data/cve/CVE-2026-98491.md) | High | net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry | 7.8 | 0.0017 |  |
| [CVE-2026-89500](https://patchblox.com/security/data/cve/CVE-2026-89500.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ring-buffer: Make cpu_buffer::free_page a buffer... | 7.8 | 0.0017 |  |
| [CVE-2026-89503](https://patchblox.com/security/data/cve/CVE-2026-89503.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ring-buffer: Fix subbuf resize race with ring_bu... | 7.8 | 0.0017 |  |
| [CVE-2026-97949](https://patchblox.com/security/data/cve/CVE-2026-97949.md) | High | configfs: unhash the dentry before dropping the item in rmdir | 7.8 | 0.0017 |  |
| [CVE-2026-98101](https://patchblox.com/security/data/cve/CVE-2026-98101.md) | High | ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() | 7.8 | 0.0017 |  |
| [CVE-2026-98229](https://patchblox.com/security/data/cve/CVE-2026-98229.md) | High | xfrm: save input state data before secpath resets | 7.8 | 0.0017 |  |
| [CVE-2026-98720](https://patchblox.com/security/data/cve/CVE-2026-98720.md) | High | KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified | 7.7 | 0.0017 |  |
| [CVE-2026-98801](https://patchblox.com/security/data/cve/CVE-2026-98801.md) | High | net: restrict SO_RESERVE_MEM to TCP sockets and cap max value | 7.1 | 0.0017 |  |
| [CVE-2026-98611](https://patchblox.com/security/data/cve/CVE-2026-98611.md) | High | bpf: Check params size before reading reserved fields | n/a | 0.0017 |  |
| [CVE-2026-98713](https://patchblox.com/security/data/cve/CVE-2026-98713.md) | High | KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT | n/a | 0.0017 |  |
| [CVE-2026-98728](https://patchblox.com/security/data/cve/CVE-2026-98728.md) | High | tpm: fix off-by-four bounds check in tpm2_get_random() | n/a | 0.0017 |  |
| [CVE-2026-98791](https://patchblox.com/security/data/cve/CVE-2026-98791.md) | High | net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference | n/a | 0.0017 |  |
| [CVE-2026-98841](https://patchblox.com/security/data/cve/CVE-2026-98841.md) | High | virt: vmgenid: set driver_data before registering notification handlers | n/a | 0.0017 |  |
| [CVE-2026-98923](https://patchblox.com/security/data/cve/CVE-2026-98923.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  arm64: io: Reject non-user protection in ioremap... | n/a | 0.0017 |  |
| [CVE-2026-99055](https://patchblox.com/security/data/cve/CVE-2026-99055.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  tcp: reject net_iov in zerocopy receive mapping... | n/a | 0.0017 |  |
| [CVE-2026-99062](https://patchblox.com/security/data/cve/CVE-2026-99062.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  vsock/virtio: account only unread bytes in read_... | n/a | 0.0017 |  |
| [CVE-2026-98507](https://patchblox.com/security/data/cve/CVE-2026-98507.md) | High | mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish | 7.8 | 0.0017 |  |
| [CVE-2026-98857](https://patchblox.com/security/data/cve/CVE-2026-98857.md) | High | ipvs: bound LBLCR and LBLC cache growth | 7.5 | 0.0017 |  |
| [CVE-2026-90013](https://patchblox.com/security/data/cve/CVE-2026-90013.md) | High | tracing: Take trace_array reference when opening options file | 7.8 | 0.0016 |  |
| [CVE-2026-97594](https://patchblox.com/security/data/cve/CVE-2026-97594.md) | High | landlock: Fix use-after-free of the source's parent directory | 7.8 | 0.0016 |  |
| [CVE-2026-98487](https://patchblox.com/security/data/cve/CVE-2026-98487.md) | High | net: bridge: mdb: restart port group walk after deletion | 7.8 | 0.0016 |  |
| [CVE-2026-99006](https://patchblox.com/security/data/cve/CVE-2026-99006.md) | High | drm/i915/gem: Prevent overstepping exec array boundary | 7.8 | 0.0016 |  |
| [CVE-2026-98982](https://patchblox.com/security/data/cve/CVE-2026-98982.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  namespace: don't let a pseudo dentry become the... | 7.8 | 0.0016 |  |
| [CVE-2026-98383](https://patchblox.com/security/data/cve/CVE-2026-98383.md) | High | bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL | 7.8 | 0.0016 |  |
| [CVE-2026-98382](https://patchblox.com/security/data/cve/CVE-2026-98382.md) | High | bpf: Reject dev-bound-only programs on other devices | 7.8 | 0.0016 |  |
| [CVE-2026-99054](https://patchblox.com/security/data/cve/CVE-2026-99054.md) | High | tipc: destroy topsrv workqueues before closing connections | 7.8 | 0.0016 |  |
| [CVE-2026-98376](https://patchblox.com/security/data/cve/CVE-2026-98376.md) | High | bpf: Use array_map_meta_equal for percpu array inner map replacement | 7.8 | 0.0016 |  |
| [CVE-2026-98858](https://patchblox.com/security/data/cve/CVE-2026-98858.md) | High | io_uring: fix task_work add use-after-free with SQPOLL | n/a | 0.0016 |  |
| [CVE-2026-99073](https://patchblox.com/security/data/cve/CVE-2026-99073.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ipv4: stop exception dump when nexthop group shr... | n/a | 0.0016 |  |
| [CVE-2026-98844](https://patchblox.com/security/data/cve/CVE-2026-98844.md) | High | netfs: clear post-EOF pagecache when extending a file via write | n/a | 0.0016 |  |
| [CVE-2026-98845](https://patchblox.com/security/data/cve/CVE-2026-98845.md) | High | tpm: Disable TPM on null key name mismatch | n/a | 0.0016 |  |
| [CVE-2026-98927](https://patchblox.com/security/data/cve/CVE-2026-98927.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  KVM: arm64: nv: Fix life cycle of the nested_mmu... | 7.0 | 0.0015 |  |
| [CVE-2026-99074](https://patchblox.com/security/data/cve/CVE-2026-99074.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ipv4: stop PMTU walk when nexthop group shrinks... | n/a | 0.0015 |  |
| [CVE-2026-97609](https://patchblox.com/security/data/cve/CVE-2026-97609.md) | High | netfilter: cttimeout: prevent UAF during module unload | 7.0 | 0.0015 |  |
| [CVE-2026-98369](https://patchblox.com/security/data/cve/CVE-2026-98369.md) | High | xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() | 7.8 | 0.0014 |  |
| [CVE-2026-98443](https://patchblox.com/security/data/cve/CVE-2026-98443.md) | High | xfs: fix cursor and pointer handling when recovering iunlink buckets | 7.8 | 0.0014 |  |
| [CVE-2026-98241](https://patchblox.com/security/data/cve/CVE-2026-98241.md) | High | ipv6: xfrm: use full sockets in local error paths | 7.8 | 0.0013 |  |
| [CVE-2026-98276](https://patchblox.com/security/data/cve/CVE-2026-98276.md) | High | net: lock the socket in sock_gettstamp() | 7.8 | 0.0013 |  |
| [CVE-2026-98381](https://patchblox.com/security/data/cve/CVE-2026-98381.md) | High | veth: manage XDP program pointers during channel resize | 7.8 | 0.0013 |  |
| [CVE-2026-98440](https://patchblox.com/security/data/cve/CVE-2026-98440.md) | High | KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction | 7.0 | 0.0012 |  |
| [CVE-2026-98364](https://patchblox.com/security/data/cve/CVE-2026-98364.md) | High | xfrm: hold net_device reference under RCU in bundle creation | 9.8 | 0.0012 |  |
| [CVE-2026-98230](https://patchblox.com/security/data/cve/CVE-2026-98230.md) | High | xfrm: use hlist_del_init_rcu for state_cache and state_cache_input | 7.0 | 0.0012 |  |
| [CVE-2026-98378](https://patchblox.com/security/data/cve/CVE-2026-98378.md) | High | bpf: Skip unsettled links in link iterator | 7.8 | 0.0012 |  |
| [CVE-2026-98359](https://patchblox.com/security/data/cve/CVE-2026-98359.md) | High | RDMA/core: Reject unregistering netdevs in ib_get_eth_speed | 7.8 | 0.0012 |  |
| [CVE-2026-98405](https://patchblox.com/security/data/cve/CVE-2026-98405.md) | Routine | smb: client: fix missing iov bounds check in parse_posix_sids() | 5.4 | 0.0048 |  |
| [CVE-2026-98937](https://patchblox.com/security/data/cve/CVE-2026-98937.md) | Routine | perf/core: Check kernel access when kernel callchains are requested | 3.3 | 0.0029 |  |
| [CVE-2026-93243](https://patchblox.com/security/data/cve/CVE-2026-93243.md) | Routine | mm/secretmem: properly account locked pages | 5.5 | 0.0025 |  |
| [CVE-2026-97597](https://patchblox.com/security/data/cve/CVE-2026-97597.md) | Routine | ipv6: flowlabel: cap duplicate leases per socket | 5.5 | 0.0022 |  |
| [CVE-2026-98413](https://patchblox.com/security/data/cve/CVE-2026-98413.md) | Routine | selinux: always fill AVC decision in avc_has_perm_noaudit() | 6.1 | 0.0022 |  |
| [CVE-2026-98537](https://patchblox.com/security/data/cve/CVE-2026-98537.md) | Routine | workqueue: Fix NULL current_pwq deref in flush dependency check | 4.7 | 0.0022 |  |
| [CVE-2026-98531](https://patchblox.com/security/data/cve/CVE-2026-98531.md) | Routine | ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST | 4.4 | 0.0022 |  |
| [CVE-2026-99036](https://patchblox.com/security/data/cve/CVE-2026-99036.md) | Routine | dm: fix reading free memory in do_resume | 4.1 | 0.0022 |  |
| [CVE-2026-97939](https://patchblox.com/security/data/cve/CVE-2026-97939.md) | Routine | ipmr: account multicast table and route memory | 6.5 | 0.0022 |  |
| [CVE-2026-98856](https://patchblox.com/security/data/cve/CVE-2026-98856.md) | Routine | kprobes: Skip disarmed probes when checking optkprobe overlap | 6.4 | 0.0022 |  |
| [CVE-2026-97906](https://patchblox.com/security/data/cve/CVE-2026-97906.md) | Routine | bootconfig: Fix integer overflow in initrd size check | 5.5 | 0.0022 |  |
| [CVE-2026-98567](https://patchblox.com/security/data/cve/CVE-2026-98567.md) | Routine | net: xps: reject an out of range traffic class | 6.7 | 0.0022 |  |
| [CVE-2026-98590](https://patchblox.com/security/data/cve/CVE-2026-98590.md) | Routine | bpf: Fix bpf_sock context code generation | 6.3 | 0.0022 |  |
| [CVE-2026-98495](https://patchblox.com/security/data/cve/CVE-2026-98495.md) | Routine | net: arp: terminate device name before lookup | 6.1 | 0.0022 |  |
| [CVE-2026-98541](https://patchblox.com/security/data/cve/CVE-2026-98541.md) | Routine | fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT | 5.9 | 0.0022 |  |
| [CVE-2026-98610](https://patchblox.com/security/data/cve/CVE-2026-98610.md) | Routine | net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget | 5.9 | 0.0022 |  |
| [CVE-2026-98554](https://patchblox.com/security/data/cve/CVE-2026-98554.md) | Routine | vlan: ensure sufficient headroom in vlan_dev_hard_header() | 5.5 | 0.0022 |  |
| [CVE-2026-98547](https://patchblox.com/security/data/cve/CVE-2026-98547.md) | Routine | af_packet: fix integer overflow in prb_calc_retire_blk_tmo() | 4.4 | 0.0022 |  |
| [CVE-2026-98569](https://patchblox.com/security/data/cve/CVE-2026-98569.md) | Routine | ip_gre: Reject enabling collect metadata through changelink | 4.4 | 0.0022 |  |
| [CVE-2026-98553](https://patchblox.com/security/data/cve/CVE-2026-98553.md) | Routine | autofs: fix sbi->pipe file reference leak in autofs_kill_sb() | 3.3 | 0.0022 |  |
| [CVE-2026-98521](https://patchblox.com/security/data/cve/CVE-2026-98521.md) | Routine | drm/i915: fix incorrect RCU teardown order | 6.5 | 0.0022 |  |
| [CVE-2026-98536](https://patchblox.com/security/data/cve/CVE-2026-98536.md) | Routine | writeback: report a Tasks-RCU quiescent state per cgwb drain pass | 4.1 | 0.0022 |  |
| [CVE-2026-98935](https://patchblox.com/security/data/cve/CVE-2026-98935.md) | Routine | rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak | 3.3 | 0.0022 |  |
| [CVE-2026-89996](https://patchblox.com/security/data/cve/CVE-2026-89996.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  dma-buf: dma-heap: don't publish fd before copy_... | 5.3 | 0.0021 |  |
| [CVE-2026-97567](https://patchblox.com/security/data/cve/CVE-2026-97567.md) | Routine | mptcp: prevent race between disconnect() and rtx | 4.7 | 0.0021 |  |
| [CVE-2026-97566](https://patchblox.com/security/data/cve/CVE-2026-97566.md) | Routine | mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0 | 3.3 | 0.0021 |  |
| [CVE-2026-98606](https://patchblox.com/security/data/cve/CVE-2026-98606.md) | Routine | drm/virtio: release the GEM object on virtio_gpu_vram_create() errors | 6.5 | 0.0021 |  |
| [CVE-2026-98568](https://patchblox.com/security/data/cve/CVE-2026-98568.md) | Routine | vxlan: use one headroom snapshot for neighbour replies | 6.0 | 0.0021 |  |
| [CVE-2026-98588](https://patchblox.com/security/data/cve/CVE-2026-98588.md) | Routine | bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc | 5.7 | 0.0021 |  |
| [CVE-2026-98625](https://patchblox.com/security/data/cve/CVE-2026-98625.md) | Routine | netfilter: flowtable: publish HW_DEAD after worker is done | 5.7 | 0.0021 |  |
| [CVE-2026-98979](https://patchblox.com/security/data/cve/CVE-2026-98979.md) | Routine | namespace: refuse an automount below a mount that is in no namespace | 5.5 | 0.0021 |  |
| [CVE-2026-98643](https://patchblox.com/security/data/cve/CVE-2026-98643.md) | Routine | bpf: Fix out-of-bounds read of rtt_min in sock_ops | 4.4 | 0.0021 |  |
| [CVE-2026-98955](https://patchblox.com/security/data/cve/CVE-2026-98955.md) | Routine | flow_dissector: avoid u16 truncation of skb->len when computing thoff | 3.4 | 0.0021 |  |
| [CVE-2026-98969](https://patchblox.com/security/data/cve/CVE-2026-98969.md) | Routine | net/sched: em_text: reject unterminated algo before autoload | 3.3 | 0.0021 |  |
| [CVE-2026-98934](https://patchblox.com/security/data/cve/CVE-2026-98934.md) | Routine | ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() | 1.9 | 0.0021 |  |
| [CVE-2026-98631](https://patchblox.com/security/data/cve/CVE-2026-98631.md) | Routine | xsk: Use a 32-bit compare in xsk_map_gen_lookup | 6.0 | 0.0021 |  |
| [CVE-2026-98695](https://patchblox.com/security/data/cve/CVE-2026-98695.md) | Routine | USB: serial: fix ioctl hangup race | 4.2 | 0.0021 |  |
| [CVE-2026-98539](https://patchblox.com/security/data/cve/CVE-2026-98539.md) | Routine | fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga | 6.3 | 0.0021 |  |
| [CVE-2026-98523](https://patchblox.com/security/data/cve/CVE-2026-98523.md) | Routine | drm/client: fix restore of partially initialized client | 3.3 | 0.0021 |  |
| [CVE-2026-98528](https://patchblox.com/security/data/cve/CVE-2026-98528.md) | Routine | gpio: cdev: fix kernel stack leak to user-space in error path | 3.3 | 0.0021 |  |
| [CVE-2026-98851](https://patchblox.com/security/data/cve/CVE-2026-98851.md) | Routine | netfilter: nft_flow_offload: drop flowtable reference on init error path | 2.3 | 0.0021 |  |
| [CVE-2026-98545](https://patchblox.com/security/data/cve/CVE-2026-98545.md) | Routine | ata: libata-scsi: bound the ATA passthru sense descriptor writes | 6.8 | 0.0021 |  |
| [CVE-2026-98468](https://patchblox.com/security/data/cve/CVE-2026-98468.md) | Routine | KVM: arm64: Fix spurious warning for benign stage 2 teardown race | 5.5 | 0.0021 |  |
| [CVE-2026-98644](https://patchblox.com/security/data/cve/CVE-2026-98644.md) | Routine | bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() | 4.4 | 0.0021 |  |
| [CVE-2026-98484](https://patchblox.com/security/data/cve/CVE-2026-98484.md) | Routine | netfilter: nf_tables: skip expired catchall elements on insert and delete | 3.4 | 0.0021 |  |
| [CVE-2026-98629](https://patchblox.com/security/data/cve/CVE-2026-98629.md) | Routine | net/sched: cls_u32: fix manual hash table handle IDR aliasing | 3.4 | 0.0021 |  |
| [CVE-2026-98596](https://patchblox.com/security/data/cve/CVE-2026-98596.md) | Routine | ipv6: Fix dst leak for uncached routes. | 3.3 | 0.0021 |  |
| [CVE-2026-99071](https://patchblox.com/security/data/cve/CVE-2026-99071.md) | Routine | ipv4: do not warn on route notification size race | 1.9 | 0.0021 |  |
| [CVE-2026-99080](https://patchblox.com/security/data/cve/CVE-2026-99080.md) | Routine | fs: Free any excess xarray nodes in clear_inode() | 4.7 | 0.0020 |  |
| [CVE-2026-98591](https://patchblox.com/security/data/cve/CVE-2026-98591.md) | Routine | bpf: Fix bounds check for skb-backed dynptrs | 6.7 | 0.0020 |  |
| [CVE-2026-98862](https://patchblox.com/security/data/cve/CVE-2026-98862.md) | Routine | audit: fix exe mark UAF in kill_rules() | 6.0 | 0.0020 |  |
| [CVE-2026-98855](https://patchblox.com/security/data/cve/CVE-2026-98855.md) | Routine | of/overlay: put property on deadprops only after changeset add succeeds | 5.2 | 0.0020 |  |
| [CVE-2026-98850](https://patchblox.com/security/data/cve/CVE-2026-98850.md) | Routine | net/packet: prevent TX_RING byte count overflow | 4.1 | 0.0020 |  |
| [CVE-2026-98503](https://patchblox.com/security/data/cve/CVE-2026-98503.md) | Routine | packet: use ubuf_info completion for TX_RING packets | 6.0 | 0.0020 |  |
| [CVE-2026-98506](https://patchblox.com/security/data/cve/CVE-2026-98506.md) | Routine | mm/hugetlb: do not dissolve gigantic pages without runtime support | 5.7 | 0.0020 |  |
| [CVE-2026-98508](https://patchblox.com/security/data/cve/CVE-2026-98508.md) | Routine | drm/virtio: fix NULL pointer dereference on fence allocation failure | 5.5 | 0.0020 |  |
| [CVE-2026-98717](https://patchblox.com/security/data/cve/CVE-2026-98717.md) | Routine | KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy | 4.7 | 0.0020 |  |
| [CVE-2026-98509](https://patchblox.com/security/data/cve/CVE-2026-98509.md) | Routine | drm/virtio: fix memory leak of fence event on execbuffer failure | 3.3 | 0.0020 |  |
| [CVE-2026-98505](https://patchblox.com/security/data/cve/CVE-2026-98505.md) | Routine | mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() | 1.9 | 0.0020 |  |
| [CVE-2026-99005](https://patchblox.com/security/data/cve/CVE-2026-99005.md) | Routine | drm/i915/gt: Unmask interrupts only when ACTIVE is true | 2.5 | 0.0019 |  |
| [CVE-2026-99040](https://patchblox.com/security/data/cve/CVE-2026-99040.md) | Routine | KEYS: Fix add_key() race with keyring restriction | 4.7 | 0.0019 |  |
| [CVE-2026-89766](https://patchblox.com/security/data/cve/CVE-2026-89766.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  pidfd: hold exec_update_lock around namespace io... | 4.4 | 0.0019 |  |
| [CVE-2026-99058](https://patchblox.com/security/data/cve/CVE-2026-99058.md) | Routine | workqueue: Fix NULL current_pwq deref in chained work check | 4.1 | 0.0019 |  |
| [CVE-2026-98655](https://patchblox.com/security/data/cve/CVE-2026-98655.md) | Routine | perf: Require kernel access for text poke events | 5.5 | 0.0019 |  |
| [CVE-2026-98925](https://patchblox.com/security/data/cve/CVE-2026-98925.md) | Routine | bpf, sockmap: Fix self-redirect copied_seq double-counting | 5.5 | 0.0019 |  |
| [CVE-2026-98990](https://patchblox.com/security/data/cve/CVE-2026-98990.md) | Routine | namespace: check a submount for references right before unmounting it | 4.7 | 0.0019 |  |
| [CVE-2026-99057](https://patchblox.com/security/data/cve/CVE-2026-99057.md) | Routine | xen/netfront: don't leak the skb when xennet_fill_frags() fails | 4.5 | 0.0019 |  |
| [CVE-2026-99033](https://patchblox.com/security/data/cve/CVE-2026-99033.md) | Routine | net/packet: guard the ll header push in packet_rcv_spkt() | 4.4 | 0.0019 |  |
| [CVE-2026-98950](https://patchblox.com/security/data/cve/CVE-2026-98950.md) | Routine | flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() | 3.4 | 0.0019 |  |
| [CVE-2026-98306](https://patchblox.com/security/data/cve/CVE-2026-98306.md) | Routine | seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation | 6.5 | 0.0018 |  |
| [CVE-2026-98763](https://patchblox.com/security/data/cve/CVE-2026-98763.md) | Routine | usb: core: clear both ep_in and ep_out for non-ep0 control endpoints | 6.8 | 0.0018 |  |
| [CVE-2026-99043](https://patchblox.com/security/data/cve/CVE-2026-99043.md) | Routine | ice: fix metadata_dst refcount handling on representor teardown | 4.7 | 0.0018 |  |
| [CVE-2026-98805](https://patchblox.com/security/data/cve/CVE-2026-98805.md) | Routine | tipc: prevent GCM nonce reuse on peer key changes | 6.8 | 0.0018 |  |
| [CVE-2026-98790](https://patchblox.com/security/data/cve/CVE-2026-98790.md) | Routine | perf: Fix race between perf_event_exit_task() and perf_pending_task() | 2.5 | 0.0018 |  |
| [CVE-2026-98811](https://patchblox.com/security/data/cve/CVE-2026-98811.md) | Routine | net/sched: cls_api: reclaim an empty proto on the error path | 1.9 | 0.0018 |  |
| [CVE-2026-98205](https://patchblox.com/security/data/cve/CVE-2026-98205.md) | Routine | Input: evdev - zero absinfo before partial copy in EVIOCSABS | 6.1 | 0.0018 |  |
| [CVE-2026-99037](https://patchblox.com/security/data/cve/CVE-2026-99037.md) | Routine | dm-crypt: reject the lmk IV mode with AEAD ciphers | 6.0 | 0.0018 |  |
| [CVE-2026-99052](https://patchblox.com/security/data/cve/CVE-2026-99052.md) | Routine | selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts | 6.0 | 0.0018 |  |
| [CVE-2026-98614](https://patchblox.com/security/data/cve/CVE-2026-98614.md) | Routine | sctp: avoid livelock while updating retransmit path | 5.9 | 0.0018 |  |
| [CVE-2026-98772](https://patchblox.com/security/data/cve/CVE-2026-98772.md) | Routine | USB: serial: fix port tear down use-after-free | 5.7 | 0.0018 |  |
| [CVE-2026-98262](https://patchblox.com/security/data/cve/CVE-2026-98262.md) | Routine | ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY | 5.5 | 0.0018 |  |
| [CVE-2026-98299](https://patchblox.com/security/data/cve/CVE-2026-98299.md) | Routine | tcp: do not let tcp_rmem be set below 4096 | 5.5 | 0.0018 |  |
| [CVE-2026-98300](https://patchblox.com/security/data/cve/CVE-2026-98300.md) | Routine | tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). | 5.5 | 0.0018 |  |
| [CVE-2026-98344](https://patchblox.com/security/data/cve/CVE-2026-98344.md) | Routine | dmaengine: Fix device kref underflow in dma_chan_put() | 5.5 | 0.0018 |  |
| [CVE-2026-98380](https://patchblox.com/security/data/cve/CVE-2026-98380.md) | Routine | net/sched: reject IDR error pointers when deleting actions | 5.5 | 0.0018 |  |
| [CVE-2026-98608](https://patchblox.com/security/data/cve/CVE-2026-98608.md) | Routine | drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() | 5.5 | 0.0018 |  |
| [CVE-2026-98609](https://patchblox.com/security/data/cve/CVE-2026-98609.md) | Routine | drm/virtio: fix object leak when drm_gem_handle_create() fails | 5.5 | 0.0018 |  |
| [CVE-2026-98624](https://patchblox.com/security/data/cve/CVE-2026-98624.md) | Routine | netfilter: nfnetlink_queue: hold nfnl mutex in event notifier | 5.5 | 0.0018 |  |
| [CVE-2026-98636](https://patchblox.com/security/data/cve/CVE-2026-98636.md) | Routine | squashfs: Add dictionary size range check to prevent shift-out-of-bounds | 4.4 | 0.0018 |  |
| [CVE-2026-98992](https://patchblox.com/security/data/cve/CVE-2026-98992.md) | Routine | namespace: don't copy an unmounted mount tree | 4.4 | 0.0018 |  |
| [CVE-2026-99031](https://patchblox.com/security/data/cve/CVE-2026-99031.md) | Routine | net: bridge: avoid recursive multicast port cleanup | 4.4 | 0.0018 |  |
| [CVE-2026-98453](https://patchblox.com/security/data/cve/CVE-2026-98453.md) | Routine | smb: client: close handle after create-context parsing failure | 4.3 | 0.0018 |  |
| [CVE-2026-99025](https://patchblox.com/security/data/cve/CVE-2026-99025.md) | Routine | openvswitch: fix soft lockup in the netlink flow dump | 4.1 | 0.0018 |  |
| [CVE-2026-93231](https://patchblox.com/security/data/cve/CVE-2026-93231.md) | Routine | lockd: fix swapped arguments in nlmsvc_match_ip() | 3.4 | 0.0018 |  |
| [CVE-2026-98613](https://patchblox.com/security/data/cve/CVE-2026-98613.md) | Routine | bpf: Bound ownership depth through local kptrs and graph roots | 3.3 | 0.0018 |  |
| [CVE-2026-98450](https://patchblox.com/security/data/cve/CVE-2026-98450.md) | Routine | smb: client: close completed creates on compound wait errors | 3.1 | 0.0018 |  |
| [CVE-2026-98984](https://patchblox.com/security/data/cve/CVE-2026-98984.md) | Routine | dcache: don't put a mountpoint on a dentry that's being removed | 2.5 | 0.0018 |  |
| [CVE-2026-99007](https://patchblox.com/security/data/cve/CVE-2026-99007.md) | Routine | drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN | 2.5 | 0.0018 |  |
| [CVE-2026-98831](https://patchblox.com/security/data/cve/CVE-2026-98831.md) | Routine | of/overlay: don't leak fragment references when changeset init fails | 2.3 | 0.0018 |  |
| [CVE-2026-99063](https://patchblox.com/security/data/cve/CVE-2026-99063.md) | Routine | dm ioctl: don't let data_start run past the buffer | 2.3 | 0.0018 |  |
| [CVE-2026-99067](https://patchblox.com/security/data/cve/CVE-2026-99067.md) | Routine | btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() | 1.9 | 0.0018 |  |
| [CVE-2026-98750](https://patchblox.com/security/data/cve/CVE-2026-98750.md) | Routine | tty: fix saved termios reset race | 6.4 | 0.0018 |  |
| [CVE-2026-98752](https://patchblox.com/security/data/cve/CVE-2026-98752.md) | Routine | tty: port: fix tty_port_tty_vhangup() race | 5.7 | 0.0018 |  |
| [CVE-2026-98696](https://patchblox.com/security/data/cve/CVE-2026-98696.md) | Routine | USB: serial: fix driver deregistration order | 5.2 | 0.0018 |  |
| [CVE-2026-98681](https://patchblox.com/security/data/cve/CVE-2026-98681.md) | Routine | smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races | 5.0 | 0.0018 |  |
| [CVE-2026-98751](https://patchblox.com/security/data/cve/CVE-2026-98751.md) | Routine | tty: abort break signalling on hangup | 4.7 | 0.0018 |  |
| [CVE-2026-98753](https://patchblox.com/security/data/cve/CVE-2026-98753.md) | Routine | tty: tty_port: restore TTY_IO_ERROR on activation failure | 4.7 | 0.0018 |  |
| [CVE-2026-98840](https://patchblox.com/security/data/cve/CVE-2026-98840.md) | Routine | vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF | 4.7 | 0.0018 |  |
| [CVE-2026-98771](https://patchblox.com/security/data/cve/CVE-2026-98771.md) | Routine | usb: storage: sierra_ms: reject short SWoC info transfers | 4.3 | 0.0018 |  |
| [CVE-2026-98697](https://patchblox.com/security/data/cve/CVE-2026-98697.md) | Routine | USB: serial: fix dynamic id driver deregistration race | 1.9 | 0.0018 |  |
| [CVE-2026-98452](https://patchblox.com/security/data/cve/CVE-2026-98452.md) | Routine | smb: client: clean up failed cached directory opens | 5.5 | 0.0018 |  |
| [CVE-2026-98807](https://patchblox.com/security/data/cve/CVE-2026-98807.md) | Routine | net/mlx5: Fix slab-out-of-bounds when handling team device events | 3.4 | 0.0018 |  |
| [CVE-2026-98448](https://patchblox.com/security/data/cve/CVE-2026-98448.md) | Routine | xfs: release orphanage dir inode if chown fails | 2.3 | 0.0018 |  |
| [CVE-2026-98793](https://patchblox.com/security/data/cve/CVE-2026-98793.md) | Routine | netfilter: bpf: reject invalid NAT manipulation types | 6.7 | 0.0017 |  |
| [CVE-2026-98586](https://patchblox.com/security/data/cve/CVE-2026-98586.md) | Routine | sctp: hold asoc or transport before mod_timer() in timer handlers | 5.9 | 0.0017 |  |
| [CVE-2026-98647](https://patchblox.com/security/data/cve/CVE-2026-98647.md) | Routine | bpf: Fix divide-by-zero in btf_struct_walk() | 5.5 | 0.0017 |  |
| [CVE-2026-98833](https://patchblox.com/security/data/cve/CVE-2026-98833.md) | Routine | mtd: core: call _get_device() with the master MTD | 4.4 | 0.0017 |  |
| [CVE-2026-98607](https://patchblox.com/security/data/cve/CVE-2026-98607.md) | Routine | drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() | 3.3 | 0.0017 |  |
| [CVE-2026-99070](https://patchblox.com/security/data/cve/CVE-2026-99070.md) | Routine | ipv6: do not warn on route notification size race | 1.9 | 0.0017 |  |
| [CVE-2026-98773](https://patchblox.com/security/data/cve/CVE-2026-98773.md) | Routine | USB: cdc-acm: skip URB restart in port_shutdown if disconnected | 5.7 | 0.0017 |  |
| [CVE-2026-99088](https://patchblox.com/security/data/cve/CVE-2026-99088.md) | Routine | net: openvswitch: validate transport header presence in set_ipv6_addr | 2.3 | 0.0017 |  |
| [CVE-2026-98377](https://patchblox.com/security/data/cve/CVE-2026-98377.md) | Routine | vlan: require the MAC header to be present in __vlan_insert_inner_tag() | 5.5 | 0.0017 |  |
| [CVE-2026-98379](https://patchblox.com/security/data/cve/CVE-2026-98379.md) | Routine | netfilter: ip6t_rpfilter: reject routes without inet6_dev | 5.5 | 0.0017 |  |
| [CVE-2026-98642](https://patchblox.com/security/data/cve/CVE-2026-98642.md) | Routine | bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk | 6.4 | 0.0017 |  |
| [CVE-2026-98084](https://patchblox.com/security/data/cve/CVE-2026-98084.md) | Routine | bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks | 6.3 | 0.0017 |  |
| [CVE-2026-98271](https://patchblox.com/security/data/cve/CVE-2026-98271.md) | Routine | net: skbuff: do not leave stale header offsets after pskb_carve() | 6.1 | 0.0017 |  |
| [CVE-2026-98634](https://patchblox.com/security/data/cve/CVE-2026-98634.md) | Routine | scsi: sd_zbc: Reject disks with too many zones | 6.1 | 0.0017 |  |
| [CVE-2026-98235](https://patchblox.com/security/data/cve/CVE-2026-98235.md) | Routine | net/sched: act_api: release tail references on DELACTION failure | 5.5 | 0.0017 |  |
| [CVE-2026-98646](https://patchblox.com/security/data/cve/CVE-2026-98646.md) | Routine | tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context | 5.5 | 0.0017 |  |
| [CVE-2026-98792](https://patchblox.com/security/data/cve/CVE-2026-98792.md) | Routine | netfilter: flowtable: generalize pending status bit | 5.2 | 0.0017 |  |
| [CVE-2026-98641](https://patchblox.com/security/data/cve/CVE-2026-98641.md) | Routine | bpf, arm64: set up the frame pointer for the exception callback | 5.1 | 0.0017 |  |
| [CVE-2026-98477](https://patchblox.com/security/data/cve/CVE-2026-98477.md) | Routine | perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() | 4.4 | 0.0017 |  |
| [CVE-2026-98947](https://patchblox.com/security/data/cve/CVE-2026-98947.md) | Routine | vsock: Fix memory leak in vmci_transport_recv_dgram_cb() | 2.6 | 0.0017 |  |
| [CVE-2026-98354](https://patchblox.com/security/data/cve/CVE-2026-98354.md) | Routine | RDMA/mad: Fix receive buffer leak when PKey enforcement fails | 5.5 | 0.0017 |  |
| [CVE-2026-98373](https://patchblox.com/security/data/cve/CVE-2026-98373.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  mm/hugetlb: preserve mremap address delta when s... | 5.5 | 0.0016 |  |
| [CVE-2026-98854](https://patchblox.com/security/data/cve/CVE-2026-98854.md) | Routine | of/overlay: only treat a positive changeset id as registered | 4.1 | 0.0016 |  |
| [CVE-2026-99072](https://patchblox.com/security/data/cve/CVE-2026-99072.md) | Routine | ipv4: stop route notification sizing when nexthop group shrinks | 4.1 | 0.0016 |  |
| [CVE-2026-98797](https://patchblox.com/security/data/cve/CVE-2026-98797.md) | Routine | net: cap skb->queue_mapping when the tx queue is picked | 6.4 | 0.0016 |  |
| [CVE-2026-98859](https://patchblox.com/security/data/cve/CVE-2026-98859.md) | Routine | HID: multitouch: stop the release timer from being rearmed on remove | 5.7 | 0.0016 |  |
| [CVE-2026-98852](https://patchblox.com/security/data/cve/CVE-2026-98852.md) | Routine | net: extend IPv6 exthdr detection of tunneled packets | 3.7 | 0.0016 |  |
| [CVE-2026-98384](https://patchblox.com/security/data/cve/CVE-2026-98384.md) | Routine | bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy() | 3.3 | 0.0016 |  |
| [CVE-2026-98161](https://patchblox.com/security/data/cve/CVE-2026-98161.md) | Routine | nvdimm: pmem: keep PREFLUSH before data writes | 5.5 | 0.0011 |  |
| [CVE-2026-97618](https://patchblox.com/security/data/cve/CVE-2026-97618.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  io_uring/net: don't overconsume buffers when usi... | 4.4 | n/a |  |

---

Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.